IPSec connection using IPv6 link-local addresses

[xbrs1]

Hello,

Is it possible to use IPv6 link-local addresses to establish an IPsec connection?

I have following configuration:
Server:

        inet 192.168.221.1  netmask 255.255.255.248  broadcast 192.168.221.7
        inet6 fe80::250:56ff:fe83:bab0  prefixlen 64  scopeid 0x20<link>
        ether 00:50:56:83:ba:b0  txqueuelen 1000  (Ethernet)
        RX packets 11  bytes 730 (730.0 B)
        RX errors 0  dropped 2  overruns 0  frame 0
        TX packets 17  bytes 1526 (1.5 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ip ro get fe80::250:56ff:fe83:685d
fe80::250:56ff:fe83:685d from :: dev ens193 src fe80::250:56ff:fe83:bab0 metric 1 pref medium

Client

        inet 192.168.221.2  netmask 255.255.255.248  broadcast 192.168.221.7
        inet6 fe80::250:56ff:fe83:685d  prefixlen 64  scopeid 0x20<link>
        ether 00:50:56:83:68:5d  txqueuelen 1000  (Ethernet)
        RX packets 24  bytes 1540 (1.5 KB)
        RX errors 0  dropped 12  overruns 0  frame 0
        TX packets 17  bytes 1526 (1.5 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ip ro get fe80::250:56ff:fe83:bab0
fe80::250:56ff:fe83:bab0 from :: dev ens161 src fe80::250:56ff:fe83:685d metric 1 pref medium

Server ipsec.conf

conn IPSec-IKEv2-ESP
     esp=aes256-sha512-modp1024,aes128-aes256-sha1-sha256-modp2048-modp4096-modp1024,aes128-sha1,aes128-sha1-modp1024,aes128-sha1-modp1536,aes128-sha1-modp2048,aes128-sha256,aes128-sha256-ecp256,aes128-sha256-modp1024,aes128-sha256-modp1536,aes128-sha256-modp2048,aes128gcm12-aes128gcm16-aes256gcm12-aes256gcm16-modp2048-modp4096-modp1024,aes128gcm16,aes128gcm16-ecp256,aes256-sha1,aes256-sha256,aes256-sha256-modp1024,aes256-sha256-modp1536,aes256-sha256-modp2048,aes256-sha256-modp4096,aes256-sha384,aes256-sha384-ecp384,aes256-sha384-modp1024,aes256-sha384-modp1536,aes256-sha384-modp2048,aes256-sha384-modp4096,aes256gcm16,aes256gcm16-ecp384,3des-sha1
    keyexchange=ikev2
    auto=add
    left=%any
    leftid=fe80::250:56ff:fe83:bab0
    leftsubnet=2a02:8100:d102:1::0/64
    right=%any
    rightsourceip=2a02:8100:d102:2::2
    rightsubnet=2a02:8100:d102:2::0/64
    mobike=no

Client ipsec.conf

conn ikev2-rw-esp
    right=fe80::250:56ff:fe83:bab0
    rightid=fe80::250:56ff:fe83:bab0
    rightsubnet=2a02:8100:d102:1::0/64
    rightauth=secret
    leftsourceip=%config
    leftauth=secret
    leftsubnet=2a02:8100:d102:2::0/64
    auto=start

