From: Jakub Kicinski <kuba@kernel.org>
To: Antony Antony <antony.antony@secunet.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>,
"David S. Miller" <davem@davemloft.net>,
David Ahern <dsahern@kernel.org>,
Eric Dumazet <edumazet@google.com>,
"Paolo Abeni" <pabeni@redhat.com>, <netdev@vger.kernel.org>,
Herbert Xu <herbert@gondor.apana.org.au>, <devel@linux-ipsec.org>,
Tobias Brunner <tobias@strongswan.org>
Subject: Re: [PATCH net 1/1] xfrm: fix source address in icmp error generation from IPsec gateway
Date: Mon, 8 Apr 2024 19:15:34 -0700 [thread overview]
Message-ID: <20240408191534.2dd7892d@kernel.org> (raw)
In-Reply-To: <20ea2ab0472ecf2d1625dadb7ca0df39cf4fe0f5.1712226175.git.antony.antony@secunet.com>
On Thu, 4 Apr 2024 12:31:56 +0200 Antony Antony wrote:
> export AB="10.1"
> for i in 1 2 3 4 5; do
> h="host${i}"
> ip netns add ${h}
> ip -netns ${h} link set lo up
> ip netns exec ${h} sysctl -wq net.ipv4.ip_forward=1
> if [ $i -lt 5 ]; then
> ip -netns ${h} link add eth0 type veth peer name eth10${i}
> ip -netns ${h} addr add "${AB}.${i}.1/24" dev eth0
> ip -netns ${h} link set up dev eth0
> fi
> done
>
> for i in 1 2 3 4 5; do
> h="host${i}"
> p=$((i - 1))
> ph="host${p}"
> # connect to previous host
> if [ $i -gt 1 ]; then
> ip -netns ${ph} link set eth10${p} netns ${h}
> ip -netns ${h} link set eth10${p} name eth1
> ip -netns ${h} link set up dev eth1
> ip -netns ${h} addr add "${AB}.${p}.2/24" dev eth1
> fi
> # add forward routes
> for k in $(seq ${i} $((5 - 1))); do
> ip -netns ${h} route 2>/dev/null | (grep "${AB}.${k}.0" 2>/dev/null) || \
> ip -netns ${h} route add "${AB}.${k}.0/24" via "${AB}.${i}.2" 2>/dev/nul
> done
>
> # add reverse routes
> for k in $(seq 1 $((i - 2))); do
> ip -netns ${h} route 2>/dev/null | grep "${AB}.${k}.0" 2>/dev/null || \
> ip -netns ${h} route add "${AB}.${k}.0/24" via "${AB}.${p}.1" 2>/dev/nul
> done
> done
>
> ip netns exec host1 ping -q -W 2 -w 1 -c 1 10.1.4.2 2>&1>/dev/null && echo "success 10.1.4.2 reachable" || echo "ERROR"
> ip netns exec host1 ping -W 9 -w 5 -c 1 10.1.4.3 || echo "note the source address of unreachble of gateway"
> ip -netns host1 route flush cache
>
> ip netns exec host3 nft add table inet filter
> ip netns exec host3 nft add chain inet filter FORWARD { type filter hook forward priority filter\; policy drop \; }
> ip netns exec host3 nft add rule inet filter FORWARD counter ip protocol icmp drop
> ip netns exec host3 nft add rule inet filter FORWARD counter ip protocol esp accept
> ip netns exec host3 nft add rule inet filter FORWARD counter drop
>
> ip -netns host2 xfrm policy add src 10.1.1.0/24 dst 10.1.4.0/24 dir out \
> flag icmp tmpl src 10.1.2.1 dst 10.1.3.2 proto esp reqid 1 mode tunnel
>
> ip -netns host2 xfrm policy add src 10.1.4.0/24 dst 10.1.1.0/24 dir in \
> tmpl src 10.1.3.2 dst 10.1.2.1 proto esp reqid 2 mode tunnel
>
