Re: [RFC, PATCH 2/5]: netfilter+ipsec - output hooks

[Alexander Samad <alex@samad.com.au>]

[-- Attachment #1: Type: text/plain, Size: 1107 bytes --]

Hi

I don't have a full understanding of the code area we are talking about,
having only had a peruse of it a while back.

But from my reading of this do I understand that packets that enter a
box to be routed (forwarded on) that match a IPSEC transform policy

1) Are seen in  mangle prerouting
2) nat prerouting 
2) Encrypted
3) mangle Output
4) nat Output

Does this mean they also hit the filter input & output tables aswell or
 just the filter forward table.

I would have thought for the whole process the packet (routed/forward
packet) would only be seen in the prerouting/forward/postrouting flow.
Weather or not it is going to be encrypted shouldn't make a difference I
would have thought

On Thu, Mar 18, 2004 at 05:31:40PM +0100, Patrick McHardy wrote:
> This patch adds new output-hooks. Packets with dst->xfrm != NULL
> traverse the POST_ROUTING hook before dst_output is called. The
> transformers mark the packets in the control buffer with a new flag
> IPSKB_XFRM_TRANSFORMED, these packets then traverse the LOCAL_OUT
> hook when they hit ip_output.
> 
> 



[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]