Connection logs from client

Mar 19 12:38:29 vsrv-bicab-2u charon: 15[LIB] created thread 15 [5186]
Mar 19 12:38:29 vsrv-bicab-2u charon: 04[NET] waiting for data on sockets
Mar 19 12:38:29 vsrv-bicab-2u charon: 16[LIB] created thread 16 [5172]
Mar 19 12:38:29 vsrv-bicab-2u charon: 06[CFG] received stroke: add connection 'ikev2-rw-esp'
Mar 19 12:38:29 vsrv-bicab-2u charon: 06[CFG] conn ikev2-rw-esp
Mar 19 12:38:29 vsrv-bicab-2u charon: 06[CFG]   left=%any
Mar 19 12:38:29 vsrv-bicab-2u charon: 06[CFG]   leftsubnet=2a02:8100:d102:2::0/64
Mar 19 12:38:29 vsrv-bicab-2u charon: 06[CFG]   leftsourceip=%config
Mar 19 12:38:29 vsrv-bicab-2u charon: 06[CFG]   leftauth=secret
Mar 19 12:38:29 vsrv-bicab-2u charon: 06[CFG]   right=fe80::250:56ff:fe83:bab0
Mar 19 12:38:29 vsrv-bicab-2u charon: 06[CFG]   rightsubnet=2a02:8100:d102:1::0/64
Mar 19 12:38:29 vsrv-bicab-2u charon: 06[CFG]   rightauth=secret
Mar 19 12:38:29 vsrv-bicab-2u charon: 06[CFG]   rightid=fe80::250:56ff:fe83:bab0
Mar 19 12:38:29 vsrv-bicab-2u charon: 06[CFG]   dpddelay=30
Mar 19 12:38:29 vsrv-bicab-2u charon: 06[CFG]   dpdtimeout=150
Mar 19 12:38:29 vsrv-bicab-2u charon: 06[CFG]   sha256_96=no
Mar 19 12:38:29 vsrv-bicab-2u charon: 06[CFG]   mediation=no
Mar 19 12:38:29 vsrv-bicab-2u charon: 06[KNL] fe80::250:56ff:fe83:bab0 is not a local address or the interface is down
Mar 19 12:38:29 vsrv-bicab-2u charon: 06[CFG] added configuration 'ikev2-rw-esp'
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[CFG] received stroke: initiate 'ikev2-rw-esp'
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[MGR] checkout IKE_SA by config
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[MGR] created IKE_SA (unnamed)[1]
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[KNL] using fe80::250:56ff:fe83:685d as address to reach fe80::250:56ff:fe83:bab0/128
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[IKE] queueing IKE_VENDOR task
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[IKE] queueing IKE_INIT task
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[IKE] queueing IKE_NATD task
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[IKE] queueing IKE_CERT_PRE task
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[IKE] queueing IKE_AUTH task
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[IKE] queueing IKE_CERT_POST task
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[IKE] queueing IKE_CONFIG task
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[IKE] queueing IKE_AUTH_LIFETIME task
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[IKE] queueing IKE_MOBIKE task
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[IKE] queueing IKE_ME task
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[IKE] queueing CHILD_CREATE task
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[IKE] activating new tasks
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[IKE]   activating IKE_VENDOR task
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[IKE]   activating IKE_INIT task
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[IKE]   activating IKE_NATD task
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[IKE]   activating IKE_CERT_PRE task
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[IKE]   activating IKE_ME task
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[IKE]   activating IKE_AUTH task
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[IKE]   activating IKE_CERT_POST task
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[IKE]   activating IKE_CONFIG task
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[IKE]   activating CHILD_CREATE task
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[IKE]   activating IKE_AUTH_LIFETIME task
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[IKE]   activating IKE_MOBIKE task
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[IKE] initiating IKE_SA ikev2-rw-esp[1] to fe80::250:56ff:fe83:bab0
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[IKE] IKE_SA ikev2-rw-esp[1] state change: CREATED => CONNECTING
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[CFG] configured proposals: IKE:AES_CBC_128/AES_CBC_192/AES_CBC_256/AES_CTR_128/AES_CTR_192/AES_CTR_256/CAMELLIA_CBC_128/CAMELLIA_CBC_192/CAMELLIA_CBC_256/3DES_CBC/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/AES_XCBC_96/AES_CMAC_96/HMAC_SHA1_96/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_HMAC_SHA1/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048, IKE:AES_CCM_16_128/AES_CCM_16_192/AES_CCM_16_256/AES_GCM_16_128/AES_GCM_16_192/AES_GCM_16_256/AES_CCM_8_128/AES_CCM_8_192/AES_CCM_8_256/AES_CCM_12_128/AES_CCM_12_192/AES_CCM_12_256/AES_GCM_8_128/AES_GCM_8_192/AES_GCM_8_256/AES_GCM_12_128/AES_GCM_12_192/AES_GCM_12_256/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_HMAC_SHA1/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[CFG] sending supported signature hash algorithms: sha256 sha384 sha512
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[NET] sending packet: from fe80::250:56ff:fe83:685d[500] to fe80::250:56ff:fe83:bab0[500] (894 bytes)
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[MGR] checkin IKE_SA ikev2-rw-esp[1]
Mar 19 12:38:29 vsrv-bicab-2u charon: 07[MGR] checkin of IKE_SA successful
Mar 19 12:38:29 vsrv-bicab-2u charon: 05[NET] sending packet: from fe80::250:56ff:fe83:685d[500] to fe80::250:56ff:fe83:bab0[500]
Mar 19 12:38:29 vsrv-bicab-2u charon: 05[NET] error writing to socket: Invalid argument
Mar 19 12:38:33 vsrv-bicab-2u charon: 09[MGR] checkout IKEv2 SA with SPIs 172f6495eae4c2a4_i 0000000000000000_r
Mar 19 12:38:33 vsrv-bicab-2u charon: 09[MGR] IKE_SA ikev2-rw-esp[1] successfully checked out
Mar 19 12:38:33 vsrv-bicab-2u charon: 09[IKE] retransmit 1 of request with message ID 0
Mar 19 12:38:33 vsrv-bicab-2u charon: 09[NET] sending packet: from fe80::250:56ff:fe83:685d[500] to fe80::250:56ff:fe83:bab0[500] (894 bytes)
Mar 19 12:38:33 vsrv-bicab-2u charon: 09[MGR] checkin IKE_SA ikev2-rw-esp[1]
Mar 19 12:38:33 vsrv-bicab-2u charon: 09[MGR] checkin of IKE_SA successful
Mar 19 12:38:33 vsrv-bicab-2u charon: 05[NET] sending packet: from fe80::250:56ff:fe83:685d[500] to fe80::250:56ff:fe83:bab0[500]
Mar 19 12:38:33 vsrv-bicab-2u charon: 05[NET] error writing to socket: Invalid argument

[strongX509]

IPv6 local link addresses are not supported. Please assign a network prefix to your LAN.

[Thermi]

There's charon.plugins.socket-default.set_sourceif, which was added by Martin in 2017 with commit 9b29003. That is supposed to enable using link-llocal addresses, doesn't it?

[...]

This also allows using IPv6 link-local addresses, which won't work if
the outbound interface is not set explicitly.