Date: Fri, 11 Jan 2002 23:36:23 +0100 From: Rene de Vries <rene@canyon.xs4all.nl> To: hackers@freebsd.org Subject: Filtering packets received through an ipsec tunnel Message-ID: <A3F0121C-06E3-11D6-A736-00039357FA7A@canyon.xs4all.nl>
next in thread | raw e-mail | index | archive | help
Hello, By experimenting with ipsec and looking at the source of "ip_input.c" a co-worker and I found the following out. When a ipsec tunnel packet is received this (protocol 50/51) packet is passed through ip-filter (& co). After filtering and when it has been determent that the current host is the destination (tunnel end-point), this packet is decrypted/verified. The decrypted packet is then pushed back into the queue that leads to ip_input(...). So far so good.... But once in ip_input(...) the filtering code is skipped and we were wondering why. I know that ipsec has some handles to be able to filter on address, protocol and/or port. But for more complex situations this is not enough. In these situations it would be nice to be able to use ip-filter (& co) on traffic from the tunnel (and also for traffic going into the tunnel). I was wondering why this is implemented the way it is. Maybe someone on this list could shed a light on this? Rene -- Rene de Vries <rene@tcja.nl> To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?A3F0121C-06E3-11D6-A736-00039357FA7A>