Re: [XFRM]: Always reroute in tunnel mode

[Patrick McHardy <kaber@xxxxxxxxx>]

Herbert Xu wrote:

> Put it another way, my solution to Patrick's inconsistency would be to
> always inherit the routing decision from the top to the bottom of the
> bundle.  For example, suppose you had
>
> ip ro add 192.168.0.0/16 \
>         nexthop via 10.0.0.1 dev eth0 \
>         nexthop via 10.0.0.2 dev eth0
>
> Then the packets to 192.168.0.0/16 should be sent via 10.0.0.1/10.0.0.2
> regardless of what IPsec protections are applied to it.
I agree it is a nice alternative to the current way. It would solve
another inconsistency caused by overriding the routing result in
tunnel mode: on output we don't care about oif, so packets from a
socket will be tunneled independent of sk_bound_dev_if. On input
packets won't be delivered to the socket if the encapsulated
packet arrived on a different interface.

Regards
Patrick