[Openswan Users] Connection against a Lucent FW, again....
Rolando Zappacosta
zappacor at yahoo.com.ar
Sat Aug 2 15:32:16 EDT 2008
Hi all,
I was trying to get connected to a Lucent VPN Gateway some time ago but I couldn't. Now, I added some lines to get debug information from the code and found the openswan's computed hash definitevilly doesn't match the one received for the ISAKMP's packet from the GW during phase 1 when it should.
The secret is definetivelly OK as even the hex dump when I activate the pluto debug shows it correctly. What can be the reason for OSW not computing the hash properly?
One thing I saw sniffing the Lucent VPN Client/Windoze is Lucent sends the three ISAKMP messages for phase unencrypted (Flags=0), may it be the reason?
Background info: I changed two parts of ipsec_doi.c:
1) in main_mode_hash:
{
struct hmac_ctx ctx;
hmac_init_chunk(&ctx, st->st_oakley.hasher, st->st_skeyid);
main_mode_hash_body(st, hashi, idpl, &ctx.hash_ctx, ctx.h->hash_update);
DBG_dump("ISSUE_main_mode_hash 2:", hash_val, 20);
hmac_final(hash_val, &ctx);
DBG_dump("ISSUE_main_mode_hash 1:", hash_val, 20);
return ctx.hmac_digest_len;
}
2) in oakley_id_and_auth:
/* Hash the ID Payload.
* main_mode_hash requires idpl->cur to be at end of payload
* so we temporarily set if so.
*/
{
pb_stream *idpl = &md->chain[ISAKMP_NEXT_ID]->pbs;
u_int8_t *old_cur = idpl->cur;
idpl->cur = idpl->roof;
DBG_dump("ISSUE_oakley_id_and_auth (3): hash_val, 20 is:", hash_val, 20 );
hash_len = main_mode_hash(st, hash_val, !initiator, idpl);
DBG_dump("ISSUE_oakley_id_and_auth (2): hash_val, hash_len is:", hash_val, hash_len );
idpl->cur = old_cur;
}
switch (st->st_oakley.auth)
{
case OAKLEY_PRESHARED_KEY:
{
pb_stream *const hash_pbs = &md->chain[ISAKMP_NEXT_HASH]->pbs;
if (pbs_left(hash_pbs) != hash_len
|| memcmp(hash_pbs->cur, hash_val, hash_len) != 0)
{
DBG_cond_dump(DBG_CRYPT, "received HASH:"
, hash_pbs->cur, pbs_left(hash_pbs));
loglog(RC_LOG_SERIOUS, "received Hash Payload does not match computed value");
openswan_log("ISSUE_oakley_id_and_auth (Info): pbs_left(hash_pbs)=%d and hash_len=%d\n", (int)pbs_left(hash_pbs), (int)hash_l
en );
DBG_dump("ISSUE_oakley_id_and_auth (1): hash_val, hash_len is:", hash_val, hash_len );
DBG_dump("ISSUE_oakley_id_and_auth (0): The received hash (hash_pbs->cur, hash_len) is:", hash_pbs->cur, hash_len );
/* XXX Could send notification back */
r = STF_FAIL + INVALID_HASH_INFORMATION;
}
}
and this is what I got:
RJZ-LNX ~ # ipsec auto --up Intranet
112 "Intranet" #1: STATE_AGGR_I1: initiate
003 "Intranet" #1: ignoring unknown Vendor ID payload [4c5647392e322e3234353a425249434b3a392e322e323435]
003 "Intranet" #1: received Hash Payload does not match computed value
223 "Intranet" #1: STATE_AGGR_I1: INVALID_HASH_INFORMATION
Aug 2 21:27:57 RJZ-LNX pluto[18220]: |
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | *received whack message
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | processing connection Intranet
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | empty esp_info, returning empty
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | creating state object #1 at 0x94df800
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | processing connection Intranet
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | ICOOKIE: 92 b7 eb b3 0a ef 11 8d
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | RCOOKIE: 00 00 00 00 00 00 00 00
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | peer: 87 f4 1f fe
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | state hash entry 6
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | inserting event EVENT_SO_DISCARD, timeout in 0 seconds for #1
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | using transform (5,2,2,0)
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | initiating aggressive mode with IKE=E=5-H=2-M=2
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | Queuing pending Quick Mode with <GW IP address> "Intranet"
Aug 2 21:27:57 RJZ-LNX pluto[18220]: "Intranet" #1: initiating Aggressive Mode #1, connection "Intranet"
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | helper -1 doing build_kenonce op id: 0
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | processing connection Intranet
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | using transform (5,2,2,0)
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | sending 372 bytes for aggr_outI1 through eth1:500 to <GW IP address>:500:
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | inserting event EVENT_RETRANSMIT, timeout in 10 seconds for #1
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | complete state transition with STF_IGNORE
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | next event EVENT_RETRANSMIT in 10 seconds for #1
Aug 2 21:27:57 RJZ-LNX pluto[18220]: |
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | *received 308 bytes from <GW IP address>:500 on eth1 (port=500)
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | processing packet with exchange type=ISAKMP_XCHG_AGGR (4)
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | ICOOKIE: 92 b7 eb b3 0a ef 11 8d
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | RCOOKIE: 30 e2 75 4e c9 f1 ea 6d
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | peer: 87 f4 1f fe
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | state hash entry 28
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | state object not found
