The 2.00 code fails a MAJOR user acceptance test
Hugh Daniel <[email protected]>
| Newsgroups | gmane.network.freeswan.devel |
|---|---|
| Message-ID | <[email protected]> |
-----BEGIN PGP SIGNED MESSAGE----- I just ran a simple test that, sadly, ended in total failure, one that must be added to the test suite and tried every time we cut a release. I setup a simple client machine (RH-8, a snapshot of 2.00, workng OE DNS setup etc.) and started FreeS/WAN and tested it. It got OE going to another site in well under the first ping's timeout, perfect! I then tar'ed up and removed ipsec.conf and the ipsec.d directory tree and then started up FreeS/WAN again. This time I can't talk at all to the host I was just talking to (wrong, it should have re-negotiated OE, but maybe expected still), but worse I don't have any OE working to any site as I just deleted the default policy file it seems. Matter of fact there is no hope of having OE, see no trap route: """ + _________________________ proc/net/ipsec_eroute + sort -n +3 /proc/net/ipsec_eroute + _________________________ netstat-rn """ I will append the whole barf so you can see all the gory details your selves. So, simpley put the OE system should function if ONLY the necessary keying information exists an nothing else. Or if the the config files are just comments that should be the same as their NOT being there, ie the internal (OE) defaults should then rule. Only if OE is _expressly_ turned off do we not do OE as the default case. I would suggest then that any host in the VPN, OE or bust group (private) get block/droped at the IPtables (or what ever it name is this week) layer. I don't expect this is a big probelm to fix. ||ugh Daniel Testing Fool [email protected] east.test.toad.com Sun Feb 16 06:25:51 PST 2003 + _________________________ version + ipsec --version Linux FreeS/WAN 2.00-pre8-cand1 See `ipsec --copyright' for copyright information. + _________________________ proc/version + cat /proc/version Linux version 2.4.20 ([email protected]) (gcc version 3.2 20020903 (Red Hat Linux 8.0 3.2-7)) #3 Sat Feb 15 18:56:43 PST 2003 + _________________________ ipsec_verify + ipsec verify Checking your system to see if IPsec got installed and started correctly Version check and ipsec on-path [OK] Checking for KLIPS support in kernel [OK] Checking for RSA private key (/etc/ipsec.secrets) [OK] Checking that pluto is running [OK] DNS checks. Looking for forward key for east.test.toad.com [OK] Does the machine have at least one non-private address [OK] Two or more interfaces found, checking IP forwarding [OK] Checking NAT and MASQUERADING [N/A] + _________________________ proc/net/ipsec_eroute + sort -n +3 /proc/net/ipsec_eroute + _________________________ netstat-rn + netstat -nr Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 216.240.42.160 0.0.0.0 255.255.255.248 U 40 0 0 eth1 216.240.42.144 0.0.0.0 255.255.255.240 U 40 0 0 eth2 216.240.42.144 0.0.0.0 255.255.255.240 U 40 0 0 ipsec0 216.240.42.0 0.0.0.0 255.255.255.192 U 40 0 0 eth0 127.0.0.0 0.0.0.0 255.0.0.0 U 40 0 0 lo 0.0.0.0 216.240.42.158 0.0.0.0 UG 40 0 0 eth2 + _________________________ proc/net/ipsec_spi + cat /proc/net/ipsec_spi + _________________________ proc/net/ipsec_spigrp + cat /proc/net/ipsec_spigrp + _________________________ proc/net/ipsec_tncfg + cat /proc/net/ipsec_tncfg ipsec0 -> eth2 mtu=16260(1500) -> 1500 ipsec1 -> NULL mtu=0(0) -> 0 ipsec2 -> NULL mtu=0(0) -> 0 ipsec3 -> NULL mtu=0(0) -> 0 + _________________________ proc/net/pf_key + cat /proc/net/pf_key sock pid socket next prev e n p sndbf Flags Type St c0a029e0 30883 c1a4af50 0 0 0 0 2 65535 00000000 3 1 + _________________________ proc/net/pf_key-star + cd /proc/net + egrep '^' pf_key_registered pf_key_supported pf_key_registered:satype socket pid sk pf_key_registered: 2 c1a4af50 30883 c0a029e0 pf_key_registered: 3 c1a4af50 30883 c0a029e0 pf_key_registered: 9 c1a4af50 30883 c0a029e0 pf_key_registered: 10 c1a4af50 30883 c0a029e0 pf_key_supported:satype exttype alg_id ivlen minbits maxbits pf_key_supported: 2 14 3 0 160 160 pf_key_supported: 2 14 2 0 128 128 pf_key_supported: 3 15 3 128 168 168 pf_key_supported: 3 14 3 0 160 160 pf_key_supported: 3 14 2 0 128 128 pf_key_supported: 9 15 1 0 32 32 pf_key_supported: 10 15 2 0 1 1 + _________________________ proc/sys/net/ipsec-star + cd /proc/sys/net/ipsec + egrep '^' debug_ah debug_eroute debug_esp debug_ipcomp debug_netlink debug_pfkey debug_radij debug_rcv debug_spi debug_tunnel debug_verbose debug_xform icmp inbound_policy_check tos debug_ah:0 debug_eroute:0 debug_esp:0 debug_ipcomp:0 debug_netlink:0 debug_pfkey:0 debug_radij:0 debug_rcv:0 debug_spi:0 debug_tunnel:0 debug_verbose:0 debug_xform:0 icmp:1 inbound_policy_check:1 tos:1 + _________________________ ipsec/status + ipsec auto --status 000 interface ipsec0/eth2 216.240.42.145 000 000 "private": 216.240.42.145---216.240.42.158...