Dotaz: OpenVPN - prideluje IPv6 na serveru bez IPv6. Proc?

[tuxmartin]

Ahoj, mam na serveru OpenVPN 2.2.1, Ubuntu 12.04 server 64bit.

Mam zakazane IPv6:

# cat /proc/sys/net/ipv6/conf/all/disable_ipv6
1

# ifconfig 
br0       Link encap:Ethernet  HWadr xxxxxxxxxxxxxxxxxxxx  
          inet adr:192.168.1.1  Všesměr:192.168.1.255  Maska:255.255.255.0
          AKTIVOVÁNO VŠESMĚROVÉ_VYSÍLÁNÍ BĚŽÍ MULTICAST  MTU:1500  Metrika:1
          RX packets:22224950 errors:0 dropped:0 overruns:0 frame:0
          TX packets:28584376 errors:0 dropped:0 overruns:0 carrier:0
          kolizí:0 délka odchozí fronty:0 
          Přijato bajtů: 10794074559 (10.7 GB) Odesláno bajtů: 33068521418 (33.0 GB)

eth1      Link encap:Ethernet  HWadr xxxxxxxxxxxxxxxxxxxx
          AKTIVOVÁNO VŠESMĚROVÉ_VYSÍLÁNÍ BĚŽÍ MULTICAST  MTU:1500  Metrika:1
          RX packets:6169544 errors:0 dropped:0 overruns:0 frame:0
          TX packets:7766258 errors:0 dropped:0 overruns:0 carrier:0
          kolizí:0 délka odchozí fronty:1000 
          Přijato bajtů: 2438009579 (2.4 GB) Odesláno bajtů: 8237573676 (8.2 GB)
          Přerušení:16 Paměť:80400000-80420000 

eth2      Link encap:Ethernet  HWadr xxxxxxxxxxxxxxxxxxxx
          inet adr:192.168.103.26  Všesměr:192.168.103.255  Maska:255.255.255.0
          AKTIVOVÁNO VŠESMĚROVÉ_VYSÍLÁNÍ BĚŽÍ MULTICAST  MTU:1500  Metrika:1
          RX packets:24185354 errors:0 dropped:0 overruns:0 frame:0
          TX packets:16767757 errors:0 dropped:0 overruns:0 carrier:0
          kolizí:0 délka odchozí fronty:1000 
          Přijato bajtů: 30203069888 (30.2 GB) Odesláno bajtů: 2814583836 (2.8 GB)
          Přerušení:47 Vstupně/Výstupní port:0x2000 

tap0      Link encap:Ethernet  HWadr xxxxxxxxxxxxxxxxxxxx
          inet adr:192.168.2.1  Všesměr:192.168.2.255  Maska:255.255.255.0
          AKTIVOVÁNO VŠESMĚROVÉ_VYSÍLÁNÍ BĚŽÍ MULTICAST  MTU:1500  Metrika:1
          RX packets:221 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5897 errors:0 dropped:0 overruns:0 carrier:0
          kolizí:0 délka odchozí fronty:100 
          Přijato bajtů: 27508 (27.5 KB) Odesláno bajtů: 1450290 (1.4 MB)

wlan0     Link encap:Ethernet  HWadr xxxxxxxxxxxxxxxxxxxx
          AKTIVOVÁNO VŠESMĚROVÉ_VYSÍLÁNÍ BĚŽÍ MULTICAST  MTU:1500  Metrika:1
          RX packets:16868015 errors:0 dropped:0 overruns:0 frame:0
          TX packets:21354941 errors:0 dropped:0 overruns:0 carrier:0
          kolizí:0 délka odchozí fronty:1000 
          Přijato bajtů: 8791112746 (8.7 GB) Odesláno bajtů: 25378400218 (25.3 GB)

# 

OpenVPN ma nasleujici nastaveni:

mode server
tls-server
port 443
proto tcp-server
dev tap0
ifconfig 192.168.2.1 255.255.255.0
ifconfig-pool 192.168.2.150 192.168.2.200 255.255.255.0
client-to-client
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh2048.pem
log-append /var/log/openvpn
status /var/run/vpn.status 10
user nobody
group nogroup
keepalive 10 120
comp-lzo
verb 5
persist-key
persist-tun
push "route 192.168.1.0 255.255.255.0 192.168.2.1"
push "dhcp-option DNS 192.168.2.1"
push "redirect-gateway def1"
push "route-gateway 192.168.2.1"
ifconfig-pool-persist ip_pool.txt
client-config-dir ccd
max-clients 5

