> > > >	per-pcb policies should not be manipulated via PF_KEY.
> > > 
> > > 	oops, read access (via dump/whatever) is ok.
> > > 
> > > itojun
> > 
> > do you mean spddump should dump per-pcb ones as well?
> 
> 	we currently do show them via "setkey -DP".

no, we don't.
spddump dumps policies on sptree (ie. only spd ones) while spdflush
flushes ones on sptailq (ie. both of spd and pcb ones).

YAMAMOTO Takashi