Tobias Brunner
6d8890767c
This also restores the test as it was before the referenced commit so it
again, as written in the description, demonstrates that venus is unable
to ping sun without IPsec tunnel.
Fixes: f27fb58ae0 ("testing: Update description and test evaluation of host2host-transport-nat")
15 lines
1019 B
Plaintext
15 lines
1019 B
Plaintext
An IPsec <b>transport-mode</b> connection between the natted host <b>alice</b> and gateway <b>sun</b>
|
|
is successfully set up. The updown script automatically inserts iptables-based firewall
|
|
rules that let pass the protected traffic. In order to test the host-to-host tunnel
|
|
<b>alice</b> pings <b>sun</b>.<br/>
|
|
<b>Note:</b> This scenario also demonstrates two problems with transport-mode and NAT traversal:
|
|
<ol>
|
|
<li>The client <b>venus</b> behind the same NAT as client <b>alice</b> is not able to ping <b>sun</b>
|
|
(even with ICMP explicitly allowed there) because the request arrives unencrypted and thus gets
|
|
dropped when the IPsec policies are consulted (increases the <em>XfrmInTmplMismatch</em> counter
|
|
in <em>/proc/net/xfrm_stat</em>).</li>
|
|
<li>A similar issue arises when <b>venus</b> also establishes an IPsec <b>transport-mode</b> connection to
|
|
<b>sun</b>. Due to the conflicting IPsec policies <b>sun</b> will use the newer SA from
|
|
<b>venus</b> to send traffic to the common transport mode address.</li>
|
|
</ol>
|