Thursday, June 26, 2008

TCP MD5 debugging

Added CLI support for TCP MD5 (via Quagga) to the upcoming Vyatta release. It worked fine under testing (VM) but wouldn't operate with IOS. Reduced the problem down by making some useful utilities:
  • Patch for Netcat to support MD5
  • Standalone using libpcap to validate MD5 option in capture file
It turned out that the sender was generating wrong MD5 option after the initial SYN handshake. When data is finally sent, the problem is that the data in the kernel is fragmented because the underlying device supports scatter/gather but the md5_calc doesn't do scatter gather.

No comments: