$Id: howto-pluto.txt,v 1.1.1.1 1999/10/26 17:19:15 sakane Exp $ %Hd: pluto (ISAKMP/oakley by finnish univ.) を BSDI/FreeBSD で動かす。 o pluto とは？ ISAKMP with Oakley の USA exportable な実装。 Main mode with pre-shared key のみをサポート。 ISAKMP Identity Protection Exchange Proposal はハードコーディング。 pre-shared key のみ設定可能。 o 動かす。 o gmp-2.0.2 を持ってくる。 libgmp.a, gmp.h が必要なので、適当にコピーし Makefile も書き換える。 o packet.h, sha1.c, md5.c で endian.h を見ている。 取り敢えず __NetBSD__ を Makefile で定義するか。 sys/endian.h を machine/endian.h に書き換えるか。 bsdi とか __FreeBSD__ の #ifdef を追加するか。 する。 o whack.c の INADDR_LOOPBACK IN_LOOPBACKNET とか (u_long)0x7f000001 に書き換える。 o constants.h の OAKLEY_ISAKMP_SA_LIFETIME を正しい値に定義する。 OAKLEY_ISAKMP_SA_LIFETIME を 1200 以上に定義するか。 OAKLEY_ISAKMP_SA_LIFETIME_MINIMUM を 60 以下にする。 o 画面３つ開いて、 % ./pluto 7500 % ./pluto 8000 % ./whack 7501 127.0.0.1 8000 encrypt o 動作 Phase 1 Main mode With a Pre-Shared Key のパケットを覗く。 initiator -> responder cookies = ccbf 3b93 3d45 773c 0000 0000 0000 0000 next payload = SA exchange type = Identity Protection flags = 0 message id = 0 length = 0x58 -- SA -- next payload = 0 length = 0x3c DOI = IPSEC situation = SIT_IDENTITY_ONLY -- Proposal -- next payload = 0 length = 0x30 proposal # = 1 protocol id = PROTO_ISAKMP SPI size = 8 # of transforms = 1 SPI = 0000 0100 0000 0000 -- Transform -- next payload = 0 length = 0x20 transform # = 1 transform id = KEY_OAKLEY AF = 1 attribute type = Encryption Algorithm attribute value = DES-CBC AF = 1 attribute type = Hash Algorithm attribute value = SHA AF = 1 attribute type = Authentication Method attribute value = pre-shared key AF = 1 attribute type = Group Description attribute value = default 768-bit MODP group (section 6.1) AF = 1 attribute type = Life Type attribute value = seconds AF = 1 attribute type = Life Duration attribute value = 0x0e10 responder -> initiator cookies = ccbf 3b93 3d45 773c 8b48 6ba0 29ff 49ae next payload = SA exchange type = Identity Protection flags = 0 message id = 0 length = 0x58 -- SA -- next payload = 0 length = 0x3c DOI = IPSEC situation = SIT_IDENTITY_ONLY -- Proposal -- next payload = 0 length = 0x30 proposal # = 1 protocol id = PROTO_ISAKMP SPI size = 8 # of transforms = 1 SPI = 0000 0100 0000 0000 -- Transform -- next payload = 0 length = 0x20 transform # = 1 transform id = KEY_OAKLEY AF = 1 attribute type = Encryption Algorithm attribute value = DES-CBC AF = 1 attribute type = Hash Algorithm attribute value = SHA AF = 1 attribute type = Authentication Method attribute value = pre-shared key AF = 1 attribute type = Group Description attribute value = default 768-bit MODP group (section 6.1) AF = 1 attribute type = Life Type attribute value = seconds AF = 1 attribute type = Life Duration attribute value = 0x0e10 initiator -> responder cookies = ccbf 3b93 3d45 773c 8b48 6ba0 29ff 49ae next payload = KE exchange type = Identity Protection flags = 0 message id = 0 length = 0x95 -- Key Exchange -- next payload = Nonce length = 0x65 DH public value = 00ef 282c a5b7 f30a 7ddd 5efe b6d7 b19f 8adb 92ac c0f0 602f 726e 6f52 45ad 3f94 caa2 381d 871a d2e3 7d02 ee3f 