When sending SCTP traffic over and IPv6 IPsec tunnel the SCTP packets are transmitted unencrypted. It seems that these packets are being ignored by ipsec/kernel. Recreation: 1. Set up and IPv6 IPsec tunnel using any configuration tools (This problem was seen with both Racoon and Racoon2. Other people have seen this with OpenSwan) 2. Send SCTP traffic from Host A to Host B. 3. Using wireshark detect if the packets are encrypted or if the sctp packets are unencrypted. Notes: - When IPsec is configured to encrypt all upper layer protocols the sctp connection does not initialize. After using wireshark to follow packets, this is because the SCTP packet leaves Box A unencrypted and Box B believes all upper layer protocols are to be encrypted so it drops this packet. Causing the SCTP connection to fail to initialize. - When IPsec is configured to encrypt just SCTP the SCTP packets are observed unencrypted.
I was wondering if there has been any additional investigation/work done on this issue. A few people have emailed me offline asking me if I have fixed this or know the status of the issue. Is there anything else I can do or provide to help with this bug?
I can sort of reproduce this with simple setkey(8) file and socat invocations.
IPv4 works while IPv6 doesn't.
IPv4 tcpdump socat sctp-listen:3333 - echo plaintext | socat - sctp-connect:$IP:3333 and it works (first socat prints "plaintext" and exists) 22:14:20.809645 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 116) 192.168.0.2 > 192.168.0.5: AH(spi=0x00000042,sumlen=16,seq=0x1): ESP(spi=0x00000044,seq=0x1), length 72 22:14:20.813270 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 340) 192.168.0.5 > 192.168.0.2: AH(spi=0x00000043,sumlen=16,seq=0x1): ESP(spi=0x00000045,seq=0x1), length 296 22:14:20.813834 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 308) 192.168.0.2 > 192.168.0.5: AH(spi=0x00000042,sumlen=16,seq=0x2): ESP(spi=0x00000044,seq=0x2), length 264 22:14:20.813920 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 84) 192.168.0.5 > 192.168.0.2: AH(spi=0x00000043,sumlen=16,seq=0x2): ESP(spi=0x00000045,seq=0x2), length 40 22:14:20.814330 IP (tos 0x2,ECT(0), ttl 64, id 1, offset 0, flags [DF], proto AH (51), length 108) 192.168.0.2 > 192.168.0.5: AH(spi=0x00000042,sumlen=16,seq=0x3): ESP(spi=0x00000044,seq=0x3), length 64 22:14:20.814379 IP (tos 0x2,ECT(0), ttl 64, id 5721, offset 0, flags [DF], proto AH (51), length 92) 192.168.0.5 > 192.168.0.2: AH(spi=0x00000043,sumlen=16,seq=0x3): ESP(spi=0x00000045,seq=0x3), length 48 22:14:20.814709 IP (tos 0x2,ECT(0), ttl 64, id 2, offset 0, flags [DF], proto AH (51), length 84) 192.168.0.2 > 192.168.0.5: AH(spi=0x00000042,sumlen=16,seq=0x4): ESP(spi=0x00000044,seq=0x4), length 40 22:14:20.814745 IP (tos 0x2,ECT(0), ttl 64, id 5722, offset 0, flags [DF], proto AH (51), length 84) 192.168.0.5 > 192.168.0.2: AH(spi=0x00000043,sumlen=16,seq=0x4): ESP(spi=0x00000045,seq=0x4), length 40 22:14:20.815062 IP (tos 0x2,ECT(0), ttl 64, id 3, offset 0, flags [DF], proto AH (51), length 84) 192.168.0.2 > 192.168.0.5: AH(spi=0x00000042,sumlen=16,seq=0x5): ESP(spi=0x00000044,seq=0x5), length 40
IPv6 tcpdump socat sctp6-listen:3333 - [socat maybe doesn't have option to setup sin6_scope_id, so a simple program was written instead] and it doesn't work 22:31:16.212810 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::92e6:baff:fe0d:5a54 > ff02::1:ff87:7fc: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has fe80::222:15ff:fe87:7fc source link-address option (1), length 8 (1): 90:e6:ba:0d:5a:54 0x0000: 90e6 ba0d 5a54 22:31:16.212907 IP6 (hlim 255, next-header AH (51) payload length: 80) fe80::222:15ff:fe87:7fc > fe80::92e6:baff:fe0d:5a54: AH(spi=0x00000043,sumlen=16,seq=0x1): ESP(spi=0x00000045,seq=0x1), length 56 22:31:16.213299 IP6 (class 0x02, hlim 64, next-header AH (51) payload length: 120) fe80::92e6:baff:fe0d:5a54 > fe80::222:15ff:fe87:7fc: AH(spi=0x00000042,sumlen=16,seq=0x1): ESP(spi=0x00000044,seq=0x1), length 96 22:31:16.213423 IP6 (class 0x02, hlim 64, next-header SCTP (132) payload length: 364) fe80::222:15ff:fe87:7fc.3333 > fe80::92e6:baff:fe0d:5a54.36767: sctp 1) [INIT ACK] [init tag: 1875304899] [rwnd: 62464] [OS: 10] [MIS: 10] [init TSN: 131147491] 22:31:19.214962 IP6 (class 0x02, hlim 