Re: [PATCH net v3] vti: fix spd lookup: match plaintext pkt, not ipsec pkt

[Steffen Klassert <steffen.klassert@secunet.com>]

On Tue, Dec 03, 2013 at 10:01:07AM +0100, Christophe Gouault wrote:
> >
> >On transmit side:
> >
> >1. Mark the packet with the o_key. The policy and the state
> >    must match this key now.
> >
> >2. Do a xfrm_lookup on the original packet with the mark applied.
> >
> >3. Check if we got an IPsec route.
> >
> >4. Clean the skb to not leak informations on namespace
> >    transitions.
> >
> >5. Attach the dst_enty we got from the xfrm_lookup to the skb.
> 
> I am just wondering when exactly the netns transition IPsec and route
> lookups are performed (as far as I understand, we first need to perform
> the SP+SA lookup in inner netns, then change namespaces to outer
> netns, then perform a route lookup).
> 

The idea is to do the xfrm_lookup based on the original dst_entry that
comes with the skb. xfrm_lookup then generates a bundle with the IPsec
dst entries on top. Later xfrm_output pops all IPsec dst entires from
the skb, such that only the original routing one remains. I did not
do much with namespaces so far, but after the IPsec processing we should
be in the situation as we are when we transmitting via ipip. If it
works there it should work with vti too.