%opportunisticgroup 000 "private": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0 000 "private": policy: RSASIG+ENCRYPT+TUNNEL+PFS+OPPORTUNISTIC+GROUP+GROUTED+failureDROP+lKOD+rKOD; interface: eth2; unrouted 000 "private": newest ISAKMP SA: #0; newest IPsec SA: #0; eroute owner: #0 000 "private-or-clear": 216.240.42.145---216.240.42.158...%opportunisticgroup 000 "private-or-clear": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0 000 "private-or-clear": policy: RSASIG+ENCRYPT+TUNNEL+PFS+OPPORTUNISTIC+GROUP+GROUTED+failurePASS+lKOD+rKOD; interface: eth2; unrouted 000 "private-or-clear": newest ISAKMP SA: #0; newest IPsec SA: #0; eroute owner: #0 000 "clear": 216.240.42.145---216.240.42.158...%group 000 "clear": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0 000 "clear": policy: TUNNEL+PFS+GROUP+GROUTED+PASS+NEVER_NEGOTIATE+lKOD+rKOD; interface: eth2; unrouted 000 "clear": newest ISAKMP SA: #0; newest IPsec SA: #0; eroute owner: #0 000 "clear-or-private": 216.240.42.145---216.240.42.158...%opportunisticgroup 000 "clear-or-private": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0 000 "clear-or-private": policy: RSASIG+ENCRYPT+TUNNEL+PFS+OPPORTUNISTIC+GROUP+GROUTED+PASS+failurePASS+lKOD+rKOD; interface: eth2; unrouted 000 "clear-or-private": newest ISAKMP SA: #0; newest IPsec SA: #0; eroute owner: #0 000 "block": 216.240.42.145---216.240.42.158...%group 000 "block": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0 000 "block": policy: TUNNEL+PFS+GROUP+GROUTED+REJECT+NEVER_NEGOTIATE+lKOD+rKOD; interface: eth2; unrouted 000 "block": newest ISAKMP SA: #0; newest IPsec SA: #0; eroute owner: #0 000 000 + _________________________ ifconfig-a + ifconfig -a dummy0 Link encap:Ethernet HWaddr 00:00:00:00:00:00 BROADCAST NOARP MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) eth0 Link encap:Ethernet HWaddr 00:60:EF:10:0F:62 inet addr:216.240.42.45 Bcast:216.240.42.63 Mask:255.255.255.192 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:159041 errors:0 dropped:0 overruns:0 frame:0 TX packets:144665 errors:0 dropped:0 overruns:0 carrier:0 collisions:4531 txqueuelen:100 RX bytes:10622688 (10.1 Mb) TX bytes:30391784 (28.9 Mb) Interrupt:9 Base address:0x1000 eth1 Link encap:Ethernet HWaddr 00:A0:CC:3E:88:D7 inet addr:216.240.42.166 Bcast:216.240.42.167 Mask:255.255.255.248 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:0 errors:1 dropped:0 overruns:0 frame:0 TX packets:253 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:0 (0.0 b) TX bytes:10626 (10.3 Kb) Interrupt:9 Base address:0xe800 eth2 Link encap:Ethernet HWaddr 00:A0:CC:D3:D6:E0 inet addr:216.240.42.145 Bcast:216.240.42.159 Mask:255.255.255.240 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:4488 errors:1 dropped:0 overruns:0 frame:0 TX packets:2226 errors:0 dropped:0 overruns:0 carrier:0 collisions:1096 txqueuelen:100 RX bytes:3533118 (3.3 Mb) TX bytes:171683 (167.6 Kb) Interrupt:10 Base address:0xec00 ipsec0 Link encap:Ethernet HWaddr 00:A0:CC:D3:D6:E0 inet addr:216.240.42.145 Mask:255.255.255.240 UP RUNNING NOARP MTU:16260 Metric:1 RX packets:36 errors:0 dropped:36 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:10 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) ipsec1 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 NOARP MTU:0 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:10 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) ipsec2 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 NOARP MTU:0 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:10 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) ipsec3 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 