[PATCH net 1/1] xfrm: fix source address in icmp error generation from IPsec gateway

[Antony Antony <antony@phenome.org>]

Hi Michael,

On Thu, Apr 04, 2024 at 07:38:04AM -0400, Michael Richardson via Devel 
wrote:
> 
> Antony Antony via Devel <devel@linux-ipsec.org> wrote:
>     > This commit would force to use source address from the gatway/host.
>     > The ICMP error message source address correctly set from the host.
> 
> While that seems more correct, since that host is generating, it might not
> fit into the IPsec tunnel, and therefore might go the right place or
> anywhere.   Perhaps you could pick the internal IP of the gateway, but in
> more complex policies, the gateway itself might not be part of the VPN.
> 
>     > Again before the fix ping -W 5 -c 1 10.1.4.3 From 10.1.4.3 icmp_seq=1
>     > Destination Host Unreachable
> 
>     > After the fix From 10.1.3.2 icmp_seq=1 Destination Host Unreachable
> 
> ip -netns host2 xfrm policy add src 10.1.1.0/24 dst 10.1.4.0/24 dir out \
>         flag icmp tmpl src 10.1.2.1 dst 10.1.3.2 proto esp reqid 1 mode tunnel

> 
> As far as I can see, 10.1.3.2 does not fit into this policy.


Indeed, 10.1.3.2 does not match the policy. However, notice the 
"flag icmp" in the above line. That means the policy lookup will use the inner
payload for policy lookup as specified in RFC 4301, Section 6, which
will match. The inner payload 10.1.4.1 <=> 10.1.4.3  will match the policy.

> You appear to be selecting the outside ("WAN") interface of the gateway.
> It would be less confusing if you had used 172.16.0.0/24 for the outside of
> the gateways in your example.

With this fix, I am leaving the source address selection of the error
response to the stack instead of unconditionally copying from the packet
that was dropped. So, in a simple case, the outgoing interface will be
the end of the tunnel, i.e., 10.1.3.2. Also that is the end point of the 
tunnel. 

> How will the WAN interface manage to talk to the internal sender of the
> packet except via the tunnel?

WAN is geneerating an ESP packet? In this case ESP tunnel mode with  
10.1.3.2. Note: the reciver has also the icmp enabled.

-antony