lkml.org 
[lkml]   [1998]   [Sep]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: encrypted IP tunnel for 2.1?
Date
Felix von Leitner enscribed thusly:
> I have been looking for an encrypted IP tunnel for quite some time now,
> but haven't been able to locate one.

You got several options... All depends on your requirements...

> While there seem to be numerous implementations of IPSEC, none of them
> supports 2.1. CIPE is only for 2.0, too.

Ok... So what is it about 2.1 that you require and can't use 2.0.35?
I'm using 2.0.35 for encrypting tunnels and firewalls. Since they don't
do much else, I don't need any of the advanced stuff from 2.1. Besides,
some of the management would have little kitty cats, right on the spot, if
I were to plug experimental development kernels onto their precious firewalls.
If you had some sophisticated application that required some quality of
service features or some such I might buy it, but I would be surprised...

> What is so difficult about 2.1?
> I mean, 2.0 already is obsolete and will be really obsolete when 2.2
> comes out, so I don't understand why the implementors aren't already
> writing their code for 2.1.

We don't even have any 2.2-pre kernels yet and you're talking
about 2.0 being obsolete!?!? I think the clue meter just underflowed!

I think there are a LARGE number of individuals who would take
extreme exception to the idea that 2.0 is obsolete. That is pure and
utter rubish considering that the 2.1 kernels are development kernels
and there are no more recent "release" track kernels. WHEN the 2.2
series becomes the release series, then we can begin to consider phasing
out the 2.0 kernels. I remember some people were sticking with the
tried and true 1.2.13 long after we were well up into the 2.0.x series.
Some didn't think the 2.0 series really stablized till it was well into
the teens or twenties. 2.0 obsolete? There are even some pre patches
worked up for 2.0.36. Will there be a 2.0.36? Who knows? Will 2.2.0 beat
2.0.36? Who knows? Will 2.0.36 come out even if 2.2.0 beats it? Probably
not, but maybe... So just loose the idea that 2.0 is "obsolete"...
In many ways, since 2.1 is a "development" line, the 2.1 kernels will be
obsolete before the 2.0 kernels will be...

You do understand the way the numbers work, don't you? If the second
number is odd, it's a development kernel and possibly unstable. If the
second number is even, it's a release kernel and is expected to be more
stable. Experimental stuff goes into the development kernels and only
if it's very stable and in high demand does it get retrofitted back into
a previous release kernel (autofs is an example that comes to mind there).

The FreeSwan IPSec gang have been waiting for the network code in
the 2.1 series to settle out (aka waiting for 2.2 to come out) to begin
migrating to 2.2. I do NOT believe there will be an IPSec for 2.1, simply
because they are waiting for 2.2 and no one will be supporting 2.1 after
2.2 comes out. I'm waiting for a number of things in 2.2. I want IPSec,
but I also want IPv6 including the ESH and AH. I also want the firewall
code working cleanly between IPv4 and IPv6 with or without IPSec in the
equation. Think porting IPSec to 2.1 is trivial? Think again. There
were a lot of network changes in 2.1 and don't forget you have IPv6 in
the equation now as well.

You're looking for these things... Have you been helping the teams
out? I've been wading in there as deep as I dare (US citizen and all of
that) and have been testing and configuring and advising as much as I can.
I'm testing out some interoperability between the Linux IPSec stuff and
some "network appliance" type stand-alone IPSec add-on's. I'm even giving
a talk on all of the encryption stuff at the Atlanta Linux Showcase, coming
up next month.

You want it, time to join up and start making contributions...

> Is there any encrypting IP tunnel for 2.1 out there that I missed?
> Anyone care to comment?

Yeah... If you are that anxious and must use the 2.1 kernels and
must have an encrypted tunnel, check out the VPN mini-HOWTO and drop your
tunnel on PPP over ssh. That works with all of them and probably involves
less silly nonsense with key management than does IPSec... If your
requirements are for something less than a full VPN there are SSL options
for specific protocols to consider. For example, I've done the patches
for fetchmail to use SSL for POP and IMAP (patches are up on the North
American Cryptographic Archives - www.cryptography.org).

> Felix

Regards,
Mike
--
Michael H. Warfield | (770) 985-6132 | mhw@WittsEnd.com
(The Mad Wizard) | (770) 925-8248 | http://www.wittsend.com/mhw/
NIC whois: MHW9 | An optimist believes we live in the best of all
PGP Key: 0xDF1DD471 | possible worlds. A pessimist is sure of it!

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:44    [W:0.091 / U:0.024 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site