ispec - PSK - issues

[Steve Clement]

Dear List,

I tried to setup a simple road warrior VPN setup for my MacOS machine and
found the following issue.

When using spaces in the pre-shared key the MacOS VPN client (racoon) cannot
connect, this might well be a MacOS issue, but still worth sharing.
(iOS is also playing funny, there I am more stable: iOS 9.3.2 - 13F69)


## OpenBSD vpn 6.0 GENERIC#1898 i386 (Snapshot 20 July 2016)
## Darwin Steves-13-inch-MacBook 16.0.0 Darwin Kernel Version 16.0.0: Sat Jul
9 23:23:38 PDT 2016; root:xnu-3777.0.0.0.1~27/RELEASE_X86_64 x86_64


ipsec.conf has this line:

ike passive esp transport proto udp from $public_ip to any port l2tp main auth
"hmac-sha2-256" enc "aes-256" group modp1024 quick auth "hmac-sha2-256" enc
"aes-256" psk “PSK"

Messages output (PSK NO SPACES):

Jul 25 16:07:02 vpn isakmpd[80810]: attribute_unacceptable: GROUP_DESCRIPTION:
got MODP_2048, expected MODP_1024
Jul 25 16:07:02 vpn isakmpd[80810]: attribute_unacceptable: HASH_ALGORITHM:
got SHA, expected SHA2_256
Jul 25 16:07:02 vpn isakmpd[80810]: attribute_unacceptable: HASH_ALGORITHM:
got MD5, expected SHA2_256
Jul 25 16:07:02 vpn isakmpd[80810]: attribute_unacceptable: HASH_ALGORITHM:
got SHA2_512, expected SHA2_256
Jul 25 16:07:02 vpn isakmpd[80810]: attribute_unacceptable: GROUP_DESCRIPTION:
got MODP_1536, expected MODP_1024
Jul 25 16:07:02 vpn isakmpd[80810]: attribute_unacceptable: HASH_ALGORITHM:
got SHA, expected SHA2_256
Jul 25 16:07:02 vpn isakmpd[80810]: attribute_unacceptable: HASH_ALGORITHM:
got MD5, expected SHA2_256
Jul 25 16:07:03 vpn npppd[51700]: l2tpd ctrl=13 logtype=Started RecvSCCRQ
from=85.93.205.98:51860/udp tunnel_id=13/48 protocol=1.0 winsize=4
hostname=Steves-13-inch-MacBook.office.lan vendor=(no vendorname) firm=0000
Jul 25 16:07:03 vpn npppd[51700]: l2tpd ctrl=13 call=25707 logtype=PPPBind
ppp=9
Jul 25 16:07:06 vpn npppd[51700]: ppp id=9 layer=base logtype=TUNNELSTART
user="steve" duration=3sec layer2=L2TP layer2from=85.93.205.98:51860
auth=MS-CHAP-V2 ip=10.0.0.129 iface=pppx0
Jul 25 16:07:06 vpn npppd[51700]: ppp id=9 layer=base Using pipex=yes

Failing line in ipsec.conf:

ike passive esp transport proto udp from $public_ip to any port l2tp main auth
"hmac-sha2-256" enc "aes-256" group modp1024 quick auth "hmac-sha2-256" enc
"aes-256" psk “PSK 2”

Messages output (PSK SPACES):

