Subject: Re: [NF+IPsec 4/6]: Make IPsec input processing symetrical to output

From: Patrick McHardy <[email-masked]>
Date: Wed, 26 Oct 2005 01:09:12 +0200

Sorry for the huge delay Herbert, I really appreciate your input,
but I'm stuck in other work.

Herbert Xu wrote:
> I can see the concern of processing pure transport mode packets in IPv6
> twice in the stack because IPsec in IPv6 is used for a totally different
> purpose compared to IPv4.
> 
> So how about this? We let the SA tell us whether they want to go through
> netfilter again.  So each SA will carry a flag which determines whether
> packets through it should go through netfilter.
> 
> This flag would only affect transport mode SAs of course.

That would be one possibility. But I'm not a big fan of per-state flags
that affect packet flow, so I think I'd prefer to just ignore this
case. I don't think not handling inner transport mode SAs would be a
big loss, so how about we just skip inner transport mode SAs completely
on output and keep the input code as it is?

Regards
Patrick