Re: Simple IPSEC client with certificate - phase 1 time out

[Frank Wille <frank%phoenix.owl.de@localhost>]

Christos Zoulas wrote:

> If your server is behind NAT, I think that got broken at some point.

Oh no! :(


> I meant to debug this... I guess I should just do it...

That would be so great! I can provide you with any information you need
and can do all sorts of tests. Also with big endian hardware.


BTW, there is a strange problem with adding SAs in the 7.0 kernel.
Maybe it doesn't work on big endian?

1. NetBSD/macppc 7.0 (PowerBook G4):
# setkey -c
add 10.0.0.1 10.0.0.2 esp 1234 -E aes-cbc "testtesttesttest";
Invalid argument.
# setkey -D
No SAD entries.

2. NetBSD/amd64 7.0 (Asus i3):
# setkey -c
add 10.0.0.1 10.0.0.2 esp 1234 -E aes-cbc "testtesttesttest";
# setkey -D
10.0.0.1 10.0.0.2 
    esp mode=any spi=1234(0x000004d2) reqid=0(0x00000000)
    E: aes-cbc  74657374 74657374 74657374 74657374
    seq=0x00000000 replay=0 flags=0x00000040 state=mature 
    created: Mar  5 15:53:31 2016   current: Mar  5 16:20:54 2016
    diff: 1643(s)   hard: 0(s)  soft: 0(s)
    last: Mar  5 11:41:33 2016  hard: 0(s)  soft: 0(s)
    current: 0(bytes)   hard: 0(bytes)  soft: 0(bytes)
    allocated: 0    hard: 0 soft: 0
    sadb_seq=0 pid=2037 refcnt=1


So the "pfkey ADD failed" is not present on x86, but the "pfkey UPDATED
failed" is still there. I was able to see the SA to be updated for a short
time in "larval" state when phase 2 was established:

# setkey -D
192.168.0.21[4500] 78.48.238.147[4500] 
    esp-udp mode=tunnel spi=17572466(0x010c2272) reqid=0(0x00000000)
    E: aes-cbc  d5bd6bf8 2d5fd2f7 49c5ebdc d20c6299
    A: hmac-md5  3bd33ccd cd06e211 b5b7b926 399089e7
    seq=0x00000002 replay=4 flags=0x00000000 state=mature 
    created: Mar  5 14:57:06 2016   current: Mar  5 14:57:14 2016
    diff: 8(s)  hard: 28800(s)  soft: 23040(s)
    last: Mar  5 14:57:07 2016  hard: 0(s)  soft: 0(s)
    current: 320(bytes) hard: 0(bytes)  soft: 0(bytes)
    allocated: 2    hard: 0 soft: 0
    sadb_seq=1 pid=660 refcnt=2
78.48.238.147 192.168.0.21 
    esp mode=tunnel spi=120588728(0x073009b8) reqid=0(0x00000000)
    seq=0x00000000 replay=0 flags=0x00000000 state=larval 
    sadb_seq=0 pid=660 refcnt=1


-- 
Frank Wille