From: Patrick McHardy <kaber@trash.net>
To: Herbert Xu <herbert@gondor.apana.org.au>
Cc: netdev@vger.kernel.org, netfilter-devel@lists.netfilter.org
Subject: Re: [NF+IPsec 4/6]: Make IPsec input processing symetrical to output
Date: Wed, 26 Oct 2005 01:09:12 +0200 [thread overview]
Message-ID: <435EBB18.50701@trash.net> (raw)
In-Reply-To: <20051017014629.GB32661@gondor.apana.org.au>
Sorry for the huge delay Herbert, I really appreciate your input,
but I'm stuck in other work.
Herbert Xu wrote:
> I can see the concern of processing pure transport mode packets in IPv6
> twice in the stack because IPsec in IPv6 is used for a totally different
> purpose compared to IPv4.
>
> So how about this? We let the SA tell us whether they want to go through
> netfilter again. So each SA will carry a flag which determines whether
> packets through it should go through netfilter.
>
> This flag would only affect transport mode SAs of course.
That would be one possibility. But I'm not a big fan of per-state flags
that affect packet flow, so I think I'd prefer to just ignore this
case. I don't think not handling inner transport mode SAs would be a
big loss, so how about we just skip inner transport mode SAs completely
on output and keep the input code as it is?
Regards
Patrick
next prev parent reply other threads:[~2005-10-25 23:09 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-10-17 0:22 [NF+IPsec 4/6]: Make IPsec input processing symetrical to output Patrick McHardy
2005-10-17 0:49 ` YOSHIFUJI Hideaki / 吉藤英明
2005-10-17 1:24 ` Patrick McHardy
2005-10-17 1:46 ` Herbert Xu
2005-10-25 23:09 ` Patrick McHardy [this message]
2005-10-25 23:10 ` Herbert Xu
2005-10-25 23:14 ` Patrick McHardy
2005-10-26 0:39 ` Herbert Xu
2005-10-27 14:42 ` Patrick McHardy
2005-10-30 23:15 ` Patrick McHardy
2005-10-31 3:19 ` Yasuyuki KOZAKAI
2005-11-01 18:39 ` Stephen Frost
[not found] ` <200510310319.j9V3JHNl019752@toshiba.co.jp>
2005-11-01 18:23 ` Patrick McHardy
2005-10-26 4:39 ` James Morris
2005-10-26 7:37 ` Ingo Oeser
2005-10-26 13:37 ` Stephen Frost
2005-10-27 12:15 ` Herbert Xu
2005-10-27 14:57 ` YOSHIFUJI Hideaki / 吉藤英明
2005-10-27 16:58 ` Patrick McHardy
2005-11-05 6:30 ` Herbert Xu
2005-11-05 7:55 ` Patrick McHardy
2005-11-05 8:39 ` Herbert Xu
2005-11-05 8:58 ` Patrick McHardy
2005-11-05 9:09 ` Herbert Xu
2005-11-05 9:19 ` Patrick McHardy
2005-11-05 9:38 ` Herbert Xu
2005-11-05 9:55 ` Patrick McHardy
2005-11-05 10:01 ` Herbert Xu
2005-11-05 10:05 ` Patrick McHardy
2005-11-05 10:32 ` Yasuyuki KOZAKAI
[not found] ` <200511051032.jA5AWl2l000619@toshiba.co.jp>
2005-11-08 14:01 ` Patrick McHardy
2005-11-05 8:23 ` YOSHIFUJI Hideaki / 吉藤英明
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=435EBB18.50701@trash.net \
--to=kaber@trash.net \
--cc=herbert@gondor.apana.org.au \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).