Hi Nicolas, On Thu, Dec 10, 2020 at 02:18:45PM +0100, Nicolas Dichtel wrote: > Le 10/12/2020 à 12:48, Eyal Birger a écrit : > > On Thu, Dec 10, 2020 at 1:10 PM Nicolas Dichtel > > <nicolas.dichtel@xxxxxxxxx> wrote: > [snip] > > I also think they should be consistent. But it'd still be confusing to me > > to get an OUTPUT hook on the inner packet in the forwarding case. > I re-read the whole thread and I agree with you. There is no reason to pass the > inner packet through the OUTPUT hook (my comment about the consistency with ip > tunnels is still valid ;-)). > Sorry for the confusion. > > Phil, with nftables, you can match the 'kind' of the interface, that should be > enough to match packets, isn't it? Yes, sure. Also, the inner packet passes POSTROUTING hook with ipsec context present, it's just not visible in OUTPUT. Of course the broader question is what do people use ipsec context matches for. If it's really just to ensure traffic is encrypted, xfrm_interface alone is sufficient. Originally this was reported as "ipsec match stops working if xfrm_interface is used" and I suspected it's a bug in the driver. Knowing the behaviour is expected (and at least consistent with vti), the case is closed from my side. :) Thanks, Phil
