[Swan] How to let "PLUTO_PEER_PROTOCOL" and "PLUTO_MY_PROTOCOL" to be 17 (UDP) ?

[Paul Wouters]

See leftprotoport= and rightprotopprt= described in the ipsec.conf man page

Sent from my iPhone

> On Nov 1, 2015, at 12:38, ChenHao <earthlovepython at outlook.com> wrote:
> 
> Hi All:
> 
> /var/log/pluto.log writes:
> =========================
> | peer client is fd6f:d30:1bb6:b419::1
> 
> | peer client protocol/port is 17/0
> 
> | our client is fd1d:d30:1bb6:b419::1
> 
> | our client protocol/port is 17/0
> 
> "ip6.tun0" #113: the peer proposed: fd1d:d30:1bb6:b419::1/128:0/0 -> fd6f:d30:1bb6:b419::1/128:0/0
> 
> | find_client_connection starting with ip6.tun0
> 
> |   looking for fd1d:d30:1bb6:b419::1/128:17/0 -> fd6f:d30:1bb6:b419::1/128:17/0
> 
> 
> 
> Because "0/0" is NOT "17/0", find_client_connection() return NULL. As a result, quick_inI1_outR1_authtail() fail "cannot respond to IPsec SA request because no connection is known for" && "sending encrypted notification INVALID_ID_INFORMATION to"
> 
> 
> 
> Question:  how to set local protocol to 17 (UDP) instead of 0? 
> 
> 
> 
> 
> 
> 
> 
> Corresponding source code:
> 
> ==================
> 
> quick_inI1_outR1_authtail()
> 
> {
> 
> ……
> 
>                                 libreswan_log("the peer proposed: %s:%d/%d -> %s:%d/%d",
> 
>                                                       s1, c->spd.this.protocol, c->spd.this.port,      ç== “spd” is “struct spd_route”
> 
>                                                       d1, c->spd.that.protocol, c->spd.that.port);
> 
> ……
> 
> }
> 
>  
> 
> quick_inI1_outR1_authtail() calls find_client_connection()
> 
>  
> 
> find_client_connection()
> 
> {
> 
> ….
> 
>                                 DBG_log("  looking for %s:%d/%d -> %s:%d/%d",
> 
>                                                 s1, our_protocol, our_port,
> 
>                                                 d1, peer_protocol, peer_port);
> 
> ….
> 
>                                                 if (samesubnet(&sr->this.client, our_net) &&
> 
>                                                                 samesubnet(&sr->that.client, peer_net) &&
> 
>                                                                 sr->this.protocol == our_protocol &&    ç== Does NOT match. “sr” is “struct spd_route”. As a result, failed.
> 
>                                                                 (!sr->this.port ||
> 
>                                                                                 sr->this.port == our_port) &&
> 
>                                                                 (sr->that.protocol == peer_protocol) &&
> 
>                                                                 (!sr->that.port ||
> 
>                                                                                 sr->that.port == peer_port)) {
> 
>                                                                 passert(oriented(*c));
> 
>                                                                 if (routed(sr->routing))
> 
>                                                                                 return c;    ç == We expect return here, but ….
> 
>  
> 
>                                                                 unrouted = c;
> 
>                                                 }
> 
> ….
> 
> }
> 
>  
> 
> “spd.this.protocol” is same as “sr->this.protocol”
> 
> 
> 
> 
> 
> 
> 
> 
> 
> _______________________________________________
> Swan mailing list
> Swan at lists.libreswan.org
> https://lists.libreswan.org/mailman/listinfo/swan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.libreswan.org/pipermail/swan/attachments/20151101/5a7e7458/attachment.html>