headers
Panagiotis Georgopoulos | 14 Dec 2011 01:38
Picon

IPsec question

Hello all,

 

               I ‘ve got a somewhat weird question regarding IPsec. Let’s suppose that I want a MR to send a BU ipsec’ed when it has a direct connection to the Internet, and send it unencrypted (without IPsec) when it is behind another MR.

 

How can I achieve to receive successfully these two BU instances at its HA, given the way xfrm works on linux? If I am right, if I install the security associations on the HA and prepare it for a BU in transport mode and it receives an unencrypted, the kernel will swallow the packet and don’t even pass it along to the umip code in user space.

 

In the MR case I could at least handle the SAD and SPD before the BU is sent, but in the HA case I cannot do that. How could the HA be able to accept both an unencrypted and encrypted BU from a specific MR ? Any ideas?

 

Thanks,

Panos

<div><div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">Hello all,<p></p></span></p>
<p class="MsoNormal"><span lang="EN-US"><p>&nbsp;</p></span></p>
<p class="MsoNormal"><span lang="EN-US">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; I &lsquo;ve got a somewhat weird question regarding IPsec. Let&rsquo;s suppose that I want a MR to send a BU ipsec&rsquo;ed when it has a direct connection to the Internet, and send it unencrypted (without IPsec) when it is behind another MR. <p></p></span></p>
<p class="MsoNormal"><span lang="EN-US"><p>&nbsp;</p></span></p>
<p class="MsoNormal"><span lang="EN-US">How can I achieve to receive successfully these two BU instances at its HA, given the way xfrm works on linux? If I am right, if I install the security associations on the HA and prepare it for a BU in transport mode and it receives an unencrypted, the kernel will swallow the packet and don&rsquo;t even pass it along to the umip code in user space. <p></p></span></p>
<p class="MsoNormal"><span lang="EN-US"><p>&nbsp;</p></span></p>
<p class="MsoNormal"><span lang="EN-US">In the MR case I could at least handle the SAD and SPD before the BU is sent, but in the HA case I cannot do that. How could the HA be able to accept both an unencrypted and encrypted BU from a specific MR ? Any ideas?<p></p></span></p>
<p class="MsoNormal"><span lang="EN-US"><p>&nbsp;</p></span></p>
<p class="MsoNormal"><span lang="EN-US">Thanks,<p></p></span></p>
<p class="MsoNormal"><span lang="EN-US">Panos<p></p></span></p>
</div></div>
Permalink | Reply |
headers
Panagiotis Georgopoulos | 19 Dec 2011 14:36
Picon

Re: IPsec question

Hi all,

 

                Just a gentle ping… Any ideas, anyone?

 

                Cheers,

                Panos

 

 

From: support-bounces-iN02MlLpVvKBGjFcyzLEWEB+6BGkLq7r@public.gmane.org [mailto:support-bounces-iN02MlLpVvKBGjFcyzLEWEB+6BGkLq7r@public.gmane.org] On Behalf Of Panagiotis Georgopoulos
Sent: 14 December 2011 00:39
To: support-iN02MlLpVvKBGjFcyzLEWEB+6BGkLq7r@public.gmane.org
Subject: [support] IPsec question

 

Hello all,

 

               I ‘ve got a somewhat weird question regarding IPsec. Let’s suppose that I want a MR to send a BU ipsec’ed when it has a direct connection to the Internet, and send it unencrypted (without IPsec) when it is behind another MR.

 

How can I achieve to receive successfully these two BU instances at its HA, given the way xfrm works on linux? If I am right, if I install the security associations on the HA and prepare it for a BU in transport mode and it receives an unencrypted, the kernel will swallow the packet and don’t even pass it along to the umip code in user space.

 

In the MR case I could at least handle the SAD and SPD before the BU is sent, but in the HA case I cannot do that. How could the HA be able to accept both an unencrypted and encrypted BU from a specific MR ? Any ideas?