NOARP MTU:0 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:10 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:2 errors:0 dropped:0 overruns:0 frame:0 TX packets:2 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:196 (196.0 b) TX bytes:196 (196.0 b) + _________________________ mii-tool + '[' -x /sbin/mii-tool ']' + /sbin/mii-tool -v eth0: negotiated 100baseTx-HD, link ok product info: vendor 00:00:00, model 0 rev 0 basic mode: autonegotiation enabled basic status: autonegotiation complete, link ok capabilities: 100baseTx-FD 100baseTx-HD 10baseT-FD 10baseT-HD advertising: 100baseTx-FD 100baseTx-HD 10baseT-FD 10baseT-HD link partner: 100baseTx-HD 10baseT-HD eth1: negotiated 100baseTx-FD, link ok product info: Level One LXT970/971 rev 0 basic mode: autonegotiation enabled basic status: autonegotiation complete, link ok capabilities: 100baseTx-FD 100baseTx-HD 10baseT-FD 10baseT-HD advertising: 100baseTx-FD 100baseTx-HD 10baseT-FD 10baseT-HD link partner: 100baseTx-FD 100baseTx-HD 10baseT-FD 10baseT-HD flow-control eth2: no autonegotiation, 100baseTx-HD, link ok product info: vendor 00:10:18, model 33 rev 2 basic mode: autonegotiation enabled basic status: autonegotiation complete, link ok capabilities: 100baseTx-FD 100baseTx-HD 10baseT-FD 10baseT-HD advertising: 100baseTx-FD 100baseTx-HD 10baseT-FD 10baseT-HD link partner: 100baseTx-HD + _________________________ ipsec/directory + ipsec --directory /usr/local/lib/ipsec + _________________________ hostname/fqdn + hostname --fqdn east.test.toad.com + _________________________ hostname/ipaddress + hostname --ip-address 216.240.42.145 + _________________________ uptime + uptime 6:25am up 11:17, 2 users, load average: 0.05, 0.03, 0.00 + _________________________ ps + ps alxwf + egrep -i 'ppid|pluto|ipsec|klips' F UID PID PPID PRI NI VSZ RSS WCHAN STAT TTY TIME COMMAND 100 0 24241 700 9 0 3504 508 do_sig T pts/0 0:00 | \_ less /etc/ipsec.d/policies/block /etc/ipsec 000 0 31435 700 18 0 3824 992 wait4 S pts/0 0:00 | \_ /bin/sh /usr/local/libexec/ipsec/barf 000 0 31533 31435 18 0 1452 448 pipe_w S pts/0 0:00 | \_ grep -E -i ppid|pluto|ipsec|klips 040 0 30875 1 9 0 2020 944 wait4 S pts/0 0:00 /bin/sh /usr/local/lib/ipsec/_plutorun --debug --uniqueids yes 040 0 30879 30875 9 0 2020 956 wait4 S pts/0 0:00 \_ /bin/sh /usr/local/lib/ipsec/_plutorun --debug --uniqueids 100 0 30883 30879 9 0 1928 808 do_sel S pts/0 0:00 | \_ /usr/local/libexec/ipsec/pluto --nofork --uniqueids 000 0 30885 30883 9 0 1384 236 do_sel S pts/0 0:00 | \_ _pluto_adns 000 0 30880 30875 8 0 2004 940 pipe_w S pts/0 0:00 \_ /bin/sh /usr/local/lib/ipsec/_plutoload --wait no --post 000 0 30876 1 9 0 1320 352 pipe_w S pts/0 0:00 logger -s -p daemon.error -t ipsec__plutorun + _________________________ ipsec/showdefaults + ipsec showdefaults routephys=eth2 routevirt=ipsec0 routeaddr=216.240.42.145 routenexthop=216.240.42.158 + _________________________ ipsec/conf + ipsec _include /etc/ipsec.conf + ipsec _keycensor + _________________________ ipsec/secrets + ipsec _include /etc/ipsec.secrets + ipsec _secretcensor #< /etc/ipsec.secrets 1 : RSA { # RSA 2192 bits east.toad.com Sun Dec 22 22:50:17 2002 # for signatures only, UNSAFE FOR ENCRYPTION #pubkey=[keyid AQN2FKciP] #IN KEY 0x4200 4 1 [keyid AQN2FKciP] # (0x4200 = auth-only host-level, 4 = IPSec, 1 = RSA) Modulus: [...] PublicExponent: [...] # everything after this point is secret PrivateExponent: [...] Prime1: [...] Prime2: [...] Exponent1: [...] Exponent2: [...] Coefficient: [...] } # do not change the indenting of that "[sums to 7d9d...]" + '[' ']' + _________________________ ipsec/ls-dir + ls -l /usr/local/lib/ipsec total 380 - -rwxr-xr-x 1 root wheel 13574 Feb 16 03:01 _confread - -rwxr-xr-x 1 root wheel 13574 Feb 15 19:53 _confread.old - -rwxr-xr-x 1 root wheel 47455 Feb 16 03:01 _copyright - -rwxr-xr-x 1 root wheel 47411 Feb 15 19:53 _copyright.old - -rwxr-xr-x 1 root wheel 2379 Feb 16 03:01 _include - -rwxr-xr-x 1 root wheel 2379 Feb 15 19:53 _include.old - -rwxr-xr-x 1 root wheel 1475 Feb 16 03:01 _keycensor - -rwxr-xr-x 1 root wheel 1475 Feb 15 19:53 _keycensor.old - -rwxr-xr-x 1 root wheel 68381 Feb 16 03:01 _pluto_adns - -rwxr-xr-x 1 root wheel 68345 Feb 15 19:53 _pluto_adns.old - -rwxr-xr-x 1 root wheel 3586 Feb 16 03:01 _plutoload - -rwxr-xr-x 1 root wheel 3586 Feb 15 19:53 _plutoload.old - -rwxr-xr-x 1 root wheel 4486 Feb 16 03:01 _plutorun - -rwxr-xr-x 1 root wheel 4486 Feb 15 19:53 _plutorun.old - -rwxr-xr-x 1 root wheel 9358 Feb 16 03:01 _realsetup - -rwxr-xr-x 1 root wheel 9358 Feb 15 19:53 _realsetup.old - -rwxr-xr-x 1 root wheel 1975 Feb 16 03:01 _secretcensor - -rwxr-xr-x 1 root wheel 1975 Feb 15 19:53 _secretcensor.old - -rwxr-xr-x 1 root wheel 7868 Feb 16 03:01 _startklips - -rwxr-xr-x 1 root wheel 7868 Feb 15 19:53 _startklips.old - -rwxr-xr-x 1 root wheel 5015 Feb 16 03:01 _updown - -rwxr-xr-x 1 root wheel 5015 Feb 15 19:53 _updown.old - -rwxr-xr-x 1 root wheel 1942 Feb 16 03:01 ipsec_pr.template + _________________________ ipsec/updowns ++ ls /usr/local/lib/ipsec ++ egrep updown + cat /usr/local/lib/ipsec/_updown #! /bin/sh # default updown script # Copyright (C) 2000, 2001 D. Hugh Redelmeier, Henry Spencer # # This program is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by the # Free Software Foundation; either version 2 of the License, or (at your # option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. # # This program is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License # for more details. # # RCSID $Id: _updown.in,v 1.20 2002/04/24 07:36:06 mcr Exp $ # CAUTION: Installing a new version of FreeS/WAN will install a new # copy of this script, wiping out any custom changes you make. If # you need changes, make a copy of this under another name, and customize # that, and use the (left/right)updown parameters in ipsec.conf to make # FreeS/WAN use yours instead of this default one. # check interface version case "$PLUTO_VERSION" in 1.[0]) # Older Pluto?!? Play it safe, script may be using new features. echo "$0: obsolete interface version \`$PLUTO_VERSION'," >&2 echo "$0: called by obsolete Pluto?" >&2 exit 2 ;; 1.*) ;; *) echo "$0: unknown interface version \`$PLUTO_VERSION'" >&2 exit 2 ;; esac # check parameter(s) case "$1:$*" in ':') # no parameters ;; ipfwadm:ipfwadm) # due to (left/right)firewall; for default script only ;; custom:*) # custom parameters (see above CAUTION comment) ;; *) echo "$0: unknown parameters \`$*'" >&2 exit 2 ;; esac # utility functions for route manipulation # Meddling with this stuff should not be necessary and requires great care. uproute() { doroute add } downroute() { doroute del } doroute() { parms="-net $PLUTO_PEER_CLIENT_NET netmask $PLUTO_PEER_CLIENT_MASK" parms2="dev $PLUTO_INTERFACE gw $PLUTO_NEXT_HOP" case "$PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK" in "0.0.0.0/0.0.0.0") # horrible kludge for obscure routing bug with opportunistic it="route $1 -net 0.0.0.0 netmask 128.0.0.0 $parms2 && route $1 -net 128.0.0.0 netmask 128.0.0.0 $parms2" ;; *) it="route $1 $parms $parms2" ;; esac eval $it st=$? if test $st -ne 0 then # route has already given its own cryptic message echo "$0: \`$it' failed" >&2 if test " $1 $st" = " add 7" then # another totally undocumented interface -- 7 and # "SIOCADDRT: Network is unreachable" means that # the gateway isn't reachable. echo "$0: (incorrect or missing nexthop setting??)" >&2 fi fi return $st } # the big choice case "$PLUTO_VERB:$1" in prepare-host:*|prepare-client:*) # delete possibly-existing route (preliminary to adding a route) case "$PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK" in "0.0.0.0/0.0.0.0") # horrible kludge for obscure routing bug with opportunistic it="route del -net 0.0.0.0 netmask 128.0.0.0 2>&1 ; route del -net 128.0.0.0 netmask 128.0.0.0 2>&1" ;; *) it="route del -net $PLUTO_PEER_CLIENT_NET \ netmask $PLUTO_PEER_CLIENT_MASK 2>&1" ;; esac oops="`eval $it`" status="$?" if test " $oops" = " " -a " $status" != " 0" then oops="silent error, exit status $status" fi case "$oops" in 'SIOCDELRT: No such process'*) # This is what route (currently -- not documented!) gives # for "could not find such a route". oops= status=0 ;; esac if test " $oops" != " " -o " $status" != " 0" then echo "$0: \`$it' failed ($oops)" >&2 fi exit $status ;; route-host:*|route-client:*) # connection to me or my client subnet being routed uproute ;; unroute-host:*|unroute-client:*) # connection to me or my client subnet being unrouted downroute ;; up-host:*) # connection to me coming up # If you are