Re: IPsec in Kernel??

[Jesse Pollard <pollard@tomcat.admin.navo.hpc.mil>]

Justin Guyett <justin@soze.net>:
> On Thu, 12 Jul 2001, Nitin Dhingra wrote:
> 
> > Is there any possibility that IPsec will be provided in
> > the kernel ?
> 
> The maintainers won't accept code from anyone in the US for fear that
> export regulations may tighten again retroactively, so any merge into the
> kernel would require a seperate maintainer either to maintain the fork,
> and/or to constantly merge in new changes from the original freeswan
> project.
> 
> The current in-kernel portion of freeswan doesn't get along well with
> advanced routing, and doesn't take advantage of SMP, so I'd be rather
> disappointed if it got forked and merged in its current form.
> 
> Some things that would be nice:
>  integration with advanced routing
>  /proc interface so connections can be added on the fly
>  module-only option (freeswan's latest snapshots seem to have this)
>  take advantage of SMP
>  implement AES
>  use of kernel crypto patch / openssl for userland rsa stuff
>  move all non-optional parts of the updown scripts into the ipsec program,
>   a la openbsd where the shell script portion isn't hundreds of lines for
>   one tunnel.
>  no bloat (a 3.5 meg ipsec module doesn't seem very reasonable)

It also needs to support more than just encrypted IP tunnels.

I'm hoping the Linux security module will eventually be able to have modules
for IPSec plus remote user authentication, socket/data labeling.

-------------------------------------------------------------------------
Jesse I Pollard, II
Email: pollard@navo.hpc.mil

Any opinions expressed are solely my own.