(usagi-users 03309) Re: setkey can't set SPD properly

Hello,
----- Original Message ----- 
From: "Masahide NAKAMURA" <[email protected]>
To: <[email protected]>
Sent: Thursday, April 14, 2005 11:41 AM
Subject: (usagi-users 03308) Re: setkey can't set SPD properly


>> I want to ask why I can't set SPD properly.Or is it impossible to have two policies which only differ by templates.
> 
> Yes. To be exact, it is impossible to have two (or more) SPD entries
> with the same selector (e.g. src/dst_range and upperspec in setkey(8)) for each
> direction.
> 

But there are four keywords in adding SPD, that are  src/dst_range,  upperspec and policy.
So I wonder it should be possible to add, isn't it?

> Regards,
> 
> -- 
> Masahide NAKAMURA
> 
> 
> Lv Liangying wrote:
>> Hello, all
>> 
>> Now, I am testing ipv6 with TAHI. I met a problem and I think maybe it's sensible to post it here.
>> I want to set two SPD with same IPsrc, same spi, but just different protocol. But I can't set this two entries.
>> for example:
>> I first run the script to set SPD
>> 
>> /sbin/setkey -c <<EOD
>>  spdadd 3ffe:501:ffff:ff04::/64 3ffe:501:ffff:ff01::/64
>>  any
>>  -P in ipsec
>>  esp/tunnel/3ffe:501:ffff:ff02:200:ff:fe00:a1a1-3ffe:501:ffff:ff00:200:f f:fe00:b0b0/require;
>>  spddump;
>>  EOD
>> 
>> It set correctly;
>> then I run next script just change protocol
>> 
>> /sbin/setkey -c <<EOD
>>  spdadd 3ffe:501:ffff:ff04::/64 3ffe:501:ffff:ff01::/64
>>  any
>>  -P in ipsec
>>  ah/tunnel/3ffe:501:ffff:ff02:200:ff:fe00:a1a1-3ffe:501:ffff:ff00:200:f f:fe00:b0b0/require;
>>  spddump;
>>  EOD
>> 
>> It says file has already exists.
>> 
>> I want to ask why I can't set SPD properly.Or is it impossible to have two policies which only differ by templates.
>> 
>> Thank you in advance!
>> 
>> Best Regards
>> Lv Liangying
>> 
>> 
>> 
> 
>