netdev - Re: [net-next-2.6 PATCH 1/7] xfrm: introduce basic mark infrastructure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 16 Feb 2010 06:57:17 -0500
From:	jamal <hadi@...erus.ca>
To:	Benny Amorsen <benny+usenet@...rsen.dk>
Cc:	Patrick McHardy <kaber@...sh.net>, timo.teras@....fi,
	herbert@...dor.apana.org.au, davem@...emloft.net,
	netdev@...r.kernel.org
Subject: Re: [net-next-2.6 PATCH 1/7] xfrm: introduce basic mark
 infrastructure

On Tue, 2010-02-16 at 11:43 +0100, Benny Amorsen wrote:

> xfrm ignores policy routing. You can't route IPSEC in Linux. This is
> actually a fairly annoying limitation. The workaround is to do like
> Microsoft: Encapsulate everything in l2tp or gre.

With these patches if you set policy routing mark, have the proper
setting in the skb or socket for the mark then the proper
route will be selected. If you have an SPD + SA added with the
same mark, those will be used right after the route is selected. 
So essentially you have the same mark across.
Does that solve or alleviate the problem?

cheers,
jamal

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html