Como depurar as regras do ip xfrm

Navegue suas respostas
3

Eu criei as regras do ip xfrm em duas máquinas e tentando passar o tráfego pelo túnel ipsec. O pacote chega ao outro lado, criptografado e desaparece.

Eu os tracei através do iptables, e aqui está o traço. 

2015-11-27T14:50:21.442638+04:30 cfae kernel: [70234.667488] TRACE: raw:PREROUTING:policy:2 IN=eth0 OUT= MAC=00:0c:29:b7:97:49:00:0c:29:42:5b:e1:08:00 SRC=172.24.1.178 DST=10.60.60.31 LEN=128 TOS=0x00 PREC=0x00 TTL=61 ID=0 DF PROTO=UDP SPT=4500 DPT=4500 LEN=108 
2015-11-27T14:50:21.442665+04:30 cfae kernel: [70234.667513] TRACE: mangle:PREROUTING:rule:2 IN=eth0 OUT= MAC=00:0c:29:b7:97:49:00:0c:29:42:5b:e1:08:00 SRC=172.24.1.178 DST=10.60.60.31 LEN=128 TOS=0x00 PREC=0x00 TTL=61 ID=0 DF PROTO=UDP SPT=4500 DPT=4500 LEN=108 
2015-11-27T14:50:21.442672+04:30 cfae kernel: [70234.667580] TRACE: mangle:INPUT:policy:1 IN=eth0 OUT= MAC=00:0c:29:b7:97:49:00:0c:29:42:5b:e1:08:00 SRC=172.24.1.178 DST=10.60.60.31 LEN=128 TOS=0x00 PREC=0x00 TTL=61 ID=0 DF PROTO=UDP SPT=4500 DPT=4500 LEN=108 
2015-11-27T14:50:21.442674+04:30 cfae kernel: [70234.667589] TRACE: filter:INPUT:policy:1 IN=eth0 OUT= MAC=00:0c:29:b7:97:49:00:0c:29:42:5b:e1:08:00 SRC=172.24.1.178 DST=10.60.60.31 LEN=128 TOS=0x00 PREC=0x00 TTL=61 ID=0 DF PROTO=UDP SPT=4500 DPT=4500 LEN=108 
2015-11-27T14:50:21.471390+04:30 cfae kernel: [70234.696166] TRACE: raw:PREROUTING:policy:2 IN=eth0 OUT= MAC=00:0c:29:b7:97:49:00:0c:29:42:5b:e1:08:00 SRC=172.24.1.178 DST=10.60.60.31 LEN=128 TOS=0x00 PREC=0x00 TTL=61 ID=0 DF PROTO=UDP SPT=4500 DPT=4500 LEN=108 
2015-11-27T14:50:21.471401+04:30 cfae kernel: [70234.696184] TRACE: mangle:PREROUTING:rule:2 IN=eth0 OUT= MAC=00:0c:29:b7:97:49:00:0c:29:42:5b:e1:08:00 SRC=172.24.1.178 DST=10.60.60.31 LEN=128 TOS=0x00 PREC=0x00 TTL=61 ID=0 DF PROTO=UDP SPT=4500 DPT=4500 LEN=108 
2015-11-27T14:50:21.471408+04:30 cfae kernel: [70234.696225] TRACE: mangle:INPUT:policy:1 IN=eth0 OUT= MAC=00:0c:29:b7:97:49:00:0c:29:42:5b:e1:08:00 SRC=172.24.1.178 DST=10.60.60.31 LEN=128 TOS=0x00 PREC=0x00 TTL=61 ID=0 DF PROTO=UDP SPT=4500 DPT=4500 LEN=108 
2015-11-27T14:50:21.471409+04:30 cfae kernel: [70234.696234] TRACE: filter:INPUT:policy:1 IN=eth0 OUT= MAC=00:0c:29:b7:97:49:00:0c:29:42:5b:e1:08:00 SRC=172.24.1.178 DST=10.60.60.31 LEN=128 TOS=0x00 PREC=0x00 TTL=61 ID=0 DF PROTO=UDP SPT=4500 DPT=4500 LEN=108 
2015-11-27T14:50:21.695777+04:30 cfae kernel: [70234.920757] TRACE: raw:PREROUTING:policy:2 IN=eth0 OUT= MAC=00:0c:29:b7:97:49:00:0c:29:42:5b:e1:08:00 SRC=172.24.1.178 DST=10.60.60.31 LEN=128 TOS=0x00 PREC=0x00 TTL=61 ID=0 DF PROTO=UDP SPT=4500 DPT=4500 LEN=108 
2015-11-27T14:50:21.695801+04:30 cfae kernel: [70234.920804] TRACE: mangle:PREROUTING:rule:2 IN=eth0 OUT= MAC=00:0c:29:b7:97:49:00:0c:29:42:5b:e1:08:00 SRC=172.24.1.178 DST=10.60.60.31 LEN=128 TOS=0x00 PREC=0x00 TTL=61 ID=0 DF PROTO=UDP SPT=4500 DPT=4500 LEN=108 
2015-11-27T14:50:21.695808+04:30 cfae kernel: [70234.920847] TRACE: mangle:INPUT:policy:1 IN=eth0 OUT= MAC=00:0c:29:b7:97:49:00:0c:29:42:5b:e1:08:00 SRC=172.24.1.178 DST=10.60.60.31 LEN=128 TOS=0x00 PREC=0x00 TTL=61 ID=0 DF PROTO=UDP SPT=4500 DPT=4500 LEN=108 
2015-11-27T14:50:21.695810+04:30 cfae kernel: [70234.920875] TRACE: filter:INPUT:policy:1 IN=eth0 OUT= MAC=00:0c:29:b7:97:49:00:0c:29:42:5b:e1:08:00 SRC=172.24.1.178 DST=10.60.60.31 LEN=128 TOS=0x00 PREC=0x00 TTL=61 ID=0 DF PROTO=UDP SPT=4500 DPT=4500 LEN=108

