Linux 内核中的 IPsec - 如何弄清楚发生了什么
我正在为微控制器编写一个 IPsec 实现，我想使用运行 Debian Lenny 的标准 Linux 盒子来测试它。两个设备都应在隧道模式下使用 IPsec ESP 来保护它们之间的通信。这些按键是使用 setkey 手动设置的。处理 IPsec 数据包时不涉及（或至少不应该）用户空间程序。现在我想看看 Linux 内核如何处理我创建的数据包。为了查看原始数据包，我使用 tcpdump 捕获它们，并使用 wireshark 分析它们。
- 获取有关 IPsec 处理的调试信息的最佳方法是什么？
- 如何判断数据包是否被内核接受？
- 如何查看丢包原因？
I'm writing an IPsec implementation for a microcontroller and I want to test it using a standard Linux box running Debian Lenny. Both devices should secure the communication between them using IPsec ESP in tunnel mode. The keys are setup manually using setkey. There's no (or at least should be no) user space program involved in processing an IPsec packet. Now I want to see how my created packets are processed by the Linux kernel. To see the raw packets I capture them using tcpdump and analyze them using wireshark.
- What's the best way to obtain debug information about IPsec processing?
- How can I figure out whether the packet is accepted by the kernel?
- How can I view the reason for a packet to be dropped?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您可以检测 XFRM（或者可能是 ipv4/esp.c）内核代码，以便在正确的位置打印出调试消息。
例如，在
net/ipv4/esp.c中，存在一个函数esp_input()，它有一些错误情况，但您会发现最有趣的东西在xfrm/*.c代码。也就是说，我在自定义 IPSec 与 Linux 的互操作方面没有遇到问题。遵循 43xx 规范并通过wireshark验证数据包是否正确输出似乎效果很好。如果您遇到问题并且不想检测内核，那么您可以设置 iptables 规则并计算每个点的（各种类型）数据包的数量。
最后，确保您实际上已添加安全策略 (SP) 和安全关联 (SA) 并正确设置防火墙规则。
You can instrument the XFRM (or perhaps
ipv4/esp.c) kernel code to print out debug messages at the right spots.For example, in
net/ipv4/esp.cthere exists a functionesp_input()which has some error cases, but you'll see most the interesting stuff is in thexfrm/*.ccode.That said, I didn't have a problem interoperating a custom IPSec with Linux. Following the 43xx specs and verifying the packets came out correctly via wireshark seemed to do well. If you're having issues and don't want to instrument the kernel then you can setup iptables rules and count the number of (various type of) packets at each point.
Finally, be sure you've actually added a security policy (SP) as well as a security association (SA) and setup firewall rules properly.