Re: [NF+IPsec 4/6]: Make IPsec input processing symetrical to output

[Patrick McHardy <kaber@trash.net>]

Herbert Xu wrote:
> On Wed, Oct 26, 2005 at 01:09:12AM +0200, Patrick McHardy wrote:
> 
>>>So how about this? We let the SA tell us whether they want to go through
>>>netfilter again.  So each SA will carry a flag which determines whether
>>>packets through it should go through netfilter.
>>>
>>>This flag would only affect transport mode SAs of course.
>>
>>That would be one possibility. But I'm not a big fan of per-state flags
>>that affect packet flow, so I think I'd prefer to just ignore this
>>case. I don't think not handling inner transport mode SAs would be a
>>big loss, so how about we just skip inner transport mode SAs completely
>>on output and keep the input code as it is?
> 
> 
> Actually I was thinking of transport mode SAs with no accompanying
> tunnel mode SAs.  Did you have another way of dealing with them?

No. I thought of this as a special case of inner transport mode SAs
(without any further SAs) which would be unhandled. I've never used
pure transport mode SAs except for testing, and I've never seen any
other users of this. Do you think it is important to handle?