netdev - Re: Question about nf_conntrack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20190710080730.c4bjujzkqcjxevmf@breakpoint.cc>
Date:   Wed, 10 Jul 2019 10:07:30 +0200
From:   Florian Westphal <fw@...len.de>
To:     Naruto Nguyen <narutonguyen2018@...il.com>
Cc:     Florian Westphal <fw@...len.de>, netfilter-devel@...r.kernel.org,
        netdev@...r.kernel.org, netfilter@...r.kernel.org
Subject: Re: Question about nf_conntrack_proto for IPsec

Naruto Nguyen <narutonguyen2018@...il.com> wrote:
> Could you please elaborate more on how generic tracker tracks ESP connection?

All protocols that do not have a more specific l4 tracker are tracked
based on l3 protocol + l4 proto number.

IOW, any ESP packet sent between the same endpoint addresses is seen
as matching a single esp flow.

We could easily add the ESP SPI as additional distinction marker if needed.