IPSEC FIRST LIGHT! (by non-kernel developer :-))

From: bert hubert (ahu@ds9a.nl)
Date: Thu Nov 07 2002 - 08:02:44 EST

On Thu, Nov 07, 2002 at 02:52:50AM -0800, David S. Miller wrote:

> Really, if this one doesn't apply, your 2.5 bitkeeper tree is not
> totally uptodate.

It works in transport mode! Both EH/ASP.

Hints:
        Use the latest bitkeeper sources as of Thurday morning MET

        Apply the last patch Alexey sent in the 'silly advise' thread
                on linux kernel mailinglist

        Do not compile anything AH/ESP/CRYPTO as modules
                failed for me with bad oops

        Make very very sure that you are not filtering ipsec packets
                iptables needs to allow protocols 50 and 51

        Use the KAME tools port on ftp://ftp.inr.ac.ru/ip-routing/ipsec/
                racoon won't compile, you don't need it yet
                point it at your 2.5.46+bk+davem tree (edit GNUMakefiles)

        Use 3des-cbc
                examples online use blowfish-cbc but that gives an error
                in setkey

Configuration (needs the setkey tool) on 10.0.0.11:

#!./setkey -f
flush;
spdflush;

# AH
add 10.0.0.11 10.0.0.216 ah 15700 -A hmac-md5 "1234567890123456";
add 10.0.0.216 10.0.0.11 ah 24500 -A hmac-md5 "1234567890123456";

# ESP
add 10.0.0.11 10.0.0.216 esp 15701 -E 3des-cbc "123456789012123456789012";
add 10.0.0.216 10.0.0.11 esp 24501 -E 3des-cbc "123456789012123456789012";

spdadd 10.0.0.216 10.0.0.11 icmp -P out ipsec
           esp/transport//use
           ah/transport//use;

Configuration on 10.0.0.216:

#!./setkey -f
flush;
spdflush;

# AH
add 10.0.0.11 10.0.0.216 ah 15700 -A hmac-md5 "1234567890123456";
add 10.0.0.216 10.0.0.11 ah 24500 -A hmac-md5 "1234567890123456";

# ESP
add 10.0.0.11 10.0.0.216 esp 15701 -E 3des-cbc "123456789012123456789012";
add 10.0.0.216 10.0.0.11 esp 24501 -E 3des-cbc "123456789012123456789012";

# this is reversed
spdadd 10.0.0.11 10.0.0.216 icmp -P out ipsec
           esp/transport//use
           ah/transport//use;

# ping 10.0.0.11
PING 10.0.0.11 (10.0.0.11) from 10.0.0.216 : 56(84) bytes of data.
64 bytes from 10.0.0.11: icmp_seq=1 ttl=64 time=1.11 ms

$ sudo tcpdump -n -i eth0 -p
tcpdump: listening on eth0
13:55:42.381669 10.0.0.216 > 10.0.0.11: AH(spi=0x00005fb4,seq=0x39):
ESP(spi=0x00005fb5,seq=0x39) (DF)
13:55:42.382518 10.0.0.11 > 10.0.0.216: AH(spi=0x00003d54,seq=0x39):
ESP(spi=0x00003d55,seq=0x39)

Great work everybody! I'm very impressed.

Regards,

bert 

-- 
http://www.PowerDNS.com          Versatile DNS Software & Services
http://lartc.org           Linux Advanced Routing & Traffic Control HOWTO
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

This archive was generated by hypermail 2b29 : Thu Nov 07 2002 - 22:00:48 EST