(racoon2 68) Re: racoon2 bugs?

Le mercredi 22 mars 2006 =C3=A0 12:44 +0100, Franck GILLET a =C3=A9crit :
> Thanks for your help!
>=20
> I tried with protecting TCP packets only and I tested with iperf tool.
> It works!
>=20
> For my previous request, I don't know where the DNS occurs. I PING6 wit=
h
> IP6 address (and not with host name). Moreover, I don't remember DNS
> request appeared in TCPDUMP log. By precaution, I add "resolver
> { resolver off; };" in my configuration file. I must test explicit
> allowing to know some more.
>=20
> I don't think protecting ICMP6 causes problem in my case because my
> protection is applied on global addresses and neighbor discovery packet=
s
> are sent with local-link address (I verified that these packets were no=
t
> dropped).
>=20

A priori the problem comes from Neighbor Discovery. In fact, the source
address is global sometimes... However the destination address can be
solicited multicast. Maybe the problem is here.
I continue to test different cases...

> Are there documents that describe racoon implementation (like
> wide-draft-ipsec-report2004-01 in English)?
>=20
> Best Regards.
>=20
> Franck GILLET.
> [email protected]
>=20
>=20
> Le mercredi 22 mars 2006 =C3=A0 13:54 +0900, Fukumoto Atsushi a =C3=A9c=
rit :
> > Franck, I think node A is trying DNS but it is blocked.  Could you tr=
y
> > with more selective security policy (protect TCP packets only, for
> > example), or explicity allow DNS packets?  Also note that if you try
> > to protect ICMP, you'll block Neighbor Discovery packets which needs
> > to be sent in plain to perform IKE communication.
> >=20
> >=20
> > 					FUKUMOTO Atsushi
> > 					[email protected]
>=20