Jul 25 16:10:23 vpn isakmpd[80810]: attribute_unacceptable: GROUP_DESCRIPTION:
got MODP_2048, expected MODP_1024
Jul 25 16:10:23 vpn isakmpd[80810]: attribute_unacceptable: HASH_ALGORITHM:
got SHA, expected SHA2_256
Jul 25 16:10:23 vpn isakmpd[80810]: attribute_unacceptable: HASH_ALGORITHM:
got MD5, expected SHA2_256
Jul 25 16:10:23 vpn isakmpd[80810]: attribute_unacceptable: HASH_ALGORITHM:
got SHA2_512, expected SHA2_256
Jul 25 16:10:23 vpn isakmpd[80810]: attribute_unacceptable: GROUP_DESCRIPTION:
got MODP_1536, expected MODP_1024
Jul 25 16:10:23 vpn isakmpd[80810]: attribute_unacceptable: HASH_ALGORITHM:
got SHA, expected SHA2_256
Jul 25 16:10:23 vpn isakmpd[80810]: attribute_unacceptable: HASH_ALGORITHM:
got MD5, expected SHA2_256
Jul 25 16:10:23 vpn isakmpd[80810]: message_parse_payloads: reserved field
non-zero: af
Jul 25 16:10:23 vpn isakmpd[80810]: dropped message from 85.93.205.98 port
61021 due to notification type PAYLOAD_MALFORMED
Jul 25 16:10:26 vpn isakmpd[80810]: message_parse_payloads: reserved field
non-zero: af
Jul 25 16:10:26 vpn isakmpd[80810]: dropped message from 85.93.205.98 port
61021 due to notification type PAYLOAD_MALFORMED
Jul 25 16:10:30 vpn isakmpd[80810]: message_parse_payloads: reserved field
non-zero: af
Jul 25 16:10:30 vpn isakmpd[80810]: dropped message from 85.93.205.98 port
61021 due to notification type PAYLOAD_MALFORMED
Jul 25 16:10:33 vpn isakmpd[80810]: message_parse_payloads: reserved field
non-zero: af
Jul 25 16:10:33 vpn isakmpd[80810]: dropped message from 85.93.205.98 port
61021 due to notification type PAYLOAD_MALFORMED
Jul 25 16:10:45 vpn isakmpd[80810]: message_parse_payloads: reserved field
non-zero: af
Jul 25 16:10:45 vpn isakmpd[80810]: dropped message from 85.93.205.98 port
61021 due to notification type PAYLOAD_MALFORMED



I tried to connect my Nexus 5 with Android 6.0.1 but that plainly failed, no
clue what the correct config should be, so I haven’t reproduced it under the
Droid.

If someone is more passionate about this I can share some more logs. But
something works for me now and my patience wore thin.

Cheers,

--
Steve Clement
https://www.twitter.com/SteveClement
mailto:***@localhost.lu
.lu: [phone]

[demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

[Maurice Janssen]

Post by Steve Clement
I tried to connect my Nexus 5 with Android 6.0.1 but that plainly failed, no
clue what the correct config should be, so I haven???t reproduced it under the
Droid.

There seems to be an issue with Android 6.0.1 and L2TP/IPSEC connetions:
https://code.google.com/p/android/issues/detail?id=194269

[Steve Clement]

Your link talks more about 6.0

But this is probably it:
https://code.google.com/p/android/issues/detail?id=196939

Testing in Cyanogenmod would be next.

But the look and feel of all of these issues, I fear OpenVPN would have been
(perhaps less secure) but better to config and mostly use…

Darn those non-compliant peeps :)

I will test further once I recovered ;)

Thanks,

Post by Maurice Janssen

Post by Steve Clement
I tried to connect my Nexus 5 with Android 6.0.1 but that plainly failed,

no

Post by Maurice Janssen

Post by Steve Clement
clue what the correct config should be, so I haven???t reproduced it under

the

Post by Maurice Janssen

Post by Steve Clement
Droid.

https://code.google.com/p/android/issues/detail?id=194269
--
Maurice

--
Steve Clement
https://www.twitter.com/SteveClement
mailto:***@localhost.lu
.lu: [phone]

[demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

[Maurice Janssen]

Post by Steve Clement
Your link talks more about 6.0
https://code.google.com/p/android/issues/detail?id=196939

Yeah, that's the link I wanted to send. Somehow I managed to copy
the wrong link in my previous email.

Maurice

[Raul Miller]

Post by Maurice Janssen

Post by Steve Clement
https://code.google.com/p/android/issues/detail?id=196939

Yeah, that's the link I wanted to send. Somehow I managed to copy
the wrong link in my previous email.

I have been seeing a lot of copy&paste errors myself, where I
performed the keyboard action to trigger a copy but paste gives me
something from an older context.

I'm sure a lot of people put a lot of time into making things work this way...