Subject: Re: IPsec xfrm resolution

From: Patrick McHardy <[email-masked]>
Date: Sat, 19 Feb 2005 19:47:11 +0100

Herbert Xu wrote:

>On Sat, Feb 19, 2005 at 01:29:25PM +0100, Patrick McHardy wrote:
>  
>
>>This is not what happens currently. If an optional IPCOMP SA is missing
>>it is skipped entirely. It is also legal to configure an optional
>>ah/esp tunnel, although we don't accept such packets if the SA isn't
>>present.
>>    
>>
>
>That's a bug.  How can you forward packets properly if the tunnel mode
>SA is missing?
>
Using normal routing. What meaning would "optional" have otherwise ?
If the encapsulation has to be done, the user shouldn't mark the SA
as optional in my opinion.

Regards
Patrick