Re: [Ipsec-tools-devel] Re: [PATCH 2.6]: Check against correct policy list in ip_forward/ip6_forward

[Aidas Kasparas <a.kasparas@xxxxxx>]

Patrick McHardy wrote:
> Aidas Kasparas wrote:
>
> > I'm sorry, what is wrong with racoon?
>
> When generate_policy is set to on racoon doesn't generate forward
> policies for tunnel mode SAs, so traffic forwarded from a tunnel
> is not subject to policy checks.
Patrick,

        what _forward_ policies should racoon generate. And WHY?!

Could you please specify for the case when:
- remote host has address A.A.A.A
- security gateway have insecure adress B.B.B.B
- secured network is C.C.C.0/24, security gateway's address C.C.C.C

what policies in your oppinion has to be inserted into SPD for this 
setup by racoon?
        Thanks in advance.

> I have a patch which fixes this, I will post it a couple of days.
>
> Regards
> Patrick
--
Aidas Kasparas
IT administrator
GM Consult Group, UAB