Re: Problem with IPSEC tunnel mode

[Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>]

On Fri, Apr 22, 2005 at 03:22:49PM +0200, Wolfgang Walter wrote:
> 
> I'm not sure how packets of tunnels ending at a host are treated exactly. 
> Probably the tunnel-packet itself is checked against XFRM_POLICY_IN because 
> its destination is the host itself. Then it gets decrypted if an entry 
> appropriate in the sad in (dst,spi) exists. The inner packet gets extracted 
> and decrypted and is then rerouted.

Actually it only gets checked once, after all IPsec decapsulation has been
completed.  So forwarded packets only ever get checked against the FWD
direction.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt