Joe Pruett wrote:
trying this again on the -devel list. the basic question i'm trying to
answer is if there really isn't a way to filter esp/ah packets after
decryption/decapsulation in host2host mode. i've looked at what i think
is the current linus kernel and don't see any changes to esp/ah handling
to address this. is tunnel mode the only way i can do filtering on the
packets after ah/esp have done their work?
Packets in both tunnel and transport mode traverse the netfilter hooks
after decapsulation and before encapsulation. From a users POV there
should be nothing special about it.
i don't see that behaviour on rhel/centos 5 kernels. could this have
changed since 2.6.18? for tunnel mode, it looks to me like the ip-ip
module is what causes traffic to be seen after decrypt/decap, and i just
don't see anything like that for transport mode.
i'll do some more experiments.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
