Run

sudo sysctl net.ipv4.tcp_ecn=1

and tcpcrypt is no longer negotiated.

This is on x86, under Debian's Linux 2.6.37-1, running git 91cce74.

--Juliusz

Hello,

When a server running tcpcryptd restarts it while a tcpcrypt enabled client is connected through a web browser, further page loads hang. I'm not sure at this point exactly why, but I would guess that either (1) established connections have packets dropped without the connection closing or (2) new connections attempt to reuse key material and fail due to loss of key material on server end.

One real life scenario where the server process could change would be when moving between load balanced servers using the same IP. You would expect current tcp connections to drop and new ones be formed for any subsequent requests after such a switch.

Client log (-vvv) from point server tcpcryptd restarted:

Ignoring established connection: 192.168.2.18:52050->192.168.2.201:80 52 AF [out] tc (nil)
Ignoring established connection: 192.168.2.201:80->192.168.2.18:52050 52 AF [in] tc (nil)
Ignoring established connection: 192.168.2.18:52050->192.168.2.201:80 52 A [out] tc (nil)
192.168.2.18:50572->120.138.19.204:80 584 A [out] tc 0x9fc8108
120.138.19.204:80->192.168.2.18:50572 52 A [in] tc 0x9fc8108
MAC failed -1
Last ack for 0xb75140e6
Gotta malloc 8
Gotta malloc 8
192.168.2.18:52072->192.168.2.201:80 60 S [out] tc 0x9fcb418
Can't find session for host
192.168.2.201:80->192.168.2.18:52072 60 SA [in] tc 0x9fcb418
Ignoring established connection: 192.168.2.18:52072->192.168.2.201:80 52 A [out] tc (nil)
Ignoring established connection: 192.168.2.18:52072->192.168.2.201:80 481 A [out] tc (nil)
Ignoring established connection: 192.168.2.201:80->192.168.2.18:52072 52 A [in] tc (nil)
Ignoring established connection: 192.168.2.201:80->192.168.2.18:52072 1500 A [in] tc (nil)
Ignoring established connection: 192.168.2.201:80->192.168.2.18:52072 568 A [in] tc (nil)
Ignoring established connection: 192.168.2.18:52072->192.168.2.201:80 52 A [out] tc (nil)
Ignoring established connection: 192.168.2.18:52072->192.168.2.201:80 52 A [out] tc (nil)
192.168.2.18:50572->120.138.19.204:80 584 A [out] tc 0x9fc8108
120.138.19.204:80->192.168.2.18:50572 52 A [in] tc 0x9fc8108
MAC failed -1
Ignoring established connection: 192.168.2.18:52072->192.168.2.201:80 52 AF [out] tc (nil)
Ignoring established connection: 192.168.2.201:80->192.168.2.18:52072 52 AF [in] tc (nil)
Ignoring established connection: 192.168.2.18:52072->192.168.2.201:80 52 A [out] tc (nil)

Server log (-vvv) after restart:

Initializing...
Gotta malloc 1384
Generating RSA keys
Generating RSA key: 2048 bits
Done generating RSA keys
Gotta malloc 16
Buffer size 2097152 wanted 1048576
Divert packets using iptables -j NFQUEUE --queue-num 666
Running
Ignoring established connection: 202.78.240.7:50572->120.138.19.204:80 608 A [in] tc (nil)
No timestamp provided in packet - expect low performance due to calls to gettimeofday
Ignoring established connection: 120.138.19.204:80->202.78.240.7:50572 52 A [out] tc (nil)
Ignoring established connection: 202.78.240.7:50572->120.138.19.204:80 608 A [in] tc (nil)
Ignoring established connection: 120.138.19.204:80->202.78.240.7:50572 52 A [out] tc (nil)
Ignoring established connection: 120.138.19.204:80->120.138.19.204:42761 60 SA [out] tc (nil)
Ignoring established connection: 120.138.19.204:80->120.138.19.204:42761 52 A [out] tc (nil)
Ignoring established connection: 120.138.19.204:80->120.138.19.204:42761 283 A [out] tc (nil)
Ignoring established connection: 120.138.19.204:80->120.138.19.204:42761 504 A [out] tc (nil)
Ignoring established connection: 120.138.19.204:80->120.138.19.204:42761 52 AF [out] tc (nil)
Ignoring established connection: 202.78.240.7:50572->120.138.19.204:80 608 A [in] tc (nil)
Ignoring established connection: 120.138.19.204:80->202.78.240.7:50572 52 A [out] tc (nil)
Ignoring established connection: 120.138.19.204:80->202.78.240.7:50572 52 AF [out] tc (nil)
Ignoring established connection: 120.138.19.204:80->202.78.240.7:50574 52 AF [out] tc (nil)
Ignoring established connection: 120.138.19.204:80->202.78.240.7:50572 52 AF [out] tc (nil)
Ignoring established connection: 120.138.19.204:80->202.78.240.7:50574 52 AF [out] tc (nil)
Ignoring established connection: 120.138.19.204:80->202.78.240.7:50572 52 AF [out] tc (nil)

Cheers,

Tim

P.S. How about creating a flattr account? I'd flattr this.

