Re: [PATCH] IPSec protocol application order

[David S. Miller]

On Wed, 2003-02-19 at 15:03, Tom Lendacky wrote:
> I apologize if I missed it, but is there another way to set policy in the
> SPD besides the setkey command?  I am under the assumption that setkey's
> spdadd operation is what is to be used to define the policy on the system
> so that racoon can perform dynamic keying.

That's correct.

But there is still no issue.

The user can make his machine non-RFC compliant by giving a bogus
specification to setkey.  Kernel and setkey are merely doing what
the user asks of them.

This is akin to the user writing a RAW socket application which makes
the kernel output non-RFC compliant TCP packets.  Do you suggest that
the kernel or some other part of the system should verify the packets
sent through the RAW socket interface?  That is exactly what you are
telling us that setkey should be doing.