1

We're having some IPSec connection problems that seem connected to the UDP checksum beeing (incorrectly) set with some ISPs.
To investigate further, I want to reproduce the error within a controlled environment.
Now, I do not know what the ISP does exactly so I'd like to manipulate UDP packets directly to reproduce a given scenario (UDP checksum missing, set correctly and set incorrectly).

The client: A linux machine with some tools (perl, iptables, gnu tools, bash, tcpdump)
The server: A freeBSD based machine with almost no tools (bash, pf, tcpdump)

I want to test how the server reacts with different UDP checksum situations.
Since it doesn't have much tools, I figured the easiest way to reproduce these situations would be from the linux client.
I know there is the possibility to set the UDP checksum using the mangle table.
That only allows me to correctly set the UDP checksum.

How do I forge the UDP checksum of packets to be either nonexistent, correctly set or incorrectly set?

Any ideas on how to reproduce these scenarios - maybe in a different way - are also welcome in the comments.

2
  • You'll probably have to write raw packets. But you should at least install tcpdump on the BSD box, otherwise you're going to have a bad time. Jul 20, 2020 at 16:32
  • tcpdump is available luckily :) I added it to the tools list. I also added the information that the traffic we're having problems with is IPSec. Sadly, it's not the phase 1 port 500/udp packets but the phase 2 4500/udp packets that we're having problems with. I don't know how to write raw packets that will be accepted on the BSD machine.
    – wullxz
    Jul 21, 2020 at 8:25

1 Answer 1

1

I found a way to hook a python script into the mangle table and alter the packets using that python script. The performance is understandably quite slow but for a testing purpose sufficient.

The python3 script looks like this (using scapy and NetfilterQueue):

from netfilterqueue import NetfilterQueue as nfqueue
from scapy.all import *
import os

iptablesr = 'iptables -t mangle -A POSTROUTING -p udp --dport 4500 -j NFQUEUE --queue-num 1'
print("Adding iptable rules: ")
print(iptablesr)
os.system(iptablesr)
def alter_callback(packet):
  print("=======================")
  pkt = IP(packet.get_payload())
  pkt.show2()

  udp = pkt.getlayer(UDP)

  del pkt.chksum
  #del udp.chksum
  udp.chksum = 0x111 # set udp checksum to something else

  pkt.show2()

  print("=======================")
  packet.set_payload(bytes(pkt))
  packet.accept()

def main():
  q = nfqueue()
  q.bind(1, alter_callback)
  try:
    q.run()
  except KeyboardInterrupt:
    q.unbind()
    print("Flushing iptables.")
    os.system("iptables -t mangle -F")

if __name__ == "__main__":
  main()

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .