From: Kazunori Miyazawa <Kazunori.Miyazawa@xxxxxxxxxxxxxxx>
Date: Tue, 7 Jan 2003 13:00:50 +0900
This patch is simple extension of PF_KEY to support IPv6;
to accept IPv6 IPsec configurations.
Ok. Your patch looks OK and probably I will integrate it to my
tree tomorrow.
However this patch does not contain any codes to process the packets
in IPv6 stack because we wonder how we should implement it:
1. The building packet codes of datagram (ip_append_data()) is
very different from ip6_build_xmit(). And I guess you will
change ip6_build_xmit() to ip6_append_data().
2. How should we implement to process destination option header
which is inside of AH and/or ESP? There seems two options.
One is to process IPsec on parsing extension headers.
The other is to process IPsec as upper layer protocol and
we always check the destination option header when we finish
to process AH or ESP.
We will be glad to hear your preferences, plans or a better way
to implementation.
To be honest no concrete plans exist. Alexey is currently
offline and I expected to bring him into an ipv6 ipsec discussion
as soon as he reappears. I do not know when he will return, however.
Because of this, I would suggest to just keep working in area of
AH/ESP ipv6-specific packet creation and parsing. Stay clear of
routing/dst/input/output interface issues. If you finish the packet
handling/building work and Alexey does not return, we can work on
design without him.
|