Subject: Re: [devel-ipsec] [PATCH ipsec-next v8] xfrm: Add Direction to the SA in or out

From: Christian Hopps <[email-masked]>
Date: Mon, 15 Apr 2024 07:12:03 -0400

Sabrina Dubroca via Devel <[email-masked]> writes:

> 2024-04-14, 13:45:00 +0300, Leon Romanovsky wrote:
>> Right, but what about new iproute2, which eventually will users get
>> after system update and old scripts?
>
> I suspect that new iproute2 will add an option to set the direction
> (otherwise it'd have to guess a value, that's not the goal of xfrm
> support in iproute), and only pass XFRMA_SA_DIR when the user gave
> that extra argument, so nothing will change there either?

Indeed.

I have a set of iproute2 changes for iptfs, and I was going to update those with the "in"/"out" keyword if it hadn't been added by the time I submit them, I would associate the corresponding iptfs attributes with one of those flags.

I hadn't planned on changing any restrictions for existing iproute2 options/flags as doing so might break user scripts etc :)

Thanks,
Chris.

> --
> Sabrina