Bug 1311627

Summary: Gateway IP address not properly set in IKE replies
Product: [Fedora] Fedora Reporter: Patrick Monnerat <patrick>
Component: strongswanAssignee: Pavel Šimerda (pavlix) <psimerda>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 23CC: avagarwa, psimerda
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-07-13 14:26:59 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Patrick Monnerat 2016-02-24 15:49:31 UTC 
Description of problem:
The IKE replies have their source IP set according to the connection interface, even if the gateway address is bound to another interface.

Version-Release number of selected component (if applicable):
strongswan-5.3.2-2.fc23.x86_64

How reproducible:
Always


Steps to Reproduce:
1. Set an IP address (x.x.x.x) on eth0 for real traffic.
2. Set a gateway IP address (y.y.y.y) on eth1, configure and add a tunnel using it.
3. On an external machine (with ip z.z.z.z), set a route to gateway IP address via the eth0 IP address and configure the other end of the tunnel.
4. Monitor the traffic with wireshark.
5. Start the tunnel from the external machine. 

Actual results:
The initial request: z.z.z.z --> y.y.y.y
The strongswan reply: x.x.x.x --> z.z.z.z

The reply source address puzzles the initiator :-(

Expected results:
The strongswan reply: y.y.y.y --> z.z.z.z


Additional info:
This seems to be https://wiki.strongswan.org/issues/1171. The upstream commit https://wiki.strongswan.org/projects/strongswan/repository/revisions/47e113a63905305fdb7eee8304a5eb1adcb216d4/diff?format=diff fixes this issue for me.
Comment 1 Pavel Šimerda (pavlix) 2016-07-13 14:26:59 UTC 
Strongswan has recently been updated to 5.4.0 in Fedora.