> ip -netns host2 xfrm policy add src 10.1.4.0/24 dst 10.1.1.0/24 dir fwd \
> flag icmp tmpl src 10.1.3.2 dst 10.1.2.1 proto esp reqid 2 mode tunnel
>
> ip -netns host2 xfrm state add src 10.1.2.1 dst 10.1.3.2 proto esp spi 1 \
> reqid 1 replay-window 1 mode tunnel aead 'rfc4106(gcm(aes))' \
> 0x1111111111111111111111111111111111111111 96 \
> sel src 10.1.1.0/24 dst 10.1.4.0/24
>
> ip -netns host2 xfrm state add src 10.1.3.2 dst 10.1.2.1 proto esp spi 2 \
> flag icmp reqid 2 replay-window 10 mode tunnel aead 'rfc4106(gcm(aes))' \
> 0x2222222222222222222222222222222222222222 96
>
> ip -netns host4 xfrm policy add src 10.1.4.0/24 dst 10.1.1.0/24 dir out \
> flag icmp tmpl src 10.1.3.2 dst 10.1.2.1 proto esp reqid 1 mode tunnel
>
> ip -netns host4 xfrm policy add src 10.1.1.0/24 dst 10.1.4.0/24 dir in \
> tmpl src 10.1.2.1 dst 10.1.3.2 proto esp reqid 2 mode tunnel
>
> ip -netns host4 xfrm policy add src 10.1.1.0/24 dst 10.1.4.0/24 dir fwd \
> flag icmp tmpl src 10.1.2.1 dst 10.1.3.2 proto esp reqid 2 mode tunnel
>
> ip -netns host4 xfrm state add src 10.1.3.2 dst 10.1.2.1 proto esp spi 2 \
> reqid 1 replay-window 1 mode tunnel aead 'rfc4106(gcm(aes))' \
> 0x2222222222222222222222222222222222222222 96
>
> ip -netns host4 xfrm state add src 10.1.2.1 dst 10.1.3.2 proto esp spi 1 \
> reqid 2 replay-window 20 flag icmp mode tunnel aead 'rfc4106(gcm(aes))' \
> 0x1111111111111111111111111111111111111111 96 \
> sel src 10.1.1.0/24 dst 10.1.4.0/24
>
> ip netns exec host1 ping -W 5 -c 1 10.1.4.2 2>&1 > /dev/null && echo ""
> ip netns exec host1 ping -W 5 -c 1 10.1.4.3 || echo "note source address of gateway 10.1.3.2"
Could you turn this into a selftest?
next prev parent reply other threads:[~2024-04-09 2:15 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-04 10:29 [PATCH net 0/1] fix icmp error source with ICMP reverse lookup Antony Antony
2024-04-04 10:31 ` [PATCH net 1/1] xfrm: fix source address in icmp error generation from IPsec gateway Antony Antony
2024-04-04 11:38 ` [devel-ipsec] " Michael Richardson
2024-04-04 12:16 ` Antony Antony
2024-04-04 14:39 ` Michael Richardson
2024-04-04 15:23 ` Antony Antony
2024-04-04 15:35 ` Michael Richardson
2024-04-05 12:27 ` Antony Antony
2024-04-05 12:21 ` [devel-ipsec] " Tero Kivinen
2024-04-04 12:35 ` Tobias Brunner
2024-04-09 2:15 ` Jakub Kicinski [this message]
2024-04-10 17:48 ` 14141 Antony Antony
2024-04-11 0:49 ` 14141 Jakub Kicinski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240408191534.2dd7892d@kernel.org \
--to=kuba@kernel.org \
--cc=antony.antony@secunet.com \
--cc=davem@davemloft.net \
--cc=devel@linux-ipsec.org \
--cc=dsahern@kernel.org \
--cc=edumazet@google.com \
--cc=herbert@gondor.apana.org.au \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=steffen.klassert@secunet.com \
--cc=tobias@strongswan.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).