On Tuesday 2009-02-17 19:33, Joe Pruett wrote: >> Joe Pruett wrote: >>> trying this again on the -devel list. the basic question i'm trying to >>> answer is if there really isn't a way to filter esp/ah packets after >>> decryption/decapsulation in host2host mode. i've looked at what i think >>> is the current linus kernel and don't see any changes to esp/ah handling >>> to address this. is tunnel mode the only way i can do filtering on the >>> packets after ah/esp have done their work? >> >> Packets in both tunnel and transport mode traverse the netfilter hooks >> after decapsulation and before encapsulation. From a users POV there >> should be nothing special about it. > > i don't see that behaviour on rhel/centos 5 kernels. could this have changed > since 2.6.18? for tunnel mode, it looks to me like the ip-ip module is what > causes traffic to be seen after decrypt/decap, and i just don't see anything > like that for transport mode. ipip is not used for ipsec. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
