Subject: Re: [PATCH net v3] vti: fix spd lookup: match plaintext pkt, not ipsec pkt

From: Steffen Klassert <[email-masked]>
Date: Thu, 21 Nov 2013 12:45:53 +0100

On Thu, Nov 21, 2013 at 11:07:27AM +0100, Christophe Gouault wrote:
> 
> But you can optionally apply differentiated policies within the same
> tunnel, by setting SPs with narrower selectors: according to the
> plaintext traffic that crosses the tunnel, you can request to use
> different protocols (esp/ah), different SAs, maybe drop some traffic.

This raises the question about the MTU of a vti device. If the SA
is not unique, it is not clear which MTU we should use for that device.

> Only ipsec tunnel mode and drop policies should be bound to a VTI interface.
> 
> And the patch restores the SP semantics: the selector is used to match
> the plaintext traffic, not the IPsec encrypted traffic.
> 

On the other hand, I've spend quite some time to figure out how
inter address family tunneling can work with vti devices. It
seems that we need plaintext matching to get this to work.