Re: [NF+IPsec 4/6]: Make IPsec input processing symetrical to output

[Patrick McHardy <kaber@trash.net>]

Herbert Xu wrote:
> On Wed, Oct 26, 2005 at 01:14:31AM +0200, Patrick McHardy wrote:
> 
>>No. I thought of this as a special case of inner transport mode SAs
>>(without any further SAs) which would be unhandled. I've never used
>>pure transport mode SAs except for testing, and I've never seen any
>>other users of this. Do you think it is important to handle?
> 
> 
> Well the scenario is IPv4 transport mode ESP applied outside normal
> IPIP tunnel devices.
> 
> Actually, this could work if we make sure that the user-space KMs
> set the SA selectors properly in this case.
> 
> I presume that you will be changing the output path so that LOCAL_OUT
> does not see the plain-text packet.  Otherwise it'll be asymmetric with
> repsect to the inbound side which does not see plain-text packets for
> transport mode SAs.

Yes, that was the idea. But since people seem to consider this an
important case to handle I'm going to try the per-SA flag you
proposed. I'll send new patches in the next days.