[strongSwan] using 500/tcp

Harald Dunkel harald.dunkel at aixigo.de
Thu Jul 21 09:47:12 CEST 2016 

Hi Tobias,

On 07/20/16 17:03, Tobias Brunner wrote:
> Hi Harald,
> 
> As you noticed the IKE_AUTH packet is the one that's problematic.  But
> since Mac OS X supports IKEv2 fragmentation
> 
>>         Notify (IKEv2 Fragmentation Supported) Payload:
>>         No Data
> 
> there is really no reason not to enable it (unless you use an old
> strongSwan version that does not support it yet).
> 

AFAIU defragmentation is enabled in strongswan for incoming packages,
anyway. I have enabled fragmentation explicitly yesterday (Stronswan 5.5.0).
Unfortunately it didn't help. MacOS does fragment the package, using an MTU
of 1500. My IPv6 tunnel supports 1280 only. Apparently IKEv2 on MacOS
ignores the icmp6 "package too big" pointing to the path MTU of 1280 bytes.

tcpdump:

19:56:21.292979 a4:d1:8c:e5:e8:50 > 80:ee:73:95:c1:0d, ethertype IPv6 (0x86dd), length 494: (flowlabel 0xc48b1, hlim 64, next-header UDP (17) payload length: 440) 2001:db8:0:1:c1a8:d747:f5f0:d411.500 > 2001:db8:0:2::63.500: [udp sum ok] isakmp 2.0 msgid 00000000: parent_sa ikev2_init[I]:
    (sa: len=44
        (p: #1 protoid=isakmp transform=4 len=44
            (t: #1 type=encr id=aes (type=keylen value=0100))
            (t: #2 type=prf id=#5 )
            (t: #3 type=integ id=#12 )
            (t: #4 type=dh id=modp2048 )))
    (v2ke: len=256 group=modp2048)
    (nonce: len=16 data=(147c7063b0f6df32a2ed...5d770b5d54400a6763c60e23000000080000402e))
    (n: prot_id=#0 type=16406(status))
    (n: prot_id=#0 type=16388(nat_detection_source_ip))
    (n: prot_id=#0 type=16389(nat_detection_destination_ip))
    (n: prot_id=#0 type=16430(status))
19:56:21.350933 80:ee:73:95:c1:0d > a4:d1:8c:e5:e8:50, ethertype IPv6 (0x86dd), length 595: (flowlabel 0xc5feb, hlim 54, next-header UDP (17) payload length: 541) 2001:db8:0:2::63.500 > 2001:db8:0:1:c1a8:d747:f5f0:d411.500: [udp sum ok] isakmp 2.0 msgid 00000000: parent_sa ikev2_init[R]:
    (sa: len=44
        (p: #1 protoid=isakmp transform=4 len=44
            (t: #1 type=encr id=aes (type=keylen value=0100))
            (t: #2 type=integ id=#12 )
            (t: #3 type=prf id=#5 )
            (t: #4 type=dh id=modp2048 )))
    (v2ke: len=256 group=modp2048)
    (nonce: len=32 data=(62d400bb1e01b7821568...00000014882fe56d6fd20dbc2251613b2ebe5beb))
    (n: prot_id=#0 type=16388(nat_detection_source_ip))
    (n: prot_id=#0 type=16389(nat_detection_destination_ip))
    (v2cr: len=61)
    (n: prot_id=#0 type=16430(status))
    (n: prot_id=#0 type=16404(status))
    (v2vid: len=16 vid=./.mo..."Qa;..[.)
19:56:21.450731 a4:d1:8c:e5:e8:50 > 80:ee:73:95:c1:0d, ethertype IPv6 (0x86dd), length 1318: (flowlabel 0x6067d, hlim 64, next-header UDP (17) payload length: 1264) 2001:db8:0:1:c1a8:d747:f5f0:d411.4500 > 2001:db8:0:2::63.4500: [udp sum ok] NONESP-encap: isakmp 2.0 msgid 00000001: child_sa  ikev2_auth[I]:
    (#53) [|v2IDi]
19:56:21.450799 a4:d1:8c:e5:e8:50 > 80:ee:73:95:c1:0d, ethertype IPv6 (0x86dd), length 1318: (flowlabel 0x6067d, hlim 255, next-header UDP (17) payload length: 1264) 2001:db8:0:1:c1a8:d747:f5f0:d411.4500 > 2001:db8:0:2::63.4500: [udp sum ok] NONESP-encap: isakmp 2.0 msgid 00000001: child_sa  ikev2_auth[I]:
