Hello list,
I have a problem with an IPsec peer. My OpenBSD 4.1 responder (obsd in
the tcpdump below) doesn't reply to pings in the tunnel. The initiator
is an OpenBSD 4.1 appliance (not GENERIC kernel, but I don't think
that's the problem). There are two NATed hosts behind the peer-gw, and
one of them works fine. The len 160 packets are icmp echos btw.
The problematic peer is sending packets that gets TOS 0x3. If I
understand the ECN RFC correctly, this means the sending router has
set the Congestion Experienced codepoint, ie it is congested. I see
the point for TCP, but this is UDP, so I'm not sure what behaviour is
expected.
Is OpenBSD dropping these packets because of this?
If the sending gateway is broken I just need to get back with a good
explanation.
15:58:16.725725 peer-gw.19062 > obsd.4500: [no cksum] udpencap: esp
peer-gw > obsd spi 0x916EDE15 seq 1 len 132 [tos 0x3 (EC)] (ttl 51, id
1823, len 160)
15:58:19.737917 peer-gw.19062 > obsd.4500: [no cksum] udpencap: esp
peer-gw > obsd spi 0x916EDE15 seq 2 len 132 [tos 0x3 (EC)] (ttl 51, id
30812, len 160)
15:58:22.757857 peer-gw.19062 > obsd.4500: [no cksum] udpencap: esp
peer-gw > obsd spi 0x916EDE15 seq 3 len 132 [tos 0x3 (EC)] (ttl 51, id
29700, len 160)
15:58:25.778924 peer-gw.19062 > obsd.4500: [no cksum] udpencap: esp
peer-gw > obsd spi 0x916EDE15 seq 4 len 132 [tos 0x3 (EC)] (ttl 51, id
17471, len 160)
15:58:27.412816 peer-gw.22417 > obsd.4500: [no cksum] udpencap: esp
peer-gw > obsd spi 0x01CE4B59 seq 41 len 132 (ttl 51, id 60525, len 160)
15:58:27.412897 obsd.4500 > peer-gw.22417: [no cksum] udpencap: esp
obsd > peer-gw spi 0xDA9BB2EC seq 41 len 132 (ttl 64, id 20442, len 160)
15:58:28.799610 peer-gw.19062 > obsd.4500: [no cksum] udpencap: esp
peer-gw > obsd spi 0x916EDE15 seq 5 len 132 [tos 0x3 (EC)] (ttl 51, id
7672, len 160)
15:58:29.265331 peer-gw.22417 > obsd.4500: [udp sum ok] NAT-T
Keepalive (ttl 51, id 35799, len 29)
15:58:32.772233 peer-gw.19062 > obsd.4500: [udp sum ok] NAT-T
Keepalive [tos 0x3 (EC)] (ttl 51, id 11876, len 29)
15:58:36.919621 peer-gw.19062 > obsd.4500: [no cksum] udpencap: esp
peer-gw > obsd spi 0x916EDE15 seq 6 len 132 [tos 0x3 (EC)] (ttl 51, id
32119, len 160)
I'm trying to track down where these TOS bits are set, but have had no
luck yet.
tia
-martin
