a question about XFRM_POLICY_FWD

a question about XFRM_POLICY_FWD

[Kazunori Miyazawa]

Hello,

I would like to ask about meaning of XFRM_POLICY_FWD,
although a question may have been asked before.

I configured IPsec tunnel and thought XFRM_POLICY_FWD
might be confusing.

A forwarding policy which is represent with XFRM_POLICY_FWD
in the kernel affects only in-comming forwarding packet.
The policy does not affect out-going forwarding packet and
input packet to a security gateway itself.

If we want to connect network 2001:DB8:1::/64 and 2001:DB8:3::/64
with SGW(A) and SGW(B),

---------------SGW(A)==================SGW(B)---------
2001:DB8:1::/64        2001:DB8:2::/64        2001:DB8:3::/64

=== represents IPsec tunnel
--- represents a network behind SGW.

The addresses of each SGW are:

SGW(A) internal address 2001:DB8:1::A/64
SGW(A) external address 2001:DB8:2::A/64
SGW(B) external address 2001:DB8:2::B/64
SGW(B) internal address 2001:DB8:3::B/64

We need to configure policies in SGW(A) which are represent with setkey command are
spdadd 2001:DB8:1::/64 2001:DB8:3::/64 any -P out ipsec esp/tunnel/2001:DB8:2::A-2001:DB82::B/require;
spdadd 2001:DB8:3::/64 2001:DB8:1::/64 any -P fwd ipsec esp/tunnel/2001:DB8:2::B-2001:DB82::A/require;

However, the above policies does not allow SGW(A) to receive packest from 2001:DB8:3::/64 to
2001:DB8:1::A/64 because there is no policy for "INPUT".

To let the packet reach 2001:DB8:1::A, we needs an additional policy
spdadd 2001:DB8:3::/64 2001:DB8:1::A/128 any -P in ipsec esp/tunnel/2001:DB8:2::B-2001:DB82::A/require;

Totally, we need three policies for the configuration in a SGW.

I think , from the point of view of user or administrator, why forward does not allow the packet instead
2001:DB8:1::A is included in network 2001:DB8:1::/64. And I also think why I can not configure out-going
forward policy with "fwd". Anyway XFRM_POLICY_FWD or "fwd" might be confusing.

What does XFRM_POLICY_FWD or direction="forward" means in the architecture design?

Of course I know the implementation :-p

P.S.
IMHO,
We should remove or obsolete XFRM_POLICY_FORWARD and use XFRM_POLICY_IN instead of it.
or
We should lookup out-going forwarding packet with XFRM_POLICY_FORWARD.

--
Kazunori Miyazawa