Re: IPsec in Kernel??

[Justin Guyett]

On Thu, 12 Jul 2001, Nitin Dhingra wrote:

> Is there any possibility that IPsec will be provided in
> the kernel ?

The maintainers won't accept code from anyone in the US for fear that
export regulations may tighten again retroactively, so any merge into the
kernel would require a seperate maintainer either to maintain the fork,
and/or to constantly merge in new changes from the original freeswan
project.

The current in-kernel portion of freeswan doesn't get along well with
advanced routing, and doesn't take advantage of SMP, so I'd be rather
disappointed if it got forked and merged in its current form.

Some things that would be nice:
 integration with advanced routing
 /proc interface so connections can be added on the fly
 module-only option (freeswan's latest snapshots seem to have this)
 take advantage of SMP
 implement AES
 use of kernel crypto patch / openssl for userland rsa stuff
 move all non-optional parts of the updown scripts into the ipsec program,
  a la openbsd where the shell script portion isn't hundreds of lines for
  one tunnel.
 no bloat (a 3.5 meg ipsec module doesn't seem very reasonable)

justin