Not working on my machine kali linux 2.0 rolling, when i run test in "test" directory not cetting error! When i use launch_tcpcrypt.sh i getthis output: root@kali:/opt/tcpcrypt/user# ./launch_tcpcryptd.sh
Tcpcrypting port 80 and 7777...
iptables -I INPUT -p tcp --sport 80 -j NFQUEUE --queue-num 666
iptables -I OUTPUT -p tcp --dport 80 -j NFQUEUE --queue-num 666
iptables -I INPUT -p tcp --dport 7777 -j NFQUEUE --queue-num 666
iptables -I INPUT -p tcp --sport 7777 -j NFQUEUE --queue-num 666
iptables -I OUTPUT -p tcp --dport 7777 -j NFQUEUE --queue-num 666
iptables -I OUTPUT -p tcp --sport 7777 -j NFQUEUE --queue-num 666
Initializing...
Running
Testing network via 171.66.3.195
No timestamp provided in packet - expect low performance due to calls to gettimeofday
Test result: port 80 crypt 0 req 0 state 2 err 668 flags 0
Test result: port 80 crypt 0 req 1 state 2 err 666 flags 0
Test result: port 80 crypt 1 req 2 state 2 err 666 flags 0
Test result: port 7777 crypt 0 req 0 state 1 err 111 flags 0
Test result: port 7777 crypt 0 req 1 state 1 err 111 flags 0
Test result: port 7777 crypt 1 req 2 state 1 err 111 flags 0
Tests done! 1 2 3 4 5 6 failed [6/6]!
^C
Removing iptables rules and quitting tcpcryptd...
root@kali:/opt/tcpcrypt/user# sudo ./launch_tcpcryptd.sh &
[1] 14538
root@kali:/opt/tcpcrypt/user# nc -l 7777 &
[2] 14539
root@kali:/opt/tcpcrypt/user# sudo tcpdump -i lo -n -s0 -vvvv -X tcp port 7777 &[3] 14540
root@kali:/opt/tcpcrypt/user# echo hello, world! | nc localhost 7777Tcpcrypting port 80 and 7777...
iptables -I INPUT -p tcp --sport 80 -j NFQUEUE --queue-num 666
iptables -I OUTPUT -p tcp --dport 80 -j NFQUEUE --queue-num 666
iptables -I INPUT -p tcp --dport 7777 -j NFQUEUE --queue-num 666
iptables -I INPUT -p tcp --sport 7777 -j NFQUEUE --queue-num 666
iptables -I OUTPUT -p tcp --dport 7777 -j NFQUEUE --queue-num 666
iptables -I OUTPUT -p tcp --sport 7777 -j NFQUEUE --queue-num 666
Initializing...
tcpdump: listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
Running
Testing network via 171.66.3.195
No timestamp provided in packet - expect low performance due to calls to gettimeofday
Test result: port 80 crypt 0 req 0 state 2 err 668 flags 0
Test result: port 80 crypt 0 req 1 state 2 err 666 flags 0
Test result: port 80 crypt 1 req 2 state 2 err 666 flags 0
Test result: port 7777 crypt 0 req 0 state 1 err 111 flags 0
Test result: port 7777 crypt 0 req 1 state 1 err 111 flags 0
Test result: port 7777 crypt 1 req 2 state 1 err 111 flags 0
Tests done! 1 2 3 4 5 6 failed [6/6]!

It would be nice if there was support for UDP, to avoid TCP "man in the middle" (MIM)attacks.

The BitTorrent protocol was initially 100% TCP.

However a web filtering company came up with a product that took advantage of TCP's MIM weakness.

The attack that was utilized (mainly sending 2 x "TCP hangup message" to "Alice" and "Bob") ... worked.

So now BT is mostly UDP.

I assume the same fix is needed here.