A partir dos rastreamentos, vejo que o pacote está passando do filtro: INPUT de volta para raw: PREROUTING, o que significa que ele deve estar passando pelo processamento de lookup / decode do xfrm. Mas o pacote sai desse processamento inalterado (mesmo comprimento, mesmos endereços src / dst).

Mas "ip -s xfrm state" mostra 0 pacotes falidos / processados.

Existe alguma maneira de rastrear esses pacotes através do módulo xfrm? Ou existe uma maneira de habilitar a depuração para o xfrm?

Aqui está a configuração. 

    On Machine1: 
    # ip xfrm state
    src 10.60.60.31 dst 172.24.1.178
        proto esp spi 0x5fca3acb reqid 212013014 mode tunnel
        replay-window 0 
        auth-trunc hmac(sha512) 0xc2dde59416e78c96b9b0333686b3cf0b09016bb1c1d27215d3dbf7aca471304a1c25536eb2648b3dcd8946047007389d06eb3fb4c4e9379630acae51bd755b07 96
        enc cbc(aes) 0x944023fd181e13d401f80e2166654b549b758aeeb9f382a20ca967631b111ef0
        encap type espinudp sport 4500 dport 4500 addr 10.60.60.31
        sel src 0.0.0.0/0 dst 0.0.0.0/0 
    src 172.24.1.178 dst 10.60.60.31
        proto esp spi 0x5fca3acb reqid 212013014 mode tunnel
        replay-window 0 
        mark 212013014/0xffffffff
        auth-trunc hmac(sha512) 0xc2dde59416e78c96b9b0333686b3cf0b09016bb1c1d27215d3dbf7aca471304a1c25536eb2648b3dcd8946047007389d06eb3fb4c4e9379630acae51bd755b07 96
        enc cbc(aes) 0x944023fd181e13d401f80e2166654b549b758aeeb9f382a20ca967631b111ef0
        encap type espinudp sport 4500 dport 4500 addr 172.24.1.178
        sel src 0.0.0.0/0 dst 0.0.0.0/0 
    # ip xfrm policy
    src 0.0.0.0/0 dst 0.0.0.0/0 
        dir fwd priority 65535 
        tmpl src 10.60.60.31 dst 172.24.1.178
            proto esp spi 0x5fca3acb reqid 212013014 mode tunnel
            level use 
    src 0.0.0.0/0 dst 0.0.0.0/0 
        dir in priority 65535 
        tmpl src 10.60.60.31 dst 172.24.1.178
            proto esp spi 0x5fca3acb reqid 212013014 mode tunnel
            level use 
    src 0.0.0.0/0 dst 0.0.0.0/0 
        dir out priority 65535 
        mark 212013014/0xffffffff
        tmpl src 172.24.1.178 dst 10.60.60.31
            proto esp spi 0x5fca3acb reqid 212013014 mode tunnel
            level use 


