[strongSwan] IKE_SA established despite no corresponding configuration.

Krishna G, Suhas (Nokia - IN/Bangalore) suhas.krishna_g at nokia.com
Thu Sep 24 08:57:07 CEST 2015


Hi,


I am facing a peculiar issue in Strongswan-4.3.6. I have a connection setup something like:

                      Con1                                     Con2
Node1---------------------DUT-----------------------Node2
77.0.0.1-----------------77.0.0.2--------------------77.0.0.4

My ipsec configuration on DUT(Device Under Test) is as follows:

# ipsec.conf
# FlexiPlatform: IPsec configuration file

config setup
        charonstart=yes
        plutostart=no
        uniqueids=no
        charondebug="knl 0,enc 0,net 0"
conn %default
        auto=route
        keyexchange=ikev2
        reauth=no
ca r1~v1
        cacert="/etc/ipsec/certs/ipsec.d//cacerts/defaultCaCertificate.pem"
conn r1~v1
        rekeymargin=70
        rekeyfuzz=100%
        left=77.0.0.2
        right=77.0.0.4
        leftsubnet=77.0.0.2/32
        rightsubnet=0.0.0.0/32
        leftprotoport=17/100
        rightprotoport=17/20
        authby=rsasig
        leftcert="/etc/ipsec/certs/ipsec.d//certs/defaultCertificate.pem"
        leftid=77.0.0.2
        rightid=%any
        ike=aes128-sha1-modp1024!
        esp=aes128-sha1!
        type=tunnel
        ikelifetime=1000s
        keylife=700s
        mobike=no
        auto=route
        reauth=no
        encapdscp=yes
        vrfid=0

Note that I have no ipsec for Con1. Even so, if Node1 initiates an IKE_SA establishment, DUT obliges it and establishes IKE_SA.
IPSec Conf on Node1 is:

# ipsec.conf
# FlexiPlatform: IPsec configuration file

config setup
        charonstart=yes
        plutostart=no
        uniqueids=no
        charondebug="knl 0,enc 0,net 0"
conn %default
        auto=route
        keyexchange=ikev2
        reauth=no
ca r1~v1
        cacert="/etc/ipsec/certs/ipsec.d//cacerts/defaultCaCertificate.pem"
conn r1~v1
        rekeymargin=70
        rekeyfuzz=100%
        left=77.0.0.1
        right=77.0.0.2
        leftsubnet=77.0.0.1/32
        rightsubnet=0.0.0.0/32
        authby=rsasig
        leftcert="/etc/ipsec/certs/ipsec.d//certs/defaultCertificate.pem"
        leftid=77.0.0.1
        rightid=%any
        ike=aes128-sha1-modp1024!
        esp=aes128-sha1!
        type=tunnel
        ikelifetime=1000s
        keylife=700s
        mobike=no
        auto=route
        reauth=no
        encapdscp=yes
        vrfid=0

IPSec status  for Node1(name: EIPU-0) and DUT(name: EIPU-1) are as below:

[root at EIPU-0(BCN126) /root]
# ipsec statusall
Status of IKEv2 charon daemon (strongSwan 4.3.6):
  uptime: 6 hours, since Aug 31 09:26:49 2015
  worker threads: 9 idle of 16, job queue load: 0, scheduled events: 2
  loaded plugins: openssl random pem x509 pubkey pkcs1 hmac xcbc stroke kernel-netlink sqlite attr-sql
Listening IP addresses:
  169.254.64.5
  169.254.0.6
  169.254.0.41
  77.0.0.1
  66.0.0.1
Connections:
       r1~v1:  77.0.0.1...77.0.0.2, vpn: (null)
       r1~v1:   local:  [C=de, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP, CN=ATCA_host, E=gianluigi.ongaro at nsn.com<mailto:E=gianluigi.ongaro at nsn.com>] uses public key authentication
       r1~v1:    cert:  "C=de, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP, CN=ATCA_host, E=gianluigi.ongaro at nsn.com<mailto:E=gianluigi.ongaro at nsn.com>"
       r1~v1:   remote: [(vr*)%any] uses any authentication
       r1~v1:   child:  77.0.0.1/32 === 0.0.0.0/0
Routed Connections:
       r1~v1{1}:  ROUTED, TUNNEL
       r1~v1{1}:   77.0.0.1/32 === 0.0.0.0/0
Security Associations:
       r1~v1[5]: ESTABLISHED 77.0.0.1[C=de, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP, CN=ATCA_host, E=gianluigi.ongaro at nsn.com]...77.0.0.2[C=de<mailto:E=gianluigi.ongaro at nsn.com]...77.0.0.2[C=de>, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP, CN=ATCA_host, E=gianluigi.ongaro at nsn.com<mailto:E=gianluigi.ongaro at nsn.com>]
       r1~v1[5]: IKE SPIs: a901f915e60cee17_i* 36facd6ae173128c_r Creation time: 3 minutes ago
, rekeying in 11 minutes
       r1~v1[5]: IKE proposal: AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024

