Re: [NF+IPsec 4/6]: Make IPsec input processing symetrical to output

[Patrick McHardy <kaber@trash.net>]

Herbert Xu wrote:
> On Sat, Nov 05, 2005 at 09:58:24AM +0100, Patrick McHardy wrote:
> 
>>IMO the view for netfilter should be as if we called netif_rx,
>>so on the input path decapsulated packets from the innermost
>>transport mode SA should go through PRE_ROUTING->LOCAL_IN
>>or possibly FORWARD in case of NAT.
> 
> You mean we simply skip the pre-decapsulation LOCAL_IN step
> and the post-encapsulation LOCAL_OUT step? That sounds great
> to me.

No, that won't be possible if we have more than one SA and
would also make DNAT in LOCAL_OUT on the encapsulated packet
impossible.

What I propose is to keep tunnel mode handling as it is, so
for each tunnel mode SA we hit PRE_ROUTING and LOCAL_IN in
the normal packet path. If the final SA is a transport mode
SA, we don't call netif_rx as in my first patchset, but pass
the packet through a new PRE_ROUTING hook in xfrm{4,6}_input
and LOCAL_IN afterwards. The packet won't be processed a second
time by the stack, just the netfilter hooks will be called.
NAT be will be handled manually for IPv4 by doing a new route
lookup and calling dst_input if NAT took place.