Re: IPSEC IPV4 Tunnel Requires IPV6 WIth 2.6.25?

[Kazunori MIYAZAWA <kazunori@miyazawa.org>]

[-- Attachment #1: Type: text/plain, Size: 2273 bytes --]

Hello,

This patch fixes the problem.
I though that someone (sorry I foget) sent the same patch
when netlink was fixed.

Alan Swanson wrote:
> Hi. Usual non-subscriber CC replies request please.
> 
> There is a problem with 2.6.25(.4) using IPSEC on ipv4. You seem to need
> to have ipv6 available otherwise a protocol not supported error is
> returned when trying to set a Security Association Database. I'm using
> setkey on a file but another user on the ipsec-tools-devel list reported
> the same issue using racoon.
> 
> http://marc.info/?l=ipsec-tools-devel&m=121015164014761&w=2
> 
> So with modules loaded you expect to work.
> 
> $ lsmod
>   Module                  Size  Used by
>   authenc                 5056  0 
>   ah4                     4672  0 
>   esp4                    5824  0 
>   aead                    5824  2 authenc,esp4
>   xfrm4_mode_tunnel       2176  20
> 
> A static file with tunnel configuration for laptop to desktop over open
> wireless not running WEP/WPA.
> 
> $ head -n 12 /etc/ipsec.conf
>   #!/usr/sbin/setkey -f
>   
>   flush;
>   spdflush;
>   
>   add 1.1.1.1 2.2.2.2 esp 0x500 -m tunnel
>   -E rijndael-cbc 0x...
>   -A hmac-sha1 0x...;
>   
>   add 2.2.2.2 1.1.1.1 esp 0x501 -m tunnel
>   -E rijndael-cbc 0x...
>   -A hmac-sha1 0x...;
> 
> You get protocol not supported error.
> 
> $ setkey -f /etc/ipsec.conf
>   The result of line 8: Protocol not supported.
>   The result of line 12: Protocol not supported.
> 
> But after modprobing ipv6 which automatically pulls
> in xfrm6_mode_tunnel, setkey starts working and I can communicate via
> IPSEC.
> 
> $ lsmod
>   Module                  Size  Used by
>   xfrm6_mode_tunnel       2048  4 
>   ipv6                  217444  10 xfrm6_mode_tunnel
>   authenc                 5056  4 
>   ah4                     4672  0 
>   esp4                    5824  4 
>   aead                    5824  2 authenc,esp4
>   xfrm4_mode_tunnel       2176  28
> 
> It really shouldn't need ipv6. Full kernel config, lsmod before and
> after modprobing ipv6 are available at below URL's.
> 
> http://www.swanson.ukfsn.org/ipsec/config
> http://www.swanson.ukfsn.org/ipsec/lsmod-post-modprobe-ipv6
> http://www.swanson.ukfsn.org/ipsec/lsmod-pre-modprobe-ipv6
> 

--
Kazunori Miyazawa

[-- Attachment #2: patch-fixing-af_key.txt --]
[-- Type: text/plain, Size: 531 bytes --]

signed-off-by: Kazunori MIYAZAWA <kazunori@miyazawa.org>

diff --git a/net/key/af_key.c b/net/key/af_key.c
index e9ef9af..835e307 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1219,7 +1219,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct sadb_msg *hdr,
                x->sel.prefixlen_s = addr->sadb_address_prefixlen;
        }
 
-       if (x->props.mode == XFRM_MODE_TRANSPORT)
+       if (!x->sel.mode)
                x->sel.family = x->props.family;
 
        if (ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1]) {