From: Michael Richardson <mcr@sandelman.ca>
To: Antony Antony <antony@phenome.org>
Cc: antony.antony@secunet.com,
Herbert Xu <herbert@gondor.apana.org.au>,
netdev@vger.kernel.org, David Ahern <dsahern@kernel.org>,
devel@linux-ipsec.org, Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
"David S. Miller" <davem@davemloft.net>
Subject: Re: [PATCH net 1/1] xfrm: fix source address in icmp error generation from IPsec gateway
Date: Thu, 04 Apr 2024 10:39:17 -0400 [thread overview]
Message-ID: <7748.1712241557@obiwan.sandelman.ca> (raw)
In-Reply-To: <Zg6aIbUV-oj4wPMq@Antony2201.local>
[-- Attachment #1: Type: text/plain, Size: 452 bytes --]
Antony Antony <antony@phenome.org> wrote:
> Indeed, 10.1.3.2 does not match the policy. However, notice the "flag
> icmp" in the above line. That means the policy lookup will use the
> inner payload for policy lookup as specified in RFC 4301, Section 6,
> which will match. The inner payload 10.1.4.1 <=> 10.1.4.3 will match
> the policy.
How is "flag icmp" communicated via IKEv2?
Won't the other gateway just drop this packet?
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 511 bytes --]
next prev parent reply other threads:[~2024-04-04 14:39 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-04 10:29 [PATCH net 0/1] fix icmp error source with ICMP reverse lookup Antony Antony
2024-04-04 10:31 ` [PATCH net 1/1] xfrm: fix source address in icmp error generation from IPsec gateway Antony Antony
2024-04-04 11:38 ` [devel-ipsec] " Michael Richardson
2024-04-04 12:16 ` Antony Antony
2024-04-04 14:39 ` Michael Richardson [this message]
2024-04-04 15:23 ` Antony Antony
2024-04-04 15:35 ` Michael Richardson
2024-04-05 12:27 ` Antony Antony
2024-04-05 12:21 ` [devel-ipsec] " Tero Kivinen
2024-04-04 12:35 ` Tobias Brunner
2024-04-09 2:15 ` Jakub Kicinski
2024-04-10 17:48 ` 14141 Antony Antony
2024-04-11 0:49 ` 14141 Jakub Kicinski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7748.1712241557@obiwan.sandelman.ca \
--to=mcr@sandelman.ca \
--cc=antony.antony@secunet.com \
--cc=antony@phenome.org \
--cc=davem@davemloft.net \
--cc=devel@linux-ipsec.org \
--cc=dsahern@kernel.org \
--cc=edumazet@google.com \
--cc=herbert@gondor.apana.org.au \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.