 

Thanks,

Panos

<div><div class="WordSection1">
<p class="MsoNormal"><span>Hi all,<p></p></span></p>
<p class="MsoNormal"><span><p>&nbsp;</p></span></p>
<p class="MsoNormal"><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Just a gentle ping&hellip; Any ideas, anyone?<p></p></span></p>
<p class="MsoNormal"><span><p>&nbsp;</p></span></p>
<p class="MsoNormal"><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Cheers,<p></p></span></p>
<p class="MsoNormal"><span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Panos<p></p></span></p>
<p class="MsoNormal"><span><p>&nbsp;</p></span></p>
<p class="MsoNormal"><span><p>&nbsp;</p></span></p>
<div>
<div><div><p class="MsoNormal"><span lang="EN-US">From:</span><span lang="EN-US"> support-bounces@... [mailto:support-bounces@...] On Behalf Of Panagiotis Georgopoulos<br>Sent: 14 December 2011 00:39<br>To: support@...<br>Subject: [support] IPsec question<p></p></span></p></div></div>
<p class="MsoNormal"><p>&nbsp;</p></p>
<p class="MsoNormal"><span lang="EN-US">Hello all,<p></p></span></p>
<p class="MsoNormal"><span lang="EN-US"><p>&nbsp;</p></span></p>
<p class="MsoNormal"><span lang="EN-US">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; I &lsquo;ve got a somewhat weird question regarding IPsec. Let&rsquo;s suppose that I want a MR to send a BU ipsec&rsquo;ed when it has a direct connection to the Internet, and send it unencrypted (without IPsec) when it is behind another MR. <p></p></span></p>
<p class="MsoNormal"><span lang="EN-US"><p>&nbsp;</p></span></p>
<p class="MsoNormal"><span lang="EN-US">How can I achieve to receive successfully these two BU instances at its HA, given the way xfrm works on linux? If I am right, if I install the security associations on the HA and prepare it for a BU in transport mode and it receives an unencrypted, the kernel will swallow the packet and don&rsquo;t even pass it along to the umip code in user space. <p></p></span></p>
<p class="MsoNormal"><span lang="EN-US"><p>&nbsp;</p></span></p>
<p class="MsoNormal"><span lang="EN-US">In the MR case I could at least handle the SAD and SPD before the BU is sent, but in the HA case I cannot do that. How could the HA be able to accept both an unencrypted and encrypted BU from a specific MR ? Any ideas?<p></p></span></p>
<p class="MsoNormal"><span lang="EN-US"><p>&nbsp;</p></span></p>
<p class="MsoNormal"><span lang="EN-US">Thanks,<p></p></span></p>
<p class="MsoNormal"><span lang="EN-US">Panos<p></p></span></p>
</div>
</div></div>
Permalink | Reply |
headers
Romain KUNTZ | 19 Dec 2011 14:51
Picon

Re: IPsec question

Hi,

If you know the prefix that is used in the network in which the MR connects to, you could add an XFRM ACCEPT
policy for the incoming packets which source address uses such prefix. 

Cheers,
Romain

On Dec 19, 2011, at 14:36, Panagiotis Georgopoulos wrote:

> Hi all,
>  
>                 Just a gentle ping… Any ideas, anyone?
>  
>                 Cheers,
>                 Panos
>  
>  
> From: support-bounces@...
[mailto:support-bounces <at> jules.nautilus6.org] On Behalf Of Panagiotis Georgopoulos
> Sent: 14 December 2011 00:39
> To: support@...
> Subject: [support] IPsec question
>  
> Hello all,
>  
>                I ‘ve got a somewhat weird question regarding IPsec. Let’s suppose that I want a MR to send a BU
ipsec’ed when it has a direct connection to the Internet, and send it unencrypted (without IPsec) when
it is behind another MR.
>  
> How can I achieve to receive successfully these two BU instances at its HA, given the way xfrm works on
linux? If I am right, if I install the security associations on the HA and prepare it for a BU in transport
mode and it receives an unencrypted, the kernel will swallow the packet and don’t even pass it along to
the umip code in user space.
>  
> In the MR case I could at least handle the SAD and SPD before the BU is sent, but in the HA case I cannot do that.
How could the HA be able to accept both an unencrypted and encrypted BU from a specific MR ? Any ideas?
>  
> Thanks,
> Panos
> _______________________________________________
> Support mailing list
> Support@...
> http://ml.nautilus6.org/mailman/listinfo/support
Permalink | Reply |
headers
Panagiotis Georgopoulos | 19 Dec 2011 15:06
Picon

Re: IPsec question

Hi Romain,

	Thanks for your email and suggestion! 

	Indeed I can add such a policy manually, which for a testbed setup will work fine!
However, I was thinking of a more generic solution as the current suggestion goes against
the nature of roaming as I would have to know in advance the prefix of the Access Networks
a MR could potentially connect to...

	I am just thinking if there is a way to "bypass" xfrm or at least force it to pass
the packet to the umip code even though the packet might not adhere to a certain installed
IPsec policy.

