strongSwan

Hi,

it seems that passthrough connection install wrong routing rules in the 220 routing table (using strongSwan 5.1.3)

IPv4¶

For example, on a network with routing table:

default via 192.168.28.254 dev eth0  proto static 
192.168.28.0/24 dev eth0  proto kernel  scope link  src 192.168.28.56  

and with other local subnets accessible in 192.168.0.0/16.

Installing a passthrough connection with:

conn pass
  leftsubnet=192.168.0.0/16
  rightsubnet=192.168.0.0/16
  type=passthrough
  auto=route

will setup a routing table like:

ip route show table 220
192.168.0.0/16 via 192.168.28.254 dev eth0  proto static  src 192.168.28.56

so that means all traffic for 192.168.0.0/16 should be sent to 192.168.28.254. That will fail for trafic to the local subnet (192.168.28.0/24) since that gateway would like to resent that trafic through the same interface. That trafic should be sent directly after ARP resolution, table 220 lacks a rule like:

192.168.28.0/24 dev eth0

IPv6¶

On the opposite, on an IPv6 network with local address 2001:xxxx:yyyy:zz::1/64 and with the following routing table:

local ::1 dev lo  proto kernel  metric 256 
2001:xxxx:yyyy:zz::/64 dev eth0  proto kernel  metric 256  expires 86398sec
fe80::/64 dev eth0  proto kernel  metric 256 
default via fe80::aaaa:aaff:feaa:aaaa dev eth0  proto ra  metric 1024  expires 1798sec

and a “local” network 2001:xxxx:yyyy::/48 accessible through the fe80::aaaa:aaff:feaa:aaaa.

Adding a passthrough connection like:

conn pass6
        rightsubnet=2001:xxxx:yyyy::0/48
        leftsubnet=2001:xxxx:yyyy::0/48
        type=passthrough
        auto=route

sets up a 220 routing table like:

2001:xxxx:yyyy::/48 dev eth0  proto static  src 2001:xxxx:yyyy:zz::1

So that means the whole /48 is considered to be on the same subnet and ipv6 neighbor discoveries are sent for trafic which should instead be sent to the local gateway.

That means the 220 routing table should be like:

2001:xxxx:yyyy:zz::/64 dev eth0 
2001:xxxx:yyyy::/48 via fe80::aaaa:aaff:feaa:aaaa dev eth0

Summary¶

So it seems that both IPv4 and IPv6 passtrhough connections are broken, but differently:

• on IPv4, all the passthrough traffic is sent to the default gateway, including trafic for the local subnet;
• on IPv6, all the passthrough traffic is sent locally, including traffic which sould be sent through the correct gateway.