netdev - Re: Question about xfrm by MARK feature

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <201006250935.30967.lists@egidy.de>
Date:	Fri, 25 Jun 2010 09:35:30 +0200
From:	"Gerd v. Egidy" <lists@...dy.de>
To:	hadi@...erus.ca
Cc:	timo.teras@....fi, kaber@...sh.net, herbert@...dor.apana.org.au,
	netdev@...r.kernel.org
Subject: Re: Question about xfrm by MARK feature

Hi Jamal,

thanks for your detailed answer.

> > For example I have 2 different remote networks with the same ip network
> > each and both of them have a tunnel to the same local network.
> 
> It seems "Same IP network" means that two remote locations will have
> exactly same IP address?

yes

> This is hard of course - but nat may do it..
> There's also the nat zones feature that Patrick introduced a while back
> that may help you

I'm using Patricks conntrack zones. And Patrick helped me with a input chain 
in the nat table. The other cases with e.g. a ip clash between local and 
remote net already work.

So only the case with two remotes and same ips is missing.

> > I map their IPs to
> > something different so I can distinguish them in the local network. But
> > after the nat the xfrm code sees two tunnels with exactly the same
> > values. So this can't work.
> 
> Can you look at the incoming encrypted packet headers and tell if they
> are from different remotes? If not, are different remotes coming in via
> a different network device? If yes, you can install a tc rule to mark
> them as they come in before decryption 

I planned to avoid looking at the remote gateway ip (to even allow two 
different remote gateways hiding natted behind the same ip) but that would be 
a good fallback solution if my other ideas don't work out.

> and that mark should stay with
> them even after they get decrypted.

Didn't know that, very good.

I just contacted the strongswan maintainers about reqids and marks. Let's see 
if this works out...

Kind regards,

Gerd

-- 
Address (better: trap) for people I really don't want to get mail from:
jonas@...tusamerica.com
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html