POLICY: sub policy support.

Sub policy is introduced. Main and sub policy are applied the same flow. (Policy that current kernel uses is named as main.)
It is required another transformation policy management to keep IPsec and Mobile IPv6 lives separate.
Policy which lives shorter time in kernel should be a sub i.e. normally main is for IPsec and sub is for Mobile IPv6.
(Such usage as two IPsec policies on different database can be used, too.)

Limitation or TODOs:
- Sub policy is not supported for per socket one (it is always inserted as main).
- Current kernel makes cached outbound with flowi to skip searching database. However this patch makes it disabled only when "two policies are used and the first matched one is bypass case" because neither flowi nor bundle information knows about transformation template size.

---
 include/linux/xfrm.h   |    7 +
 include/net/xfrm.h     |   45 +++++++-
 net/xfrm/xfrm_policy.c |  255 +++++++++++++++++++++++++++++++++++++++++-------
 3 files changed, 263 insertions(+), 44 deletions(-)

index 84a3e76..901bb65 100644
@@ -104,6 +104,13 @@ struct xfrm_stats {
 
 enum
 {
+	XFRM_POLICY_TYPE_MAIN	= 0,
+	XFRM_POLICY_TYPE_SUB	= 1,
+	XFRM_POLICY_TYPE_MAX	= 2
+};
+
+enum
+{
 	XFRM_POLICY_IN	= 0,
 	XFRM_POLICY_OUT	= 1,
 	XFRM_POLICY_FWD	= 2,

1.4.1

Why can't IPSec & MIP transforms be bundled on the same policy?

Or, perhaps a different approach is needed, where the disposition of a policy can be to re-submit a packet for another policy match after the current bundle has been traversed (something like NF_REPEAT).

- James

James Morris
<[email protected]>

From: James Morris <[email protected]>
Date: Wed, 2 Aug 2006 12:04:31 -0400 (EDT)

At the first year of netconf, Yoshifuji went into detail as to why the IPSEC and MIP transformations had to live seperately.

It's partly a side effect of different userland daemons controlling IPSEC vs. MIP configuration.

We can consider an approach like this as a future refinement. It would allow arbitrary nesting of sub-transforms, for sure, just like netfilter's NF_REPEAT.