Re: kern/59070: net.ipsecif.use_fixed_reqid=1's behaviour

[Andrew Cagney <andrew.cagney%gmail.com@localhost>]

On Tue, 11 Feb 2025 at 22:46, Kengo Nakahara <k-nakahara%iij.ad.jp@localhost> wrote:
>
> Hi,
>
> The behavior is by design.  I will update man later.

There's something I'm not understanding.

> >   Because different REQIDs are put on the IPv4 and IPv6 policy, I
> >   presumably need to install four SAs:
> >   - in reqid=IPv4
> >   - in reqid=IPv6
> >   - out reqid=IPv4
> >   - out reqid=IPv6
> >   instead of the standard two.

One of IKEv2's SOPs is to establish a single ESP SA and use that to
tunnel all traffic - both IPv4 and IPv6.
Here, that would presumably mean creating SAs that are identical other
than the REQID (same keys, same alg, same inbound/outbound SPIs).
What I'm not understanding is how the kernel, given only the inbound
SPI, can select the correct SA.  Perhaps it uses the Next Header
field.