Re: IPsec xfrm resolution

[Patrick McHardy <kaber@xxxxxxxxx>]

Herbert Xu wrote:

> On Sat, Feb 19, 2005 at 07:03:32AM +0100, Patrick McHardy wrote:
>  
>
> > - netfilter LOCAL_OUT hook sees incorrect output device
> > - strict source routing check done with incorrect rt_gateway
> >    
>
> Once you take the above into account these turn out to be non-issues.
> If the optional SA is transport mode, then the route is identical with
> or without it.  If it's tunnel mode, then we must perform the IPIP
> encapsulation regardless.
This is not what happens currently. If an optional IPCOMP SA is missing
it is skipped entirely. It is also legal to configure an optional
ah/esp tunnel, although we don't accept such packets if the SA isn't
present.

Regards
Patrick