Jako klient se pripojuji z Android 2.3 mobilu pomoci aplikaci OpenVPN Installer a OpenVPN Settings. Na serveru nemam od ISP IPv6 a Vodafone (mam na mobilu) na 99,999% IPv6 taky neumi. Pripojeni z mobilu probehne v poradku, ale v logu na serveru vidim neco o IPv6:

Fri May 25 23:44:13 2012 us=940729 MULTI: multi_create_instance called
Fri May 25 23:44:13 2012 us=941005 Re-using SSL/TLS context
Fri May 25 23:44:13 2012 us=941113 LZO compression initialized
Fri May 25 23:44:13 2012 us=941432 Control Channel MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
Fri May 25 23:44:13 2012 us=941553 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
Fri May 25 23:44:13 2012 us=941772 Local Options String: 'V4,dev-type tap,link-mtu 1576,tun-mtu 1532,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Fri May 25 23:44:13 2012 us=941855 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1576,tun-mtu 1532,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Fri May 25 23:44:13 2012 us=941979 Local Options hash (VER=V4): '3e6d1056'
Fri May 25 23:44:13 2012 us=942096 Expected Remote Options hash (VER=V4): '31fdf004'
Fri May 25 23:44:13 2012 us=942312 TCP connection established with [AF_INET]46.135.144.15:51418
Fri May 25 23:44:13 2012 us=942418 TCPv4_SERVER link local: [undef]
Fri May 25 23:44:13 2012 us=942512 TCPv4_SERVER link remote: [AF_INET]46.135.144.15:51418
RFri May 25 23:44:14 2012 us=723369 46.135.144.15:51418 TLS: Initial packet from [AF_INET]46.135.144.15:51418, sid=be456ecb 6ebc503e
WRRWWWWRWRWRWWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRRRWRWRWRWRWRRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRFri May 25 23:44:28 2012 us=917224 46.135.144.15:51418 VERIFY OK: depth=1, /C=CZ/ST=Czech_Republic/L=XXX/O=XXX/CN=XXX_CA/emailAddress=XXX@gmail.com
Fri May 25 23:44:28 2012 us=918858 46.135.144.15:51418 VERIFY OK: depth=0, /C=CZ/ST=Czech_Republic/L=XXX/O=XXX/CN=martin/name=XXX/emailAddress=XXX@gmail.com
WRWRWRWRWRWRWRWRWRWRFri May 25 23:44:31 2012 us=293958 46.135.144.15:51418 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri May 25 23:44:31 2012 us=294098 46.135.144.15:51418 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri May 25 23:44:31 2012 us=294491 46.135.144.15:51418 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri May 25 23:44:31 2012 us=294603 46.135.144.15:51418 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
WWWRRFri May 25 23:44:32 2012 us=181197 46.135.144.15:51418 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Fri May 25 23:44:32 2012 us=181381 46.135.144.15:51418 [martin] Peer Connection Initiated with [AF_INET]46.135.144.15:51418
Fri May 25 23:44:32 2012 us=181661 martin/46.135.144.15:51418 MULTI_sva: pool returned IPv4=192.168.2.151, IPv6=d8da:7191:ec7f::
RFri May 25 23:44:34 2012 us=548072 martin/46.135.144.15:51418 PUSH: Received control message: 'PUSH_REQUEST'
Fri May 25 23:44:34 2012 us=548353 martin/46.135.144.15:51418 send_push_reply(): safe_cap=960
Fri May 25 23:44:34 2012 us=548593 martin/46.135.144.15:51418 SENT CONTROL [martin]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0 192.168.2.1,dhcp-option DNS 192.168.2.1,redirect-gateway def1,route-gateway 192.168.2.1,ping 10,ping-restart 120,ifconfig 192.168.2.151 255.255.255.0' (status=1)
WWWWRRRFri May 25 23:44:35 2012 us=764061 martin/46.135.144.15:51418 MULTI: Learn: c6:e7:15:ca:da:01 -> martin/46.135.144.15:51418
wRwRwRwRwWRwRwRwRwWRwRwRw

Pri kazdem pripojeni je IPv6 uplne jina:

