Re: [XFRM]: Always reroute in tunnel mode

[Patrick McHardy <kaber@trash.net>]

Herbert Xu wrote:

>Put it another way, my solution to Patrick's inconsistency would be to
>always inherit the routing decision from the top to the bottom of the
>bundle.  For example, suppose you had
>
>ip ro add 192.168.0.0/16 \
>	nexthop via 10.0.0.1 dev eth0 \
>	nexthop via 10.0.0.2 dev eth0
>
>Then the packets to 192.168.0.0/16 should be sent via 10.0.0.1/10.0.0.2
>regardless of what IPsec protections are applied to it.
>
I agree it is a nice alternative to the current way. It would solve
another inconsistency caused by overriding the routing result in
tunnel mode: on output we don't care about oif, so packets from a
socket will be tunneled independent of sk_bound_dev_if. On input
packets won't be delivered to the socket if the encapsulated
packet arrived on a different interface.

Regards
Patrick