Question about tunnels, IPsec and redirect
Hi, I am looking at this patch: http://lists.openwall.net/netdev/2007/08/24/29 and I cannot understand it. Can somebody please try to explain ? more specifically: Can somebody please give an example of some setup of IPsec tunnel where the ip_rt_send_redirect() method should not be called when the skb->sp is not NULL ? (in other words, why if the SKB is and IPsec SKB, we should not send a redirect in such a case while forwarding a packet; note I am talking about IPv4) Note that the check for skb->sp was changed in recent kernels to skb_sec_path(skb), but it is essentially the same. Regards, Kevin
Hi Kevin On 2013年09月25日 02:52, Kevin Wilson wrote:
Hi, I am looking at this patch: http://lists.openwall.net/netdev/2007/08/24/29 and I cannot understand it. Can somebody please try to explain ? more specifically: Can somebody please give an example of some setup of IPsec tunnel where the ip_rt_send_redirect() method should not be called when the skb->sp is not NULL ?
+ if (rt->rt_flags&RTCF_DOREDIRECT && !opt->srr && !skb->sp) ^^^^^^^ If IPsec policy is not enabled for a specific flow that this skb matches, skb->sp is NULL.
(in other words, why if the SKB is and IPsec SKB, we should not send a redirect in such a case while forwarding a packet; note I am talking about IPv4)
Note that the check for skb->sp was changed in recent kernels to skb_sec_path(skb), but it is essentially the same.
Regards, Kevin
_______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
-- 八百里秦川尘土飞扬,三千万老陕齐吼秦腔。 --bill
Hi, Of course. But the (unanswered) question is: when sp is non NULL and we are working with IPsec, why shoudn't we send redirect in such a case ? rgs Kevin On Thu, Sep 26, 2013 at 10:02 AM, bill4carson <bill4carson@gmail.com> wrote:
Hi Kevin
On 2013年09月25日 02:52, Kevin Wilson wrote:
Hi, I am looking at this patch: http://lists.openwall.net/netdev/2007/08/24/29 and I cannot understand it. Can somebody please try to explain ? more specifically: Can somebody please give an example of some setup of IPsec tunnel where the ip_rt_send_redirect() method should not be called when the skb->sp is not NULL ?
+ if (rt->rt_flags&RTCF_DOREDIRECT && !opt->srr && !skb->sp) ^^^^^^^ If IPsec policy is not enabled for a specific flow that this skb matches, skb->sp is NULL.
(in other words, why if the SKB is and IPsec SKB, we should not send a redirect in such a case while forwarding a packet; note I am talking about IPv4)
Note that the check for skb->sp was changed in recent kernels to skb_sec_path(skb), but it is essentially the same.
Regards, Kevin
_______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
-- 八百里秦川尘土飞扬,三千万老陕齐吼秦腔。
--bill
Hi, Kevin On 2013年09月26日 15:31, Kevin Wilson wrote:
Hi, Of course. But the (unanswered) question is: when sp is non NULL and we are working with IPsec, why shoudn't we send redirect in such a case ?
Apologize for replying late. I think you probably missing what "ICMP redirect" does, if so please take a look at this link: http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080094702... My understanding is: If host is protected by gateway A using IPsec, even if a better routing for host is gateway B, gateway A cannot tell host to using gateway B as next hop(sending redirect), as IPsec policy is on gateway A only, not necessarily on gateway B. I think this is scenario that the patch is try to describe.
rgs Kevin
On Thu, Sep 26, 2013 at 10:02 AM, bill4carson<bill4carson@gmail.com> wrote:
Hi Kevin
On 2013年09月25日 02:52, Kevin Wilson wrote:
Hi, I am looking at this patch: http://lists.openwall.net/netdev/2007/08/24/29 and I cannot understand it. Can somebody please try to explain ? more specifically: Can somebody please give an example of some setup of IPsec tunnel where the ip_rt_send_redirect() method should not be called when the skb->sp is not NULL ?
+ if (rt->rt_flags&RTCF_DOREDIRECT&& !opt->srr&& !skb->sp) ^^^^^^^ If IPsec policy is not enabled for a specific flow that this skb matches, skb->sp is NULL.
(in other words, why if the SKB is and IPsec SKB, we should not send a redirect in such a case while forwarding a packet; note I am talking about IPv4)
Note that the check for skb->sp was changed in recent kernels to skb_sec_path(skb), but it is essentially the same.
Regards, Kevin
_______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
-- 八百里秦川尘土飞扬,三千万老陕齐吼秦腔。
--bill
-- 八百里秦川尘土飞扬,三千万老陕齐吼秦腔。 --bill
On 2013年09月29日 10:23, bill4carson wrote:
Hi, Kevin
On 2013年09月26日 15:31, Kevin Wilson wrote:
Hi, Of course. But the (unanswered) question is: when sp is non NULL and we are working with IPsec, why shoudn't we send redirect in such a case ?
Apologize for replying late.
I think you probably missing what "ICMP redirect" does, if so please take a look at this link:
http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080094702...
My understanding is: If host is protected by gateway A using IPsec, even if a better routing for host is gateway B, gateway A cannot tell host to using gateway B as next hop(sending redirect), as IPsec policy is on gateway A only, not necessarily on gateway B.
I think this is scenario that the patch is try to describe.
There is a subtle difference with what I described above, but most the same. Quotes from original commit log: IPv4 IPsec tunnel gateway incorrectly sends redirect to sender if it is onlink host when network device the IPsec tunnelled packet is arrived is the same as the one the decapsulated packet is sent. The author maybe said this scenario: Gateway B / \ / \ / \ Host ----> Gateway A Gateway A protects traffic from host destined to Gateway B, while as finally Gateway A found out host better next hop should be Gateway B. So we cannot send redirect here to Host, otherwise the traffic will be naked for Gateway B.
rgs Kevin
On Thu, Sep 26, 2013 at 10:02 AM, bill4carson<bill4carson@gmail.com> wrote:
Hi Kevin
On 2013年09月25日 02:52, Kevin Wilson wrote:
Hi, I am looking at this patch: http://lists.openwall.net/netdev/2007/08/24/29 and I cannot understand it. Can somebody please try to explain ? more specifically: Can somebody please give an example of some setup of IPsec tunnel where the ip_rt_send_redirect() method should not be called when the skb->sp is not NULL ?
+ if (rt->rt_flags&RTCF_DOREDIRECT&& !opt->srr&& !skb->sp) ^^^^^^^ If IPsec policy is not enabled for a specific flow that this skb matches, skb->sp is NULL.
(in other words, why if the SKB is and IPsec SKB, we should not send a redirect in such a case while forwarding a packet; note I am talking about IPv4)
Note that the check for skb->sp was changed in recent kernels to skb_sec_path(skb), but it is essentially the same.
Regards, Kevin
_______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
-- 八百里秦川尘土飞扬,三千万老陕齐吼秦腔。
--bill
-- 八百里秦川尘土飞扬,三千万老陕齐吼秦腔。 --bill
participants (2)
-
bill4carson -
Kevin Wilson