Sat May 26 00:06:44 2012 us=923581 MULTI: multi_create_instance called
Sat May 26 00:06:44 2012 us=923991 Re-using SSL/TLS context
Sat May 26 00:06:44 2012 us=924183 LZO compression initialized
Sat May 26 00:06:44 2012 us=924900 Control Channel MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
Sat May 26 00:06:44 2012 us=925081 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
Sat May 26 00:06:44 2012 us=925371 Local Options String: 'V4,dev-type tap,link-mtu 1576,tun-mtu 1532,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Sat May 26 00:06:44 2012 us=925512 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1576,tun-mtu 1532,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Sat May 26 00:06:44 2012 us=925655 Local Options hash (VER=V4): '3e6d1056'
Sat May 26 00:06:44 2012 us=925769 Expected Remote Options hash (VER=V4): '31fdf004'
Sat May 26 00:06:44 2012 us=925911 TCP connection established with [AF_INET]46.135.173.0:40119
Sat May 26 00:06:44 2012 us=926003 TCPv4_SERVER link local: [undef]
Sat May 26 00:06:44 2012 us=926093 TCPv4_SERVER link remote: [AF_INET]46.135.173.0:40119
RSat May 26 00:06:45 2012 us=724309 46.135.173.0:40119 TLS: Initial packet from [AF_INET]46.135.173.0:40119, sid=37ccdf61 e967f092
WRRWWWWRWRWRWWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRRRRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRSat May 26 00:06:59 2012 us=886326 46.135.173.0:40119 VERIFY OK: depth=1, /C=CZ/ST=Czech_Republic/L=XXX/O=XXX/CN=XXX_CA/emailAddress=XXX@gmail.com
Sat May 26 00:06:59 2012 us=887922 46.135.173.0:40119 VERIFY OK: depth=0, /C=CZ/ST=Czech_Republic/L=XXX/O=XXX/CN=martin/name=XXX/emailAddress=XXX@gmail.com
WRWRWRWRWRWRWRWRWRWRSat May 26 00:07:02 2012 us=164883 46.135.173.0:40119 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat May 26 00:07:02 2012 us=165019 46.135.173.0:40119 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat May 26 00:07:02 2012 us=165300 46.135.173.0:40119 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat May 26 00:07:02 2012 us=165393 46.135.173.0:40119 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
WWWRRSat May 26 00:07:02 2012 us=961172 46.135.173.0:40119 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sat May 26 00:07:02 2012 us=961378 46.135.173.0:40119 [martin] Peer Connection Initiated with [AF_INET]46.135.173.0:40119
Sat May 26 00:07:02 2012 us=961651 martin/46.135.173.0:40119 MULTI_sva: pool returned IPv4=192.168.2.151, IPv6=1823:93ab:f57f::
RSat May 26 00:07:05 2012 us=23911 martin/46.135.173.0:40119 PUSH: Received control message: 'PUSH_REQUEST'
Sat May 26 00:07:05 2012 us=24041 martin/46.135.173.0:40119 send_push_reply(): safe_cap=960
Sat May 26 00:07:05 2012 us=24260 martin/46.135.173.0:40119 SENT CONTROL [martin]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0 192.168.2.1,dhcp-option DNS 192.168.2.1,redirect-gateway def1,route-gateway 192.168.2.1,ping 10,ping-restart 120,ifconfig 192.168.2.151 255.255.255.0' (status=1)
WWWWRRRSat May 26 00:07:06 2012 us=23301 martin/46.135.173.0:40119 MULTI: Learn: 66:0e:31:25:90:bc -> martin/46.135.173.0:40119
wRwRwRwRwWRwSat May 26 00:07:25 2012 us=622086 martin/46.135.173.0:40119 Connection reset, restarting [0]
Sat May 26 00:07:25 2012 us=622382 martin/46.135.173.0:40119 SIGUSR1[soft,connection-reset] received, client-instance restarting
Sat May 26 00:07:25 2012 us=623113 TCP/UDP: Closing socket

Napr.:
IPv6=d8da:7191:ec7f::
IPv6=1823:93ab:f57f::


IPv6 je na serveru vynuta a na mobilu ji pravdepodobne nepodporuje.

To prece neni zadna lokalni adresa.

Co to znamena?

Odpovědi

[Ales Hakl]

Zda se, ze je to chyba v logovani OpenVPN. Pokud zadna IPv6 adresa neni pridelena, tak do logu zaloguje nejakou naprosto nahodnou (napr. obe uvadene priklady adres jsou s pohledu IPv6 naprosto nesmyslne, nicmene pokud se na to podivame jako na data, tak obe vypadaji napadne jako pointer do stacku s otocenym endianem, neboli proste bordel co po necem zustal na zasobniku).

[tuxmartin]

Diky za vysvetleni.

Takze to muzu v klidu ignorovat?