(racoon 912) Multiple SAD entries (ref racoon 905)
"John Doe" <[email protected]> Fri, 25 Feb 2005 05:28:16 -0500 (EST)
| Newsgroups | gmane.network.ipv6.kame.racoon |
|---|---|
| Message-ID | <[email protected]> |
Hi, I am not really sure if this is a problem directly related to racoon or the implementation of IPSec in general, so apologies if this isn't the right place to post this. With reference to "(racoon 905) Problems Renegotiating", I have done some further debugging, and have discovered that the problem lies in the fact that when racoon expires Phase1 and the given tunnel is closed (by resetting WinXP's IPSEC), renegotiation occurs between FreeBSD and WinXP. What then occurs is that the new negotiated SA's are added to the Security associations database (SAD), by racoon. Packets arriving from WinXP use the new SA's and FreeBSD is able to decrypt them as there is a corresponding entry in the SAD. The problem is that packets from FreeBSD to WinXP continue to use the old SA, even though the new one is also present in the SAD thus communication between the two gateways fails. (as WinXP is expecting to use the new SA). It then takes several minutes to reestablish a working tunnel. Below I have attached a dump of the SAD entries. Is this behaviour correct/by design/known problem and does this relate to a racoon problem or IPSec/Kernel problem?? Any help would be much appreciated.. Regards Rekkie SAD Entries when tunnel is working 192.168.133.128 192.168.133.1 esp mode=tunnel spi=241313234(0x0e6225d2) reqid=0(0x00000000) E: 3des-cbc 30c78675 88b4289e f1813790 2ae20ca3 e60ef8d4 3639ef9a A: hmac-sha1 06cd3c01 18b63995 8d844e2b ae360fae 60fd6482 seq=0x00000005 replay=4 flags=0x00000000 state=mature created: Feb 4 22:27:28 2005 current: Feb 4 22:27:54 2005 diff: 26(s) hard: 900(s) soft: 720(s) last: Feb 4 22:27:33 2005 hard: 0(s) soft: 0(s) current: 560(bytes) hard: 0(bytes) soft: 0(bytes) allocated: 5 hard: 0 soft: 0 sadb_seq=1 pid=2797 refcnt=2 192.168.133.1 192.168.133.128 esp mode=tunnel spi=32610605(0x01f1992d) reqid=0(0x00000000) E: 3des-cbc 5fc1c444 177fbfd1 53d74639 2f6d5983 47a5e915 977bfa73 A: hmac-sha1 aa8753f1 164135c9 4a98b5c8 b4889481 78ee0740 seq=0x00000000 replay=4 flags=0x00000000 state=mature created: Feb 4 22:27:28 2005 current: Feb 4 22:27:54 2005 diff: 26(s) hard: 900(s) soft: 720(s) last: Feb 4 22:27:33 2005 hard: 0(s) soft: 0(s) current: 400(bytes) hard: 0(bytes) soft: 0(bytes) allocated: 5 hard: 0 soft: 0 sadb_seq=0 pid=2797 refcnt=1 SAD entries when only half of tunnel is working 192.168.133.128 192.168.133.1 esp mode=tunnel spi=2253796337(0x865633f1) reqid=0(0x00000000) E: 3des-cbc ac162df3 a7d79dc0 e6733012 d81a8fed 648977bc 916a9327 A: hmac-sha1 bd7431bc 7f4c2539 70525db1 cb12c78b a899d2e5 seq=0x00000000 replay=4 flags=0x00000000 state=mature created: Feb 4 22:28:51 2005 current: Feb 4 22:29:11 2005 diff: 20(s) hard: 900(s) soft: 720(s) last: hard: 0(s) soft: 0(s) current: 0(bytes) hard: 0(bytes) soft: 0(bytes) allocated: 0 hard: 0 soft: 0 sadb_seq=3 pid=2799 refcnt=1 192.168.133.128 192.168.133.1 esp mode=tunnel spi=241313234(0x0e6225d2) reqid=0(0x00000000) E: 3des-cbc 30c78675 88b4289e f1813790 2ae20ca3 e60ef8d4 3639ef9a A: hmac-sha1 06cd3c01 18b63995 8d844e2b ae360fae 60fd6482 seq=0x00000009 replay=4 flags=0x00000000 state=mature created: Feb 4 22:27:28 2005 current: Feb 4 22:29:11 2005 diff: 103(s) hard: 900(s) soft: 720(s) last: Feb 4 22:28:57 2005 hard: 0(s) soft: 0(s) current: 1008(bytes) hard: 0(bytes) soft: 0(bytes) allocated: 9 hard: 0 soft: 0 sadb_seq=2 pid=2799 refcnt=2 192.168.133.1 192.168.133.128 esp mode=tunnel spi=115056449(0x06db9f41) reqid=0(0x00000000) E: 3des-cbc 4d9d7559 69b361cf 7abef55c dbad3679 568c9fe2 264a5633 A: hmac-sha1 6f77a072 230887f7 0da5929d b604e580 d065e6da seq=0x00000000 replay=4 flags=0x00000000 state=mature created: Feb 4 22:28:51 2005 current: Feb 4 22:29:11 2005 diff: 20(s) hard: 900(s) soft: 720(s) last: Feb 4 22:28:57 2005 hard: 0(s) soft: 0(s) current: 160(bytes) hard: 0(bytes) soft: 0(bytes) allocated: 2 hard: 0 soft: 0 sadb_seq=1 pid=2799 refcnt=1 192.168.133.1 192.168.133.128 esp mode=tunnel spi=32610605(0x01f1992d) reqid=0(0x00000000) E: 3des-cbc 5fc1c444 177fbfd1 53d74639 2f6d5983 47a5e915 977bfa73 A: hmac-sha1 aa8753f1 164135c9 4a98b5c8 b4889481 78ee0740 seq=0x00000000 replay=4 flags=0x00000000 state=mature created: Feb 4 22:27:28 2005 current: Feb 4 22:29:11 2005 diff: 103(s) hard: 900(s) soft: 720(s) last: Feb 4 22:28:33 2005 hard: 0(s) soft: 0(s) current: 560(bytes) hard: 0(bytes) soft: 0(bytes) allocated: 7 hard: 0 soft: 0 sadb_seq=0 pid=2799 refcnt=1 _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!