(racoon 912) Multiple SAD entries (ref racoon 905)

"John Doe" <[email protected]> Fri, 25 Feb 2005 05:28:16 -0500 (EST)
Newsgroups gmane.network.ipv6.kame.racoon
Message-ID <[email protected]>
Hi,

I am not really sure if this is a problem directly related to racoon or the implementation of IPSec in general, so apologies if this isn't the right place to post this. 

With reference to "(racoon 905) Problems Renegotiating", I have done some further debugging, and have discovered that the problem lies in the fact that when racoon expires Phase1 and the given tunnel is closed (by resetting WinXP's IPSEC), renegotiation occurs between FreeBSD and WinXP. What then occurs is that the new negotiated SA's are added to the Security associations database (SAD), by racoon. Packets arriving from WinXP use the new SA's and FreeBSD is able to decrypt them as there is a corresponding entry in the SAD. 

The problem is that packets from FreeBSD to WinXP continue to use the old SA, even though the new one is also present in the SAD thus communication between the two gateways fails. (as WinXP is expecting to use the new SA). It then takes several minutes to reestablish a working tunnel. Below I have attached a dump of the SAD entries.

Is this behaviour correct/by design/known problem and does this relate to a racoon problem or IPSec/Kernel problem?? Any help would be much appreciated..

Regards

Rekkie


SAD Entries when tunnel is working

192.168.133.128 192.168.133.1 
	esp mode=tunnel spi=241313234(0x0e6225d2) reqid=0(0x00000000)
	E: 3des-cbc  30c78675 88b4289e f1813790 2ae20ca3 e60ef8d4 3639ef9a
	A: hmac-sha1  06cd3c01 18b63995 8d844e2b ae360fae 60fd6482
	seq=0x00000005 replay=4 flags=0x00000000 state=mature 
	created: Feb  4 22:27:28 2005	current: Feb  4 22:27:54 2005
	diff: 26(s)	hard: 900(s)	soft: 720(s)
	last: Feb  4 22:27:33 2005	hard: 0(s)	soft: 0(s)
	current: 560(bytes)	hard: 0(bytes)	soft: 0(bytes)
	allocated: 5	hard: 0	soft: 0
	sadb_seq=1 pid=2797 refcnt=2
192.168.133.1 192.168.133.128 
	esp mode=tunnel spi=32610605(0x01f1992d) reqid=0(0x00000000)
	E: 3des-cbc  5fc1c444 177fbfd1 53d74639 2f6d5983 47a5e915 977bfa73
	A: hmac-sha1  aa8753f1 164135c9 4a98b5c8 b4889481 78ee0740
	seq=0x00000000 replay=4 flags=0x00000000 state=mature 
	created: Feb  4 22:27:28 2005	current: Feb  4 22:27:54 2005
	diff: 26(s)	hard: 900(s)	soft: 720(s)
	last: Feb  4 22:27:33 2005	hard: 0(s)	soft: 0(s)
	current: 400(bytes)	hard: 0(bytes)	soft: 0(bytes)
	allocated: 5	hard: 0	soft: 0
	sadb_seq=0 pid=2797 refcnt=1



SAD entries when only half of tunnel is working

192.168.133.128 192.168.133.1 
	esp mode=tunnel spi=2253796337(0x865633f1) reqid=0(0x00000000)
	E: 3des-cbc  ac162df3 a7d79dc0 e6733012 d81a8fed 648977bc 916a9327
	A: hmac-sha1  bd7431bc 7f4c2539 70525db1 cb12c78b a899d2e5
	seq=0x00000000 replay=4 flags=0x00000000 state=mature 
	created: Feb  4 22:28:51 2005	current: Feb  4 22:29:11 2005
	diff: 20(s)	hard: 900(s)	soft: 720(s)
	last:                     	hard: 0(s)	soft: 0(s)
	current: 0(bytes)	hard: 0(bytes)	soft: 0(bytes)
	allocated: 0	hard: 0	soft: 0
	sadb_seq=3 pid=2799 refcnt=1
192.168.133.128 192.168.133.1 
	esp mode=tunnel spi=241313234(0x0e6225d2) reqid=0(0x00000000)
	E: 3des-cbc  30c78675 88b4289e f1813790 2ae20ca3 e60ef8d4 3639ef9a
	A: hmac-sha1  06cd3c01 18b63995 8d844e2b ae360fae 60fd6482
	seq=0x00000009 replay=4 flags=0x00000000 state=mature 
	created: Feb  4 22:27:28 2005	current: Feb  4 22:29:11 2005
	diff: 103(s)	hard: 900(s)	soft: 720(s)
	last: Feb  4 22:28:57 2005	hard: 0(s)	soft: 0(s)
	current: 1008(bytes)	hard: 0(bytes)	soft: 0(bytes)
	allocated: 9	hard: 0	soft: 0
	sadb_seq=2 pid=2799 refcnt=2
192.168.133.1 192.168.133.128 
	esp mode=tunnel spi=115056449(0x06db9f41) reqid=0(0x00000000)
	E: 3des-cbc  4d9d7559 69b361cf 7abef55c dbad3679 568c9fe2 264a5633
	A: hmac-sha1  6f77a072 230887f7 0da5929d b604e580 d065e6da
	seq=0x00000000 replay=4 flags=0x00000000 state=mature 
	created: Feb  4 22:28:51 2005	current: Feb  4 22:29:11 2005
	diff: 20(s)	hard: 900(s)	soft: 720(s)
	last: Feb  4 22:28:57 2005	hard: 0(s)	soft: 0(s)
	current: 160(bytes)	hard: 0(bytes)	soft: 0(bytes)
	allocated: 2	hard: 0	soft: 0
	sadb_seq=1 pid=2799 refcnt=1
192.168.133.1 192.168.133.128 
	esp mode=tunnel spi=32610605(0x01f1992d) reqid=0(0x00000000)
	E: 3des-cbc  5fc1c444 177fbfd1 53d74639 2f6d5983 47a5e915 977bfa73
	A: hmac-sha1  aa8753f1 164135c9 4a98b5c8 b4889481 78ee0740
	seq=0x00000000 replay=4 flags=0x00000000 state=mature 
	created: Feb  4 22:27:28 2005	current: Feb  4 22:29:11 2005
	diff: 103(s)	hard: 900(s)	soft: 720(s)
	last: Feb  4 22:28:33 2005	hard: 0(s)	soft: 0(s)
	current: 560(bytes)	hard: 0(bytes)	soft: 0(bytes)
	allocated: 7	hard: 0	soft: 0
	sadb_seq=0 pid=2799 refcnt=1


_______________________________________________
Join Excite! - http://www.excite.com
The most personalized portal on the Web!