Bug 1311627 - Gateway IP address not properly set in IKE replies
Gateway IP address not properly set in IKE replies
Product: Fedora
Classification: Fedora
Component: strongswan (Show other bugs)
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Pavel Šimerda (pavlix)
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2016-02-24 10:49 EST by Patrick Monnerat
Modified: 2016-07-13 10:26 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2016-07-13 10:26:59 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Patrick Monnerat 2016-02-24 10:49:31 EST
Description of problem:
The IKE replies have their source IP set according to the connection interface, even if the gateway address is bound to another interface.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Set an IP address (x.x.x.x) on eth0 for real traffic.
2. Set a gateway IP address (y.y.y.y) on eth1, configure and add a tunnel using it.
3. On an external machine (with ip z.z.z.z), set a route to gateway IP address via the eth0 IP address and configure the other end of the tunnel.
4. Monitor the traffic with wireshark.
5. Start the tunnel from the external machine. 

Actual results:
The initial request: z.z.z.z --> y.y.y.y
The strongswan reply: x.x.x.x --> z.z.z.z

The reply source address puzzles the initiator :-(

Expected results:
The strongswan reply: y.y.y.y --> z.z.z.z

Additional info:
This seems to be https://wiki.strongswan.org/issues/1171. The upstream commit https://wiki.strongswan.org/projects/strongswan/repository/revisions/47e113a63905305fdb7eee8304a5eb1adcb216d4/diff?format=diff fixes this issue for me.
Comment 1 Pavel Šimerda (pavlix) 2016-07-13 10:26:59 EDT
Strongswan has recently been updated to 5.4.0 in Fedora.

Note You need to log in before you can comment on or make changes to this bug.