    On Machine2:
    # ip xfrm policy
src 0.0.0.0/0 dst 0.0.0.0/0 
    dir fwd priority 65535 
    tmpl src 172.24.1.178 dst 10.60.60.31
        proto esp spi 0x5fca3acb reqid 212012972 mode tunnel
        level use 
src 0.0.0.0/0 dst 0.0.0.0/0 
    dir in priority 65535 
    tmpl src 172.24.1.178 dst 10.60.60.31
        proto esp spi 0x5fca3acb reqid 212012972 mode tunnel
        level use 
src 0.0.0.0/0 dst 0.0.0.0/0 
    dir out priority 65535 
    mark 212012972/0xffffffff
    tmpl src 10.60.60.31 dst 172.24.1.178
        proto esp spi 0x5fca3acb reqid 212012972 mode tunnel
        level use 
# ip xfrm state
src 172.24.1.178 dst 10.60.60.31
    proto esp spi 0x5fca3acb reqid 212012972 mode tunnel
    replay-window 0 
    auth-trunc hmac(sha512) 0xc2dde59416e78c96b9b0333686b3cf0b09016bb1c1d27215d3dbf7aca471304a1c25536eb2648b3dcd8946047007389d06eb3fb4c4e9379630acae51bd755b07 96
    enc cbc(aes) 0x944023fd181e13d401f80e2166654b549b758aeeb9f382a20ca967631b111ef0
    encap type espinudp sport 4500 dport 4500 addr 172.24.1.178
    sel src 0.0.0.0/0 dst 0.0.0.0/0 
src 10.60.60.31 dst 172.24.1.178
    proto esp spi 0x5fca3acb reqid 212012972 mode tunnel
    replay-window 0 
    mark 212012972/0xffffffff
    auth-trunc hmac(sha512) 0xc2dde59416e78c96b9b0333686b3cf0b09016bb1c1d27215d3dbf7aca471304a1c25536eb2648b3dcd8946047007389d06eb3fb4c4e9379630acae51bd755b07 96
    enc cbc(aes) 0x944023fd181e13d401f80e2166654b549b758aeeb9f382a20ca967631b111ef0
    encap type espinudp sport 4500 dport 4500 addr 10.60.60.31
    sel src 0.0.0.0/0 dst 0.0.0.0/0
    
por Sindhura Bandi 27.11.2015 / 11:51

2 respostas

2

Para depurar o xfrm, você pode usar o comando ip xfrm monitor .

Ele mostrará as alterações na política do banco de dados. E mostrará o processamento de cada pacote de dados.

    
por 15.12.2016 / 15:50
0

link

Parece que o kernel do Linux não decapsula os pacotes sem alguma instrução. Precisamos nos ligar a um soquete na porta udp de entrada e habilitar o encapsulamento udp. O link acima tem o script perl para fazer isso. Depois disso, meu tráfego está funcionando sem problemas.

    
por 28.11.2015 / 04:50

Tags

Como exigir que todas as atividades de rede passem por um firewall guest KVM antes de chegar ao host? Redirecionar todos os subdomínios para o domínio principal com HTTPS sem um certificado curinga (nginx)