For example, executing the below commands in that order succeed:The policy with mark 1 is the first we find. The policy passes the
ip -6 xfrm policy flush
ip -6 xfrm policy add src fd00::1/128 dst fd00::2/128 dir out mark 1 mask 0xffffffff
ip -6 xfrm policy add src fd00::1/128 dst fd00::2/128 dir out
mark check and if the flow matches the selectors, we use this policy.
But it fails in the reverse order:With this scenario, we would find the policy with mark and mask 0 first.
ip -6 xfrm policy flush
ip -6 xfrm policy add src fd00::1/128 dst fd00::2/128 dir out
ip -6 xfrm policy add src fd00::1/128 dst fd00::2/128 dir out mark 1 mask 0xffffffff
RTNETLINK answers: File exists
This policy passes the mark check too. So we would use this policy if the
flow matches the selectors, but the flow asked for a policy with mark 1.