Re: ipsec patches test: minor compilation and policy match issues

[Patrick McHardy <kaber@trash.net>]

Just to avoid confusion, there is a small mistake in my setkey script.
I replaced the local tunnel-address with 0.0.0.0 to see if it will be
set automatically. It works, but I haven't tested the policy match with
this configuration.

Patrick McHardy wrote:

> setkey:
> spdadd 192.168.0.23/32 0.0.0.0/0 any
>         -P out ipsec
>         esp/tunnel/0.0.0.0-192.168.0.1/require
                      ^192.168.0.23
>         ah/transport//require;
> 
> spdadd 0.0.0.0/0 192.168.0.23/32 any
>         -P in ipsec
>         esp/tunnel/192.168.0.1-0.0.0.0/require
                                  ^192.168.0.23
>         ah/transport//require;
> 
> policy match:
> iptables -A INPUT -m policy --dir in --pol ipsec --strict --proto esp
>  --mode tunnel --tunnel-src 192.168.0.1 --tunnel-dst 192.168.0.23 --next
>  --proto ah --mode transport
> 
> iptables -A OUTPUT -m policy --dir out --pol ipsec --strict --proto esp
>  --mode tunnel --tunnel-src 192.168.0.23 --tunnel-dst 192.168.0.1 --next
>  --proto ah  --mode transport