Re: encrypted IP tunnel for 2.1?

Olaf Titz (olaf@bigred.inka.de)
Tue, 22 Sep 1998 11:31:56 +0200


> While there seem to be numerous implementations of IPSEC, none of them
> supports 2.1. CIPE is only for 2.0, too.

A 2.1 version of CIPE which basically works is there, but it's in the
alpha stage. Mail me if you are interested in testing. I just don't
want to announce it officially until I'm rather sure that it doesn't
crash, but I want to have it available with or shortly after Linux 2.2.

Of course, when you use that, I want to see every possible bug report.

> What is so difficult about 2.1?

Some structures and kernel routines have fundamentally changed.
Compare "struct sock", and look especially for the various header
pointers. Compare "struct device". Just for fun, compare the tunnel
drivers (drivers/net/new_tunnel.c vs. net/ipv4/ipip.c). The output
part porting was mostly a "tear down and re-build".

They got cleared of a lot of cruft and more streamlined, but it is a
change and you have to adapt a lot of code. Luckily, CIPE is rather
small and separated into parts which are strongly linked to the kernel
and parts which are not. Modularity sometimes saves your mind.

Another reason: the whole kernel internals documentation you can get
like the hackers guide etc. is mostly for 2.0. Just figuring out what
the parameters to the new ip_route_output() mean took me a non-trivial
amount of time.

> I mean, 2.0 already is obsolete and will be really obsolete when 2.2
> comes out, so I don't understand why the implementors aren't already
> writing their code for 2.1.

Because the major development has taken place last year or even
earlier, because the developers have less time than then, because
their need for a stable production box running was paramount and
2.1.[1-6]? was really no option...
(all three counts true for me :-/)

olaf

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/