Hi
When i run ./launch_tcpcryptd.sh on FreeBSD 10.2 64 bit, errors occured:

Tcpcrypting port 80 and 7777...
00002 divert 666 tcp from any to any dst-port 80
00003 divert 666 tcp from any 80 to any
00004 divert 666 tcp from any to any dst-port 7777
00005 divert 666 tcp from any 7777 to any
Initializing...
Reading random seed from /dev/urandom
Running
Testing network via 171.66.3.195
Test result: port 80 crypt 0 req 0 state 2 err 666 flags 0
Test result: port 80 crypt 0 req 1 state 2 err 666 flags 0
Test result: port 80 crypt 1 req 2 state 2 err 666 flags 0
Test result: port 7777 crypt 0 req 0 state 2 err 666 flags 0
Test result: port 7777 crypt 0 req 1 state 2 err 666 flags 0
tcpcryptd: sendto(raw): Invalid argument
Removing ipfw rules and quitting tcpcryptd...

In Arch linux, everything is OK.
but this warning appears:
No timestamp provided in packet - expect low performance due to calls to gettimeofday

Configure doesn't check for libcap and libnetfilter-queue, which causes obscure build failures rather than a friendly error message from configure.

To reproduce on Debian, do

apt-get uninstall libnetfilter-queue-dev libcap-dev

and attempt to compile.

--Juliusz

tcpcrypt is designed to encrypt only TCP connection so I was thinking what about to go a layer down? Would it be possible to encrypt all network data that is delivered over ip connections or would this cause technical problems? If tcpcrypt would be able to really encrypt all network traffic this would be a very nice enhancement.

tcpcryptd
Initializing...
Reading random seed from /dev/urandom
Running
Testing network via 171.66.3.195
Test result: port 80 crypt 0 req 0 state 2 err 668 flags 0
Test result: port 80 crypt 0 req 1 state 2 err 666 flags 0
Test result: port 80 crypt 1 req 2 state 2 err 666 flags 0
Test result: port 7777 crypt 0 req 0 state 1 err 111 flags 0
Test result: port 7777 crypt 0 req 1 state 1 err 111 flags 0
Test result: port 7777 crypt 1 req 2 state 1 err 111 flags 0
Tests done! 1 2 3 4 5 6 failed [6/6]!

what does stat 2 and err 668 mean? What was going wrong here?
What does state 1 and err 111 mean?

Are there any explanations for the the error message codes and or the states?

evil@evil:/opt/tcpcrypt$ ./bootstrap.sh
autoreconf: Entering directory `.'
autoreconf: configure.ac: not using Gettext
autoreconf: running: aclocal --force -I m4
aclocal: warning: couldn't open directory 'm4': No such file or directory
autom4te: cannot create autom4te.cache: No such file or directory
aclocal: error: echo failed with exit status: 1
autoreconf: aclocal failed with exit status: 1
evil@evil:/opt/tcpcrypt$

Cannot understand error, running on Ubuntu BackBox 32 bit

On Fedora 21(Chappeau) I get the following and tcpcrypt refuses to run.

[me@localhost ~]$ sudo tcpcryptd -f
Initializing...
Reading random seed from /dev/urandom
Running
(fails to auth with the main site)

^C
[me@localhost ~]$ sudo tcpcryptd -vvvv
Initializing...
Reading random seed from /dev/urandom
Random seed set to 1565759196
Gotta malloc 4976
Generating RSA key
Generating RSA key: 4096 bits
Done generating RSA key
Gotta malloc 16
Buffer size 2097152 wanted 1048576
Divert packets using iptables -j NFQUEUE --queue-num 666
Opening control socket at /var/run/tcpcryptd.control
Attempting to drop privileges with chroot=/var/run/tcpcryptd and user=tcpcryptd
Running
Testing network via 171.66.3.195
Gotta malloc 4976
Test result: port 80 crypt 0 req 0 state 3 err 0 flags 0
Gotta malloc 4976
Gotta malloc 4976
Test result: port 80 crypt 0 req 1 state 3 err 0 flags 0
Gotta malloc 4976
Gotta malloc 4976
Test result: port 80 crypt 1 req 2 state 2 err 670 flags 0
Gotta malloc 4976
Gotta malloc 4976
Test result: port 7777 crypt 0 req 0 state 3 err 0 flags 0
Gotta malloc 4976
Gotta malloc 4976
Test result: port 7777 crypt 0 req 1 state 3 err 0 flags 0
Gotta malloc 4976
Gotta malloc 4976
Test result: port 7777 crypt 1 req 2 state 2 err 670 flags 0
Tests done! 3 6 failed [2/6]!
Disabling tcpcrypt for 30 minutes

Using Firefox 3.6.13 on Windows XP Pro SP SP3 ... after starting tcpcrypt, the first access of the tcpcrypt.org web site (any page) goes wrong. Instead of coming up in the browser, Firefox prompts as follows e.g.

