Re: [PATCH] xfrm: Accept ESP packets regardless of UDP encapsulation mode

[David Miller <davem@davemloft.net>]

From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Thu, 18 Dec 2008 15:14:19 +1100

> A quick google failed to reveal any specific requirements apart
> from the need to move in and out of NAT environments.
> 
> That isn't actually an issue because when your addresses change
> you have to renegotiate with the other side to ensure that this
> isn't some kind of an attack.  Afterwards you have to recreate
> the SAs at which point you can easily set the encapsulation to
> whatever it should be.
> 
> The only time when you need this patch is if the other side
> unilaterally switched from NAT-T to no NAT-T, or vice versa,
> which does not sound like a sane thing to do.

My interpretation of the situation is that when you change (address or
NAT-T) you still have to perform the renegotiation over the old SA.

Or something like that.