Re: letting traffic flow through a SG by default

Here's my current thinking on this problem.

- management wants folks to be able to drop FreeS/WAN onto a system
  without requiring any other changes to the system.  It should
  continue to work the way it did, except for the fact that OE
  might be able to provide privacy for some links.

  We'd even like distribution vendors to enable FreeS/WAN without
  troubling their clients.

  This motivating case requires that packets flow by default.

  (FreeS/WAN must not automatically enable forwarding -- that would
  create security problems.)

  (Ordinary firewall rules may well not apply to the ipsecN device, so
  we may actually be creating a security problem that way.  Hard to
  see a way around this.)

- we don't really have a way for FreeS/WAN to discover what subnets
  are "behind" our node.  So we pretty much have to default to passing
  0.0.0.0/0->0.0.0.0/0 traffic.

- how should we pass it?  A pass eroute is obvious.  An OE conn might
  be even better:

  + there is an opportunity to keep the traffic private

  - slower: we must go through the OE protocol for each new pair

  - there *might* be some security attacks.  With the recently added
    code to check DNS for credentials for the local side, many such
    opportunities have been foreclosed.  Are there any that don't
    require hijacking the reverse domain of the IP address to be
    hijacked?

I propose to add the following implicit conn:

    conn packetdefault
	    leftsubnet=0.0.0.0/0
	    also=private-or-clear

The "config setup" option "packetdefault" would be eliminated.

I considered calling it "default", but that would get confused with
the %default conn -- something quite different.

Notice that the leftsubnet is hard coded to be everything.  We had
considered making a general mechanism that would use mysubnet= to
specify subnets to be handled, and to default mysubnet to be 0.0.0.0.

I prefer this more modest proposal

- the policies for each *real* subnets are likely to be distinct

- even when actual subnets are present and reflected in the
  configuration, there still needs to be a policy for packets from
  other sources.

- the proposal is not likely to interfere with any features that we might add
  later

- the proposal is very easy to implement and needs no new supporting
  infrastructure.

- it is very easy for a sysadmin to override this feature.  For
  example, add to ipsec.conf:
  	conn packetdefault
		leftsubnet=0.0.0.0/0
		also=block

Hugh Redelmeier
[email protected]  voice: +1 416 482-8253