Re: [NF+IPsec 4/6]: Make IPsec input processing symetrical to output

[Stephen Frost <sfrost@snowman.net>]

[-- Attachment #1: Type: text/plain, Size: 2105 bytes --]

* Yasuyuki KOZAKAI (yasuyuki.kozakai@toshiba.co.jp) wrote:
> I think pure transport mode is important, too. For example, for users of
> L2TP over IPsec.
> 
> But I'm not sure that how many people wants to use netfilter hook together.
> At least, I don't need that. Because I can use IPsec policy instead of
> iptables rule and that's enough for me.
> 
> I also think that it's the work for IPsec policy check to decide to
> accept or drop decrypted packets on input path of transport mode, that is
> not netfilter work.

Trying to compare IPsec policy to netfilter is just plain silly.  IPsec
policy is *not* equivilant to a firewall system like netfilter.  Not
even close.  Not offering the ability to firewall transport-mode IPsec 
packets shouldn't even be an option. :/  With 15 servers which all talk
transport-mode IPsec to each other I'd still want to be able to do
firewalling to hopefully reduce the impact of one of the servers being
compromised.

> On the other hand, for the users who want to use local NAT and IPsec
> transport mode together, we might have to add netfilter hook to input
> path. But I'm not sure how many such users are. If nobody want, hooks
> we need are only LOCAL_OUT and POST_ROUTING on output path per tunnel.

I had wanted to do this, in order to hide the network configuration of
the machines behind the gateway but ended up not being able to. :/  My
situation is perhaps not very common but I think it will become more
common in the future: I've got a VPN setup with multiple different
people who I don't completely trust and who don't entirely trust me or
the other people.  This situation can exist for tunnel mode and
transport mode users.  As use-ipsec-when-available transport mode
increases in use this need seems likely to grow.

Consider a corporate network where the whole thing is set up to do
transport-mode ipsec.  Chances are the guys who run the corporate
servers are still going to want to be able to run firewalls on their
servers to cover things in case a given desktop is compromised.

	Thanks,

		Stephen

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]