Subject: Re: Patch for Fast-IPsec over loopback
To: None <M.Drochner@fz-juelich.de>
From: Jonathan Stone <jonathan@DSG.Stanford.EDU>
List: tech-net
Date: 08/18/2003 13:14:22
In message <200308181958.VAA0000030308@zel459.zel.kfa-juelich.de>Matthias Drochner writes
>
>jonathan@DSG.Stanford.EDU said:
>> 3.  ip_output() enqueues packet on lo0, which immediately routes the
>> packet back up
>>     the networking stack, complete with tags. 
>> [...]
>> Conclusion: I should commit the change to icmp_reflect() to strip all
>> packet tags
>
>Forgive my ignorance, but what would be wrong with stripping all tags
>in the loopback driver? After all, a real interface transfers just the
>packet without tags, and why should lo0 behave differently than, lets
>say, an external loopback?

Thats exactly the analogy I made on Friday.


I believe that long-term, the most stable and robust cohice is to
define the packet-tag API so that after enqueing a packet on an
interface, the status of any tags is *in general*, undefined.

That entails that when a protocol needs to do internal `looping' of
packets, and needs those packets to keeep particular tags, that the
protocol must to loop the packet directly (e.g., for IP, enqueue on
ipintrq), not just send the packet out lo0.

Specific call to some known interface's output routine by name (gre?,
dummynet on FreeBSD?)  can, of course, rely on a private contract
with that interface.