Project

General

Profile

Bug #207

ikev1, auto=route narrows subnet based TS to protocol port used

Added by Kimmo Koivisto over 7 years ago. Updated over 7 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
charon
Target version:
Start date:
26.07.2012
Due date:
Estimated time:
Affected version:
5.0.0
Resolution:

Description

When IKEv1, auto=route and /24 subnets in both sites, auto=route incorrectly narrows Traffic Selectors.

When traffic is initiated, IPsec SA is narrowed/negotiated only for the protocol/port used but not for subnets.
Example: using ssh from site1 to site2, TS is
172.16.60.10/32[tcp/ssh] === 172.16.50.10/32[tcp/49298]

Expected behaviour is that TS would be
172.16.60.0/24[any] === 172.16.50.0/24[any]

If auto=start is used, TS is as expected.

ecdsa-comment:
I think that bug was introduced in an attempt to
fix IKEv1 reauthentication (where we do want to reuse the smaller TS
in case of narrowing).

Associated revisions

Revision 777bcdc0 (diff)
Added by Martin Willi over 7 years ago

Don't include acquiring packet traffic selectors in IKEv1

As we only can negotiate a single TS in IKEv1, don't prepend the
triggering packet TS, as we do in IKEv2. Otherwise we don't establish
the TS of the configuration, but only that of the triggering packet.

Fixes #207.

History

#1 Updated by Martin Willi over 7 years ago

  • Status changed from New to Closed
  • Assignee set to Martin Willi
  • Target version set to 5.0.1

Ah yes, almost forgotten, thanks Kimmo.

The referenced patch should fix this issue.

Also available in: Atom PDF