Opening docs.php
docs.php
which is a: PHP file
from http://tcpcrypt.org

What should Firefox do with this file?

Open
Save

Pressing the Cancel button on that dialog box and accessing the same URL again clears the problem, which seemingly does not recur unless tcpcrypt is stopped and started again. Problem seems to be highly reproducible.

Is this a problem with the tcpcrypt.org web site or with tcpcrypt itself or ...?

Are there any other web servers running tcpcrypt that I can test with?

There's embedded asm code in checksum.c, some errors occurred when compiling with mips-gcc, Macro NO_ASM can not avoid of that problem.

/tmp/cczDJOkb.s: Assembler messages:
/tmp/cczDJOkb.s:229: Error: unrecognized opcode addl 16($16),$4' /tmp/cczDJOkb.s:230: Error: unrecognized opcodeadcl 12($16),$4'
/tmp/cczDJOkb.s:231: Error: unrecognized opcode adcl $2,$4' /tmp/cczDJOkb.s:232: Error: unrecognized opcodeadcl $0,$4'
/tmp/cczDJOkb.s:238: Error: unrecognized opcode addl $4,$3' /tmp/cczDJOkb.s:239: Error: unrecognized opcodeadcl $0xffff,$3'
/tmp/cczDJOkb.s:278: Error: unrecognized opcode addl 16($16),$4' /tmp/cczDJOkb.s:279: Error: unrecognized opcodeadcl 12($16),$4'
/tmp/cczDJOkb.s:280: Error: unrecognized opcode adcl $2,$4' /tmp/cczDJOkb.s:281: Error: unrecognized opcodeadcl $0,$4'
/tmp/cczDJOkb.s:287: Error: unrecognized opcode addl $4,$3' /tmp/cczDJOkb.s:288: Error: unrecognized opcodeadcl $0xffff,$3'
/tmp/cczDJOkb.s:363: Error: unrecognized opcode addl $2,$3' /tmp/cczDJOkb.s:364: Error: unrecognized opcodeadcl $0xffff,$3'
/tmp/cczDJOkb.s:437: Error: unrecognized opcode addl $2,$3' /tmp/cczDJOkb.s:438: Error: unrecognized opcodeadcl $0xffff,$3'

I've been investigating using tcpcrypt to secure inter-server communication between my virtual servers on the Rackspace Cloud. However, tcpcryptd seems to intermittently crash, with the error:

tcpcryptd: tcpcryptd.c:147: add_timer: Assertion `t' failed.

Hi,

I'm an application programmer and I'm looking at what you are what this library is capable of, by reading the pdf-presentation available from the website.

My feature request is that you get this sort of crypto into a messaging library that we app developers use, such as AMQP or 0MQ and create a few manifests for devops to apply - aim for puppet and chef manifests/recipes initially and branch out from there.

And you need to fix all Windows problems, natually - it should be as smooth to use as TrueCrypt is for Windows.

Cheers,
Henrik

I use Archlinux and got the error

Initializing...
tcpcryptd: tcpcrypt.c:116: do_add_ciphers: Assertion `p + sz <= (uint8_t*) speclen' failed.
Aborted (core dumped)

tcpcryptd failed to start

I get error while install: HrInstallNetComponent()

Yesterday someone reported a problem on Arch Linux forums where the nfq_unbind_pf() function fails with "Invalid argument", on Arch Linux: https://bbs.archlinux.org/viewtopic.php?pid=839012#p839012

After digging a bit further, I found several reports of the same problem with other software, the ndq_unbind_pf() function returning EINVAL. The reports seem to be only specific to 2.6.23, but unfortunately I don't know what kernel version the reporter is running.

1. http://developer.berlios.de/bugs/?func=detailbug&bug_id=12156&group_id=2509
2. http://copilotconsulting.com/mail-archives/snort-users.2008/msg01036.html

However it was suggested on the netfilter list that the return value of nfq_unbind_pf() should be ignored in the first place? http://www.spinics.net/lists/netfilter/msg42063.html
People seem to have taken their advice: http://software.inl.fr/trac/changeset/6956

So, I don't know if ignoring nfq_unbind_pf() return is still a good idea or not -- maybe it's been fixed in newer kernels. I'm just putting this out here, hopefully you know better than me.

