Coding With Fun
Home Docker Django Node.js Articles Python pip guide FAQ Policy

What's the difference between xfrm output and xfrma output?


Asked by Joanna Boone on Dec 09, 2021 FAQ



A quick summary of difference between the two marks. XFRM_OUTPUT_MARK is for routing a packet after XFRM (think as ESP out or Clear text in) a look up key for routing rule, while XFRMA_MARK is for routing a clear text packet into xfrm sub system; XFRMA_MARK is a lookup key in SPDB and SADB.
In fact,
xfrm is an IP framework for transforming packets (such as encrypting their payloads). This framework is used to implement the IPsec protocol suite (with the state object operating on the Security Association Database, and the policy object operating on the Security Policy Database).
Consequently, XFRMA_MARK (along with mask) is used inside xfrm code to find policy and state on for an outgoing, clear text, packet Jamal's notes (clear text packet out only. Then I wonder why set XFRMA_MARK on incoming SA?
Next,
XFRM-PROTO specifies a transform protocol: IPsec Encapsulating Security Payload ( esp ), IPsec Authentication Header ( ah ), IP Payload Compression ( comp ), Mobile IPv6 Type 2 Routing Header ( route2 ), or Mobile IPv6 Home Address Option ( hao ). ALGO-LIST contains one or more algorithms to use.
In respect to this,
XFRMi need "ip rule" when the peer's ip is covered by ipsec policy and for /32-to-/32 IPsec policies. Antony's initial attempt was the following rule and route 50 table. Because of "table 50" we don't need 0/1 and 128/1 split rules when the the other end is 0/0.