Subject: Re: IPsec xfrm resolution

From: Patrick McHardy <[email-masked]>
Date: Sat, 19 Feb 2005 13:29:25 +0100

Herbert Xu wrote:

>On Sat, Feb 19, 2005 at 07:03:32AM +0100, Patrick McHardy wrote:
>  
>
>>- netfilter LOCAL_OUT hook sees incorrect output device
>>- strict source routing check done with incorrect rt_gateway
>>    
>>
>
>Once you take the above into account these turn out to be non-issues.
>If the optional SA is transport mode, then the route is identical with
>or without it.  If it's tunnel mode, then we must perform the IPIP
>encapsulation regardless.
>
This is not what happens currently. If an optional IPCOMP SA is missing
it is skipped entirely. It is also legal to configure an optional
ah/esp tunnel, although we don't accept such packets if the SA isn't
present.

Regards
Patrick