doing a custom version, firewall commands go here. ;; down-host:*) # connection to me going down # If you are doing a custom version, firewall commands go here. ;; up-client:) # connection to my client subnet coming up # If you are doing a custom version, firewall commands go here. ;; down-client:) # connection to my client subnet going down # If you are doing a custom version, firewall commands go here. ;; up-client:ipfwadm) # connection to client subnet, with (left/right)firewall=yes, coming up # This is used only by the default updown script, not by your custom # ones, so do not mess with it; see CAUTION comment up at top. ipfwadm -F -i accept -b -S $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \ -D $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK ;; down-client:ipfwadm) # connection to client subnet, with (left/right)firewall=yes, going down # This is used only by the default updown script, not by your custom # ones, so do not mess with it; see CAUTION comment up at top. ipfwadm -F -d accept -b -S $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \ -D $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK ;; *) echo "$0: unknown verb \`$PLUTO_VERB' or parameter \`$1'" >&2 exit 1 ;; esac + cat /usr/local/lib/ipsec/_updown.old #! /bin/sh # default updown script # Copyright (C) 2000, 2001 D. Hugh Redelmeier, Henry Spencer # # This program is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by the # Free Software Foundation; either version 2 of the License, or (at your # option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. # # This program is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License # for more details. # # RCSID $Id: _updown.in,v 1.20 2002/04/24 07:36:06 mcr Exp $ # CAUTION: Installing a new version of FreeS/WAN will install a new # copy of this script, wiping out any custom changes you make. If # you need changes, make a copy of this under another name, and customize # that, and use the (left/right)updown parameters in ipsec.conf to make # FreeS/WAN use yours instead of this default one. # check interface version case "$PLUTO_VERSION" in 1.[0]) # Older Pluto?!? Play it safe, script may be using new features. echo "$0: obsolete interface version \`$PLUTO_VERSION'," >&2 echo "$0: called by obsolete Pluto?" >&2 exit 2 ;; 1.*) ;; *) echo "$0: unknown interface version \`$PLUTO_VERSION'" >&2 exit 2 ;; esac # check parameter(s) case "$1:$*" in ':') # no parameters ;; ipfwadm:ipfwadm) # due to (left/right)firewall; for default script only ;; custom:*) # custom parameters (see above CAUTION comment) ;; *) echo "$0: unknown parameters \`$*'" >&2 exit 2 ;; esac # utility functions for route manipulation # Meddling with this stuff should not be necessary and requires great care. uproute() { doroute add } downroute() { doroute del } doroute() { parms="-net $PLUTO_PEER_CLIENT_NET netmask $PLUTO_PEER_CLIENT_MASK" parms2="dev $PLUTO_INTERFACE gw $PLUTO_NEXT_HOP" case "$PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK" in "0.0.0.0/0.0.0.0") # horrible kludge for obscure routing bug with opportunistic it="route $1 -net 0.0.0.0 netmask 128.0.0.0 $parms2 && route $1 -net 128.0.0.0 netmask 128.0.0.0 $parms2" ;; *) it="route $1 $parms $parms2" ;; esac eval $it st=$? if test $st -ne 0 then # route has already given its own cryptic message echo "$0: \`$it' failed" >&2 if test " $1 $st" = " add 7" then # another totally undocumented interface -- 7 and # "SIOCADDRT: Network is unreachable" means that # the gateway isn't reachable. echo "$0: (incorrect or missing nexthop setting??)" >&2 fi fi return $st } # the big choice case "$PLUTO_VERB:$1" in prepare-host:*|prepare-client:*) # delete possibly-existing route (preliminary to adding a route) case "$PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK" in "0.0.0.0/0.0.0.0") # horrible kludge for obscure routing bug with opportunistic it="route del -net 0.0.0.0 netmask 128.0.0.0 2>&1 ; route del -net 128.0.0.0 netmask 128.0.0.0 2>&1" ;; *) it="route del -net $PLUTO_PEER_CLIENT_NET \ netmask $PLUTO_PEER_CLIENT_MASK 2>&1" ;; esac oops="`eval $it`" status="$?" if test " $oops" = " " -a " $status" != " 0" then oops="silent error, exit status $status" fi case "$oops" in 'SIOCDELRT: No such process'*) # This is what route (currently -- not documented!) gives # for "could not find such a route". oops= status=0 ;; esac if test " $oops" != " " -o " $status" != " 0" then echo "$0: \`$it' failed ($oops)" >&2 fi exit $status ;; route-host:*|route-client:*) # connection to me or my client subnet being routed uproute ;; unroute-host:*|unroute-client:*) # connection to me or my client subnet being unrouted downroute ;; up-host:*) # connection to me coming up # If you are doing a custom version, firewall commands go here. ;; down-host:*) # connection to me going down # If you are doing a custom version, firewall commands go here. ;; up-client:) # connection to my client subnet coming up # If you are doing a custom version, firewall commands go here. ;; down-client:) # connection to my client subnet going down # If you are doing a custom version, firewall commands go here. ;; up-client:ipfwadm) # connection to client subnet, with (left/right)firewall=yes, coming up # This is used only by the default updown script, not by your custom # ones, so do not mess with it; see CAUTION comment up at top. ipfwadm -F -i accept -b -S $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \ -D $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK ;; down-client:ipfwadm) # connection to client subnet, with (left/right)firewall=yes, going down # This is used only by the default updown script, not by your custom # ones, so do not mess with it; see CAUTION comment up at top. ipfwadm -F -d accept -b -S $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \ -D $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK ;; *) echo "$0: unknown verb \`$PLUTO_VERB' or parameter \`$1'" >&2 exit 1 ;; esac + _________________________ proc/net/dev + cat /proc/net/dev Inter-| Receive | Transmit face |bytes packets errs drop fifo frame compressed multicast|bytes packets errs drop fifo colls carrier compressed lo: 196 2 0 0 0 0 0 0 196 2 0 0 0 0 0 0 dummy0: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 eth0:10622688 159041 0 0 0 0 0 0 30391784 144665 0 0 0 4531 0 0 eth1: 0 0 1 0 0 0 0 0 10626 253 0 0 0 0 0 0 eth2: 3533376 4490 1 0 0 0 0 0 171839 2228 0 0 0 1096 0 0 ipsec0: 0 36 0 36 0 0 0 0 0 0 0 0 0 0 0 0 ipsec1: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ipsec2: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ipsec3: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 + _________________________ proc/net/route + cat /proc/net/route Iface Destination Gateway Flags RefCnt Use Metric Mask MTU Window IRTT eth1 A02AF0D8 00000000 0001 0 0 0 F8FFFFFF 40 0 0 eth2 902AF0D8 00000000 0001 0 0 0 F0FFFFFF 40 0 0 ipsec0 902AF0D8 00000000 0001 0 0 0 F0FFFFFF 40 0 0 eth0 002AF0D8 00000000 0001 0 0 0 C0FFFFFF 40 0 0 lo 0000007F 00000000 0001 0 0 0 000000FF 40 0 0 eth2 00000000 9E2AF0D8 0003 0 0 0 00000000 40 0 0 + _________________________ proc/sys/net/ipv4/ip_forward + cat /proc/sys/net/ipv4/ip_forward 1 + _________________________ proc/sys/net/ipv4/conf/star-rp_filter + cd /proc/sys/net/ipv4/conf + egrep '^' all/rp_filter default/rp_filter eth0/rp_filter eth1/rp_filter eth2/rp_filter ipsec0/rp_filter lo/rp_filter all/rp_filter:0 default/rp_filter:0 eth0/rp_filter:0 eth1/rp_filter:0 eth2/rp_filter:0 ipsec0/rp_filter:0 lo/rp_filter:0 + _________________________ uname-a + uname -a Linux east.test.toad.com 2.4.20 #3 Sat Feb 15 18:56:43 PST 2003 i686 i686 i386 GNU/Linux + _________________________ redhat-release + test -r /etc/redhat-release + cat /etc/redhat-release Red Hat Linux release 8.0 (Psyche) + _________________________ proc/net/ipsec_version + cat /proc/net/ipsec_version FreeS/WAN version: 2.00-pre8-cand1 + _________________________ iptables/list + iptables -L -v -n Chain INPUT (policy ACCEPT 148K packets, 11M bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 94 packets, 10658 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 146K packets, 28M bytes) pkts bytes target prot opt in out source destination + _________________________ ipchains/list + ipchains -L -v -n /usr/local/libexec/ipsec/barf: line 234: ipchains: command not found + _________________________ ipfwadm/forward + ipfwadm -F -l -n -e /usr/local/libexec/ipsec/barf: line 236: ipfwadm: command not found + _________________________ ipfwadm/input + ipfwadm -I -l -n -e /usr/local/libexec/ipsec/barf: line 238: ipfwadm: command not found + _________________________ ipfwadm/output + ipfwadm -O -l -n -e /usr/local/libexec/ipsec/barf: line 240: ipfwadm: command not found + _________________________ iptables/nat + iptables -t nat -L -v -n Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination + _________________________ ipchains/masq + ipchains -M -L -v -n /usr/local/libexec/ipsec/barf: line 244: ipchains: command not found + _________________________ ipfwadm/masq + ipfwadm -M -l -n -e /usr/local/libexec/ipsec/barf: line 246: ipfwadm: command not found + _________________________ iptables/mangle + iptables -t mangle -L -v -n Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination + _________________________ proc/modules + cat /proc/modules iptable_mangle 2776 0 (autoclean) (unused) iptable_nat 26488 0 (autoclean) (unused) ip_conntrack 36448 1 (autoclean) [iptable_nat] ipsec 286048 2 loop 11608 0 (autoclean) tulip 45184 2 8139too 17128 1 mii 3912 0 [8139too] iptable_filter 2412 0 (autoclean) (unused) ip_tables 17624 5 [iptable_mangle iptable_nat iptable_filter] mousedev 5460 0 (unused) keybdev 2944 0 (unused) hid 22180 0 (unused) + _________________________ proc/meminfo + cat /proc/meminfo total: used: free: shared: buffers: cached: Mem: 63762432 61353984 2408448 0 13000704 13840384 Swap: 139821056 4759552 135061504 MemTotal: 62268 kB MemFree: 2352 kB MemShared: 0 kB Buffers: 12696 kB Cached: 11268 kB SwapCached: 2248 kB Active: 15380 kB Inactive: 13884 kB HighTotal: 0 kB HighFree: 0 kB LowTotal: 62268 kB LowFree: 2352 kB SwapTotal: 136544 kB SwapFree: 131896 kB + _________________________ dev/ipsec-ls + ls -l '/dev/ipsec*' ls: /dev/ipsec*: No such file or directory + _________________________ proc/net/ipsec-ls + ls -l /proc/net/ipsec_eroute /proc/net/ipsec_klipsdebug /proc/net/ipsec_spi /proc/net/ipsec_spigrp /proc/net/ipsec_tncfg /proc/net/ipsec_version lrwxrwxrwx 1 root root 16 Feb 16 06:25 /proc/net/ipsec_eroute -> ipsec/eroute/all lrwxrwxrwx 1 root root 16 Feb 16 06:25 /proc/net/ipsec_klipsdebug -> ipsec/klipsdebug lrwxrwxrwx 1 root root 13 Feb 16 06:25 /proc/net/ipsec_spi -> ipsec/spi/all lrwxrwxrwx 1 root root 16 Feb 16 06:25 /proc/net/ipsec_spigrp -> ipsec/spigrp/all lrwxrwxrwx 1 root root 11 Feb 16 06:25 /proc/net/ipsec_tncfg -> ipsec/tncfg lrwxrwxrwx 1 root root 13 Feb 16 06:25 /proc/net/ipsec_version -> ipsec/version + _________________________ usr/src/linux/.config + test -f /usr/src/linux/.config + egrep 'IP|NETLINK' /usr/src/linux/.config # CONFIG_MWINCHIPC6 is not set # CONFIG_MWINCHIP2 is not set # CONFIG_MWINCHIP3D is not set CONFIG_SYSVIPC=y # CONFIG_MD_MULTIPATH is not set CONFIG_NETLINK_DEV=m CONFIG_IP_MULTICAST=y CONFIG_IP_ADVANCED_ROUTER=y CONFIG_IP_MULTIPLE_TABLES=y # CONFIG_IP_ROUTE_FWMARK is not set CONFIG_IP_ROUTE_NAT=y CONFIG_IP_ROUTE_MULTIPATH=y CONFIG_IP_ROUTE_TOS=y CONFIG_IP_ROUTE_VERBOSE=y CONFIG_IP_ROUTE_LARGE_TABLES=y # CONFIG_IP_PNP is not set # CONFIG_NET_IPIP is not set CONFIG_NET_IPGRE=m CONFIG_NET_IPGRE_BROADCAST=y CONFIG_IP_MROUTE=y CONFIG_IP_PIMSM_V1=y CONFIG_IP_PIMSM_V2=y # IP: Netfilter Configuration CONFIG_IP_NF_CONNTRACK=m CONFIG_IP_NF_FTP=m CONFIG_IP_NF_IRC=m CONFIG_IP_NF_QUEUE=m CONFIG_IP_NF_IPTABLES=m CONFIG_IP_NF_MATCH_LIMIT=m CONFIG_IP_NF_MATCH_MAC=m CONFIG_IP_NF_MATCH_PKTTYPE=m CONFIG_IP_NF_MATCH_MARK=m CONFIG_IP_NF_MATCH_MULTIPORT=m CONFIG_IP_NF_MATCH_TOS=m CONFIG_IP_NF_MATCH_ECN=m CONFIG_IP_NF_MATCH_DSCP=m CONFIG_IP_NF_MATCH_AH_ESP=m CONFIG_IP_NF_MATCH_LENGTH=m CONFIG_IP_NF_MATCH_TTL=m CONFIG_IP_NF_MATCH_TCPMSS=m CONFIG_IP_NF_MATCH_HELPER=m CONFIG_IP_NF_MATCH_STATE=m CONFIG_IP_NF_MATCH_CONNTRACK=m CONFIG_IP_NF_MATCH_UNCLEAN=m CONFIG_IP_NF_MATCH_OWNER=m CONFIG_IP_NF_FILTER=m CONFIG_IP_NF_TARGET_REJECT=m CONFIG_IP_NF_TARGET_MIRROR=m CONFIG_IP_NF_NAT=m CONFIG_IP_NF_NAT_NEEDED=y CONFIG_IP_NF_TARGET_MASQUERADE=m CONFIG_IP_NF_TARGET_REDIRECT=m CONFIG_IP_NF_NAT_LOCAL=y CONFIG_IP_NF_NAT_SNMP_BASIC=m CONFIG_IP_NF_NAT_IRC=m CONFIG_IP_NF_NAT_FTP=m CONFIG_IP_NF_MANGLE=m CONFIG_IP_NF_TARGET_TOS=m CONFIG_IP_NF_TARGET_ECN=m CONFIG_IP_NF_TARGET_DSCP=m CONFIG_IP_NF_TARGET_MARK=m CONFIG_IP_NF_TARGET_LOG=m CONFIG_IP_NF_TARGET_ULOG=m CONFIG_IP_NF_TARGET_TCPMSS=m CONFIG_IP_NF_ARPTABLES=m CONFIG_IP_NF_ARPFILTER=m CONFIG_IP_NF_COMPAT_IPCHAINS=m