IPv4 tunneled over IPv6-IPsec?

IPv4 tunneled over IPv6-IPsec?

[Peter Bieringer]

Hello,

I retry to play tunneling IPv4 over IPv6-IPsec. Afair it is still not 
working (support is missing in 2.6.x kernel), but for startup, I have 
already a patch for ipsec.conf parsing (pluto already has an option to do 
this):

--- /usr/lib/ipsec/_confread.2.3.0      2005-03-26 19:23:13.715148147 +0100
+++ /usr/lib/ipsec/_confread    2005-03-26 20:26:46.002583265 +0100
@@ -131,7 +131,7 @@
        }

        good = "also alsoflip type auto authby _plutodevel"
-       good = good " connaddrfamily forceencaps"
+       good = good " connaddrfamily forceencaps tunneladdrfamily"
        good = good " modecfgpull"
        left = " left leftsubnet leftnexthop leftupdown"
        akey = " keyexchange auth pfs keylife rekey rekeymargin rekeyfuzz"
--- /usr/libexec/ipsec/auto.2.3.0       2005-03-26 20:27:17.677451842 +0100
+++ /usr/libexec/ipsec/auto     2005-03-26 20:29:52.165532980 +0100
@@ -482,6 +482,14 @@
                 } else if (s["connaddrfamily"] != "ipv4") {
                         fail("unknown connaddrfamily value " 
s["connaddrfamily"
])
                 }
+                default("tunneladdrfamily", "ipv4")
+                if (s["tunneladdrfamily"] == "ipv4") {
+                        settings = settings " --tunnelipv4"
+                } else if (s["tunneladdrfamily"] == "ipv6") {
+                        settings = settings " --tunnelipv6"
+                } else {
+                        fail("unknown tunneladdrfamily value " 
s["tunneladdrfamily"])
+                }
                 # END IPv6

                if (s["ike"] != "")


With upper patch it's possible to use following config:

conn ipv6-muc-pbg-net
        connaddrfamily=ipv6
        tunneladdrfamily=ipv4
        left=3ffe:ffff:1:0::2
        leftsubnet=192.168.1.0/24
        right=3ffe:ffff:2:0::2
        rightsubnet=192.168.2.0/24
	...

setkey -P -D already shows something like that:

192.168.1.0/24[any] 192.168.2.0/24[any] any
        out prio high + 1073739480 ipsec
        esp/tunnel/1.2.3.4-1.2.3.4/unique#16389
        created: Mar 26 20:35:11 2005  lastused:
        lifetime: 0(s) validtime: 0(s)
        spid=217 seq=25 pid=10039
        refcnt=1

Note that here occurs the first problem, at least setkey doesn't understand 
that the IPv4 networks are tunneled via IPv6-IPsec.
"ip -6 xfrm policy" has the same problem

As a second problem, no packets will be encrypted proper, they are lost in 
the networking stack somewhere...

Kernel version I've used for tests: 2.6.10-1.770_FC3 (Fedora Core 3).

Is there any status available when or ever IPv4 over IPv6-IPsec will be 
supported or is it already supported and something is going wrong here?

Regards,
        Peter
-- 
Dr. Peter Bieringer                     http://www.bieringer.de/pb/
GPG/PGP Key 0x958F422D               mailto: pb at bieringer dot de
Deep Space 6 Co-Founder and Core Member  http://www.deepspace6.net/

[Openswan dev] Re: IPv4 tunneled over IPv6-IPsec?

[Herbert Xu]

Peter Bieringer <pb@bieringer.de> wrote:
> 
> I retry to play tunneling IPv4 over IPv6-IPsec. Afair it is still not 
> working (support is missing in 2.6.x kernel), but for startup, I have 
> already a patch for ipsec.conf parsing (pluto already has an option to do 
> this):

The native IPsec stack doesn't support IPv4 over IPv6 or IPv6 over
IPv4 SAs.  It won't be able to do so unless major surgery is done
to the IPsec and IP stack.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: IPv4 tunneled over IPv6-IPsec?

