Re: [PATCH] xfrm: Accept ESP packets regardless of UDP encapsulation mode

[David Miller <davem@davemloft.net>]

From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Fri, 19 Dec 2008 07:54:06 +1100

> On Thu, Dec 18, 2008 at 01:36:56PM +0100, Martin Willi wrote:
> > 
> > >From the key manager perspective, I can enable or disable UDP
> > encapsulation, fine. I decide locally what I'll use for outgoing
> > packets. But how should I know what the peer uses? I can't, it isn't
> > negotiated. It is, by the standard, perfectly valid to send UDP
> > encapsulated packets if the peer wants to do so. And there is no need to
> > communicate this to the key manager, there is actually no such mechanism
> > in IKEv2. Therefore I need the kernel to accept packet, encapsulated or
> > not.
> 
> Even if the kernel did accept such packets, there is no guarantee
> that your return traffic will make it back to the other side because
> stateful firewalls may be present.
> 
> Responding with unencapsulated ESP traffic when the peer is sending
> you UDP-encapsulated traffic is just not going to fly.
> 
> BTW I think the IKEv2 draft has stuffed it up on this one (though
> luckily it hasn't made it to RFC yet).  I'll open a report on it.

I'm going to revert the change from net-next-2.6 from now
becasue:

1) The general scheme's validity is still suspect and under
   discussion

2) The change has a known bug (the UDP header access issue)

3) Martin can apply the change locally to do testing until we
   work this stuff out.

Thanks guys.