Re: [PATCH v2] xfrm: interface: Don't hide plain packets from netfilter

Hi Nicolas, On Thu, Dec 10, 2020 at 02:18:45PM +0100, Nicolas Dichtel wrote: > Le 10/12/2020 à 12:48, Eyal Birger a écrit : > > On Thu, Dec 10, 2020 at 1:10 PM Nicolas Dichtel > > wrote: > [snip] > > I also think they should be consistent. But it'd still be confusing to me > > to get an OUTPUT ho

Re: [PATCH v2] xfrm: interface: Don't hide plain packets from netfilter

Le 10/12/2020 à 12:48, Eyal Birger a écrit : > Hi Nicolas, Hi Eyal, > > On Thu, Dec 10, 2020 at 1:10 PM Nicolas Dichtel > wrote: [snip] > I also think they should be consistent. But it'd still be confusing to me > to get an OUTPUT hook on the inner packet in the forwarding case. I re-read the wh

Re: [PATCH v2] xfrm: interface: Don't hide plain packets from netfilter

Hi Nicolas, On Thu, Dec 10, 2020 at 1:10 PM Nicolas Dichtel wrote: > > Le 09/12/2020 à 15:40, Eyal Birger a écrit : > > Hi Phil, > > > > On Tue, Dec 8, 2020 at 8:51 PM Phil Sutter wrote: > >> > >> Hi Eyal, > >> > >> On Tue, Dec 08, 2020 at 04:47:02PM +0200, Eyal Birger wrote: > >>> On Mon, Dec 7

Re: [PATCH v2] xfrm: interface: Don't hide plain packets from netfilter

Le 09/12/2020 à 15:40, Eyal Birger a écrit : > Hi Phil, > > On Tue, Dec 8, 2020 at 8:51 PM Phil Sutter wrote: >> >> Hi Eyal, >> >> On Tue, Dec 08, 2020 at 04:47:02PM +0200, Eyal Birger wrote: >>> On Mon, Dec 7, 2020 at 4:07 PM Phil Sutter wrote: [snip] >> >> The packet appears twice being sent t

Re: [PATCH v2] xfrm: interface: Don't hide plain packets from netfilter

Hi Phil, On Tue, Dec 8, 2020 at 8:51 PM Phil Sutter wrote: > > Hi Eyal, > > On Tue, Dec 08, 2020 at 04:47:02PM +0200, Eyal Birger wrote: > > On Mon, Dec 7, 2020 at 4:07 PM Phil Sutter wrote: > > > > > > With an IPsec tunnel without dedicated interface, netfilter sees locally > > > generated pack

Re: [PATCH v2] xfrm: interface: Don't hide plain packets from netfilter

Hi Eyal, On Tue, Dec 08, 2020 at 04:47:02PM +0200, Eyal Birger wrote: > On Mon, Dec 7, 2020 at 4:07 PM Phil Sutter wrote: > > > > With an IPsec tunnel without dedicated interface, netfilter sees locally > > generated packets twice as they exit the physical interface: Once as "the > > inner packet

Re: [PATCH v2] xfrm: interface: Don't hide plain packets from netfilter

Hi Phil, On Mon, Dec 7, 2020 at 4:07 PM Phil Sutter wrote: > > With an IPsec tunnel without dedicated interface, netfilter sees locally > generated packets twice as they exit the physical interface: Once as "the > inner packet" with IPsec context attached and once as the encrypted > (ESP) packet.

Re: [PATCH v2] xfrm: interface: Don't hide plain packets from netfilter

Le 08/12/2020 à 15:00, Phil Sutter a écrit : > Hi Nicolas, > > On Tue, Dec 08, 2020 at 10:02:16AM +0100, Nicolas Dichtel wrote: >> Le 07/12/2020 à 14:43, Phil Sutter a écrit : > [...] >>> diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c >>> index aa4cdcf69d471..24af61c95b4d4 1006

Re: [PATCH v2] xfrm: interface: Don't hide plain packets from netfilter

Hi Nicolas, On Tue, Dec 08, 2020 at 10:02:16AM +0100, Nicolas Dichtel wrote: > Le 07/12/2020 à 14:43, Phil Sutter a écrit : [...] > > diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c > > index aa4cdcf69d471..24af61c95b4d4 100644 > > --- a/net/xfrm/xfrm_interface.c > > +++ b/net/x

Re: [PATCH v2] xfrm: interface: Don't hide plain packets from netfilter

Le 07/12/2020 à 14:43, Phil Sutter a écrit : > With an IPsec tunnel without dedicated interface, netfilter sees locally > generated packets twice as they exit the physical interface: Once as "the > inner packet" with IPsec context attached and once as the encrypted > (ESP) packet. > > With xfrm_in

[PATCH v2] xfrm: interface: Don't hide plain packets from netfilter

With an IPsec tunnel without dedicated interface, netfilter sees locally generated packets twice as they exit the physical interface: Once as "the inner packet" with IPsec context attached and once as the encrypted (ESP) packet. With xfrm_interface, the inner packet did not traverse NF_INET_LOCAL_