    (#53)
19:56:21.450858 a4:d1:8c:e5:e8:50 > 80:ee:73:95:c1:0d, ethertype IPv6 (0x86dd), length 198: (flowlabel 0x6067d, hlim 255, next-header UDP (17) payload length: 144) 2001:db8:0:1:c1a8:d747:f5f0:d411.4500 > 2001:db8:0:2::63.4500: [udp sum ok] NONESP-encap: isakmp 2.0 msgid 00000001: child_sa  ikev2_auth[I]:
    (#53)
19:56:21.452772 80:ee:73:95:c1:0d > a4:d1:8c:e5:e8:50, ethertype IPv6 (0x86dd), length 1294: (hlim 64, next-header ICMPv6 (58) payload length: 1240) 2001:db8:0:1::2 > 2001:db8:0:1:c1a8:d747:f5f0:d411: [icmp6 sum ok] ICMP6, packet too big, mtu 1280
19:56:21.452775 80:ee:73:95:c1:0d > a4:d1:8c:e5:e8:50, ethertype IPv6 (0x86dd), length 1294: (hlim 64, next-header ICMPv6 (58) payload length: 1240) 2001:db8:0:1::2 > 2001:db8:0:1:c1a8:d747:f5f0:d411: [icmp6 sum ok] ICMP6, packet too big, mtu 1280
19:56:40.108295 a4:d1:8c:e5:e8:50 > 80:ee:73:95:c1:0d, ethertype IPv6 (0x86dd), length 494: (flowlabel 0x1f858, hlim 64, next-header UDP (17) payload length: 440) 2001:db8:0:1:c1a8:d747:f5f0:d411.500 > 2001:db8:0:2::63.500: [udp sum ok] isakmp 2.0 msgid 00000000: parent_sa ikev2_init[I]:
    (sa: len=44
        (p: #1 protoid=isakmp transform=4 len=44
            (t: #1 type=encr id=aes (type=keylen value=0100))
            (t: #2 type=prf id=#5 )
            (t: #3 type=integ id=#12 )
            (t: #4 type=dh id=modp2048 )))
    (v2ke: len=256 group=modp2048)
    (nonce: len=16 data=(cad5dbc58dc400cca047...77aa80e0a5adad9503cbb20d000000080000402e))
    (n: prot_id=#0 type=16406(status))
    (n: prot_id=#0 type=16388(nat_detection_source_ip))
    (n: prot_id=#0 type=16389(nat_detection_destination_ip))
    (n: prot_id=#0 type=16430(status))
19:56:40.167134 80:ee:73:95:c1:0d > a4:d1:8c:e5:e8:50, ethertype IPv6 (0x86dd), length 595: (flowlabel 0xc5feb, hlim 54, next-header UDP (17) payload length: 541) 2001:db8:0:2::63.500 > 2001:db8:0:1:c1a8:d747:f5f0:d411.500: [udp sum ok] isakmp 2.0 msgid 00000000: parent_sa ikev2_init[R]:
    (sa: len=44
        (p: #1 protoid=isakmp transform=4 len=44
            (t: #1 type=encr id=aes (type=keylen value=0100))
            (t: #2 type=integ id=#12 )
            (t: #3 type=prf id=#5 )
            (t: #4 type=dh id=modp2048 )))
    (v2ke: len=256 group=modp2048)
    (nonce: len=32 data=(ac40a31794e880f6c345...00000014882fe56d6fd20dbc2251613b2ebe5beb))
    (n: prot_id=#0 type=16388(nat_detection_source_ip))
    (n: prot_id=#0 type=16389(nat_detection_destination_ip))
    (v2cr: len=61)
    (n: prot_id=#0 type=16430(status))
    (n: prot_id=#0 type=16404(status))
    (v2vid: len=16 vid=./.mo..."Qa;..[.)
19:56:40.244848 a4:d1:8c:e5:e8:50 > 80:ee:73:95:c1:0d, ethertype IPv6 (0x86dd), length 198: (flowlabel 0x6883d, hlim 255, next-header UDP (17) payload length: 144) 2001:db8:0:1:c1a8:d747:f5f0:d411.4500 > 2001:db8:0:2::63.4500: [udp sum ok] NONESP-encap: isakmp 2.0 msgid 00000001: child_sa  ikev2_auth[I]:
    (#53)
19:56:40.298766 80:ee:73:95:c1:0d > a4:d1:8c:e5:e8:50, ethertype IPv6 (0x86dd), length 1286: (flowlabel 0x698f7, hlim 54, next-header UDP (17) payload length: 1232) 2001:db8:0:2::63.4500 > 2001:db8:0:1:c1a8:d747:f5f0:d411.4500: [udp sum ok] NONESP-encap: isakmp 2.0 msgid 00000001: child_sa  ikev2_auth[R]:
    (#53) [|v2IDr]
19:56:40.299479 80:ee:73:95:c1:0d > a4:d1:8c:e5:e8:50, ethertype IPv6 (0x86dd), length 1286: (flowlabel 0x698f7, hlim 54, next-header UDP (17) payload length: 1232) 2001:db8:0:2::63.4500 > 2001:db8:0:1:c1a8:d747:f5f0:d411.4500: [udp sum ok] NONESP-encap: isakmp 2.0 msgid 00000001: child_sa  ikev2_auth[R]:
    (#53)
19:56:40.300929 80:ee:73:95:c1:0d > a4:d1:8c:e5:e8:50, ethertype IPv6 (0x86dd), length 1286: (flowlabel 0x698f7, hlim 54, next-header UDP (17) payload length: 1232) 2001:db8:0:2::63.4500 > 2001:db8:0:1:c1a8:d747:f5f0:d411.4500: [udp sum ok] NONESP-encap: isakmp 2.0 msgid 00000001: child_sa  ikev2_auth[R]:
    (#53)
19:56:40.301629 80:ee:73:95:c1:0d > a4:d1:8c:e5:e8:50, ethertype IPv6 (0x86dd), length 742: (flowlabel 0x698f7, hlim 54, next-header UDP (17) payload length: 688) 2001:db8:0:2::63.4500 > 2001:db8:0:1:c1a8:d747:f5f0:d411.4500: [udp sum ok] NONESP-encap: isakmp 2.0 msgid 00000001: child_sa  ikev2_auth[R]:
    (#53)
19:57:03.883877 a4:d1:8c:e5:e8:50 > 80:ee:73:95:c1:0d, ethertype IPv6 (0x86dd), length 146: (flowlabel 0x6883d, hlim 255, next-header UDP (17) payload length: 92) 2001:db8:0:1:c1a8:d747:f5f0:d411.4500 > 2001:db8:0:2::63.4500: [udp sum ok] NONESP-encap: isakmp 2.0 msgid 00000002: child_sa  inf2[I]:
    (v2e: len=48)
19:57:03.904657 80:ee:73:95:c1:0d > a4:d1:8c:e5:e8:50, ethertype IPv6 (0x86dd), length 146: (flowlabel 0x698f7, hlim 54, next-header UDP (17) payload length: 92) 2001:db8:0:2::63.4500 > 2001:db8:0:1:c1a8:d747:f5f0:d411.4500: [udp sum ok] NONESP-encap: isakmp 2.0 msgid 00000002: child_sa  inf2[R]:
    (v2e: len=48)
19:57:03.904688 a4:d1:8c:e5:e8:50 > 80:ee:73:95:c1:0d, ethertype IPv6 (0x86dd), length 194: (hlim 64, next-header ICMPv6 (58) payload length: 140) 2001:db8:0:1:c1a8:d747:f5f0:d411 > 2001:db8:0:2::63: [icmp6 sum ok] ICMP6, destination unreachable, unreachable port, 2001:db8:0:1:c1a8:d747:f5f0:d411 udp port 4500


Please note the delay. The Mac stops trying, i.e. I have to click on
[Connect] again. IMU MacOS should have recognized the icmp6 p-t-b
and retried immediately, this time with a proper fragmentation.

Using tcp the icmp6 p-t-b could have been handled on a lower network
layer, hiding the fragmentation issues from the IKEv2 implementation.
Since 4500/udp is used for many (unrelated) functions I understand the
concerns against 4500/tcp.

Looking at this it appears to me that there is nothing I could do on
the strongswan side. :-(

>> Once the MTU is known the IKEv2 negotiations work very well. I tried
>> to ping6 the peer with -s 1500 before initiating the IPsec connection,
>> but this did not help.
> 
> You might have to use the -m option on Mac OS X as it looks like the
> packet will otherwise be fragmented at 1280 bytes (minimum IPv6 MTU).
> Afterwards you can check the cached PMTU with `ip route get <IP>` on
> Linux, and on Mac OS X `netstat -f inet6 -narl` should show the MTU for
> cached routes.
> 

I was too blind to see. I will try.


Thanx very much
Harri

More information about the Users mailing list