(racoon 694) Re: Does racoon work with link local IPv6 addresses?

Hi Aidas,

Don't worry about it, you addressed to me right.

I was able to install racoon from cvs. Thank you ;)

But the problem related with the link local address isn't solved
completely.

Although when I start up racoon i don't find any error, when I try to
use link local address to establish the ipsec tunnel doing a ssh
connection "ssh fe80::202:b3ff:fe60:206e%eth0" I get this result:

------------------------------------------------------
2004-09-06 10:47:32: ERROR: no configuration found for
fe80::202:b3ff:fe60:206e.
2004-09-06 10:47:32: ERROR: failed to begin ipsec sa negotication.
------------------------------------------------------

My racoon.conf is the next:
-----------------------------------------------------

path pre_shared_key "/etc/racoon/psk.txt";

timer
{
        phase1  1min;
        phase2  1min;
}

remote fe80::202:b3ff:fe60:206e%eth0
{
        exchange_mode main;
        proposal
        {
                encryption_algorithm 3des;
                hash_algorithm md5;
                authentication_method pre_shared_key;
                dh_group 2;
        }
}

sainfo address fe80::202:b3ff:feb8:1857%eth0/128 tcp address
fe80::202:b3ff:fe60:206e%eth0/128 tcp
{
        pfs_group 2;
        lifetime time 12 hour;
        encryption_algorithm 3des;
        authentication_algorithm hmac_sha1, hmac_md5;
        compression_algorithm deflate;
}
-----------------------------------------------------

and my setkey.conf is :
-----------------------------------------------------
# Flush the SAD and SPD entries
flush;
spdflush;

spdadd fe80::202:b3ff:feb8:1857%eth0/128
fe80::202:b3ff:fe60:206e%eth0/128 tcp -P out ipsec
esp/tunnel/fe80::202:b3ff:feb8:1857%eth0-fe80::202:b3ff:fe60:206e%eth0/require ;
spdadd fe80::202:b3ff:fe60:206e%eth0/128
fe80::202:b3ff:feb8:1857%eth0/128 tcp -P in ipsec
esp/tunnel/fe80::202:b3ff:fe60:206e%eth0-fe80::202:b3ff:feb8:1857%eth0/require ;

-----------------------------------------------------

As you can see I've added the interface eth0 in every link local
address. But in the log error you can't find this interface, so I think
the error could be caused by don't using the interface in the link local
address so it couldn't find any remote configuration for this address
without interface. 

We've tried to remove the "%eth0" from configuration files but, we get a
bind error.

El mié, 01-09-2004 a las 18:05, Aidas Kasparas escribió:
> Fix for this just went into ipsec-tools cvs. Please try cvs version and 
> report back did it solve your problem.
> 
> Juan Antonio Martínez Navarro wrote:
> > Hi everybody,
> > 
> > I'm using racoon in a Linux (Kernel 2.6.7) and I'd like to know if it's
> > possible to use the link local address. I'm not able to use it but I can
> > use the global ipv6 address. When I start up racoon, this is the result
> > it shows.
> > 
> > ----------------------------------------------------------------------
> > Sep  1 13:26:47 pfc7 racoon: INFO: @(#)ipsec-tools 0.3.3
> > (http://ipsec-tools.sourceforge.net)
> > Sep  1 13:26:47 pfc7 racoon: INFO: @(#)This product linked OpenSSL
> > 0.9.7d 17 Mar 2004 (http://www.openssl.org/)
> > Sep  1 13:26:47 pfc7 racoon: INFO: ::1[500] used as isakmp port (fd=7)
> > Sep  1 13:26:47 pfc7 racoon: ERROR: failed to bind to address
> > fe80::202:b3ff:feb8:1857%253[500] (No such device).
> > Sep  1 13:26:47 pfc7 racoon: INFO:
> > 2001:720:1710:0:202:b3ff:feb8:1857[500] used as isakmp port (fd=8)
> > Sep  1 13:26:47 pfc7 racoon: INFO: 127.0.0.1[500] used as isakmp port
> > (fd=9)
> > Sep  1 13:26:47 pfc7 racoon: INFO: 155.54.210.94[500] used as isakmp
> > port (fd=10)
> > 
> > ------------------------------------------------------------------------
> > 
> > I asked it a few months ago, I hope it has a solution.
> > Thank you.
> > 
> > 
> > 
>