Subject: Re: [RFC, PATCH 5/5]: netfilter+ipsec - policy checks

From: "David S. Miller" <[email-masked]>
Date: Thu, 18 Mar 2004 22:19:04 -0800

On Thu, 18 Mar 2004 17:32:39 +0100
Patrick McHardy <[email-masked]> wrote:

> This patch makes xfrm_policy_check locate the correct policy after NAT.
> For protocols which do policy checks in their receive routines the
> reference to nfct has to be kept until policy checks are done, the
> other ones still drop it in ip_local_deliver_finish.

This patch looks fine to me.

Other than the minor comments I've made the most unhappy I am
with the input patch, and you agree it's grotty too.  Let's look
for a better solution, perhaps with new top-level SKB state,
and then we can put all of your work in after you're made the other
minor fixes I've asked for as well.

Thanks Patrick.