On 2013年08月30日 15:38, Steffen Klassert wrote:

On Wed, Aug 28, 2013 at 03:09:40PM +0800, Fan Du wrote:

quoted

Some thoughts on IPv4 VTI implementation:

The connection between VTI receiving part and xfrm tunnel mode input process
is hardly a "xfrm_tunnel", xfrm_tunnel is used in places where, e.g ipip/sit
and xfrm4_tunnel, acts like a true "tunnel" device.

In addition, IMHO, VTI doesn't need vti_err to do something meaningful, as all
VTI needs is just a notifier to be called whenever xfrm_input ingress a packet
to update statistics.

A IPsec protected packet is first handled by protocol handlers, e.g AH/ESP,
to check packet authentication or encryption rightness. PMTU update is taken
care of in this stage by protocol error handler.

Then the packet is rearranged properly depending on whether it's transport
mode or tunnel mode packed by mode "input" handler. The VTI handler code
takes effects in this stage in tunnel mode only. So it neither need propagate
PMTU, as it has already been done if necessary, nor the VTI handler is
qualified as a xfrm_tunnel.

So this patch introduces xfrm_tunnel_notifier and meanwhile wipe out vti_err
code.

Signed-off-by: Fan Du<redacted>
Cc: Steffen Klassert<steffen.klassert@secunet.com>
Cc: David S. Miller<davem@davemloft.net>
Reviewed-by: Saurabh Mohan<redacted>

Applied to ipsec-next, thanks a lot!

Hi, Steffen

Thanks for picking this up!

About "xfrm: Refactor xfrm_state timer management", Thomas objects adding notifier
at clock_was_set( https://lkml.org/lkml/2013/8/18/36 ), frankly speaking I'm not
experienced to argue with such high level person, neither could I convince David
that getting rid of wall clock in xfrm_state is the right thing to do.
So I really don't know what to do with this patch now :( scratching my head harder。。。

Is there any slim light of hope for me to keep working on this IPsec issue?
Or should I drop it?

Thanks

-- 
浮沉随浪只记今朝笑

--fan