On Fri, 2005-22-04 at 13:42 +0200, Wolfgang Walter wrote:
> Am Freitag, 22. April 2005 02:18 schrieb jamal:
[..]
> > So i was wondering whether they OUT shouldnt be just a duplicate of
> > FWD (instead FWD seems to be the dup of IN). Look at that sample i
> > posted - all his policies look like that. What gives? Why are the IN and
> > FWD exactly the same? bug in racoon/setkey?
> No. XFRM_POLICY_IN is only checked for incoming packets which are delivered
> locally.
>
For encrypted packets
> XFRM_POLICY_FWD is checked for incoming packets which are routed.
>
For non-encrypted packets to be forwarded.
> That our XFRM_POLICY_IN matches XFRM_POLICY_FWD is more for convenience: if a
> subnet is connected directly to a router we want to treat the interface
> address of the router itself the same way. Instead of constructing special
> rules which exactly match the interface address we simply use the same rule
> as for forwarding.
>
Ok, so it was design intent then.
> XFRM_POLICY_OUT ist checked for every outgoing packet, be it locally
> generated
> be it routed (which is different from netfilter).
>
> This asymmetry is a little bit inconsequent. Probably one should really have
> XFRM_POLICY_FWD_IN and XFRM_POLICY_FWD_OUT. But XFRM_POLICY_OUT would mainly
> be a copy of XFRM_POLICY_FWD_OUT then, I think.
>
I did notice racoon or even setkey (version 0.5) for some rules (need to
investigate)
would install two policy rules when i installed only one i.e racoon will
install
one in OUT and other in FWD direction.
Example script and setkey -DP output attached. In this case i install
two rules, but for one of them an extra rule is installed. Actually the
pattern is quiet repeatable as you add more rules. This may also be what
is happening to you maybe?
cheers,
jamal
sample.conf
Description: Text document
setkey_output
Description: Text document
|