On Friday, September 12, 2003, at 01:28  PM, Bill Studenmund wrote:

> Ok, maybe I'm on the wrong page. I assumed that Itojun _added_ kernfs
> supoprt, and that if kernfs wasn't there, we'd use PF_KEY instead. Is 
> that
> assumption correct or incorrect?

That is correct.  However, the PF_KEY interface was a second-class 
citizen to the kernfs interface, since the PF_KEY interface has a 
restriction that the kernfs interface does not have.

That means that kernfs WOULD BE REQUIRED to support large numbers of 
IPsec SAs.

         -- Jason R. Thorpe <thorpej@wasabisystems.com>