Re: [PATCH net 1/1] xfrm: fix source address in icmp error generation from IPsec gateway

[Michael Richardson <mcr@sandelman.ca>]

[-- Attachment #1: Type: text/plain, Size: 2139 bytes --]


Antony Antony <antony@phenome.org> wrote:
    > On Thu, Apr 04, 2024 at 10:39:17AM -0400, Michael Richardson wrote:
    >>
    >> Antony Antony <antony@phenome.org> wrote: > Indeed, 10.1.3.2 does not
    >> match the policy. However, notice the "flag > icmp" in the above
    >> line. That means the policy lookup will use the > inner payload for
    >> policy lookup as specified in RFC 4301, Section 6, > which will
    >> match. The inner payload 10.1.4.1 <=> 10.1.4.3 will match > the
    >> policy.
    >>
    >> How is "flag icmp" communicated via IKEv2?

    > As far as I'm aware, it isn't communicated via IKEv2. I believe it's
    > considered a local policy, and possibly specified in BCP.

    > However, how is communicating it over IKEv2 relevant to this kernel
    > patch? I don't see any connection! If there is one, please
    > elaborate. Without a clear link, the netdev maintainers might reject
    > this patch.

because, we are using a custom Linux kernel flag to get the ICMP back into
the tunnel, then the other end might not accept the packet if it doesn't have
a similiar configuration.

    >> Won't the other gateway just drop this packet?

    > That's would be a local choice, fate of an ICMP message:), akin to ICMP
    > errors elsewhere. Let's not dive into filtering choices and PMTU for
    > now:)

No, it's not. It's up to IKEv2 to configure those flags.
Your choice requires extra flags.  The previous behaviour was rather
ingenious because it guaranteed that the packet always fit into the tunnel.
(the bug was that it didn't do it for IPv6 as well)

    > Just thinking out loud, I haven't seen forwarding ICMP error messages
    > negotiated in other tunneling protocols like MPLS or pptp...., if I
    > recall correctly, QUIC does indeed have it specified.

So, what?  They aren't L3 tunnel protocols are they?
MPLS is L2.5, pptp is L2 and QUIC is L4.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     mcr@sandelman.ca  http://www.sandelman.ca/        |   ruby on rails    [


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 511 bytes --]