<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Hi. I found something funny.
<div class="">
<div class=""><br class="">
</div>
<div class="">I have a two machines having two interfaces but one default gateway.</div>
<div class=""><br class="">
</div>
<div class="">First of all, this is my setup. (Strongswan 5.3.5)</div>
<div class="">Client machine have</div>
<div class=""><br class="">
</div>
<div class="">
<div class=""><font face="Fixedsys Excelsior 3.01" style="font-size: 14px;" class="">eth0 </font><span style="font-family: 'Fixedsys Excelsior 3.01'; font-size: 14px;" class="">10.6.1.101</span><span style="font-family: 'Fixedsys Excelsior 3.01'; font-size: 14px;" class=""> </span></div>
<div class=""><font face="Fixedsys Excelsior 3.01" style="font-size: 14px;" class="">eth1 </font><span style="font-family: 'Fixedsys Excelsior 3.01'; font-size: 14px;" class="">10.2.1.170</span><span style="font-family: 'Fixedsys Excelsior 3.01'; font-size: 14px;" class=""> </span></div>
</div>
<div class=""><br class="">
</div>
<div class="">
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">Kernel IP routing table</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">Destination Gateway Genmask Flags Metric Ref Use Iface</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">10.2.0.0 * 255.255.0.0 U 1 0 0 eth1</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">10.6.0.0 * 255.255.0.0 U 1 0 0 eth0</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">default 10.6.0.1 0.0.0.0 UG 0 0 0 eth0</span></div>
</div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class=""><br class="">
</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">IPsec configuration</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class=""><br class="">
</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">
<div style="margin: 0px; line-height: normal;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">conn 4.0.0.10-2-1-175.0</span></div>
<div style="margin: 0px; line-height: normal;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> left=%any</span></div>
<div style="margin: 0px; line-height: normal;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> right=10.2.1.175</span></div>
<div style="margin: 0px; line-height: normal;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">conn 4.0.0.10-6-1-150.0</span></div>
<div style="margin: 0px; line-height: normal;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> left=%any</span></div>
<div style="margin: 0px; line-height: normal;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> right=10.6.1.150</span></div>
</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class=""><br class="">
</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class=""><br class="">
</span></div>
<div style="margin: 0px; line-height: normal;" class="">And server machine have </div>
<div class=""><br class="">
</div>
<div class=""><font face="Fixedsys Excelsior 3.01" style="font-size: 14px;" class="">eth0 10.6.1.150</font></div>
<div class=""><font face="Fixedsys Excelsior 3.01" style="font-size: 14px;" class="">eth1 10.2.1.175</font></div>
<div class=""><br class="">
</div>
<div class="">
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">Kernel IP routing table</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">Destination Gateway Genmask Flags Metric Ref Use Iface</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">10.2.0.0 * 255.255.0.0 U 1 0 0 eth1</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">10.6.0.0 * 255.255.0.0 U 1 0 0 eth0</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">default 10.6.0.1 0.0.0.0 UG 0 0 0 eth0</span></div>
</div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class=""><br class="">
</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">IPsec configuration</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class=""><br class="">
</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">
<div style="margin: 0px; line-height: normal;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">conn 4.0.0.10-2-1-170.0</span></div>
<div style="margin: 0px; line-height: normal;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> left=%any</span></div>
<div style="margin: 0px; line-height: normal;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> right=10.2.1.170</span></div>
<div style="margin: 0px; line-height: normal;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">conn 4.0.0.10-6-1-101.0</span></div>
<div style="margin: 0px; line-height: normal;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> left=%any</span></div>
<div style="margin: 0px; line-height: normal;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> right=10.6.1.101</span></div>
</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<br class="">
</div>
<div class=""><br class="">
</div>
<div class="">
<div class=""><br class="">
</div>
<div class="">And here is what I see.</div>
<div class=""><br class="">
</div>
<div class="">because both of machine is set to %any, it will choose best source ip address when stroke try to install route.</div>
<div class="">In my case, StrongSwan installs route as follows.</div>
<div class=""><br class="">
</div>
<div class="">
<div style="font-family: 'Fixedsys Excelsior 3.01'; font-size: 14px; margin: 0px; line-height: normal;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class="">Routed Connections:</span></div>
