[strongSwan-dev] kernel SPD/SAD tool

Tue May 31 08:32:50 CEST 2011

- Not saying that pluto crashes, not meant to cause such worries. 
We had some issues that we tried to reproduce by intentionally killing
it to see how it recovers.

- Thanx for the detailed netkey_cleanup pointers.
It's a pity that it uses system shell commands ("setkey" or "ip xfrm")
and not directly sending nlmsg trough its NETLINK_XFRM socket like it
does for all other operations. Our system is busybox based and doesn't
have both commands.

Thanx again - the info is very helpful

-----Original Message-----
From: Andreas Steffen [mailto:andreas.steffen at strongswan.org] 
Sent: Monday, May 30, 2011 7:16 PM
To: Goshen, Ido (Ido)
Cc: dev at lists.strongswan.org
Subject: Re: kernel SPD/SAD tool

Hi Ido,

- first, pluto is not supposed to crash. Please provide us with debug
  information so that we can fixed your problem.

- second, starter flushes all SPD/SAD entries in the kernel using
  starter_netkey_cleanup() after pluto and/or charon are terminated:

http://git.strongswan.org/?p=strongswan.git;a=blob;f=src/starter/starter
.c;h=d86da21b83f758c1824c312ede7f1caf42fd61a9;hb=HEAD#l429

http://git.strongswan.org/?p=strongswan.git;a=blob;f=src/starter/netkey.
c;h=e0449f0b2599f0c1a40c10f6428b8b6353507c87;hb=HEAD#l67

If you want to flush the SPD/SAD before starting pluto then insert
starter_netkey_cleanup() somewhere here:

http://git.strongswan.org/?p=strongswan.git;a=blob;f=src/starter/starter
.c;h=d86da21b83f758c1824c312ede7f1caf42fd61a9;hb=HEAD#l364

Regards

Andreas

On 05/30/2011 02:00 PM, Goshen, Ido (Ido) wrote:
> Hi Andreas,
> 
> Thanx for the quick response, and for exposing me to the "ip xfrm"
> option. I like it a lot better than mixing ipsec-tools setkey with
> StrongSWAN.
> 
> As you suggested I would rather not having to manually touch the
> SPD/SAD. But I'm having a problem when pluto crashes it leaves behind
> entries in the kernel that may break further negotiation after pluto
is
> restarted.
> More details were posted in:
> 1.
http://www.mail-archive.com/users@lists.strongswan.org/msg02447.html
> 2. https://lists.strongswan.org/pipermail/users/2011-May/006236.html
> 
> Is it known issue?
> 
> Any ideas how to fix/recover?
> 
> Thanx,
> - Ido
> 
> 
> 
> -----Original Message-----
> From: dev-bounces+igoshen=avaya.com at lists.strongswan.org
> [mailto:dev-bounces+igoshen=avaya.com at lists.strongswan.org] On Behalf
Of
> dev-request at lists.strongswan.org
> Sent: Monday, May 30, 2011 1:00 PM
> To: dev at lists.strongswan.org
> Subject: Dev Digest, Vol 16, Issue 5
> 
> Send Dev mailing list submissions to
> 	dev at lists.strongswan.org
> 
> To subscribe or unsubscribe via the World Wide Web, visit
> 	https://lists.strongswan.org/mailman/listinfo/dev
> or, via email, send a message with subject or body 'help' to
> 	dev-request at lists.strongswan.org
> 
> You can reach the person managing the list at
> 	dev-owner at lists.strongswan.org
> 
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Dev digest..."
> 
> 
> Today's Topics:
> 
>    1. kernel SPD/SAD tool (Goshen, Ido (Ido))
>    2. Re: kernel SPD/SAD tool (Andreas Steffen)
> 
> 
> ----------------------------------------------------------------------
> 
> Message: 1
> Date: Mon, 30 May 2011 10:07:43 +0200
> From: "Goshen, Ido (Ido)" <igoshen at avaya.com>
> Subject: [strongSwan-dev] kernel SPD/SAD tool
> To: <dev at lists.strongswan.org>
> Message-ID:
> 	
>
<EDC652A26FB23C4EB6384A4584434A04032BC954 at 307622ANEX5.global.avaya.com>
> 	
> Content-Type: text/plain; charset="us-ascii"
> 
> Hi,
> 
>  
> 
> Does StrongSWAN supply a shell tool like "setkey" from ipsec-tools to
> monitor and/or manipulate the kernel's SPD/SAD or it's all done
> programmatically via hydra (netlink plugin in my case)?
> 
>  
> 
> Thanx,
> 
> -        Ido
> 
>  
> 
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL:
>
http://lists.strongswan.org/pipermail/dev/attachments/20110530/55a852a3/
> attachment-0001.html 
> 
> ------------------------------
> 
> Message: 2
> Date: Mon, 30 May 2011 11:50:21 +0200
> From: Andreas Steffen <andreas.steffen at strongswan.org>
> Subject: Re: [strongSwan-dev] kernel SPD/SAD tool
> To: "Goshen, Ido (Ido)" <igoshen at avaya.com>
> Cc: dev at lists.strongswan.org
> Message-ID: <4DE3685D.9050003 at strongswan.org>
> Content-Type: text/plain; charset=windows-1252; format=flowed
> 
> Hi Ido,
> 
> strongSwan manages the kernel SPD/SAD via the XFRM Netlink kernel
> interface. The built-in "ipsec statusall" command can be used to
> monitor the established IPsec SAs but if you want to see all the
> details you can also use "setkey" or "ip xfrm state|policy".
> 
> If you manipulate SPD/SAD entries via "setkey" or "ip xfrm" then you
> are on your own since strongSwan will not be aware of any such
changes.
> 
> Regards
> 
> Andreas
> 
> On 05/30/2011 10:07 AM, Goshen, Ido (Ido) wrote:
>> Hi,
>>
>> Does StrongSWAN supply a shell tool like ?setkey? from ipsec-tools to
>> monitor and/or manipulate the kernel?s SPD/SAD or it?s all done
>> programmatically via hydra (netlink plugin in my case)?
>>
>> Thanx,
>>
>> -Ido
>>
> 
======================================================================
Andreas Steffen                         andreas.steffen at strongswan.org
strongSwan - the Linux VPN Solution!                www.strongswan.org
Institute for Internet Technologies and Applications
University of Applied Sciences Rapperswil
CH-8640 Rapperswil (Switzerland)
===========================================================[ITA-HSR]==