Re: Status of Netfilter IPSEC patches

[Patrick McHardy <kaber@trash.net>]

Sven Anders wrote:
> | Patrick McHardy wrote:
> |
> | Read last weeks netdev archive, turns out the whole idea of skipping
> | netfilter hooks until all IPsec processing is done was wrong. I don't
> | know how to solve it yet.
> 
> Any details about this?
> What problems can arise?

Raw sockets can have policies that allow them to receive packets
in intermediate states. Skipping the hooks on input until the
packet are entirely decrypted makes filtering before these sockets
impossible and is inconsistent with the way filtering can usually
be done.

It seems the only thing that would work is taking the opposite approach,
pass the packets through LOCAL_OUT/POST_ROUTING for each transform on
output and don't skip on input. For filtering in transport mode this
means we need to pass a packet through the stack for each transform on
input, not just for tunnel mode.

> I downloaded the latest patch-o-matic and looked at the state of the
> patches,
> but these are out-of-date. Are these patches unmaintained due to the
> statement
> above?

Yes.

> There are newer ones under:
> ~  http://www.saout.de/misc/linux-2.6.12-ipsec-nat/
> Please update the patches in the patch-o-matic!

If someone sends me a patch for svn I'll apply it.

Regards
Patrick