netdev - Strange issue with IPv6 through ipsec

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 01 Mar 2012 00:43:28 +0100
From:	Niccolò Belli <darkbasic@...uxsystems.it>
To:	netdev@...r.kernel.org
CC:	users@...ts.strongswan.org
Subject: Strange issue with IPv6 through ipsec

Hi,
I'm not sure if netdev is the right place, that's a strange behavior but 
I'm not sure if it's a bug because I'm an IPv6 newbie.

I'd like to give my servers IPv6 connectivity for the World IPv6 Launch, 
so I bought a virtual machine with IPv6 connectivity and I asked to 
route a /56, then I extruded it through an IKEv2 ipsec tunnel 
(Strongswan 4.5.3 on Debian Squeeze amd64).

A is the virtual machine with IPv6 connectivity.
B is the other peer.
A has IPv6 a:b:c:d::1/64
The routed subnet is a:b:c:300::/56

After the tunnel creation I add an IPv6 to B external interface:
ip -6 addr add a:b:c:301::1/6 dev nas0
Then I create a default route:
ip -6 route add default via a:b:c:0301::2 dev nas0

Now I can ping A from B and B from A.
If I destroy and re-create the tunnel everything keep working.

If instead of adding an IPv6 to nas0 I add it to eth0 (an internal 
interface):
ip -6 addr add a:b:c:301::1/6 dev eth0
ip -6 route add default via a:b:c:0301::2 dev eth0

it still works (A con ping B and B can ping A) *BUT* if I destroy and 
re-create the tunnel it doesn't work anymore!
I have to type:
ip -6 addr del a:b:c:301::1/6 dev eth0
ip -6 addr add a:b:c:301::1/6 dev eth0
ip -6 route add default via a:b:c:0301::2 dev eth0

to make it work again O_O

Cheers,
Niccolò
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html