From: Masahide NAKAMURA <[EMAIL PROTECTED]> Date: Fri, 6 Apr 2007 16:25:39 +0900
> On MIPv6 usage, XFRM sub policy is enabled. > When main (IPsec) and sub (MIPv6) policy selectors have the same > address set but different upper layer information (i.e. protocol > number and its ports or type/code), multiple bundle should be created. > However, currently we have issue to use the same bundle created for > the first time with all flows covered by the case. > > It is useful for the bundle to have the upper layer information > to be restructured correctly if it does not match with the flow. > > 1. Bundle was created by two policies > Selector from another policy is added to xfrm_dst. > If the flow does not match the selector, it goes to slow path to > restructure new bundle by single policy. > > 2. Bundle was created by one policy > Flow cache is added to xfrm_dst as originated one. If the flow does > not match the cache, it goes to slow path to try searching another > policy. > > Signed-off-by: Masahide NAKAMURA <[EMAIL PROTECTED]> This is an OK solution for the problem for now. My senses tell me that there is probably some cleaner way to handle this problem. If you come up with a better idea for it, please feel free to bounce your ideas to me. Thanks. - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
