linux-ipsec: Re: IPSec: Fragmentation in Linux 2.0.xx IP stack

> > Anything from OpenBSD whose license contains the advertising clause version

Then they are wasting their time. Linus will (rightfully) not accept any code under the BSD license with advertising clause into the kernel tree. The shorter BSD license without that clause isnt a problem

[This is the "must mention the name of XXX in packaging/advertising" clause  there is a BSD license variant without this too]

> mbufs. The IPsec "routing" uses the JI e-routes, which is nothing more
> than a port of the BSD radix trees.

2.1.x has its own radix trees. There is also some work on other algorithms done in finland more recently that shows a radix tree for routing is not the best algorithm. I'll try and dig out a URL or the paper. Their data structures can do 128bit lookups and do 500,000/second on a P133

For < 60,000 route entries btw the FIB hash used in Linux 2.0/2.1 outperforms radix trees

> The userland utilities I am using are all from OpenBSD now, but that is
> probably easy to change.

These are not part of the GPL kernel so it isnt a problem, as seperate applications the two licenses dont fall out.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related lists.freeswan.org Links 1998-fall 1998-spring 1998-summer 1998-winter 1999-winter announce briefs bugs design freeswan-list hipsec ietf-sectest users users-admin Request more information about Pantek

> That sounds interesting, as it might eliminate the need for a completely
> separate routing table (e-routes) for IPSec. I am not sure how stable the
> 2.1.xx release train is, as I have not used that yet. All our systems are
> 2.0.33 at the moment (we support about 50 servers both inhouse and at
> various customers).

2.1.9x is fairly stable for IP stuff. I wouldnt recommend it for production use however.

> > Maybe change ip based sockets to call > > sk->ip_build_xmit() > > and

It gets hairy on a per route basis.

Alan Received on Tue Apr 28 10:37:24 1998