From: Herbert Xu <herbert@gondor.apana.org.au>
To: Julian Anastasov <ja@ssi.bg>
Cc: David Miller <davem@davemloft.net>, netdev@vger.kernel.org
Subject: Re: [PATCH net-next] ipv4: one more case for non-local saddr in ICMP
Date: Tue, 23 Aug 2011 14:46:40 +0800 [thread overview]
Message-ID: <20110823064640.GA6174@gondor.apana.org.au> (raw)
In-Reply-To: <alpine.LFD.2.00.1108230845510.1565@ja.ssi.bg>
On Tue, Aug 23, 2011 at 09:34:45AM +0300, Julian Anastasov wrote:
>
> I just notice that if original packet (say TCP) hits
> "fwd" policy, for the locally generated ICMP error we call
> xfrm_lookup with sk = NULL and it always uses "out" dir
> for the flow_cache_lookup call to search for this reverse SA.
> So, we must be prepared with rules in "out" dir even for
> the forwarding case? icmp flag in "fwd" rules is not considered?
This is a common question about our IPsec stack. Both fwd
and in are used for ingress, with the only difference being
whether the packet is locally destined or not. Only out is
used for egress traffic.
Cheers,
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
next prev parent reply other threads:[~2011-08-23 6:46 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-08-15 16:21 [PATCH net-next] ipv4: one more case for non-local saddr in ICMP Julian Anastasov
2011-08-19 10:43 ` David Miller
2011-08-20 8:20 ` Herbert Xu
2011-08-23 6:34 ` Julian Anastasov
2011-08-23 6:46 ` Herbert Xu [this message]
2011-08-25 2:37 ` David Miller
2011-08-25 7:25 ` Julian Anastasov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110823064640.GA6174@gondor.apana.org.au \
--to=herbert@gondor.apana.org.au \
--cc=davem@davemloft.net \
--cc=ja@ssi.bg \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox