ipsec tunnel with different inner and outer ip families

ipsec tunnel with different inner and outer ip families

[Prashant Batra (prbatra)]

[-- Attachment #1.1: Type: text/plain, Size: 1007 bytes --]

Hello,

 

Does linux 2.6.* support an IPSec tunnel with different family of inner
and outer addresses , like v4 in v6 or v6 in v4.

After trying ip xfrm * from user space, the utility doesn't seem to
accept two different families in a single command.

 

#ip xfrm policy add dir out src 172.168.68.1/32 dst 172.168.68.2/32 tmpl
src 2001:db8:0:242::36/128 dst 2001:db8:0:242::37/128 proto esp  mode
tunnel

Error: an inet prefix is expected rather than "2001:db8:0:242::36/128".

 

So, I tried sending a NETLINK SPD add message) from user space with,
selector as v4 addresses and tmpl as v6 address.

Policy got added but kernel doesn't seem to be interpreting the
addresses correctly.

 

src 172.16.80.1/32 dst 0.0.0.0/0

        dir out priority 1024

        tmpl    src 32.1.13.184 dst 32.1.13.184   /* I gave ipv6
addresses here*/

                proto esp spi 0x00000000 reqid 0 mode tunnel

 

Can someone help me with this?

 

Regards,

Prashant.


[-- Attachment #1.2: Type: text/html, Size: 3491 bytes --]

[-- Attachment #2: Type: text/plain, Size: 186 bytes --]

------------------------------------------------------------------------------
RSA(R) Conference 2012
Mar 27 - Feb 2
Save $400 by Jan. 27
Register now!
http://p.sf.net/sfu/rsa-sfdev2dev2

[-- Attachment #3: Type: text/plain, Size: 0 bytes --]

Re: ipsec tunnel with different inner and outer ip families

[Prashant Batra (prbatra)]

[-- Attachment #1.1: Type: text/plain, Size: 2712 bytes --]

Thanks, 

 

But  even v6 in v4 doesn't seem to work with NETLINK XFRM interface.

 

Regards,

Prashant

 

From: Loren M. Lang [mailto:lorenl-/TqMqfqZm+BBDgjK7y7TUQ@public.gmane.org] 
Sent: Friday, January 13, 2012 12:58 PM
To: Prashant Batra (prbatra)
Cc: ipsec-tools-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org; netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
Subject: Re: [Ipsec-tools-devel] ipsec tunnel with different inner and
outer ip families

 

On 1/12/2012 11:11 PM, Prashant Batra (prbatra) wrote: 

Hello,

 

Does linux 2.6.* support an IPSec tunnel with different family of inner
and outer addresses , like v4 in v6 or v6 in v4.

After trying ip xfrm * from user space, the utility doesn't seem to
accept two different families in a single command.


Yes, I've done this in the past, but I took a different approach.  If I
recall correctly, I use IPSec in tunnel mode to tunnel IPv6 inside ESP
running over IPv4.  I haven't used ip xfrm before, but I did it with
setkey and /etc/ipsec.conf with lines like the following:

spdadd 192.168.1.1 192.168.2.1 ipv6 -P in ipsec esp/transport//require;
spdadd 192.168.2.1 192.168.1.1 ipv6 -P out ipsec esp/transport//require;

Unfortunately, I'm not in a state to test this right now.



 

#ip xfrm policy add dir out src 172.168.68.1/32 dst 172.168.68.2/32 tmpl
src 2001:db8:0:242::36/128 dst 2001:db8:0:242::37/128 proto esp  mode
tunnel

Error: an inet prefix is expected rather than "2001:db8:0:242::36/128".

 

So, I tried sending a NETLINK SPD add message) from user space with,
selector as v4 addresses and tmpl as v6 address.

Policy got added but kernel doesn't seem to be interpreting the
addresses correctly.

 

src 172.16.80.1/32 dst 0.0.0.0/0

        dir out priority 1024

        tmpl    src 32.1.13.184 dst 32.1.13.184   /* I gave ipv6
addresses here*/

                proto esp spi 0x00000000 reqid 0 mode tunnel

 

Can someone help me with this?

 

Regards,

Prashant.






------------------------------------------------------------------------
------
RSA(R) Conference 2012
Mar 27 - Feb 2
Save $400 by Jan. 27
Register now!
http://p.sf.net/sfu/rsa-sfdev2dev2






_______________________________________________
Ipsec-tools-devel mailing list
Ipsec-tools-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
https://lists.sourceforge.net/lists/listinfo/ipsec-tools-devel






-- 
Loren M. Lang
lorenl-/TqMqfqZm+BBDgjK7y7TUQ@public.gmane.org
http://www.alzatex.com/
 
 
Public Key: ftp://ftp.tallye.com/pub/lorenl_pubkey.asc
Fingerprint: 10A0 7AE2 DAF5 4780 888A  3FA4 DCEE BB39 7654 DE5B

[-- Attachment #1.2: Type: text/html, Size: 8055 bytes --]

[-- Attachment #2: Type: text/plain, Size: 186 bytes --]

------------------------------------------------------------------------------
RSA(R) Conference 2012
Mar 27 - Feb 2
Save $400 by Jan. 27
Register now!
http://p.sf.net/sfu/rsa-sfdev2dev2

[-- Attachment #3: Type: text/plain, Size: 0 bytes --]

Re: ipsec tunnel with different inner and outer ip families

[Stephen Clark]

[-- Attachment #1.1: Type: text/plain, Size: 1947 bytes --]

Hi,

I couldn't get it to work either. So I made and ipv4 in ipv6 tunnel, 
then did an ipv4 to ipv4 ipsec tunnel inside of ipv4-in-ipv6 tunnel.
Then gre inside of ipv4 ipsec tunnel so I could run OSPF - works great.

