修理 Android ICS 上那个抽风止不住的 L2TP/IPSec 客户端

在这台服务器被墙的那两天里,我尝试了让手机连接备机上的 IPSec L2TP ,但是却发现无论如何连不上。本来以为是网络问题,结果却发现 iPad 可以很轻松地连上。回头一看服务器端的日志,果然发现了一些问题。

相关日志如下:

packet from 123.123.123.123:12345: received Vendor ID payload [RFC 3947] method set to=109 
packet from 123.123.123.123:12345: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 109
packet from 123.123.123.123:12345: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 109
packet from 123.123.123.123:12345: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
packet from 123.123.123.123:12345: ignoring Vendor ID payload [FRAGMENTATION 80000000]
packet from 123.123.123.123:12345: received Vendor ID payload [Dead Peer Detection]
"L2TP-PSK-NAT"[37] 123.123.123.123 #55: responding to Main Mode from unknown peer 123.123.123.123
"L2TP-PSK-NAT"[37] 123.123.123.123 #55: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
"L2TP-PSK-NAT"[37] 123.123.123.123 #55: STATE_MAIN_R1: sent MR1, expecting MI2
"L2TP-PSK-NAT"[37] 123.123.123.123 #55: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): both are NATed
"L2TP-PSK-NAT"[37] 123.123.123.123 #55: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
"L2TP-PSK-NAT"[37] 123.123.123.123 #55: STATE_MAIN_R2: sent MR2, expecting MI3
"L2TP-PSK-NAT"[37] 123.123.123.123 #55: Main mode peer ID is ID_IPV4_ADDR: '10.140.89.199'
"L2TP-PSK-NAT"[37] 123.123.123.123 #55: switched from "L2TP-PSK-NAT" to "L2TP-PSK-NAT"
"L2TP-PSK-NAT"[38] 123.123.123.123 #55: deleting connection "L2TP-PSK-NAT" instance with peer 123.123.123.123 {isakmp=#0/ipsec=#0}
"L2TP-PSK-NAT"[38] 123.123.123.123 #55: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
"L2TP-PSK-NAT"[38] 123.123.123.123 #55: new NAT mapping for #55, was 123.123.123.123:12345, now 123.123.123.123:54321
"L2TP-PSK-NAT"[38] 123.123.123.123 #55: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_256 prf=oakley_sha group=modp1024}
"L2TP-PSK-NAT"[38] 123.123.123.123 #55: ignoring informational payload, type IPSEC_INITIAL_CONTACT msgid=00000000
"L2TP-PSK-NAT"[38] 123.123.123.123 #55: received and ignored informational message
"L2TP-PSK-NAT"[38] 123.123.123.123 #55: byte 7 of ISAKMP NAT-OA Payload must be zero, but is not
"L2TP-PSK-NAT"[38] 123.123.123.123 #55: malformed payload in packet
| payload malformed after IV
|   ec 0c b1 2a  d4 96 ac ec  47 8a 9f d3  9c 71 64 d3
"L2TP-PSK-NAT"[38] 123.123.123.123 #55: sending notification PAYLOAD_MALFORMED to 123.123.123.123:54321
"L2TP-PSK-NAT"[38] 123.123.123.123 #55: byte 7 of ISAKMP NAT-OA Payload must be zero, but is not
"L2TP-PSK-NAT"[38] 123.123.123.123 #55: malformed payload in packet
| payload malformed after IV
|   ec 0c b1 2a  d4 96 ac ec  47 8a 9f d3  9c 71 64 d3
"L2TP-PSK-NAT"[38] 123.123.123.123 #55: sending notification PAYLOAD_MALFORMED to 123.123.123.123:54321
"L2TP-PSK-NAT"[36] 220.249.99.240 #52: max number of retransmissions (2) reached STATE_MAIN_R1
"L2TP-PSK-NAT"[38] 123.123.123.123 #55: byte 7 of ISAKMP NAT-OA Payload must be zero, but is not
"L2TP-PSK-NAT"[38] 123.123.123.123 #55: malformed payload in packet
| payload malformed after IV
|   ec 0c b1 2a  d4 96 ac ec  47 8a 9f d3  9c 71 64 d3
......

如此循环,直到 Android 报告连接超时为止。看了日志的信息之后,结合 iOS 可以轻松连接而 Android ICS 却无论如何无法连上这个事实,我严重怀疑 Android ICS 的 L2TP/IPSec 客户端有 Bug 。一搜,果然如此。

好在这个 Bug 在手机已经 root 过的情况下可以非常容易而且一劳永逸地修复——替换掉那个不停地出娄子的 IPSec 程序 racoon 就可以了。首先在手机上下载打好 patch 的二进制文件(安全性自己考虑吧):http://code.google.com/p/android/issues/detail?id=23124#c203

然后打开手机上的终端(模拟器或者 adb shell 皆可),执行以下命令:

su
busybox mount -o remount,rw /system
busybox ls -l /system/bin/racoon
mv /system/bin/racoon /system/bin/racoon.sucker
mv /sdcard/download/racoon.bin /system/bin/racoon
chmod 0755 /system/bin/racoon
chown 0 /system/bin/racoon
chgrp 2000 /system/bin/racoon
busybox mount -o remount,ro /system
exit

接着,L2TP/IPSec 就可以正常使用了。

一点说明:上述命令里面,/sdcard/download/racoon.bin 是下载下来的文件,ls -l 是为了查看系统原本的 racoon 的属主和属组,我这里是 0 和 2000 ,请根据情况调整。

racoon 项目的主页:http://ipsec-tools.sourceforge.net/

发表评论

电子邮件地址不会被公开。 必填项已用*标注