Re: [PATCH 3/3 XFRM]: Fix invalid key for lookup of cached bundles

[Patrick McHardy <kaber@xxxxxxxxx>]

Herbert Xu wrote:
> On Sun, Mar 06, 2005 at 01:34:24PM +0100, Patrick McHardy wrote:
>
> > How about this one ? It keeps the DST_XFRM_TUNNEL flag and sets it on
> > the first xfrm_dst in a bundle. I know it doesn't really belong there,
>
>
> Actually, why do we need to treat tunnel mode differently here?
> In other words, why not just do the mark/tos checks unconditionally.
>
> Forwarded packets don't get a proper tos/mark setting for IPsec
> but that's a bug in itself.

Mainly to avoid excessive long lists of cached bundles in tunnel
mode. The use of a single list for the cache is questionable, but
the patch was supposed to fix a different issue. Restricting use
of tos/mark to transport mode avoids having exploding lists that
are easily remotely triggerable.

Regards
Patrick