[Swan] Tunnel IPv4 over IPv6: connaddrfamily?

[Andreas Scherrer]

Dear libreswan wizards

I am trying to set up my first IPSec tunnel using libreswan (v3.23) on
one end and racoon on the other end.

The machines have IPv6 connectivity, so I want to (have to) use IPv6 for
the "outer" IPs.

Inside the tunnel I want to route IPv4 though.

To me it currently seems that the documentation does not match what I
see with regards to "connaddrfamily".

[1] states

"set connaddrfamily= to the family of the *subnet= options, and if those
are not defined, to the family of the left=/right= options"

So for me this would mean 'ipv4', because the 'leftsubnet' and
'rightsubnet' are IPv4.

But if I do that, I see the following error when pluto starts up:

-----
failed to convert '<left ipv6>' at load time: IPv4 address may not
contain `:'

and later

We cannot identify ourselves with either end of this connection.
0.0.0.0 or 0.0.0.0 are not usable
-----

So I tried with 'connaddrfamily=ipv6'.

With that, the tunnel comes up and I can reach (ping) through the tunnel
in both directions.

I have to explicitly set the source IP (192.168.112.1) when pinging from
"the libreswan end" though, while my understanding of the documentation
is that 'leftip=192.168.112.1' should take care of that? I assume this
is not working because it expects an IPv6 address there...

In addition, I see the following error in the libreswan/pluto log:

-----
ERROR: netlink XFRM_MSG_UPDPOLICY response for flow eroute_connection
add included errno 22: Invalid argument
-----

I am wondering now if my configuration is actually doing what it is
supposed to do. Is 'connaddrfamily=ipv6' the correct thing to do even if
the documentation states the opposite?


Thanks for any hints, corrections or reassurements.
andreas

Here is my libreswan config:

-----
# /etc/ipsec.d/home.conf - Libreswan IPsec configuration file

config setup
plutodebug=all
protostack=netkey
interfaces=%none

conn mytunnel
auto=start
connaddrfamily=ipv6
left=<left ipv6>
right=<right ipv6>
also=shared
also=mysubnet

conn shared
authby=secret
ike=aes-sha2_256;dh5
phase2alg=aes-sha2_256

conn mysubnet
leftsubnet=192.168.112.0/24
leftsourceip=192.168.112.1
rightsubnet=192.168.0.0/18
rightsourceip=192.168.1.1
-----

[1] https://libreswan.org/man/ipsec.conf.5.html

[Paul Wouters]

Post by Andreas Scherrer
Dear libreswan wizards
I am trying to set up my first IPSec tunnel using libreswan (v3.23) on one
end and racoon on the other end.
The machines have IPv6 connectivity, so I want to (have to) use IPv6 for the
"outer" IPs.
Inside the tunnel I want to route IPv4 though.

There is a bug in the parser. You can try the patch at:

https://github.com/libreswan/libreswan/issues/175

Post by Andreas Scherrer
So I tried with 'connaddrfamily=ipv6'.
With that, the tunnel comes up and I can reach (ping) through the tunnel in
both directions.
I have to explicitly set the source IP (192.168.112.1) when pinging from "the
libreswan end" though, while my understanding of the documentation is that
'leftip=192.168.112.1' should take care of that? I assume this is not working
because it expects an IPv6 address there...

You mean leftsourceip= ?

So you have two IPv4 addresses? An internal and external one? And you
set leftsourceip=internalip ?

That should work indeed.

Post by Andreas Scherrer
-----
ERROR: netlink XFRM_MSG_UPDPOLICY response for flow eroute_connection add
included errno 22: Invalid argument
-----

It might be trying to install the wrong family for the %trap and fail.
So auto=ondemand might not be working.

Post by Andreas Scherrer
I am wondering now if my configuration is actually doing what it is supposed
to do. Is 'connaddrfamily=ipv6' the correct thing to do even if the
documentation states the opposite?

These options are a bit busy and we do want to move to an auto-detection
for all of this. Sorry you were caught in these.

Paul