1376 27ef 2394 0479 c264 6228 768b c80a 2384 bfa0 a49d abc3 caaa 16fc 576a 35a1 7f05 6f76 6153 634f 9796 96fc 71a1 49b8 432a 31ae 39 -- Nonce -- next payload = 0 length = 0x14 data = 2f8e 1b2d 31c5 357b fe7c c423 3c55 9b92 responder -> initiator cookies = ccbf 3b93 3d45 773c 8b48 6ba0 29ff 49ae next payload = KE exchange type = Identity Protection flags = 0 message id = 0 length = 0x95 -- Key Exchange -- next payload = Nonce length = 0x65 DH public value = 00e0 f54a ba62 ab90 674a ddc6 ab5c 45ed 8bbc 74dd 33f7 2d5c e3d5 b6c3 e605 d81a 13b5 8919 dab1 f72e 095a f0d8 3823 e56f d81b 2b53 c47f 9bce 33e2 f5ce b7ac 7526 a4d3 2ae0 6ff1 a9b5 04c7 2274 9a1a f422 0d99 d8a1 14cc 3669 6a54 9657 407f 477a bf -- Nonce -- next payload = 0 length = 0x14 data = 1094 cf1b 173b 07b6 871f fe9b a416 3304 initiator -> responder cookies = ccbf 3b93 3d45 773c 8b48 6ba0 29ff 49ae next payload = ID exchange type = Identity Protection flags = encryption message id = 0 length = 0x44 -- Identification & Signature encrypted -- 82ba 6e5f 6b7e a925 db56 9518 a24c 32ca d094 0d45 4e11 d678 5cad b32a 2aa4 ca0a 6562 f88d 408f 92d0 responder -> initiator cookies = ccbf 3b93 3d45 773c 8b48 6ba0 29ff 49ae next payload = ID exchange type = Identity Protection flags = encryption message id = 0 length = 0x44 -- Identification & Signature encrypted -- f1df 5ec1 e7c5 e67e 1264 17ae 2cac 5d6d a1f5 c29d c79a 72ed e8c8 6fd9 de31 3d66 69c7 7c12 525a aeea Phase 2 Quick mode のパケットを覗く。 initiator -> responder cookies = ccbf 3b93 3d45 773c 8b48 6ba0 29ff 49ae next payload = HASH exchange type = Identity Protection flags = encryption message id = 01000000 length = 0x80 -- Hash & SA & Nonce encrypted -- b4d1 01f5 4a46 3d74 8ebf a77a 07f3 c866 3dd1 5308 f4db 4bfc 2108 9f00 500e 2d98 d36a 7afc 34d1 6028 a253 5dee 23ab 0412 e439 a6f9 8d38 42ef 9400 3fe0 2bc4 a016 f261 e237 5eb3 87c8 5830 e15f 654e 6868 a87c f2ec b62b d7a7 a8db 7d52 395a 1f46 ff2f ef9d responder -> initiator cookies = ccbf 3b93 3d45 773c 8b48 6ba0 29ff 49ae next payload = HASH exchange type = Identity Protection flags = encryption message id = 01000000 length = 0x7c -- Hash & SA & Nonce encrypted -- 7480 9806 1968 5de6 4e93 d2a9 b8d4 11b5 e9bc 7982 8bb0 ad94 33dc 8117 a7ea 550e e5ee fc25 fd51 b723 d2d4 c499 23b7 4f6f 5bad 249d cbba ee3e ba23 08e5 eee4 142c 073c 033e 7c47 9083 4e79 a0ff bb35 2bef c800 31fa 834b 6fe9 bb3e edd1 28d8 0f94 initiator -> responder cookies = ccbf 3b93 3d45 773c 8b48 6ba0 29ff 49ae next payload = HASH exchange type = Identity Protection flags = encryption message id = 01000000 length = 0x34 -- Hash encrypted -- 391f c320 09d6 7787 8435 d7f9 8443 aea9 8b43 d8e9 12ac 06f5 上の生ログ %tcddump -s 1500 -nqtxi lo0 tcpdump: listening on lo0 127.0.0.1.1129 > 127.0.0.1.7501: udp 20 4500 0030 4077 0000 4011 3c44 7f00 0001 7f00 0001 0469 1d4d 001c 3fba 0002 1f40 7f00 0001 0000 0000 0000 0000 0200 0000 127.0.0.1.7500 > 127.0.0.1.8000: udp 88 4500 0074 4078 0000 4011 3bff 7f00 0001 7f00 0001 1d4c 1f40 0060 ea97 ccbf 3b93 3d45 773c 0000 0000 0000 0000 0110 0200 0000 0000 0000 0058 0000 003c 0000 0001 0000 0001 0000 0030 0101 0801 0000 0100 0000 0000 0000 0020 0101 0000 8001 0001 8002 0002 8003 0001 8004 0001 800b 0001 800c 0e10 127.0.0.1.8000 > 127.0.0.1.7500: udp 88 4500 0074 4079 0000 4011 3bfe 7f00 0001 7f00 0001 1f40 1d4c 0060 8001 ccbf 3b93 3d45 773c 8b48 6ba0 29ff 49ae 0110 0200 0000 0000 0000 0058 0000 003c 0000 0001 0000 0001 0000 0030 0101 0801 0000 0100 0000 0000 0000 0020 0101 0000 8001 0001 8002 0002 8003 0001 8004 0001 800b 0001 800c 0e10 127.0.0.1.7500 > 127.0.0.1.8000: udp 149 4500 00b1 407a 0000 4011 3bc0 7f00 0001 7f00 0001 1d4c 1f40 009d cad4 ccbf 3b93 3d45 773c 8b48 6ba0 29ff 49ae 0410 0200 0000 0000 0000 0095 0a00 0065 00ef 282c a5b7 f30a 7ddd 5efe b6d7 b19f 8adb 92ac c0f0 602f 726e 6f52 45ad 3f94 caa2 381d 871a d2e3 7d02 ee3f 1376 27ef 2394 0479 c264 6228 768b c80a 2384 bfa0 a49d abc3 caaa 16fc 576a 35a1 7f05 6f76 6153 634f 9796 96fc 71a1 49b8 432a 31ae 3900 0000 142f 8e1b 2d31 c535 7bfe 7cc4 233c 559b 92 127.0.0.1.8000 > 127.0.0.1.7500: udp 149 4500 00b1 407b 0000 4011 3bbf 7f00 0001 7f00 0001 1f40 1d4c 009d 5a92 ccbf 3b93 3d45 773c 8b48 6ba0 29ff 49ae 0410 0200 0000 0000 0000 0095 0a00 0065 00e0 f54a ba62 ab90 674a ddc6 ab5c 45ed 8bbc 74dd 33f7 2d5c e3d5 b6c3 e605 d81a 13b5 8919 dab1 f72e 095a f0d8 3823 e56f d81b 2b53 c47f 9bce 33e2 f5ce b7ac 7526 a4d3 2ae0 6ff1 a9b5 04c7 2274 9a1a f422 0d99 d8a1 14cc 3669 6a54 9657 407f 477a bf00 0000 1410 94cf 1b17 3b07 b687 1ffe 9ba4 1633 04 127.0.0.1.7500 > 127.0.0.1.8000: udp 68 4500 0060 407c 0000 4011 3c0f 7f00 0001 7f00 0001 1d4c 1f40 004c 1288 ccbf 3b93 3d45 773c 8b48 6ba0 29ff 49ae 0510 0201 0000 0000 0000 0044 82ba 6e5f 6b7e a925 db56 9518 a24c 32ca d094 0d45 4e11 d678 5cad b32a 2aa4 ca0a 6562 f88d 408f 92d0 127.0.0.1.8000 > 127.0.0.1.7500: udp 68 4500 0060 407d 0000 4011 3c0e 7f00 0001 7f00 0001 1f40 1d4c 004c c880 ccbf 3b93 3d45 773c 8b48 6ba0 29ff 49ae 0510 0201 0000 0000 0000 0044 f1df 5ec1 e7c5 e67e 1264 17ae 2cac 5d6d a1f5 c29d c79a 72ed e8c8 6fd9 de31 3d66 69c7 7c12 525a aeea 127.0.0.1.7500 > 127.0.0.1.8000: udp 128 4500 009c 407e 0000 4011 3bd1 7f00 0001 7f00 0001 1d4c 1f40 0088 bf2f ccbf 3b93 3d45 773c 8b48 6ba0 29ff 49ae 0810 2001 0100 0000 0000 0080 b4d1 01f5 4a46 3d74 8ebf a77a 07f3 c866 3dd1 5308 f4db 4bfc 2108 9f00 500e 2d98 d36a 7afc 34d1 6028 a253 5dee 23ab 0412 e439 a6f9 8d38 42ef 9400 3fe0 2bc4 a016 f261 e237 5eb3 87c8 5830 e15f 654e 6868 a87c f2ec b62b d7a7 a8db 7d52 395a 1f46 ff2f ef9d 127.0.0.1.8000 > 127.0.0.1.7500: udp 124 4500 0098 407f 0000 4011 3bd4 7f00 0001 7f00 0001 1f40 1d4c 0084 5744 ccbf 3b93 3d45 773c 8b48 6ba0 29ff 49ae 0810 2001 0100 0000 0000 007c 7480 9806 1968 5de6 4e93 d2a9 b8d4 11b5 e9bc 7982 8bb0 ad94 33dc 8117 a7ea 550e e5ee fc25 fd51 b723 d2d4 c499 23b7 4f6f 5bad 249d cbba ee3e ba23 08e5 eee4 142c 073c 033e 7c47 9083 4e79 a0ff bb35 2bef c800 31fa 834b 6fe9 bb3e edd1 28d8 0f94 127.0.0.1.7500 > 127.0.0.1.8000: udp 52 4500 0050 4080 0000 4011 3c1b 7f00 0001 7f00 0001 1d4c 1f40 003c e9ae ccbf 3b93 3d45 773c 8b48 6ba0 29ff 49ae 0810 2001 0100 0000 0000 0034 391f c320 09d6 7787 8435 d7f9 8443 aea9 8b43 d8e9 12ac 06f5