(racoon 739) Re: [Ipsec-tools-devel] Re: Does racoon work with link local IPv6 addresses?

El dom, 12-09-2004 a las 18:44, Aidas Kasparas escribió: 
> Juan Antonio,
> 
> 	I have two patches. One went into ipsec-tools cvs and is used to select 
> correct socket even if kernel strips sin6_scope_id. Another is attached 
> to this message. With both applied I achieved packets sent to neighbour 
> via link-local addresses. Try one more time.
> 
> 	The reason why this patch did not went into cvs is I'm not sure why 
> this code was #ifdef'ed for IPV6_INRIA_VERSION and what consequences 
> removal of this check will have. Can anybody comment, please?
> 

Hi, Aidas!,

we have applied the patch to the source downloaded first from CVS, and
it works! Good!, but there is something wrong. In the configuration file
"racoon.conf" we need to put both remote clause with the interface and
without it:

-----------------------------------------------------------------------
remote fe80::202:b3ff:fe60:206e
{
exchange_mode main;
proposal
{
encryption_algorithm 3des;
hash_algorithm md5;
authentication_method pre_shared_key;
dh_group 2;
}
}
remote fe80::202:b3ff:fe60:206e%eth0
{
exchange_mode main;
proposal
{
encryption_algorithm 3des;
hash_algorithm md5;
authentication_method pre_shared_key;
dh_group 2;
}
}
-----------------------------------------------------------

If we set remote clause without interface in both host, the host who
establish the tunnel finds out the link local address well (without
interface). But the receiver tries to find the link local address with
the interface (as you can see in receiver's log) so we couldn't
establish the tunnel. So we have to set the remote clause in receiver
with its interface. But following this configuration the host who
establish the tunnel must be always "the sender".

--------------------------------
receiver's log:

2004-09-13 13:28:55: DEBUG: ===
2004-09-13 13:28:55: DEBUG: 80 bytes message received from
fe80::202:b3ff:fe60:206e%eth0[500] to fe80::202:b3ff:feb8:1857%eth0[500]
2004-09-13 13:28:55: DEBUG:
6a698224 c9df745c 00000000 00000000 01100200 00000000 00000050 00000034
00000001 00000001 00000028 01010001 00000020 01010000 800b0001 800c7080
80010005 80030001 80020001 80040002
2004-09-13 13:28:55: DEBUG: no remote configuration found.
2004-09-13 13:28:55: ERROR: couldn't find configuration.
----------------------------------------
----------------------------------------
----------------------------------------




>From now on we show you the distinct combinations for racoon.conf (with
and without interface id):

---------------------------------------------------------
Output shown by racoon in the host that startes up a communication
(ssh): Both without interfaces in remote clause.

2004-09-13 13:29:08: INFO: IPsec-SA request for fe80::202:b3ff:feb8:1857
queued due to no phase1 found.
2004-09-13 13:29:08: INFO: initiate new phase 1 negotiation:
fe80::202:b3ff:fe60:206e[500]<=>fe80::202:b3ff:feb8:1857[500]
2004-09-13 13:29:08: INFO: begin Identity Protection mode.

Doesn't work :-(

-------------------

Output shown by racoon in the host that startes up a communication
(ssh): this host without interface in remote clause. The other host with
the interface.

2004-09-13 13:31:52: INFO: IPsec-SA request for fe80::202:b3ff:feb8:1857
queued due to no phase1 found.
2004-09-13 13:31:52: INFO: initiate new phase 1 negotiation:
fe80::202:b3ff:fe60:206e[500]<=>fe80::202:b3ff:feb8:1857[500]
2004-09-13 13:31:52: INFO: begin Identity Protection mode.
2004-09-13 13:31:53: WARNING: remote address mismatched.
db=fe80::202:b3ff:feb8:1857[500], act=fe80::202:b3ff:feb8:1857%eth1[500]
2004-09-13 13:31:53: WARNING: remote address mismatched.
db=fe80::202:b3ff:feb8:1857[500], act=fe80::202:b3ff:feb8:1857%eth1[500]
2004-09-13 13:31:53: INFO: ISAKMP-SA established
fe80::202:b3ff:fe60:206e[500]-fe80::202:b3ff:feb8:1857[500]
spi:2d257a78472fb53b:a78f199cd2843862
2004-09-13 13:31:53: WARNING: remote address mismatched.
db=fe80::202:b3ff:feb8:1857[500], act=fe80::202:b3ff:feb8:1857%eth1[500]
2004-09-13 13:31:54: INFO: initiate new phase 2 negotiation:
fe80::202:b3ff:fe60:206e[0]<=>fe80::202:b3ff:feb8:1857[0]
2004-09-13 13:31:55: WARNING: remote address mismatched.
db=fe80::202:b3ff:feb8:1857[500], act=fe80::202:b3ff:feb8:1857%eth1[500]
2004-09-13 13:31:56: INFO: IPsec-SA established: ESP/Tunnel
fe80::202:b3ff:feb8:1857->fe80::202:b3ff:fe60:206e
spi=253823703(0xf210ad7)
2004-09-13 13:31:56: INFO: IPsec-SA established: ESP/Tunnel
fe80::202:b3ff:fe60:206e->fe80::202:b3ff:feb8:1857
spi=42265321(0x284eae9)

Works!

------------------



Output shown by racoon in the host that init a communication (ssh): Both
with interfaces in remote clause.

2004-09-13 13:41:16: ERROR: no configuration found for
fe80::202:b3ff:feb8:1857.
2004-09-13 13:41:16: ERROR: failed to begin ipsec sa negotication.

Doesn't work :-(