Re: [IPSEC] Use xfrm_rcv for xfrm tunnel packets

From: Herbert Xu (herbert@gondor.apana.org.au)
Date: Thu Jul 31 2003 - 16:33:38 EST


On Thu, Jul 31, 2003 at 05:57:52PM +0400, kuznet@ms2.inr.ac.ru wrote:
>
> Bits of saddr saved in spi field are supposed to be just hashing helper,
> allowing to avoid hashing all the tunnels of all the tunnels ending
> at our host and, hence, having one destination address, at one hash bucket.
>
> IPv6 should do full check for saddr and can use some folded hash value
> of saddr as spi.

That would be good. The problem right now is that only daddr is used
as a key in xfrm_state_lookup. If we use both saddr/daddr then we can
even set spi to zero if we use the saddr in the spi_hash too.

-- 
Debian GNU/Linux 3.0 is out! ( http://www.debian.org/ )
Email:  Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
-
To unsubscribe from this list: send the line "unsubscribe linux-net" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html



This archive was generated by hypermail 2b29 : Thu Jul 31 2003 - 22:00:02 EST