HTH,
Steve

On 01/13/2012 02:11 AM, Prashant Batra (prbatra) wrote:
>
> Hello,
>
> Does linux 2.6.* support an IPSec tunnel with different family of 
> inner and outer addresses , like v4 in v6 or v6 in v4.
>
> After trying ip xfrm * from user space, the utility doesn't seem to 
> accept two different families in a single command.
>
> #ip xfrm policy add dir out src 172.168.68.1/32 dst 172.168.68.2/32 
> tmpl src 2001:db8:0:242::36/128 dst 2001:db8:0:242::37/128 proto esp  
> mode tunnel
>
> Error: an inet prefix is expected rather than "2001:db8:0:242::36/128".
>
> So, I tried sending a NETLINK SPD add message) from user space with, 
> selector as v4 addresses and tmpl as v6 address.
>
> Policy got added but kernel doesn't seem to be interpreting the 
> addresses correctly.
>
> src 172.16.80.1/32 dst 0.0.0.0/0
>
>         dir out priority 1024
>
>         tmpl    src 32.1.13.184 dst 32.1.13.184   /* I gave ipv6 
> addresses here*/
>
>                 proto esp spi 0x00000000 reqid 0 mode tunnel
>
> Can someone help me with this?
>
> Regards,
>
> Prashant.
>
>
> ------------------------------------------------------------------------------
> RSA(R) Conference 2012
> Mar 27 - Feb 2
> Save $400 by Jan. 27
> Register now!
> http://p.sf.net/sfu/rsa-sfdev2dev2
>
>
> _______________________________________________
> Ipsec-tools-devel mailing list
> Ipsec-tools-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
> https://lists.sourceforge.net/lists/listinfo/ipsec-tools-devel
>    


-- 

"They that give up essential liberty to obtain temporary safety,
deserve neither liberty nor safety."  (Ben Franklin)

"The course of history shows that as a government grows, liberty
decreases."  (Thomas Jefferson)




[-- Attachment #1.2: Type: text/html, Size: 4959 bytes --]

[-- Attachment #2: Type: text/plain, Size: 186 bytes --]

------------------------------------------------------------------------------
RSA(R) Conference 2012
Mar 27 - Feb 2
Save $400 by Jan. 27
Register now!
http://p.sf.net/sfu/rsa-sfdev2dev2

[-- Attachment #3: Type: text/plain, Size: 0 bytes --]

ipsec tunnel with different inner and outer ip families

[Prashant Batra (prbatra)]

Hello,

Does linux 2.6.* support an IPSec tunnel with different family of inner and outer addresses , like v4 in v6 or v6 in v4.
After trying ip xfrm * from user space, the utility doesn't seem to accept two different families in a single command.

#ip xfrm policy add dir out src 172.168.68.1/32 dst 172.168.68.2/32 tmpl src 2001:db8:0:242::36/128 dst 2001:db8:0:242::37/128 proto esp  mode tunnel
Error: an inet prefix is expected rather than "2001:db8:0:242::36/128".

So, I tried sending a NETLINK SPD add message) from user space with, selector as v4 addresses and tmpl as v6 address.
Policy got added but kernel doesn't seem to be interpreting the addresses correctly.

src 172.16.80.1/32 dst 0.0.0.0/0
        dir out priority 1024
        tmpl    src 32.1.13.184 dst 32.1.13.184   /* I gave ipv6 addresses here*/
                proto esp spi 0x00000000 reqid 0 mode tunnel

Can someone help me with this?

Regards,
Prashant.

Re: ipsec tunnel with different inner and outer ip families

[Herbert Xu]

Prashant Batra prbatra <prbatra@cisco.com> wrote:
> Hello,
> 
> Does linux 2.6.* support an IPSec tunnel with different family of inner and outer addresses , like v4 in v6 or v6 in v4.
> After trying ip xfrm * from user space, the utility doesn't seem to accept two different families in a single command.
> 
> #ip xfrm policy add dir out src 172.168.68.1/32 dst 172.168.68.2/32 tmpl src 2001:db8:0:242::36/128 dst 2001:db8:0:242::37/128 proto esp  mode tunnel
> Error: an inet prefix is expected rather than "2001:db8:0:242::36/128".
> 
> So, I tried sending a NETLINK SPD add message) from user space with, selector as v4 addresses and tmpl as v6 address.
> Policy got added but kernel doesn't seem to be interpreting the addresses correctly.
> 
> src 172.16.80.1/32 dst 0.0.0.0/0
>         dir out priority 1024
>         tmpl    src 32.1.13.184 dst 32.1.13.184   /* I gave ipv6 addresses here*/
>                 proto esp spi 0x00000000 reqid 0 mode tunnel
> 
> Can someone help me with this?

The kernel is certainly supposed to support inter-family SAs
and policies.  However, I wouldn't be surprised if it's buggy
as very few people use it.

Cheers,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt