Messages in this thread |  | | Date | Thu, 7 May 2026 11:26:49 +0200 | | From | Sabrina Dubroca <> | | Subject | Re: [PATCH ipsec-next v8 03/14] xfrm: allow migration from UDP encapsulated to non-encapsulated ESP |
| |
2026-05-05, 06:32:30 +0200, Antony Antony wrote: > The current code prevents migrating an SA from UDP encapsulation to > plain ESP. This is needed when moving from a NATed path to a non-NATed > one, for example when switching from IPv4+NAT to IPv6. > > Only copy the existing encapsulation during migration if the encap > attribute is explicitly provided. > > Note: PF_KEY's SADB_X_MIGRATE always passes encap=NULL and never > supported encapsulation in migration. PF_KEY is deprecated and was > in feature freeze when UDP encapsulation was added to xfrm. > > Signed-off-by: Antony Antony <antony.antony@secunet.com> > Tested-by: Yan Yan <evitayan@google.com> > --- > net/xfrm/xfrm_state.c | 10 ++-------- > 1 file changed, 2 insertions(+), 8 deletions(-)
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
If someone complains about this we can add a sysctl "preserve_old_encap_on_migrate".
-- Sabrina
|  |