64, next-header AH (51) payload length: 120) fe80::92e6:baff:fe0d:5a54 > fe80::222:15ff:fe87:7fc: AH(spi=0x00000042,sumlen=16,seq=0x2): ESP(spi=0x00000044,seq=0x2), length 96 22:31:19.215029 IP6 (class 0x02, hlim 64, next-header SCTP (132) payload length: 364) fe80::222:15ff:fe87:7fc.3333 > fe80::92e6:baff:fe0d:5a54.36767: sctp 1) [INIT ACK] [init tag: 747759530] [rwnd: 62464] [OS: 10] [MIS: 10] [init TSN: 310556273] 22:31:19.340499 IP (tos 0x0, ttl 64, id 5200, offset 0, flags [none], proto UDP (17), length 197) 192.168.0.1.8099 > 239.255.0.1.9303: [udp sum ok] UDP, length 169 22:31:21.212624 IP6 (hlim 255, next-header AH (51) payload length: 80) fe80::222:15ff:fe87:7fc > fe80::92e6:baff:fe0d:5a54: AH(spi=0x00000043,sumlen=16,seq=0x2): ESP(spi=0x00000045,seq=0x2), length 56 22:31:21.213150 IP6 (hlim 255, next-header AH (51) payload length: 72) fe80::92e6:baff:fe0d:5a54 > fe80::222:15ff:fe87:7fc: AH(spi=0x00000042,sumlen=16,seq=0x3): ESP(spi=0x00000044,seq=0x3), length 48 22:31:25.235139 IP6 (class 0x02, hlim 64, next-header AH (51) payload length: 120) fe80::92e6:baff:fe0d:5a54 > fe80::222:15ff:fe87:7fc: AH(spi=0x00000042,sumlen=16,seq=0x4): ESP(spi=0x00000044,seq=0x4), length 96 22:31:25.235209 IP6 (class 0x02, hlim 64, next-header SCTP (132) payload length: 364) fe80::222:15ff:fe87:7fc.3333 > fe80::92e6:baff:fe0d:5a54.36767: sctp 1) [INIT ACK] [init tag: 3018255165] [rwnd: 62464] [OS: 10] [MIS: 10] [init TSN: 464808795] 22:31:29.341912 IP (tos 0x0, ttl 64, id 5557, offset 0, flags [none], proto UDP (17), length 197) 192.168.0.1.8100 > 239.255.0.1.9303: [udp sum ok] UDP, length 169 22:31:37.259513 IP6 (class 0x02, hlim 64, next-header AH (51) payload length: 120) fe80::92e6:baff:fe0d:5a54 > fe80::222:15ff:fe87:7fc: AH(spi=0x00000042,sumlen=16,seq=0x5): ESP(spi=0x00000044,seq=0x5), length 96 22:31:37.259583 IP6 (class 0x02, hlim 64, next-header SCTP (132) payload length: 364) fe80::222:15ff:fe87:7fc.3333 > fe80::92e6:baff:fe0d:5a54.36767: sctp 1) [INIT ACK] [init tag: 1733515857] [rwnd: 62464] [OS: 10] [MIS: 10] [init TSN: 2931534808]
LINUX_MIB_XFRMINTMPLMISMATCH is incremented at __xfrm_policy_check(): for (i = xfrm_nr-1, k = 0; i >= 0; i--) { k = xfrm_policy_ok(tpp[i], sp, k, family); if (k < 0) { if (k < -1) /* "-2 - errored_index" returned */ xerr_idx = -(2+k); XFRM_INC_STATS(net, LINUX_MIB_XFRMINTMPLMISMATCH); goto reject; } }
For some reason, skb->sp is NULL at sctp_v6_get_dst() which of course doesn't work: __xfrm_policy_check: skb->sp ffff880222e62000 __xfrm_policy_check: ->id.daddr :: __xfrm_policy_check: ->id.proto 50 __xfrm_policy_check: ->mode 0 __xfrm_policy_check: ->id.daddr :: __xfrm_policy_check: ->id.proto 51 __xfrm_policy_check: ->mode 0 __xfrm_policy_check: skb->sp ffff880222e62000 __xfrm_policy_check: ->id.daddr :: __xfrm_policy_check: ->id.proto 50 __xfrm_policy_check: ->mode 0 __xfrm_policy_check: ->id.daddr :: __xfrm_policy_check: ->id.proto 51 __xfrm_policy_check: ->mode 0 __xfrm_policy_check: skb->sp ffff880222e62000 __xfrm_policy_check: ->id.daddr :: __xfrm_policy_check: ->id.proto 50 __xfrm_policy_check: ->mode 0 __xfrm_policy_check: ->id.daddr :: __xfrm_policy_check: ->id.proto 51 __xfrm_policy_check: ->mode 0 __xfrm_policy_check: skb->sp ffff880222e62000 __xfrm_policy_check: ->id.daddr :: __xfrm_policy_check: ->id.proto 50 __xfrm_policy_check: ->mode 0 __xfrm_policy_check: ->id.daddr :: __xfrm_policy_check: ->id.proto 51 __xfrm_policy_check: ->mode 0 sctp_v6_get_dst: ENTER sctp_v6_get_dst: dst ffff880222e64900, asoc ffff880211c48000, saddr (null) __xfrm_policy_check: skb->sp (null) __xfrm_policy_check: ->id.daddr :: __xfrm_policy_check: ->id.proto 50 __xfrm_policy_check: ->mode 0 __xfrm_policy_check: ->id.daddr :: __xfrm_policy_check: ->id.proto 51 __xfrm_policy_check: ->mode 0 __xfrm_policy_check: 001, k -1
Fixed in: http://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=95ee62083cb6453e056562d91f597552021e6ae7
(In reply to Alexey Dobriyan from comment #5) > IPv6 tcpdump > > socat sctp6-listen:3333 - > [socat maybe doesn't have option to setup sin6_scope_id, so a simple program > was written instead] @alexey - can you, please, attach that simple program for ipv6?
RESOLVED FIXED in 3.12 commit 95ee62083cb6453e056562d91f597552021e6ae7 net: sctp: fix ipv6 ipsec encryption bug in sctp_v6_xmit