tree af2f97c88098f06444434c2678196d9b4f36875c
parent 21fb4f71ee3824c8f177045f21fea258ece602a9
author Neale Ranns <nranns@cisco.com> 1602079136 +0000
committer Damjan Marion <dmarion@me.com> 1602138047 +0000

ipsec: Allow SAs with NULL auth &crypto on IPSec interface

Type: improvement

on the dedicated IPSec interface, the SA describes the peer, so it is
not possible to forward to a peer for which there is no SA. Therefore if
an SA is added with NULL auth and integ then this explicitly states that
this is what the peer desires.
on the contrary on the IP-IP/GRE interface, in the absence of protection
and an SA, then the traffic is sent in the clear. So adding NULL
auth/crypto iSA is a means to describe that the peer should not be sent
traffic.

Signed-off-by: Neale Ranns <nranns@cisco.com>
Change-Id: I7ad2d466cc74eb7ff8c4c84e0d7897d06e2fcf86