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | ICOOKIE: 92 b7 eb b3 0a ef 11 8d
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | RCOOKIE: 00 00 00 00 00 00 00 00
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | peer: 87 f4 1f fe
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | state hash entry 6
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | peer and cookies match on #1, provided msgid 00000000 vs 00000000
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | state object #1 found, in STATE_AGGR_I1
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | processing connection Intranet
Aug 2 21:27:57 RJZ-LNX pluto[18220]: "Intranet" #1: ignoring unknown Vendor ID payload [4c5647392e322e3234353a425249434b3a392e322e323435]
Aug 2 21:27:57 RJZ-LNX pluto[18220]: "Intranet" #1: Aggressive mode peer ID is ID_IPV4_ADDR: '<GW IP address>'
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | offered CA: '%none'
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | started looking for secret for !@#$%-><GW IP address> of kind PPK_PSK
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | actually looking for secret for !@#$%-><GW IP address> of kind PPK_PSK
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | 1: compared PSK <GW IP address> to !@#$% / <GW IP address> -> 2
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | 2: compared PSK !@#$% to !@#$% / <GW IP address> -> 6
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | best_match 0>6 best=0x94dea78 (line=1)
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | concluding with best_match=6 best=0x94dea78 (lineno=1)
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | ICOOKIE: 92 b7 eb b3 0a ef 11 8d
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | RCOOKIE: 00 00 00 00 00 00 00 00
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | peer: 87 f4 1f fe
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | state hash entry 6
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | ICOOKIE: 92 b7 eb b3 0a ef 11 8d
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | RCOOKIE: 30 e2 75 4e c9 f1 ea 6d
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | peer: 87 f4 1f fe
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | state hash entry 28
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | started looking for secret for !@#$%-><GW IP address> of kind PPK_PSK
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | actually looking for secret for !@#$%-><GW IP address> of kind PPK_PSK
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | 1: compared PSK <GW IP address> to !@#$% / <GW IP address> -> 2
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | 2: compared PSK !@#$% to !@#$% / <GW IP address> -> 6
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | best_match 0>6 best=0x94dea78 (line=1)
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | concluding with best_match=6 best=0x94dea78 (lineno=1)
Aug 2 21:27:57 RJZ-LNX pluto[18220]: "Intranet" #1: Aggressive mode peer ID is ID_IPV4_ADDR: '<GW IP address>'
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | ISSUE_oakley_id_and_auth (3): hash_val, 20 is:
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | 4d f1 3e ac d6 d0 18 f1 bc 55 31 df e9 85 01 13
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | c0 7c 99 fd
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | ISSUE_main_mode_hash 2:
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | 4d f1 3e ac d6 d0 18 f1 bc 55 31 df e9 85 01 13
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | c0 7c 99 fd
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | ISSUE_main_mode_hash 1:
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | 85 f0 a3 9d 4a a9 f3 d2 4d 07 3e 3a 40 31 9b ba
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | a6 91 e1 f2
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | ISSUE_oakley_id_and_auth (2): hash_val, hash_len is:
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | 85 f0 a3 9d 4a a9 f3 d2 4d 07 3e 3a 40 31 9b ba
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | a6 91 e1 f2
Aug 2 21:27:57 RJZ-LNX pluto[18220]: "Intranet" #1: received Hash Payload does not match computed value
Aug 2 21:27:57 RJZ-LNX pluto[18220]: "Intranet" #1: ISSUE_oakley_id_and_auth (Info): pbs_left(hash_pbs)=20 and hash_len=20
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | ISSUE_oakley_id_and_auth (1): hash_val, hash_len is:
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | 85 f0 a3 9d 4a a9 f3 d2 4d 07 3e 3a 40 31 9b ba
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | a6 91 e1 f2
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | ISSUE_oakley_id_and_auth (0): The received hash (hash_pbs->cur, hash_len) is:
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | 29 c8 a0 be 06 76 5f de cd 0e e3 f7 f2 f9 f6 b1
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | 4f 13 7e 3a
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | complete state transition with (null)
Aug 2 21:27:57 RJZ-LNX pluto[18220]: "Intranet" #1: sending notification INVALID_HASH_INFORMATION to <GW IP address>:500
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | sending 40 bytes for notification packet through eth1:500 to <GW IP address>:500:
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | state transition function for STATE_AGGR_I1 failed: INVALID_HASH_INFORMATION
Aug 2 21:27:57 RJZ-LNX pluto[18220]: | next event EVENT_PENDING_PHASE2 in 74 seconds
More information about the Users
mailing list