There are two hosts
Host#1: Oracle Linux 2.6.39-400.281.1.el6uek.i686
The tcpcrypt seems to be working fine on this host. Console o/p is as follows:
[root@localhost tcpcrypt-0.5]# ./launch_tcpcryptd.sh
Initializing...
Reading random seed from /dev/urandom
^C
No timestamp provided in packet - expect low performance due to calls to gettimeofday
Removing iptables rules and quitting tcpcryptd...
==== DUMPING STATE ====
FD 10 state 2
FD 4 state 1

[root@localhost tcpcrypt-0.5]#

=============================================================================
Host#2: Oracle Linux 2.6.39-400.281.1.el6uek.i686
The tcpcrypt doesn't come up. It throws following error:

[root@localhost tcpcrypt-0.5]# ./launch_tcpcryptd.sh
Initializing...
Reading random seed from /dev/urandom

nid=415
tcpcryptd: unknown curve nid 716
nid=716==== DUMPING STATE ====

Removing iptables rules and quitting tcpcryptd...

Any clue what went wrong on the second host would be useful.

The UI version doesn't do anything.

Compiling from source, hacking up the .sh to do the right things and globally setting DYLD_FALLBACK_LIBRARY_PATH still does not result in a successful http://tcpcrypt.org/test.php

Pretty much broken FAIAP.

they're moving to PF

I'm pretty sure this is caused by TCPcrypt, as it has happened thrice since I've installed it last week, and my computer crashes extremely rarely. The only lead I had on the issue was that the BSoD screen mentioned a "passthru.exe", which after a quick search I found to be in one of TCPcrypts' folders. My machine is a Dell Inspiron E1505 with no related hardware modifications, running WinXP SP2. Help please!

Using git version 20100828-1

Installed on Arch linux. Installation was no problem.

It seems to be consuming memory after a long period of browsing. I will come back with more details should it be reproducable.

With tcpcrypt started under Windows Vista, I have had multiple BSODs. I can't provide much useful information (flashes off the screen too quickly) other than that the most recent one occurred in passthru.sys

On restart, Vista says:

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.0.6002.2.2.0.256.6
Locale ID: 3081

Additional information about the problem:
BCCode: d1
BCP1: 8ACFC810
BCP2: 00000002
BCP3: 00000000
BCP4: 8C7E7F7D
OS Version: 6_0_6002
Service Pack: 2_0
Product: 256_1

There's an XML file that contains info about all the drivers that were loaded. This contains in part:

<DRIVER>
    <FILENAME>passthru.sys</FILENAME>
    <FILESIZE>45416</FILESIZE>
    <CREATIONDATE>10-13-2010 06:38:10</CREATIONDATE>
    <VERSION>6.1.7600.16385</VERSION>
    <MANUFACTURER>Windows (R) Win 7 DDK provider</MANUFACTURER>
    <PRODUCTNAME>Windows (R) Win 7 DDK driver</PRODUCTNAME>
    <HASH>fce1c6c0949f178dc01b5f6f1bc28c7f</HASH>
</DRIVER>

There's a Windows Minidump file but I don't know how to get anything useful out of it.

Initial installation (.msi file) hung after about 2/3 on the progress bar; permission dialog had already been answered twice.
Reboot, and seemed to install fine and quickly. Tried to start service, and got a Blue Screen of Death (BSOD). There wasn't much time to read it, but there was something at the top about the driver being "not less than or equal to" something.

I applaud the effort, but wish my system was compatible.

Attempting to use tcpcrypt to access any web site under Windows Vista SP2 does not work. It just times out.

Running tcpcryptd with verbose output yields e.g.

Added ARP entry for 171.66.3.211 [00:13:46:f4:d4:fc] table size 1
Gotta malloc 40

192.168.36.6:49174->171.66.3.211:80 52 S [out] tc 000236D8
Can't find session for host

192.168.36.6:49174->171.66.3.211:80 52 S [out] tc 000236D8
Can't find session for host

192.168.36.6:49174->171.66.3.211:80 48 S [out] tc 000236D8
Can't find session for host

The above is for accessing tcpcrypt.org but no web sites, whether supporting tcpcrypt or not, are accessible until I turn off tcpcrypt.

Any ideas what's going wrong?

It would be nice if the MINIX 3 OS platform were supported.

The Minix 3 OS is famous for being more modular than BSD or Linux, that have late 1970's style megakernal architectural designs.

Porting to MINIX 3 may also lead to easier ports for QNX and VxWorks RTOSes.

After the last command "tcpcrypt$ sudo ./launch_tcpcryptd.sh", the program returns the following:

Initializing...
Reading random seed from /dev/urandom
Running

It doesn,t work on virtual box.
(Virtual network card is in NAS mode)

I'm using tcpcrypt to encrypt http trafic between two ubuntu hosts. after few http requests, following error occurs and "quitting tcpcrptd... " message appears.
tcpcryptd: src/profile.c:62: time_diff : Assertion 'diff >= 0' failed.