(review request) ipfw and ipsec processing order for outgoingpackets

[Andre Oppermann]

Jeremie Le Hen wrote:
> 
> > > > > I have some stuff wrt [Fast]IPSEC and your problem in the works and
> > > > > it should become ready around christmas time (loadable [Fast]IPSEC, at
> > > > > least for IPv4).
> > > >
> > > > While this way of 'fixing' the IPSEC problem works it is rather gross
> > > > and not very stylish.  I prefer not to have this in the tree as makes
> > > > maintainance a lot harder.
> > >
> > > I totaly agree that it is not pretty. I was trying to avoid duplicating
> > > the code (so every change would have to be made twice) and making it a
> > > function didn't sit right for some reason. Hints/tips for dealing with
> > > this kind of situation are welcome, but maybe better off-list.
> >
> > As things currently are with IPSEC code weaved directly into ip_input()
> > and ip_output() there is no better way than what you have proposed.
> >
> > It will solve it much more nicely. :)
> 
> If I understand correctly, either Joost's patch or your nice changes
> that-should-appear-before-christmas will achieve what the OpenBSD enc(4)
> interface provides [1].  It would be really wonderful.  But I may be
> missing something because I can see no way in firewall rules to
> distinguish between the before IPSec processing hook and the after IPSec
> processing one.  Could you clarify this for me please ?

With the changes you can chose whether you want to do firewallig before
ipsec processing or after but not both.  The enc(4) pseudo device looks
interesting but I haven't looked at the code.  Maybe that makes things
easier.  I'll look into it.

-- 
Andre