Subject: Re: [PATCH net-next 0/2] netfilter: IPv4/v6 IPcomp match support

From: Pablo Neira Ayuso <[email-masked]>
Date: Tue, 24 Dec 2013 19:16:14 +0100

On Tue, Dec 24, 2013 at 02:19:57PM +0800, Fan Du wrote:
> For a packet encapsulated in order of ah->esp->ah->original packet, as you said
> par->thoff is set at esp, that's why netfilter esp has a unified implementation
> in net/netfilter/xt_esp.c, because it's always the last parse header netfilter
> can reach.
> 
> The same rule apply with IPcomp, for example,
> (1) ah->ipcomp->original packet
>          ^par->thoff
> (2) ipcomp->ah->original packet
>       ^par->thoff
> 
> Both cases (1) and (2) par->thoff can only point into IPcomp header, so in such
> circumstance, a unified implementation for both IPv4/6 is feasible, and I have
> tested (2) in such implementation, it works anyway.
> 
> IMO, a unified implementation suggested by you previous is ok for this round review.

Your right, I forgot the fact that ipcomp "hides" what it
encapsulates, so it's basically the last header we can see.