<div style="font-family: 'Fixedsys Excelsior 3.01'; font-size: 14px; margin: 0px; line-height: normal;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class="">4.0.0.10-6-1-150.0{2}: ROUTED, TRANSPORT, reqid 2</span></div>
<div style="font-family: 'Fixedsys Excelsior 3.01'; font-size: 14px; margin: 0px; line-height: normal;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class="">4.0.0.10-6-1-150.0{2}: 10.6.1.101/32 === 10.6.1.150/32</span></div>
<div style="font-family: 'Fixedsys Excelsior 3.01'; font-size: 14px; margin: 0px; line-height: normal;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class="">4.0.0.10-2-1-175.0{1}: ROUTED, TRANSPORT, reqid 1</span></div>
<div style="font-family: 'Fixedsys Excelsior 3.01'; font-size: 14px; margin: 0px; line-height: normal;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class="">4.0.0.10-2-1-175.0{1}: 10.6.1.101/32 === 10.2.1.175/32</span></div>
</div>
<div style="font-family: 'Fixedsys Excelsior 3.01'; font-size: 14px; margin: 0px; line-height: normal;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class=""><br class="">
</span></div>
<div class=""><br class="">
</div>
<div class="">
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">Routed Connections:</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">4.0.0.10-6-1-101.0{2}: ROUTED, TRANSPORT, reqid 2</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">4.0.0.10-6-1-101.0{2}: 10.6.1.150/32 === 10.6.1.101/32</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">4.0.0.10-2-1-170.0{1}: ROUTED, TRANSPORT, reqid 1</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">4.0.0.10-2-1-170.0{1}: 10.6.1.150/32 === 10.2.1.170/32</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">Security Associations (0 up, 0 connecting):</span></div>
</div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class=""><br class="">
</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<br class="">
</div>
<div style="margin: 0px; font-size: 14px; line-height: normal;" class=""><span style="font-variant-ligatures: no-common-ligatures;" class="">So when the data traffic from 10.2.1.170 to 10.2.1.175 won’t trigger IKE/IPSec.</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal;" class=""><span style="font-variant-ligatures: no-common-ligatures;" class=""><br class="">
</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal;" class="">I guess this is a bug in get_route function in ./libhydra/plugins/kernel_netlink/kernel_netlink_net.c</div>
<div style="margin: 0px; font-size: 14px; line-height: normal;" class=""><br class="">
</div>
<div style="margin: 0px; font-size: 14px; line-height: normal;" class="">After query RTM_GETROUTE, it will collect all the possible route entries.</div>
<div style="margin: 0px; font-size: 14px; line-height: normal;" class=""><br class="">
</div>
<div style="margin: 0px; font-size: 14px; line-height: normal;" class="">With above network setup it will collect two route entries to destination 10.2.1.xx.</div>
<div style="margin: 0px; font-size: 14px; line-height: normal;" class=""><br class="">
</div>
<div style="margin: 0px; font-size: 14px; line-height: normal;" class="">However only one entry will have src_host.</div>
<div style="margin: 0px; font-size: 14px; line-height: normal;" class=""><br class="">
</div>
<div style="margin: 0px; font-size: 14px; line-height: normal;" class="">Then when it loop through collected route entries to get the best source ip address, depends on the order of route entries</div>
<div style="margin: 0px; font-size: 14px; line-height: normal;" class=""><br class="">
</div>
<div style="margin: 0px; line-height: normal;" class=""><font class=""><span style="font-size: 14px;" class=""> it will hit the entry without source ip address but OIF first, that will break right away and give that address as best address, which is not what
I wanted.</span></font></div>
<div style="margin: 0px; line-height: normal;" class=""><br class="">
</div>
<div style="margin: 0px; line-height: normal;" class=""><span style="font-size: 14px;" class="">Is this bug or on purpose?</span></div>
<div style="margin: 0px; line-height: normal;" class=""><br class="">
</div>
<div style="margin: 0px; line-height: normal;" class=""><span style="font-size: 14px;" class="">And why do we collect route entry that doesn’t have source ip address in the first place when we collect route entries?</span></div>
<div style="margin: 0px; line-height: normal;" class=""><span style="font-size: 14px;" class=""><br class="">
</span></div>
<div style="margin: 0px; line-height: normal;" class=""><span style="font-size: 14px;" class="">Thanks.</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal;" class=""><font face="Fixedsys Excelsior 3.01" class=""><br class="">
</font></div>
<div style="margin: 0px; font-size: 14px; line-height: normal;" class=""><span style="font-family: 'Fixedsys Excelsior 3.01';" class=""><br class="">
</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal;" class=""><span style="font-family: 'Fixedsys Excelsior 3.01';" class=""><br class="">
</span></div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<br class="">
</div>
<div style="margin: 0px; font-size: 14px; line-height: normal; font-family: 'Fixedsys Excelsior 3.01';" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">
<div style="margin: 0px; line-height: normal;" class=""><br class="">
</div>
<div style="margin: 0px; line-height: normal;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><br class="">
</span></div>
</span></div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
</div>
</div>
</body>
</html>