From: Patrick McHardy <kaber@trash.net>
To: jplatte@naasa.net
Cc: netdev@vger.kernel.org, netfilter-devel@lists.netfilter.org,
davem@davemloft.net
Subject: Re: [PATCH 00/13]: Netfilter IPsec support
Date: Sun, 20 Nov 2005 19:07:30 +0100 [thread overview]
Message-ID: <4380BB62.8050404@trash.net> (raw)
In-Reply-To: <200511201902.10179.lists@naasa.net>
Joerg Platte wrote:
> Am Sonntag, 20. November 2005 17:31 schrieb Patrick McHardy:
> Hi!
>
>>- policy lookups after NAT:
>>
>>When NAT changes a packet it already calls ip_route_me_harder, which
>>reroutes the packet and does a new policy lookup. It only looks at
>>the IP addresses however, changing the port numbers require a new
>>policy lookup as well. It also doesn't reroute in POST_ROUTING, since
>>the packet has already been routed. To behave more like a regular
>>tunnel device a policy lookup is now also done after SNAT and the
>>packet is passed to dst_output again if the lookup yielded a new
>>policy.
>
> I suppose, this is the reason, why masqueraded packages leave a recent kernel
> unencrypted, even if they would match the policy. It's still not implemented
> in mainline. Am I right? If yes, I hope your patches will be merged as soon
> as possible :-)
You're right, that's the reason. Since the patches touch quite a lot of
code they won't make it in 2.6.15, though.
next prev parent reply other threads:[~2005-11-20 18:07 UTC|newest]
Thread overview: 54+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-11-20 16:31 [PATCH 00/13]: Netfilter IPsec support Patrick McHardy
2005-11-20 16:31 ` [PATCH 01/13]: [NETFILTER]: Remove okfn usage in ip_vs_core.c Patrick McHardy
2005-11-20 16:31 ` [PATCH 02/13]: [NETFILTER]: Call POST_ROUTING hook before fragmentation Patrick McHardy
2005-11-20 16:31 ` [PATCH 03/13]: [IPV4]: Replace dst_output by ip_dst_output Patrick McHardy
2005-11-20 16:31 ` [PATCH 04/13]: [IPV6]: Replace dst_output by ip6_dst_output Patrick McHardy
2005-11-20 16:31 ` [PATCH 05/13]: [IPV4/6]: Netfilter IPsec output hooks Patrick McHardy
2005-11-22 4:40 ` Herbert Xu
2005-11-22 4:53 ` Patrick McHardy
2005-11-22 5:13 ` Patrick McHardy
2005-11-22 10:30 ` Herbert Xu
2005-11-22 10:31 ` Herbert Xu
2005-11-22 12:13 ` Herbert Xu
2005-11-28 1:07 ` Patrick McHardy
2005-11-28 4:56 ` Herbert Xu
2005-11-28 12:25 ` Patrick McHardy
2005-12-04 22:09 ` Patrick McHardy
2005-12-04 22:15 ` Herbert Xu
2005-11-20 16:31 ` [PATCH 06/13]: [IPV4/6]: Netfilter IPsec input hooks Patrick McHardy
2005-11-21 4:42 ` Yasuyuki KOZAKAI
[not found] ` <200511210442.jAL4gPoO001846@toshiba.co.jp>
2005-11-21 6:52 ` Patrick McHardy
2005-11-21 7:00 ` David S. Miller
2005-11-21 7:47 ` Herbert Xu
2005-11-21 16:52 ` Patrick McHardy
2005-11-21 10:53 ` Yasuyuki KOZAKAI
[not found] ` <200511211053.jALAro04019574@toshiba.co.jp>
2005-11-21 16:34 ` Patrick McHardy
[not found] ` <438185ED.3050005@miyazawa.org>
2005-11-21 8:50 ` YOSHIFUJI Hideaki / 吉藤英明
2005-11-21 16:29 ` Patrick McHardy
2005-12-01 1:27 ` Herbert Xu
2005-12-04 22:06 ` Patrick McHardy
2005-12-04 22:10 ` Herbert Xu
2005-12-04 22:49 ` Patrick McHardy
2005-11-20 16:31 ` [PATCH 07/13]: [NETFILTER]: Fix xfrm lookup in ip_route_me_harder/ip6_route_me_harder Patrick McHardy
2005-11-28 21:06 ` Herbert Xu
2005-11-29 7:02 ` Patrick McHardy
2005-11-29 7:34 ` Herbert Xu
2005-11-29 7:49 ` David S. Miller
2005-11-29 11:31 ` Herbert Xu
2005-11-20 16:31 ` [PATCH 08/13]: [NETFILTER]: Use conntrack information to determine if packet was NATed Patrick McHardy
2005-11-20 16:31 ` [PATCH 09/13]: [NETFILTER]: Redo policy lookups after NAT when neccessary Patrick McHardy
2005-11-20 16:43 ` Patrick McHardy
2005-11-20 16:31 ` [PATCH 10/13]: [NETFILTER]: Keep the conntrack reference until after policy checks Patrick McHardy
2005-11-20 16:31 ` [PATCH 11/13]: [NETFILTER]: Handle NAT in IPsec " Patrick McHardy
2005-11-20 16:31 ` [PATCH 12/13]: [NETFILTER]: Export ip6_masked_addrcmp, don't pass IPv6 addresses on stack Patrick McHardy
2005-11-20 16:31 ` [PATCH 13/13]: [NETFILTER]: Add ipt_policy/ip6t_policy matches Patrick McHardy
[not found] ` <200511201902.10179.lists@naasa.net>
2005-11-20 18:07 ` Patrick McHardy [this message]
2005-11-22 22:34 ` [PATCH 00/13]: Netfilter IPsec support David S. Miller
2005-11-22 22:38 ` YOSHIFUJI Hideaki / 吉藤英明
2005-11-23 1:20 ` Patrick McHardy
2005-11-23 1:17 ` Patrick McHardy
2005-11-23 1:35 ` Herbert Xu
2005-11-23 3:36 ` David S. Miller
2005-11-23 4:47 ` Herbert Xu
2005-11-23 4:52 ` Yasuyuki KOZAKAI
2005-11-23 3:35 ` David S. Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4380BB62.8050404@trash.net \
--to=kaber@trash.net \
--cc=davem@davemloft.net \
--cc=jplatte@naasa.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.