From: Patrick McHardy <kaber@trash.net>
To: Herbert Xu <herbert@gondor.apana.org.au>
Cc: netdev@vger.kernel.org, netfilter-devel@lists.netfilter.org
Subject: Re: [NF+IPsec 4/6]: Make IPsec input processing symetrical to output
Date: Sat, 05 Nov 2005 08:55:44 +0100 [thread overview]
Message-ID: <436C6580.6030007@trash.net> (raw)
In-Reply-To: <20051105063030.GA32385@gondor.apana.org.au>
Herbert Xu wrote:
> On Thu, Oct 27, 2005 at 11:57:32PM +0900, YOSHIFUJI Hideaki / ?$B5HF#1QL@ wrote:
>
>>Well, I really care.
>>I strongly believe that we SHOULD NOT mix encrypted
>>packets and plain text packets at the same hook.
>>e.g. LOCAL_IN is NOT for decrypted plain text packets,
>>but for the original encrypted ones.
>
>
> OK. Would it be workable for you if LOCAL_IN only saw the decrypted
> packets without ever seeing the encrypted ones?
How exactly would that work? I guess we couldn't do NAT with
the encrypted packet anymore?
> I'd like to know where the boundaries are so we can find a compromise
> that works for everyone.
I would prefer something similar to the second set of patches.
Instead of calling netif_rx we could use NF_HOOK and simulate
the relevant parts of the input path for IPv4 and NAT. This
would assure that statistics are still correct and tcpdump is
not affected, which were Yoshifuji's biggest concerns if I
understood correctly.
next prev parent reply other threads:[~2005-11-05 7:55 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-10-17 0:22 [NF+IPsec 4/6]: Make IPsec input processing symetrical to output Patrick McHardy
2005-10-17 0:49 ` YOSHIFUJI Hideaki / 吉藤英明
2005-10-17 1:24 ` Patrick McHardy
2005-10-17 1:46 ` Herbert Xu
2005-10-25 23:09 ` Patrick McHardy
2005-10-25 23:10 ` Herbert Xu
2005-10-25 23:14 ` Patrick McHardy
2005-10-26 0:39 ` Herbert Xu
2005-10-27 14:42 ` Patrick McHardy
2005-10-30 23:15 ` Patrick McHardy
2005-10-31 3:19 ` Yasuyuki KOZAKAI
2005-11-01 18:39 ` Stephen Frost
[not found] ` <200510310319.j9V3JHNl019752@toshiba.co.jp>
2005-11-01 18:23 ` Patrick McHardy
2005-10-26 4:39 ` James Morris
2005-10-26 7:37 ` Ingo Oeser
2005-10-26 13:37 ` Stephen Frost
2005-10-27 12:15 ` Herbert Xu
2005-10-27 14:57 ` YOSHIFUJI Hideaki / 吉藤英明
2005-10-27 16:58 ` Patrick McHardy
2005-11-05 6:30 ` Herbert Xu
2005-11-05 7:55 ` Patrick McHardy [this message]
2005-11-05 8:39 ` Herbert Xu
2005-11-05 8:58 ` Patrick McHardy
2005-11-05 9:09 ` Herbert Xu
2005-11-05 9:19 ` Patrick McHardy
2005-11-05 9:38 ` Herbert Xu
2005-11-05 9:55 ` Patrick McHardy
2005-11-05 10:01 ` Herbert Xu
2005-11-05 10:05 ` Patrick McHardy
2005-11-05 10:32 ` Yasuyuki KOZAKAI
[not found] ` <200511051032.jA5AWl2l000619@toshiba.co.jp>
2005-11-08 14:01 ` Patrick McHardy
2005-11-05 8:23 ` YOSHIFUJI Hideaki / 吉藤英明
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=436C6580.6030007@trash.net \
--to=kaber@trash.net \
--cc=herbert@gondor.apana.org.au \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).