Subject: Re: [NF+IPsec 4/6]: Make IPsec input processing symetrical to output

From: Ingo Oeser <[email-masked]>
Date: Wed, 26 Oct 2005 09:37:33 +0200

Patrick McHardy wrote:
> Herbert Xu wrote:
> > Actually I was thinking of transport mode SAs with no accompanying
> > tunnel mode SAs.  Did you have another way of dealing with them?
>
> No. I thought of this as a special case of inner transport mode SAs
> (without any further SAs) which would be unhandled. I've never used
> pure transport mode SAs except for testing, and I've never seen any
> other users of this. Do you think it is important to handle?

These become important in untrusted LANs. These days, the LAN is often 
not safe enough for confidental data, so you need end to end encryption,
for which tunnel mode is a bitch to setup (due to the additional routing
required ).

Regards

Ingo Oeser