On Sun, Jun 29, 2003 at 02:34:08PM -0700, David S. Miller wrote: > > If the kernel need not do that, why does the KM need to do that? > You're talking nonsense. > > Entities register policies, and entities registers specific > transformer states. Policies have templates which expand only > to specific transformer states. Let me restate that example. I'm starting with one pair of policies from local host A to remote host C. A -> C ESP(transport) C -> A ESP(transport) Now I create an ESP tunnel from A to the next-hop gateway B. any(A) -> any(B) ESP(tunnel) any(B) -> any(A) ESP(tunnel) Now the intention is usually to protect all traffic coming out of A since B may in fact reject any other traffic (e.g., wireless gateway). I cannot see any way of achieving the intended effect apart from updating the policies between A to C to be A -> C ESP(transport)/ESP(tunnel) C -> A ESP(transport)/ESP(tunnel) -- Debian GNU/Linux 3.0 is out! ( http://www.debian.org/ ) Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