	I understand why xfrm's role is as such on linux, but at the same time is a bit
restrictive.

	Thanks again,
	Panos

> -----Original Message-----
> From: Romain KUNTZ [mailto:kuntz@...]
> Sent: 19 December 2011 13:52
> To: Panagiotis Georgopoulos
> Cc: support@...
> Subject: Re: [support] IPsec question
> 
> Hi,
> 
> If you know the prefix that is used in the network in which the MR connects to, you
> could add an XFRM ACCEPT policy for the incoming packets which source address uses
> such prefix.
> 
> Cheers,
> Romain
> 
> On Dec 19, 2011, at 14:36, Panagiotis Georgopoulos wrote:
> 
> > Hi all,
> >
> >                 Just a gentle ping. Any ideas, anyone?
> >
> >                 Cheers,
> >                 Panos
> >
> >
> > From: support-bounces@... [mailto:support-
> bounces@...] On Behalf Of Panagiotis Georgopoulos
> > Sent: 14 December 2011 00:39
> > To: support@...
> > Subject: [support] IPsec question
> >
> > Hello all,
> >
> >                I 've got a somewhat weird question regarding IPsec. Let's suppose
> that I want a MR to send a BU ipsec'ed when it has a direct connection to the
> Internet, and send it unencrypted (without IPsec) when it is behind another MR.
> >
> > How can I achieve to receive successfully these two BU instances at its HA, given
> the way xfrm works on linux? If I am right, if I install the security associations
> on the HA and prepare it for a BU in transport mode and it receives an unencrypted,
> the kernel will swallow the packet and don't even pass it along to the umip code in
> user space.
> >
> > In the MR case I could at least handle the SAD and SPD before the BU is sent, but
> in the HA case I cannot do that. How could the HA be able to accept both an
> unencrypted and encrypted BU from a specific MR ? Any ideas?
> >
> > Thanks,
> > Panos
> > _______________________________________________
> > Support mailing list
> > Support@...
> > http://ml.nautilus6.org/mailman/listinfo/support
> 
>
Permalink | Reply |
headers
Romain KUNTZ | 19 Dec 2011 16:15
Picon

Re: IPsec question

Hi Georges, 

Have you tried adding an accept policy with a lower priority? I don't remember if XFRM would let the packet go
in that case or if it drops it whenever a single policy does not match.

romain

On Dec 19, 2011, at 15:06, Panagiotis Georgopoulos wrote:

> Hi Romain,
> 
> 	Thanks for your email and suggestion! 
> 
> 	Indeed I can add such a policy manually, which for a testbed setup will work fine!
> However, I was thinking of a more generic solution as the current suggestion goes against
> the nature of roaming as I would have to know in advance the prefix of the Access Networks
> a MR could potentially connect to...
> 
> 	I am just thinking if there is a way to "bypass" xfrm or at least force it to pass
> the packet to the umip code even though the packet might not adhere to a certain installed
> IPsec policy.
> 
> 	I understand why xfrm's role is as such on linux, but at the same time is a bit
> restrictive.
> 
> 	Thanks again,
> 	Panos
> 
> 
>> -----Original Message-----
>> From: Romain KUNTZ [mailto:kuntz@...]
>> Sent: 19 December 2011 13:52
>> To: Panagiotis Georgopoulos
>> Cc: support@...
>> Subject: Re: [support] IPsec question
>> 
>> Hi,
>> 
>> If you know the prefix that is used in the network in which the MR connects to, you
>> could add an XFRM ACCEPT policy for the incoming packets which source address uses
>> such prefix.
>> 
>> Cheers,
>> Romain
>> 
>> On Dec 19, 2011, at 14:36, Panagiotis Georgopoulos wrote:
>> 
>>> Hi all,
>>> 
>>>                Just a gentle ping. Any ideas, anyone?
>>> 
>>>                Cheers,
>>>                Panos
>>> 
>>> 
>>> From: support-bounces@... [mailto:support-
>> bounces@...] On Behalf Of Panagiotis Georgopoulos
>>> Sent: 14 December 2011 00:39
>>> To: support@...
>>> Subject: [support] IPsec question
>>> 
>>> Hello all,
>>> 
>>>               I 've got a somewhat weird question regarding IPsec. Let's suppose
>> that I want a MR to send a BU ipsec'ed when it has a direct connection to the
>> Internet, and send it unencrypted (without IPsec) when it is behind another MR.
>>> 
>>> How can I achieve to receive successfully these two BU instances at its HA, given
>> the way xfrm works on linux? If I am right, if I install the security associations
>> on the HA and prepare it for a BU in transport mode and it receives an unencrypted,
>> the kernel will swallow the packet and don't even pass it along to the umip code in
>> user space.
>>> 
>>> In the MR case I could at least handle the SAD and SPD before the BU is sent, but
>> in the HA case I cannot do that. How could the HA be able to accept both an
>> unencrypted and encrypted BU from a specific MR ? Any ideas?
>>> 
>>> Thanks,
>>> Panos
>>> _______________________________________________
>>> Support mailing list
>>> Support@...
>>> http://ml.nautilus6.org/mailman/listinfo/support
>> 
>> 
> 
> 
>
Permalink | Reply |
headers
Panagiotis Georgopoulos | 19 Dec 2011 18:56
Picon

Re: IPsec question

Hi Romain,

	I tried this some time ago and it wasn't working for some reason that I can't
remember. I 'll try again and report back...

	Thanks,
	Panos

> -----Original Message-----
> From: Romain KUNTZ [mailto:kuntz@...]
> Sent: 19 December 2011 15:16
> To: Panagiotis Georgopoulos
> Cc: support@...
> Subject: Re: [support] IPsec question
> 
> Hi Georges,
> 
> Have you tried adding an accept policy with a lower priority? I don't remember if
> XFRM would let the packet go in that case or if it drops it whenever a single policy
> does not match.
> 
> romain
> 
> On Dec 19, 2011, at 15:06, Panagiotis Georgopoulos wrote:
> 
> > Hi Romain,
> >
> > 	Thanks for your email and suggestion!
> >
> > 	Indeed I can add such a policy manually, which for a testbed setup will work
> fine!
> > However, I was thinking of a more generic solution as the current
> > suggestion goes against the nature of roaming as I would have to know
> > in advance the prefix of the Access Networks a MR could potentially connect to...
> >
> > 	I am just thinking if there is a way to "bypass" xfrm or at least
> > force it to pass the packet to the umip code even though the packet
> > might not adhere to a certain installed IPsec policy.
> >
> > 	I understand why xfrm's role is as such on linux, but at the same
> > time is a bit restrictive.
> >
> > 	Thanks again,
> > 	Panos
> >
> >
> >> -----Original Message-----
> >> From: Romain KUNTZ [mailto:kuntz@...]
> >> Sent: 19 December 2011 13:52
> >> To: Panagiotis Georgopoulos
> >> Cc: support@...
> >> Subject: Re: [support] IPsec question
> >>
> >> Hi,
> >>
> >> If you know the prefix that is used in the network in which the MR
> >> connects to, you could add an XFRM ACCEPT policy for the incoming
> >> packets which source address uses such prefix.
> >>
> >> Cheers,
> >> Romain
> >>
> >> On Dec 19, 2011, at 14:36, Panagiotis Georgopoulos wrote:
> >>
> >>> Hi all,
> >>>
> >>>                Just a gentle ping. Any ideas, anyone?
> >>>
> >>>                Cheers,
> >>>                Panos
> >>>
> >>>
> >>> From: support-bounces@... [mailto:support-
> >> bounces@...] On Behalf Of Panagiotis Georgopoulos
> >>> Sent: 14 December 2011 00:39
> >>> To: support@...
> >>> Subject: [support] IPsec question
> >>>
> >>> Hello all,
> >>>
> >>>               I 've got a somewhat weird question regarding IPsec.
> >>> Let's suppose
> >> that I want a MR to send a BU ipsec'ed when it has a direct
> >> connection to the Internet, and send it unencrypted (without IPsec) when it is
> behind another MR.
> >>>
> >>> How can I achieve to receive successfully these two BU instances at
> >>> its HA, given
> >> the way xfrm works on linux? If I am right, if I install the security
> >> associations on the HA and prepare it for a BU in transport mode and
> >> it receives an unencrypted, the kernel will swallow the packet and
> >> don't even pass it along to the umip code in user space.
> >>>
> >>> In the MR case I could at least handle the SAD and SPD before the BU
> >>> is sent, but
> >> in the HA case I cannot do that. How could the HA be able to accept
> >> both an unencrypted and encrypted BU from a specific MR ? Any ideas?
> >>>
> >>> Thanks,
> >>> Panos
> >>> _______________________________________________
> >>> Support mailing list
> >>> Support@...
> >>> http://ml.nautilus6.org/mailman/listinfo/support
> >>
> >>
> >
> >
> >
> 
>
Permalink | Reply |

Gmane