When processing an IP packet, the kernel looks into the security policy (SP) database to determine whether it is to be protected with IPsec. If the identifiers of the packet (e.g. IP addresses, etc.) match an SP entry, the kernel searches for an appropriate Security Association (SA) in the corresponding database, containing the algorithms, keys and so on.Now, the Linux kernel apparently takes always the most recently estblished matching SA (i.e. using LIFO). Is there a way (config file, command, etc.) to change this to FIFO? I am working on a solution, where I really want to use up old SAs before generating new ones.
Kernel IPsec SA database: FIFO instead of LIFO
linux;kernel;linux kernel;ipsec