From: Patrick McHardy <kaber@trash•net>
To: "Gerd v. Egidy" <lists@egidy•de>
Cc: jamal <hadi@cyberus•ca>,
timo.teras@iki•fi, herbert@gondor•apana.org.au,
netdev@vger•kernel.org
Subject: Re: Question about xfrm by MARK feature
Date: Wed, 23 Jun 2010 18:15:12 +0200 [thread overview]
Message-ID: <4C223310.6090006@trash.net> (raw)
In-Reply-To: <201006231803.17261.lists@egidy.de>
Gerd v. Egidy wrote:
> Hi Jamal,
>
> while looking through the 2.6.34 changelog I found the xfrm by MARK feature
> you developed in february. I'm currently working on NAT for ipsec connections
> and thought your feature might help me.
>
> For example I have 2 different remote networks with the same ip network each
> and both of them have a tunnel to the same local network. I map their IPs to
> something different so I can distinguish them in the local network. But after
> the nat the xfrm code sees two tunnels with exactly the same values. So this
> can't work.
>
> But if I understood your feature correctly, I can now mark the packets (e.g.
> in iptables with ... -j MARK --set-mark 1) and have xfrm select the correct
> ipsec tunnel via the mark. Correct?
>
> But does your feature also set the mark on packets decrypted by xfrm? I need
> some way to find out from which tunnel the packet came to correctly treat it.
>
You should be able to use the policy match to distinguish the tunnels,
f.i. by matching on the tunnel endpoints.
next prev parent reply other threads:[~2010-06-23 16:15 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-06-23 16:03 Question about xfrm by MARK feature Gerd v. Egidy
2010-06-23 16:15 ` Patrick McHardy [this message]
2010-06-23 22:13 ` Gerd v. Egidy
2010-06-23 22:16 ` Herbert Xu
2010-06-24 12:04 ` jamal
2010-06-25 7:35 ` Gerd v. Egidy
2010-06-25 12:43 ` jamal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4C223310.6090006@trash.net \
--to=kaber@trash$(echo .)net \
--cc=hadi@cyberus$(echo .)ca \
--cc=herbert@gondor$(echo .)apana.org.au \
--cc=lists@egidy$(echo .)de \
--cc=netdev@vger$(echo .)kernel.org \
--cc=timo.teras@iki$(echo .)fi \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox