Page MenuHomeVyOS Platform
Create Task
Maniphest T9468

IPsec VTI: dual-stack traffic selectors in a single CHILD_SA are narrowed to IPv4 by some peers (Sophos SFOS)
Open, NormalPublicBUG
Actions

Description

Description

A route-based (VTI) site-to-site peer with IPv4 and IPv6 traffic selectors in one CHILD_SA only carries IPv4 when the remote side is a Sophos Firewall (SFOS 22.0.2 MR-2). IPv6 over the tunnel does not work.

Version

VyOS 1.5.1

Configuration (relevant part)

set interfaces vti vti0 address '192.0.2.2/30'
set interfaces vti vti0 address '2001:db8:1004::2/64'
set vpn ipsec site-to-site peer peer1 vti bind 'vti0'
set vpn ipsec site-to-site peer peer1 vti traffic-selector local prefix '0.0.0.0/0'
set vpn ipsec site-to-site peer peer1 vti traffic-selector local prefix '::/0'
set vpn ipsec site-to-site peer peer1 vti traffic-selector remote prefix '0.0.0.0/0'
set vpn ipsec site-to-site peer peer1 vti traffic-selector remote prefix '::/0'

The Sophos side is a route-based connection with IP version "Dual".

Observed

The tunnel is established, but the CHILD_SA only contains IPv4:

peer1-vti: #1, reqid 1, INSTALLED, TUNNEL-in-UDP, ESP:AES_GCM_16-256
    local  0.0.0.0/0
    remote 0.0.0.0/0

ip xfrm policy has policies for 0.0.0.0/0 only, ip -6 xfrm policy has none for the tunnel.
ping 2001:db8:1004::1 fails with Destination unreachable: Address unreachable.

Test

With only ::/0 as traffic selector (IPv4 prefixes removed), the CHILD_SA is established with local ::/0 / remote ::/0 and the IPv6 ping works (14.6 ms). So both families work, just not inside one CHILD_SA.

Cause

data/templates/ipsec/swanctl/peer.j2 renders exactly one child per VTI peer (<peer>-vti) and puts all prefixes of both families into one local_ts / remote_ts. The responder is allowed to narrow the traffic selectors (RFC 7296 section 2.9) and this Sophos picks one family. strongSwan does not retry with a second CHILD_SA for the rest.

Expected

A dual-stack VTI peer should be able to carry both families, also against peers that only accept one family per CHILD_SA.

Proposal

Add an option (for example vti traffic-selector split-by-family) that renders two children for the peer, one with the IPv4 prefixes and one with the IPv6 prefixes. Same if_id, same ESP group. Without the option nothing changes for existing peers.
Needs a look at src/op_mode/ipsec.py (only knows <peer>-vti) and at vti-up-down (called once per child).

Workaround

Two peers with two VTIs and different local IDs, one per address family.

Details

Version
1.5.1
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Bug (incorrect behavior)

Event Timeline

rherold created this task.Fri, Oct 16, 2:46 PM
Viacheslav subscribed.Fri, Oct 16, 4:20 PM

@rherold, what will happen if you remove the traffic-selector option altogether?

rherold added a comment.Fri, Oct 16, 4:45 PM

PR: https://github.com/vyos/vyos-1x/pull/5565

rherold added a comment.Fri, Oct 16, 4:50 PM

@Viacheslav

With no traffic-selector configured, the template falls back to 0.0.0.0/0,::/0 for both local and remote. That is the same proposal as listing both families explicitly, so the result is identical: the responder narrows the CHILD_SA to IPv4 and IPv6 stays down. The default does not help, because both families are always sent in one CHILD_SA.
The only way to get both families up against this peer is one CHILD_SA per family. That is what the PR does: https://github.com/vyos/vyos-1x/pull/5565. I tested it against a real Sophos Firewall by configuring the two children by hand: both were installed and IPv6 worked, with no change on the Sophos side.

The documentation is ready as well (new option on the site-to-site IPsec page). I cannot open the docs PR yet because of the open pull request limit for contributors without write access. It will follow once a slot is free, and it will link to the PR above.

rherold claimed this task.Fri, Oct 16, 5:04 PM
pasik subscribed.Sat, Oct 17, 9:27 AM
Viacheslav triaged this task as Normal priority.Mon, Oct 19, 4:05 PM