Date: Sun, 11 Dec 2016 14:33:43 +0300 From: "Andrey V. Elsukov" <ae@FreeBSD.org> To: Eugene Grosbein <eugen@grosbein.net>, freebsd-net@FreeBSD.org Subject: Re: [RFC/RFT] projects/ipsec Message-ID: <36fa749c-f284-1d96-704c-b7118a574dd0@FreeBSD.org> In-Reply-To: <584D18D1.8090400@grosbein.net> References: <2bd32791-944f-2417-41e9-e0fe1c705502@FreeBSD.org> <584D18D1.8090400@grosbein.net>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --AbDHjIgxxd6SerGnmaXIOHU7GJJe0v8DR Content-Type: multipart/mixed; boundary="HRXvULsnAqHhvVG8SIp2hBFjetsJDFlbj"; protected-headers="v1" From: "Andrey V. Elsukov" <ae@FreeBSD.org> To: Eugene Grosbein <eugen@grosbein.net>, freebsd-net@FreeBSD.org Message-ID: <36fa749c-f284-1d96-704c-b7118a574dd0@FreeBSD.org> Subject: Re: [RFC/RFT] projects/ipsec References: <2bd32791-944f-2417-41e9-e0fe1c705502@FreeBSD.org> <584D18D1.8090400@grosbein.net> In-Reply-To: <584D18D1.8090400@grosbein.net> --HRXvULsnAqHhvVG8SIp2hBFjetsJDFlbj Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 11.12.2016 12:13, Eugene Grosbein wrote: > 11.12.2016 6:07, Andrey V. Elsukov =D0=BF=D0=B8=D1=88=D0=B5=D1=82: >=20 >> * use transport mode IPsec for forwarded IPv4 packets now unsupported.= >> This matches the IPv6 behavior, and since we can handle the replies, I= >> think it is useless. >=20 > Does it include a case of packets going from LAN and forwarded into > gif(4) tunnel > connected to remote IPSEC gateway and encrypted with transport mode? >=20 > That is, will this configuration break? No. An encapsulated by gif(4) packet is considered as own packet. The described change is related to transport mode policies, that are match forwarded packets, i.e. when source and destination addresses are not our own. In this case we can't handle the returned packets. --=20 WBR, Andrey V. Elsukov --HRXvULsnAqHhvVG8SIp2hBFjetsJDFlbj-- --AbDHjIgxxd6SerGnmaXIOHU7GJJe0v8DR Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEsBAEBCAAWBQJYTTmXDxxhZUBmcmVlYnNkLm9yZwAKCRABxeoEEMihejlKB/91 4n77xTT77u8yX4QEr9g8mhnb/4RnAyowFYKE2S8c93eK4D9GIac55y21Im+MQws5 zBvfW9vTcJJ5oOZscgYnzMd3uomPxxeDY5IBrQlj0bIW6fobt8/1wDfvZ3edZUx4 f9oLBQaPUIptdOjDEFVponFMrJw2338xULkn0fEpPeS1hwkda/Tn6CHjCLWC00dh 5gUlCfCB6ppdcPWmsXwAzK6E7r3Kl0secwipdyJlYGMZAkGb26g3NTRP0buqdkNp TbNkJeq769diuecDaCKilQCQHWhExsIrj9sBMtz4Ka4Ad2QxzB6Xgxl4mell33WJ UHJc+8J1YKaD1GqlLwBG =4oOc -----END PGP SIGNATURE----- --AbDHjIgxxd6SerGnmaXIOHU7GJJe0v8DR--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?36fa749c-f284-1d96-704c-b7118a574dd0>