Re: [NF+IPsec 4/6]: Make IPsec input processing symetrical to output

["YOSHIFUJI Hideaki / 吉藤英明" <yoshfuji@linux-ipv6.org>]

In article <20051027121545.GA5530@gondor.apana.org.au> (at Thu, 27 Oct 2005 22:15:45 +1000), Herbert Xu <herbert@gondor.apana.org.au> says:

> On Mon, Oct 17, 2005 at 09:49:19AM +0900, YOSHIFUJI Hideaki / ?$B5HF#1QL@ wrote:
> >
> > Stack should process the packet just once if it is of transport mode.
> > (It is okay to process one twice if it is of tunnel mode.)
> 
> Thinking about this again, I'm not sure that I agree.
> 
> OK, I don't actually care whether we process it once or twice for
> pure transport mode, but I think that it is absolutely essential
> that LOCAL_IN/LOCAL_OUT see the decapsulated packet instead of
> the encrypted version.

Well, I really care.
I strongly believe that we SHOULD NOT mix encrypted
packets and plain text packets at the same hook.
e.g. LOCAL_IN is NOT for decrypted plain text packets,
but for the original encrypted ones.
I believe that we should have another set of hooks
after decryption (other than LOCAL_IN) if we want to
look inside the encrypted packets.

--yoshfuji