Re: [Design] IPSec in 2.5 Kernel?

Paul Wouters <paul@xtdnet.nl> writes:

> > Opportunistic Encryption has the potential to get large portions

I certainly understand the importance of OE, but as you said it is not high on my list. I've already got a working IKE, and that's already available in a few contexts (ipsec-tools.sourceforge.net).

I'm not sure what kernel hooks you need for OE. The existing code has the concept of "require ipsec" and "use ipsec"... Require means that no non-IPsec packets will be passed; Use means that IPsec will be used if an SA exists. I _believe_ that both Require and Use policies will signal IKE to start a negotiation, but I'd have to re-examine that code to verify.

My immediate priority is finishing the NAT-T implementation in IKE. However, patches for other features are certainly welcome.

-derek

-- 
       Derek Atkins
       Computer and Internet Security Consultant
       derek@ihtfp.com             www.ihtfp.com
_______________________________________________
Design mailing list
Design@lists.freeswan.org
http://lists.freeswan.org/mailman/listinfo/design