[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20090219125725.GA10821@gondor.apana.org.au>
Date: Thu, 19 Feb 2009 20:57:25 +0800
From: Herbert Xu <herbert@...dor.apana.org.au>
To: Joe Pruett <joey@...an.q7.com>
Cc: netdev@...r.kernel.org
Subject: Re: ipsec and netfilter
Joe Pruett <joey@...an.q7.com> wrote:
>
> why aren't esp/ah packets run through netfilter again after
> decryption/decapsulation? in tunnel mode, packets do get sent in again,
> but that is only because ip-ip does that, not the ipsec code.
They do go through netfilter again after decap in transport mode:
int xfrm4_transport_finish(struct sk_buff *skb, int async)
{
struct iphdr *iph = ip_hdr(skb);
iph->protocol = XFRM_MODE_SKB_CB(skb)->protocol;
#ifndef CONFIG_NETFILTER
if (!async)
return -iph->protocol;
#endif
__skb_push(skb, skb->data - skb_network_header(skb));
iph->tot_len = htons(skb->len);
ip_send_check(iph);
NF_HOOK(PF_INET, NF_INET_PRE_ROUTING, skb, skb->dev, NULL,
xfrm4_rcv_encap_finish);
return 0;
}
Cheers,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists