[Top] [All Lists]

a question about XFRM_POLICY_FWD

To: davem@xxxxxxxxxx, herbert@xxxxxxxxxxxxxxxxxxx
Subject: a question about XFRM_POLICY_FWD
From: Kazunori Miyazawa <kazunori@xxxxxxxxxxxx>
Date: Tue, 14 Dec 2004 08:50:03 +0900
Cc: netdev@xxxxxxxxxxx, usagi-core@xxxxxxxxxxxxxx
Sender: netdev-bounce@xxxxxxxxxxx
User-agent: Mozilla Thunderbird 0.8 (Windows/20040913)

I would like to ask about meaning of XFRM_POLICY_FWD,
although a question may have been asked before.

I configured IPsec tunnel and thought XFRM_POLICY_FWD
might be confusing.

A forwarding policy which is represent with XFRM_POLICY_FWD
in the kernel affects only in-comming forwarding packet.
The policy does not affect out-going forwarding packet and
input packet to a security gateway itself.

If we want to connect network 2001:DB8:1::/64 and 2001:DB8:3::/64
with SGW(A) and SGW(B),

2001:DB8:1::/64        2001:DB8:2::/64        2001:DB8:3::/64

=== represents IPsec tunnel
--- represents a network behind SGW.

The addresses of each SGW are:

SGW(A) internal address 2001:DB8:1::A/64
SGW(A) external address 2001:DB8:2::A/64
SGW(B) external address 2001:DB8:2::B/64
SGW(B) internal address 2001:DB8:3::B/64

We need to configure policies in SGW(A) which are represent with setkey command 
spdadd 2001:DB8:1::/64 2001:DB8:3::/64 any -P out ipsec 
spdadd 2001:DB8:3::/64 2001:DB8:1::/64 any -P fwd ipsec 

However, the above policies does not allow SGW(A) to receive packest from 
2001:DB8:3::/64 to
2001:DB8:1::A/64 because there is no policy for "INPUT".

To let the packet reach 2001:DB8:1::A, we needs an additional policy
spdadd 2001:DB8:3::/64 2001:DB8:1::A/128 any -P in ipsec 

Totally, we need three policies for the configuration in a SGW.

I think , from the point of view of user or administrator, why forward does not 
allow the packet instead
2001:DB8:1::A is included in network 2001:DB8:1::/64. And I also think why I 
can not configure out-going
forward policy with "fwd". Anyway XFRM_POLICY_FWD or "fwd" might be confusing.

What does XFRM_POLICY_FWD or direction="forward" means in the architecture 

Of course I know the implementation :-p

We should remove or obsolete XFRM_POLICY_FORWARD and use XFRM_POLICY_IN instead 
of it.
We should lookup out-going forwarding packet with XFRM_POLICY_FORWARD.

Kazunori Miyazawa

<Prev in Thread] Current Thread [Next in Thread>
  • a question about XFRM_POLICY_FWD, Kazunori Miyazawa <=