[Peter Bieringer]

Hi Herbert,

thank you for quick reply.

--On Sonntag, 27. März 2005 20:05 +1000 Herbert Xu 
<herbert@gondor.apana.org.au> wrote:

> Peter Bieringer <pb@bieringer.de> wrote:
>>
>> I retry to play tunneling IPv4 over IPv6-IPsec. Afair it is still not
>> working (support is missing in 2.6.x kernel), but for startup, I have
>> already a patch for ipsec.conf parsing (pluto already has an option to
>> do  this):
>
> The native IPsec stack doesn't support IPv4 over IPv6 or IPv6 over
> IPv4 SAs.  It won't be able to do so unless major surgery is done
> to the IPsec and IP stack.

Hmm, looks like more a long term issue :-(

So another question: what is the status of tunneling IPv4 over IPv6 without 
IPsec e.g. using GRE or special native tunneling? Similar issue? I digged a 
little bit around in GRE code and found some IPv6 references but no hints 
whether it can be used for that also.


BTW: the reason why I'm looking for such support is the need to connect 
some "legacy" IPv4 islands over IPv6.

Regards,
	Peter
-- 
Dr. Peter Bieringer                     http://www.bieringer.de/pb/
GPG/PGP Key 0x958F422D               mailto: pb at bieringer dot de
Deep Space 6 Co-Founder and Core Member  http://www.deepspace6.net/

Re: IPv4 tunneled over IPv6-IPsec?

[Michael H. Warfield]

[-- Attachment #1: Type: text/plain, Size: 1949 bytes --]

Hey Peter!

On Sun, 2005-03-27 at 14:47 +0200, Peter Bieringer wrote:
> Hi Herbert,

> thank you for quick reply.

> --On Sonntag, 27. März 2005 20:05 +1000 Herbert Xu 
> <herbert@gondor.apana.org.au> wrote:

> > Peter Bieringer <pb@bieringer.de> wrote:
> >>
> >> I retry to play tunneling IPv4 over IPv6-IPsec. Afair it is still not
> >> working (support is missing in 2.6.x kernel), but for startup, I have
> >> already a patch for ipsec.conf parsing (pluto already has an option to
> >> do  this):
> >
> > The native IPsec stack doesn't support IPv4 over IPv6 or IPv6 over
> > IPv4 SAs.  It won't be able to do so unless major surgery is done
> > to the IPsec and IP stack.

> Hmm, looks like more a long term issue :-(

> So another question: what is the status of tunneling IPv4 over IPv6 without 
> IPsec e.g. using GRE or special native tunneling? Similar issue? I digged a 
> little bit around in GRE code and found some IPv6 references but no hints 
> whether it can be used for that also.

	You might want to check out the DSTM package here:

	<http://www.ipv6.rennes.enst-bretagne.fr/dstm/>

	That includes a tsp server as well as a 4over6 driver.  Jim Bound is
the author/editor of record for the IETF draft on DSTM.

	<http://www.ietf.org/internet-drafts/draft-bound-dstm-exp-02.txt>

	I've had it spun up on some Linux systems in the past for testing
purposes.  Unfortunately, it does not seem to be updated to build under
the 2.6 kernels.  :-(

> BTW: the reason why I'm looking for such support is the need to connect 
> some "legacy" IPv4 islands over IPv6.

> Regards,
> 	Peter

	Mike
-- 
 Michael H. Warfield    |  (770) 985-6132   |  mhw@WittsEnd.com  
  /\/\|=mhw=|\/\/       |  (678) 463-0932   |  http://www.wittsend.com/mhw/
  NIC whois:  MHW9      |  An optimist believes we live in the best of all
 PGP Key: 0xDF1DD471    |  possible worlds.  A pessimist is sure of it!

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 307 bytes --]