(racoon 717) Re: Does racoon work with link local IPv6 addresses?

El lun, 06-09-2004 a las 16:52, Aidas Kasparas escribió:
> Michal Ludvig wrote:
> > On Mon, 6 Sep 2004, Aidas Kasparas wrote:
> > 
> > 
> >>	What happens if you remove interface names from "remote" and "sainfo"
> >>statements? As I understand, even without interface name these addresses
> >>are unique at least site-wide, therefore I expect this should not
> >>confuse racoon.
> > 
> > 
> > They should be unique, yes, but without the interface name unroutable. The
> > question is if it matters in this case.
> > 
> > 
> >>	If my suggestion is wrong in principle, please provide explanation.
> > 
> > 
> > I can only explain why you must use an interface name when connecting to
> > the other host over link-local address (which is BTW not recommended - why
> > do you, Juan Antonio, need it?):
> > 
> > Each interface has its own link-local address, but all of them fall into
> > fe80::/64 prefix. As there is a route to fe80::/64 on each interface you
> > must explicitly specify through which interface the packet should leave.
> > Otherwise the kernel would be confused.
> 
> And this is why I recomended to remote interface name JUST FROM "remote" 
> and "sainfo". I said nothing about policies or ssh command line ;-)
> 
> The idea behind this recomendation was:
> 	-- ssh want to connect to fe80::somethin%eth0 -- cool, let it do so;
OK! 
> 	-- racoon/kernel finds a policy with required peer -- cool, do not change;
OK!
> 	-- racoon searches for peer _without_ interface name -- let's provide 
> it this way!
Racoon finds peer _without_ interface name, but i think when it tries to
start up the tunnel, bind fails because it uses peer name without the
interface. Racoon return this result:

-----------------------------------------------------------------------------
...
DEBUG: configuration found for fe80::202:b3ff:fe60:206e.
INFO: IPsec-SA request for fe80::202:b3ff:fe60:206e queued due to no
phase1 found.
DEBUG: ===
INFO: initiate new phase 1 negotiation:
fe80::202:b3ff:feb8:1857[500]<=>fe80::202:b3ff:fe60:206e[500]
INFO: begin Identity Protection mode.
DEBUG: new cookie:
79b33a35a52af1aa
DEBUG: add payload of len 48, next type 0
DEBUG: 80 bytes from fe80::202:b3ff:feb8:1857[500] to
fe80::202:b3ff:fe60:206e[500]
DEBUG: sockname 2001:720:1710:0:202:b3ff:feb8:1857[500]
DEBUG: send packet from fe80::202:b3ff:feb8:1857[500]
DEBUG: send packet to fe80::202:b3ff:fe60:206e[500] <-----------------
ERROR: bind 1 (Invalid argument) <------------------------------------
ERROR: sendfromto failed
ERROR: failed to begin ipsec sa negotication.
-------------------------------------------------------------------------

> 	-- as for sainfo -- I'm not sure what racoon will want in this place, 
> but I tought, if it needs address without interface while searching 
> peer, chances are good it will need address without interface for sainfo 
> too.
> 
> 	As usual, I may be wrong.

I'm sorry for the delay of my response.
Thanks.