CONFIG_IP_NF_NAT_NEEDED=y CONFIG_IP_NF_COMPAT_IPFWADM=m CONFIG_IP_NF_NAT_NEEDED=y # CONFIG_IPV6 is not set # CONFIG_IPX is not set CONFIG_IPSEC=m # IPSec options (FreeS/WAN) CONFIG_IPSEC_IPIP=y CONFIG_IPSEC_AH=y CONFIG_IPSEC_AUTH_HMAC_MD5=y CONFIG_IPSEC_AUTH_HMAC_SHA1=y CONFIG_IPSEC_ESP=y CONFIG_IPSEC_ENC_3DES=y CONFIG_IPSEC_IPCOMP=y CONFIG_IPSEC_DEBUG=y # CONFIG_IDEDMA_PCI_WIP is not set # CONFIG_IDE_CHIPSETS is not set # CONFIG_SCSI_IPS is not set CONFIG_TULIP=m # CONFIG_TULIP_MWI is not set # CONFIG_TULIP_MMIO is not set # CONFIG_HIPPI is not set # CONFIG_PLIP is not set # CONFIG_SLIP is not set # CONFIG_SERIAL_MULTIPORT is not set # CONFIG_I2C_PHILIPSPAR is not set # CONFIG_INPUT_GRIP is not set CONFIG_USB_AIPTEK=m CONFIG_USB_SERIAL_IPAQ=m + _________________________ etc/syslog.conf + cat /etc/syslog.conf # Log all kernel messages to the console. # Logging much else clutters up the screen. #kern.* /dev/console # Log anything (except mail) of level info or higher. # Don't log private authentication messages! *.info;mail.none;authpriv.none;cron.none /var/log/messages # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* /var/log/maillog # Log cron stuff cron.* /var/log/cron # Everybody gets emergency messages *.emerg * # Save news errors of level crit and higher in a special file. uucp,news.crit /var/log/spooler # Save boot messages also to boot.log local7.* /var/log/boot.log + _________________________ etc/resolv.conf + cat /etc/resolv.conf domain test.toad.com search test.toad.com toad.com freeswan.org syzygy.com xisp.net nameserver 216.240.42.158 # crm114 nameserver 216.181.81.2 # dns1.xisp.net nameserver 216.240.32.66 # ns1.idiom.com + _________________________ lib/modules-ls + ls -ltr /lib/modules total 8 drwxr-xr-x 4 root root 4096 Feb 15 15:29 2.4.18-14 drwxr-xr-x 4 root wheel 4096 Feb 16 03:04 2.4.20 + _________________________ proc/ksyms-netif_rx + egrep netif_rx /proc/ksyms c0212e60 netif_rx_Rf2cacc44 + _________________________ lib/modules-netif_rx + modulegoo kernel/net/ipv4/ipip.o netif_rx + set +x 2.4.18-14: U netif_rx_Rac7ce141 2.4.20: + _________________________ kern.debug + test -f /var/log/kern.debug + _________________________ klog + sed -n '12,$p' /var/log/messages + egrep -i 'ipsec|klips|pluto' + cat Feb 16 06:17:25 east ipsec_setup: Starting FreeS/WAN IPsec loaded)... Feb 16 06:17:25 east ipsec_setup: Using /lib/modules/2.4.20/kernel/net/ipsec/ipsec.o Feb 16 06:17:25 east kernel: klips_info:ipsec_init: KLIPS startup, FreeS/WAN IPSec version: 2.00-pre8-cand1 Feb 16 06:17:25 east /etc/hotplug/net.agent: invoke ifup ipsec0 Feb 16 06:17:25 east /etc/hotplug/net.agent: invoke ifup ipsec2 Feb 16 06:17:25 east ipsec_setup: KLIPS debug `none' Feb 16 06:17:25 east /etc/hotplug/net.agent: invoke ifup ipsec1 Feb 16 06:17:26 east /etc/hotplug/net.agent: invoke ifup ipsec3 Feb 16 06:17:26 east ipsec_setup: KLIPS ipsec0 on eth2 216.240.42.145/255.255.255.240 broadcast 216.240.42.159 Feb 16 06:17:26 east ipsec_setup: ...FreeS/WAN IPsec started + _________________________ plog + sed -n '17,$p' /var/log/secure + egrep -i pluto + cat Feb 16 06:17:26 east ipsec__plutorun: Starting Pluto subsystem... Feb 16 06:17:26 east pluto[30883]: Starting Pluto (FreeS/WAN Version 2.00-pre8-cand1) Feb 16 06:17:26 east pluto[30883]: added connection description "block" Feb 16 06:17:27 east pluto[30883]: added connection description "clear-or-private" Feb 16 06:17:27 east pluto[30883]: added connection description "clear" Feb 16 06:17:27 east pluto[30883]: added connection description "private-or-clear" Feb 16 06:17:27 east pluto[30883]: added connection description "private" Feb 16 06:17:27 east pluto[30883]: listening for IKE messages Feb 16 06:17:27 east pluto[30883]: adding interface ipsec0/eth2 216.240.42.145 Feb 16 06:17:27 east pluto[30883]: loading secrets from "/etc/ipsec.secrets" + _________________________ date + date Sun Feb 16 06:25:53 PST 2003 -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv Comment: For the matching public key, finger the Reply-To: address. iQCVAwUBPk+g4lZpdJR7FBQRAQHpqgP8DyoC6uBEJY3oTUcALwc/Ws6iKVNi2kZw bbj13cpDPcLLYfljB9vvToSshcVROGF6/5wQWpvyDRHO0OYasLLA1x5TqFEcLjGT D2zAOdLWMnRCqJmTgWYgoJG7IE6XZjVZOhJSHykVrc8qaWrCshcGmzC0IZaUUhKO q8zDycz7XhQ= =sgBx -----END PGP SIGNATURE-----