Herbert Xu wrote:
Put it another way, my solution to Patrick's inconsistency would be to
always inherit the routing decision from the top to the bottom of the
bundle. For example, suppose you had
ip ro add 192.168.0.0/16 \
nexthop via 10.0.0.1 dev eth0 \
nexthop via 10.0.0.2 dev eth0
Then the packets to 192.168.0.0/16 should be sent via 10.0.0.1/10.0.0.2
regardless of what IPsec protections are applied to it.
I agree it is a nice alternative to the current way. It would solve
another inconsistency caused by overriding the routing result in
tunnel mode: on output we don't care about oif, so packets from a
socket will be tunneled independent of sk_bound_dev_if. On input
packets won't be delivered to the socket if the encapsulated
packet arrived on a different interface.
Regards
Patrick
|