Hello Nakamura,

Masahide NAKAMURA wrote:

Hello,
I'm Nakamura, a member of USAGI.


As you know, we've been planning the MIPv6 design to use XFRM.
If we use MIPv6, we need some fix and extension to XFRM and it results to make XFRM
more generic.

I like your idea, as it allows a high level of flexibility in use of
mipv6  with flows through the definition of policies. This is the way I
would also do mipv6 extension header addition with xfrm.

However, if you insert mipv6 policies into xfrm, you need to take care
of the interactions between ipsec and mipv6 policies. The system needs
to cope with data flows to which both ipsec and mipv6 should be applied.
As a result of this the logic of the xfrm lookups probably needs some
changes to return both the matching ipsec and mipv6 policies. How have
you planned to solve this problem?

BTW, feel free to use relevant parts of my code for the output
functionality to speed up the work. After your code is ready we can look
at which approach is better suited for implementing the kernel support
and get a working kernel infrastructure for mipv6 into 2.6 kernels.

Henrik