Incorrect <vpn_networks>and <negate_networks>tables?</negate_networks></vpn_networks>

[dem]

I’ve been playing around with outgoing IPsec with 2.4.0.b.20170418.0759 running in VirtualBox. I have a working IKEv2 with an IPv4 Tunnel and a defined but currently disabled IPv6 Tunnel. The remote side of the IPv4 Tunnel is defined as 0.0.0.0/0, and for the IPv6 Tunnel it’s ::/0.

In /tmp/rules.debug I see that the <vpn_networks>and <negate_networks>tables look like this:

table <vpn_networks> { ::/0 }
table <negate_networks> { ::/0 }</negate_networks></vpn_networks>

The function filter_get_vpns_list() in filter.inc explicity excludes 0.0.0.0/0 but not ::/0. It also doesn’t take into account if a phase2 is disabled.

On the other hand, I’m not sure how leaving <vpn_networks>empty will affect these rules from setting MSS clamping for IPsec:

scrub from any to <vpn_networks> max-mss 1356
scrub from <vpn_networks> to any max-mss 1356</vpn_networks></vpn_networks>
```</vpn_networks></negate_networks></vpn_networks>