On Thu, 2007-29-11 at 21:55 +0100, Patrick McHardy wrote:
> jamal wrote:
>
> [ can't quote because non-inline attachment ]
Evolution seems to have whitespace issues everytime i inlined the
attachment; and Dave has been able to tolerate me doing this so far.
I have just read it in
> I think Yoshifuji had some objections to this because extension
> headers will be processed twice.
ah, i missed that part. Could you point to a specific portion?
I wouldnt mind just ipv4 going in - but that would be lacking
consistency. Is there anything that can be done to get the extension
headers to be processed only once?
cheers,
jamal
>From 83d91d3c6f5df027a446b575af8dd4a3fdf90148 Mon Sep 17 00:00:00 2001
From: Jamal Hadi Salim <[EMAIL PROTECTED]>
Date: Thu, 29 Nov 2007 15:41:21 -0500
Subject: [PATCH 2/2] [IPSEC]: Reinject v6 packet on input instead of
calling netfilter
This is the ipv6 version.
Derived from an earlier down-trodden patch from Herbert.
We re-inject a decrypted ipsec back and let it bubble up the
network stack. This improves packet debugability (since sniffers like
tcpdump can see the packet) and ingress tc filters can act on it.
Signed-off-by: Jamal Hadi Salim <[EMAIL PROTECTED]>
---
net/ipv6/xfrm6_input.c | 23 ++++++++++++++---------
1 files changed, 14 insertions(+), 9 deletions(-)
diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
index e2c3efd..c741fba 100644
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -33,19 +33,24 @@ int xfrm6_transport_finish(struct sk_buff *skb, int
async)
skb_network_header(skb)[IP6CB(skb)->nhoff] =
XFRM_MODE_SKB_CB(skb)->protocol;
-#ifdef CONFIG_NETFILTER
+ if (async)
+ return ip6_rcv_finish(skb);
+
ipv6_hdr(skb)->payload_len = htons(skb->len);
__skb_push(skb, skb->data - skb_network_header(skb));
- NF_HOOK(PF_INET6, NF_INET_PRE_ROUTING, skb, skb->dev, NULL,
- ip6_rcv_finish);
- return -1;
-#else
- if (async)
- return ip6_rcv_finish(skb);
+ dst_release(skb->dst);
+ skb->dst = NULL;
+ {
+ /* make some packet-sock user (eg tcpdump) happy */
+ const unsigned char *old_mac;
+ old_mac = skb_mac_header(skb);
+ skb_set_mac_header(skb, -skb->mac_len);
+ memmove(skb_mac_header(skb), old_mac, skb->mac_len);
+ }
- return 1;
-#endif
+ netif_rx(skb);
+ return 0;
}
int xfrm6_rcv(struct sk_buff *skb)
--
1.4.4.1.gaed4
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
