Re: [devel-ipsec] [PATCH ipsec, v2 0/2] xfrm: respect ip proto rules criteria in xfrm dst lookups

[Antony Antony <antony@phenome.org>]

On Mon, Sep 02, 2024 at 04:07:17AM -0700, Eyal Birger via Devel wrote:
> This series fixes the route lookup when done for xfrm to regard
> L4 criteria specified in ip rules.

Hi Eyal,
This isn't a review of the patch set, instead curiosity about use cases.
This sounds interesting. Would you like to elaborate on the use cases 
supported in this patch? From what I understand so far, it seems related to 
'ip rule', but I'm wondering about possible use cases: inner packet routing 
rule of tunnel? May be you could explain it at the IPsec coffee hour or 
share some use case or test script.

Is this only for route based IPsec, i.e. with xfrmi interface, or also for a 
policy based without route use cases. In the later case there were 
discussions why do we need a route for the inner packet.

-antony

> 
> The first patch is a minor refactor to allow passing more parameters
> to dst lookup functions.
> The second patch actually passes L4 information to these lookup functions.
> 
> Signed-off-by: Eyal Birger <eyal.birger@gmail.com>
> 
> ---
> 
> v2: fix first patch based on reviews from Steffen Klassert and
>     Simon Horman
> 
> Eyal Birger (2):
>   xfrm: extract dst lookup parameters into a struct
>   xfrm: respect ip protocols rules criteria when performing dst lookups
> 
>  include/net/xfrm.h      | 28 ++++++++++++-----------
>  net/ipv4/xfrm4_policy.c | 40 +++++++++++++++------------------
>  net/ipv6/xfrm6_policy.c | 31 +++++++++++++-------------
>  net/xfrm/xfrm_device.c  | 11 ++++++---
>  net/xfrm/xfrm_policy.c  | 49 +++++++++++++++++++++++++++++++----------
>  5 files changed, 94 insertions(+), 65 deletions(-)
> 
> -- 
> 2.34.1
> 
> -- 
> Devel mailing list
> Devel@linux-ipsec.org
> https://linux-ipsec.org/mailman/listinfo/devel