Administrace komentářů

Zkoušel jsem ping a chová se normálně, to jest prakticky ihned mu jádro zakáže packet odeslat:

$ ping -c1 -W1 -w1 -B -n -v 147.251.23.28
PING 147.251.23.28 (147.251.23.28) from 147.251.23.20 : 56(84) bytes of data.
ping: sendmsg: Operation not permitted

--- 147.251.23.28 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms

A odpovídající protokol racoonu při pokusu o ping:

Nov 19 10:23:34 album racoon: INFO: IPsec-SA request for 147.251.23.28 queued due to no phase1 found.
Nov 19 10:23:34 album racoon: INFO: initiate new phase 1 negotiation: 147.251.23.20[500]<=>147.251.23.28[500]
Nov 19 10:23:34 album racoon: INFO: begin Identity Protection mode.
Nov 19 10:23:34 album racoon: phase1(ident I msg1): 0.000780

a po chvíli:

Nov 19 10:24:05 album racoon: ERROR: phase2 negotiation failed due to time up waiting for phase1. ESP 147.251.23.28[0]->147.251.23.20[0] 
Nov 19 10:24:05 album racoon: INFO: delete phase 2 handler.
Nov 19 10:24:24 album racoon: ERROR: phase1 negotiation failed due to time up. 77584602df8e38cf:0000000000000000

Takhle vypadá moje politika:

# Test to dead end point
spdadd -4 147.251.23.20 147.251.23.28 any -P out prio def + 100 ipsec
   esp/transport//require
   ah/transport//require;
spdadd -4 147.251.23.28 147.251.23.20 any -P in prio def + 100 ipsec
   esp/transport//require
   ah/transport//require;

a takhle konfigurace IKE:

#remote anonymous
remote 147.251.23.19
{
        exchange_mode main,aggressive;
        #exchange_mode aggressive,main;
        #doi ipsec_doi;
        #situation identity_only;

    ca_type x509 "ipsec-ca.crt";
        my_identifier asn1dn;
    certificate_type x509 "album-racoon.crt" "album-racoon.key";
    peers_identifier asn1dn;
    peers_certfile x509 "router-racoon.crt";
    verify_identifier on;

        #generate_policy on;

        lifetime time 1 hour;   # sec,min,hour
        initial_contact on;
        proposal_check obey;    # obey, strict or claim

        proposal {
                encryption_algorithm 3des;
                hash_algorithm sha1;
                #hash_algorithm md5;
                #authentication_method pre_shared_key;
                authentication_method rsasig;
                dh_group modp1024;
        }
}

# Test to dead end point
remote 147.251.23.28 inherit 147.251.23.19
{}

Používám jádro 2.6.31-gentoo-r6 a ipsec-tools-0.7.3. Pinganý stroj je směrován jako link-local a žádný takový neexistuje.

TCP klient (např. telnet) se chová tak, že se pokouší ustanovit spojení, dokud nevyprší limit TCP na sestavování spojení (spí uvnitř connect(2)).