netdev - Re: IPSEC IPV4 Tunnel Requires IPV6 WIth 2.6.25?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <48340F01.6050104@miyazawa.org>
Date:	Wed, 21 May 2008 21:01:05 +0900
From:	Kazunori MIYAZAWA <kazunori@...azawa.org>
To:	Alan Swanson <swanson@...sn.org>
CC:	netdev@...r.kernel.org
Subject: Re: IPSEC IPV4 Tunnel Requires IPV6 WIth 2.6.25?

Hello,

This patch fixes the problem.
I though that someone (sorry I foget) sent the same patch
when netlink was fixed.

Alan Swanson wrote:
> Hi. Usual non-subscriber CC replies request please.
> 
> There is a problem with 2.6.25(.4) using IPSEC on ipv4. You seem to need
> to have ipv6 available otherwise a protocol not supported error is
> returned when trying to set a Security Association Database. I'm using
> setkey on a file but another user on the ipsec-tools-devel list reported
> the same issue using racoon.
> 
> http://marc.info/?l=ipsec-tools-devel&m=121015164014761&w=2
> 
> So with modules loaded you expect to work.
> 
> $ lsmod
>   Module                  Size  Used by
>   authenc                 5056  0 
>   ah4                     4672  0 
>   esp4                    5824  0 
>   aead                    5824  2 authenc,esp4
>   xfrm4_mode_tunnel       2176  20
> 
> A static file with tunnel configuration for laptop to desktop over open
> wireless not running WEP/WPA.
> 
> $ head -n 12 /etc/ipsec.conf
>   #!/usr/sbin/setkey -f
>   
>   flush;
>   spdflush;
>   
>   add 1.1.1.1 2.2.2.2 esp 0x500 -m tunnel
>   -E rijndael-cbc 0x...
>   -A hmac-sha1 0x...;
>   
>   add 2.2.2.2 1.1.1.1 esp 0x501 -m tunnel
>   -E rijndael-cbc 0x...
>   -A hmac-sha1 0x...;
> 
> You get protocol not supported error.
> 
> $ setkey -f /etc/ipsec.conf
>   The result of line 8: Protocol not supported.
>   The result of line 12: Protocol not supported.
> 
> But after modprobing ipv6 which automatically pulls
> in xfrm6_mode_tunnel, setkey starts working and I can communicate via
> IPSEC.
> 
> $ lsmod
>   Module                  Size  Used by
>   xfrm6_mode_tunnel       2048  4 
>   ipv6                  217444  10 xfrm6_mode_tunnel
>   authenc                 5056  4 
>   ah4                     4672  0 
>   esp4                    5824  4 
>   aead                    5824  2 authenc,esp4
>   xfrm4_mode_tunnel       2176  28
> 
> It really shouldn't need ipv6. Full kernel config, lsmod before and
> after modprobing ipv6 are available at below URL's.
> 
> http://www.swanson.ukfsn.org/ipsec/config
> http://www.swanson.ukfsn.org/ipsec/lsmod-post-modprobe-ipv6
> http://www.swanson.ukfsn.org/ipsec/lsmod-pre-modprobe-ipv6
> 

--
Kazunori Miyazawa

View attachment "patch-fixing-af_key.txt" of type "text/plain" (531 bytes)