[root at EIPU-0(BCN126) /root]
# ip xfrm policy
0.0.0.0/0[0] 77.0.0.1/32[0]
        upspec 0 dev (none) uid 0
        in  allow index 0x00000198 priority 3000 share any flags 0x00000000
        tmpl-1:
          77.0.0.2 77.0.0.1
                esp spi 0(0x00000000) reqid 1 tunnel
                level required share any algo-mask:E=32, A=32, C=32
        fpid 0x00000014
        policy type main
77.0.0.1/32[0] 0.0.0.0/0[0]
        upspec 0 dev (none) uid 0
        out allow index 0x00000191 priority 2680 share any flags 0x00000000
        tmpl-1:
          77.0.0.1 77.0.0.2
                esp spi 0(0x00000000) reqid 1 tunnel
                level required share any algo-mask:E=32, A=32, C=32
        fpid 0x00000013
        policy type main

[root at EIPU-1(BCN126) /root]
# ipsec statusall
Status of IKEv2 charon daemon (strongSwan 4.3.6):
  uptime: 29 minutes, since Aug 31 15:37:14 2015
  worker threads: 9 idle of 16, job queue load: 0, scheduled events: 2
  loaded plugins: openssl random pem x509 pubkey pkcs1 hmac xcbc stroke kernel-netlink sqlite attr-sql
Listening IP addresses:
  169.254.64.6
  169.254.0.8
  169.254.0.40
  169.254.0.39
  77.0.0.2
  66.0.0.2
Connections:
       r1~v1:  77.0.0.2...77.0.0.4, vpn: (null)
       r1~v1:   local:  [C=de, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP, CN=ATCA_host, E=gianluigi.ongaro at nsn.com<mailto:E=gianluigi.ongaro at nsn.com>] uses public key authentication
       r1~v1:    cert:  "C=de, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP, CN=ATCA_host, E=gianluigi.ongaro at nsn.com<mailto:E=gianluigi.ongaro at nsn.com>"
       r1~v1:   remote: [(vr*)%any] uses any authentication
       r1~v1:   child:  77.0.0.2/32[udp/100] === 0.0.0.0/0[udp/ftp-data]
Routed Connections:
       r1~v1{1}:  ROUTED, TUNNEL
       r1~v1{1}:   77.0.0.2/32[udp/100] === 0.0.0.0/0[udp/ftp-data]
Security Associations:
       r1~v1[2]: ESTABLISHED 77.0.0.2[C=de, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP, CN=ATCA_host, E=gianluigi.ongaro at nsn.com]...77.0.0.1[C=de<mailto:E=gianluigi.ongaro at nsn.com]...77.0.0.1[C=de>, ST=Bayern, L=Munich, O=Nokia Siemens Networks, OU=RTP, CN=ATCA_host, E=gianluigi.ongaro at nsn.com<mailto:E=gianluigi.ongaro at nsn.com>]
       r1~v1[2]: IKE SPIs: a901f915e60cee17_i 36facd6ae173128c_r* Creation time: 12 minutes ago
, rekeying in 3 minutes
       r1~v1[2]: IKE proposal: AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024

[root at EIPU-1(BCN126) /root]
# ip xfrm policy
0.0.0.0/0[20] 77.0.0.2/32[100]
        upspec 17 dev (none) uid 0
        in  allow index 0x00000208 priority 2997 share any flags 0x00000000
        tmpl-1:
          77.0.0.4 77.0.0.2
                esp spi 0(0x00000000) reqid 1 tunnel
                level required share any algo-mask:E=32, A=32, C=32
        fpid 0x0000001a
        policy type main
77.0.0.2/32[100] 0.0.0.0/0[20]
        upspec 17 dev (none) uid 0
        out allow index 0x00000201 priority 2677 share any flags 0x00000000
        tmpl-1:
          77.0.0.2 77.0.0.4
                esp spi 0(0x00000000) reqid 1 tunnel
                level required share any algo-mask:E=32, A=32, C=32
        fpid 0x00000019
        policy type main



The root CA for Node1, DUT and Node2 are the same. Node1 has a valid certificate.

My suspicion is that "right" field in the ipsec.conf is never checked while establishing a connection. And since rightid=%any, IKE_SA is getting established. If I change rightid to specific IP address on the DUT, IKE_SA authentication fails and connection is not established.

Is this a bug in strongswan-4.3.6? This seems to be fixed in higher versions.

Regards
Suhas

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20150924/1df625f5/attachment-0001.html>


More information about the Users mailing list