Re: [PATCHv4 net-next-2.6 1/5] XFRM,IPv6: Remove xfrm_spi_hash() dependency on destination address

Herbert Xu
2010-10-08T00:42:48Z

On Thu, Oct 07, 2010 at 10:13:04PM +0200, Arnaud Ebalard wrote:
>
> I think I will try the following alternative approach based on your
> comments and proposals:
>
> - drop my patch to change spi hash computation
> - handle destination address remapping during input upon failure of
> xfrm_state_lookup()
> - handle source address remapping as it is currently done in the patch,
> i.e. by comparing received one against x->props.saddr once the
> state found and do

I'm fine with this from IPsec's point-of-view.

On the other hand, if it is at all possible to setup these remapping
entries in the SADB beforehand, that would definitely be my
preferred solution.

Cheers,
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt