From mboxrd@z Thu Jan 1 00:00:00 1970 From: Patrick McHardy Subject: Re: [PATCH 05/13]: [IPV4/6]: Netfilter IPsec output hooks Date: Mon, 28 Nov 2005 13:25:48 +0100 Message-ID: <438AF74C.6000608@trash.net> References: <20051120163128.16666.38111.sendpatchset@localhost.localdomain> <20051120163134.16666.9265.sendpatchset@localhost.localdomain> <20051122044046.GA29166@gondor.apana.org.au> <4382A44F.9000105@trash.net> <20051122103038.GA31532@gondor.apana.org.au> <20051122103139.GA4632@gondor.apana.org.au> <20051122121358.GA9057@gondor.apana.org.au> <438A5837.5040706@trash.net> <20051128045611.GA9571@gondor.apana.org.au> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: netdev@vger.kernel.org, netfilter-devel@lists.netfilter.org, davem@davemloft.net Return-path: To: Herbert Xu In-Reply-To: <20051128045611.GA9571@gondor.apana.org.au> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-devel-bounces@lists.netfilter.org Errors-To: netfilter-devel-bounces@lists.netfilter.org List-Id: netdev.vger.kernel.org Herbert Xu wrote: > On Mon, Nov 28, 2005 at 02:07:03AM +0100, Patrick McHardy wrote: > >>Thanks, this looks great. I've changed it to only call the hooks > > > Glad you liked it :) > > >>before tunnel mode transforms and added a missing dst_output call >>for the final packet. > > > This shouldn't be necessary if you apply it on top of my previous > patch which made xfrm[46]_output process the first SA and all subsequent > transport mode SAs. I've included that patch here again. > > I think it still makes sense to do that because this corresponds > with the usual representation of an IPsec connection and it > simplifies the handling of netfilter hooks. I agree, I missed that your patch based on that one. Let me have another look :)