(racoon 696) Re: Does racoon work with link local IPv6 addresses?

Michal Ludvig wrote:
> On Mon, 6 Sep 2004, Aidas Kasparas wrote:
> 
> 
>>	What happens if you remove interface names from "remote" and "sainfo"
>>statements? As I understand, even without interface name these addresses
>>are unique at least site-wide, therefore I expect this should not
>>confuse racoon.
> 
> 
> They should be unique, yes, but without the interface name unroutable. The
> question is if it matters in this case.
> 
> 
>>	If my suggestion is wrong in principle, please provide explanation.
> 
> 
> I can only explain why you must use an interface name when connecting to
> the other host over link-local address (which is BTW not recommended - why
> do you, Juan Antonio, need it?):
> 
> Each interface has its own link-local address, but all of them fall into
> fe80::/64 prefix. As there is a route to fe80::/64 on each interface you
> must explicitly specify through which interface the packet should leave.
> Otherwise the kernel would be confused.

And this is why I recomended to remote interface name JUST FROM "remote" 
and "sainfo". I said nothing about policies or ssh command line ;-)

The idea behind this recomendation was:
	-- ssh want to connect to fe80::somethin%eth0 -- cool, let it do so;
	-- racoon/kernel finds a policy with required peer -- cool, do not change;
	-- racoon searches for peer _without_ interface name -- let's provide 
it this way!
	-- as for sainfo -- I'm not sure what racoon will want in this place, 
but I tought, if it needs address without interface while searching 
peer, chances are good it will need address without interface for sainfo 
too.

	As usual, I may be wrong.