(racoon 732) Re: Does racoon work with link local IPv6 addresses?

Juan Antonio,

	I have two patches. One went into ipsec-tools cvs and is used to select 
correct socket even if kernel strips sin6_scope_id. Another is attached 
to this message. With both applied I achieved packets sent to neighbour 
via link-local addresses. Try one more time.

	The reason why this patch did not went into cvs is I'm not sure why 
this code was #ifdef'ed for IPV6_INRIA_VERSION and what consequences 
removal of this check will have. Can anybody comment, please?


Juan Antonio Martínez Navarro wrote:
> El lun, 06-09-2004 a las 16:52, Aidas Kasparas escribió:
> 
>>Michal Ludvig wrote:
>>
>>>On Mon, 6 Sep 2004, Aidas Kasparas wrote:
>>>
>>>
>>>
>>>>	What happens if you remove interface names from "remote" and "sainfo"
>>>>statements? As I understand, even without interface name these addresses
>>>>are unique at least site-wide, therefore I expect this should not
>>>>confuse racoon.
>>>
>>>
>>>They should be unique, yes, but without the interface name unroutable. The
>>>question is if it matters in this case.
>>>
>>>
>>>
>>>>	If my suggestion is wrong in principle, please provide explanation.
>>>
>>>
>>>I can only explain why you must use an interface name when connecting to
>>>the other host over link-local address (which is BTW not recommended - why
>>>do you, Juan Antonio, need it?):
>>>
>>>Each interface has its own link-local address, but all of them fall into
>>>fe80::/64 prefix. As there is a route to fe80::/64 on each interface you
>>>must explicitly specify through which interface the packet should leave.
>>>Otherwise the kernel would be confused.
>>
>>And this is why I recomended to remote interface name JUST FROM "remote" 
>>and "sainfo". I said nothing about policies or ssh command line ;-)
>>
>>The idea behind this recomendation was:
>>	-- ssh want to connect to fe80::somethin%eth0 -- cool, let it do so;
> 
> OK! 
> 
>>	-- racoon/kernel finds a policy with required peer -- cool, do not change;
> 
> OK!
> 
>>	-- racoon searches for peer _without_ interface name -- let's provide 
>>it this way!
> 
> Racoon finds peer _without_ interface name, but i think when it tries to
> start up the tunnel, bind fails because it uses peer name without the
> interface. Racoon return this result:
> 
> -----------------------------------------------------------------------------
> ...
> DEBUG: configuration found for fe80::202:b3ff:fe60:206e.
> INFO: IPsec-SA request for fe80::202:b3ff:fe60:206e queued due to no
> phase1 found.
> DEBUG: ===
> INFO: initiate new phase 1 negotiation:
> fe80::202:b3ff:feb8:1857[500]<=>fe80::202:b3ff:fe60:206e[500]
> INFO: begin Identity Protection mode.
> DEBUG: new cookie:
> 79b33a35a52af1aa
> DEBUG: add payload of len 48, next type 0
> DEBUG: 80 bytes from fe80::202:b3ff:feb8:1857[500] to
> fe80::202:b3ff:fe60:206e[500]
> DEBUG: sockname 2001:720:1710:0:202:b3ff:feb8:1857[500]
> DEBUG: send packet from fe80::202:b3ff:feb8:1857[500]
> DEBUG: send packet to fe80::202:b3ff:fe60:206e[500] <-----------------
> ERROR: bind 1 (Invalid argument) <------------------------------------
> ERROR: sendfromto failed
> ERROR: failed to begin ipsec sa negotication.
> -------------------------------------------------------------------------
> 
> 
>>	-- as for sainfo -- I'm not sure what racoon will want in this place, 
>>but I tought, if it needs address without interface while searching 
>>peer, chances are good it will need address without interface for sainfo 
>>too.
>>
>>	As usual, I may be wrong.
> 
> 
> I'm sorry for the delay of my response.
> Thanks.
> 

-- 
Aidas Kasparas
IT administrator
GM Consult Group, UAB

--- ipsec-tools/src/racoon/sockmisc.c	2004-08-15 15:56:19.000000000 +0300
+++ comp/src/racoon/sockmisc.c	2004-09-12 19:28:41.000000000 +0300
@@ -487,7 +487,7 @@
 	}
 
 	switch (src->sa_family) {
-#if defined(INET6) && defined(ADVAPI) && !defined(IPV6_INRIA_VERSION)
+#if defined(INET6) && defined(ADVAPI)
 	case AF_INET6:
 	    {
 		struct msghdr m;
@@ -496,16 +496,20 @@
 		u_char cmsgbuf[256];
 		struct in6_pktinfo *pi;
 		int ifindex;
-		struct sockaddr_in6 src6, dst6;
+		struct sockaddr_in6 src6, dst6, *ss6;
 
 		memcpy(&src6, src, sizeof(src6));
 		memcpy(&dst6, dst, sizeof(dst6));
+		ss6 = (struct sockaddr_in6*) &ss;
 
 		/* XXX take care of other cases, such as site-local */
 		ifindex = 0;
 		if (IN6_IS_ADDR_LINKLOCAL(&src6.sin6_addr)
 		 || IN6_IS_ADDR_MULTICAST(&src6.sin6_addr)) {
-			ifindex = src6.sin6_scope_id;	/*???*/
+			/* kernel tends to drop sin6_scope_id, so 
+			 * we have better chances get it right from
+			 * socket we're going to send. --AK */
+			ifindex = ss6->sin6_scope_id;
 		}
 
 		/* XXX some sanity check on dst6.sin6_scope_id */