From: Aidas K. <a.k...@gm...> - 2004-10-29 07:05:49
|
Joy, Need to have forward policies (which are not specified in RFC 2401 or any other ipsec related RFC I've read) was like a thunder from the blue sky to us. There is no way in setkey how to insert forward policies at the moment. Which of the following directions to solve this problem we have not decided yet: 1) push kernel developers to have rfc2401 semantics in kernel; 1a) have pfkey kernel part transform rfc2401 semantics into kernel semantics; 2) have libpfkey generate extra policies transparently to the user; 3) have tools (setkey and racoon) generate extra policies transparently to the user; 4) extend setkey's syntax to make explicit forward policy management possible and write docs for all the admins to change policies. Personally I would like to have (1). This would make setups simpler. I believe, people with embeded applications would like very much to have (1) too (as extra policies => extra memory use will drive them mad). Yet, I have little hope this will happen :-//. Second least worst thing IMHO would be a combination of (2) and (4). Libpfkey functions have to be rewritten to generate extra forward policies, and current functions should be renamed as to provide view to real situation. Setkey should have a swith which tells to operate in rfc2401 compliant fashion (generating forward policies) or kernel mode (adding/removing/showing policies, including forward, as they are). Oppinions anyone? Meanwhile, I would like to recomend to abstain from upgrading to anything above 2.6.9. Joy Latten wrote: > I understand there has been discussion and code change > for checks with tunnel mode and forwarding packets. > In 2.6.9 with latest patches all my decapsulated tunnel mode > packets instead of being forwarded onto receiving subnet > or dropped. > How do I specify manually with setkey (syntax?), to forward > decapsulated packets onto receiving subnet? > > Thanks for any help. > > Joy Latten -- Aidas Kasparas IT administrator GM Consult Group, UAB |