Re: [devel-ipsec] [PATCH net 1/1] xfrm: fix source address in icmp error generation from IPsec gateway

[Michael Richardson <mcr@sandelman.ca>]

[-- Attachment #1: Type: text/plain, Size: 1420 bytes --]


Antony Antony via Devel <devel@linux-ipsec.org> wrote:
    > This commit would force to use source address from the gatway/host.
    > The ICMP error message source address correctly set from the host.

While that seems more correct, since that host is generating, it might not
fit into the IPsec tunnel, and therefore might go the right place or
anywhere.   Perhaps you could pick the internal IP of the gateway, but in
more complex policies, the gateway itself might not be part of the VPN.

    > Again before the fix ping -W 5 -c 1 10.1.4.3 From 10.1.4.3 icmp_seq=1
    > Destination Host Unreachable

    > After the fix From 10.1.3.2 icmp_seq=1 Destination Host Unreachable

ip -netns host2 xfrm policy add src 10.1.1.0/24 dst 10.1.4.0/24 dir out \
        flag icmp tmpl src 10.1.2.1 dst 10.1.3.2 proto esp reqid 1 mode tunnel

As far as I can see, 10.1.3.2 does not fit into this policy.
You appear to be selecting the outside ("WAN") interface of the gateway.
It would be less confusing if you had used 172.16.0.0/24 for the outside of
the gateways in your example.
How will the WAN interface manage to talk to the internal sender of the
packet except via the tunnel?

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     mcr@sandelman.ca  http://www.sandelman.ca/        |   ruby on rails    [


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 511 bytes --]