On Sun, 2015-02-01 at 12:19 -0800, David Miller wrote:
> From: David Woodhouse <dw...@infradead.org>
> Date: Sun, 01 Feb 2015 13:33:50 +0000
>
> > Of course, now I'm looking closely at the path these packets take to
> > leave the box, it starts to offend me that they're being passed up to
> > userspace just to encrypt them (as DTLS or ESP) and then send them back
> > down to the kernel on a UDP socket. The kernel already knows how to
> > {en,de}crypt ESP, and do the sequence number checking on incoming
> > packets.
>
> It's funny, I thought we had an IPSEC stack....Right. But I'm trying to work out how we can sanely *use* that from a VPN client. The client normally sets up a tun device, configuring it with appropriate IP addresses and routes by invoking vpnc-script or passing the information back to NetworkManager. The client itself might not even have root privs, in the NetworkManager case. The initial authentication and connection are done over HTTPS, and packets *can* be passed that way if they need to be. But obviously the client *also* tries to set up a UDP data transport too — which is DTLS in the case of Cisco AnyConnect, and ESP in UDP for Juniper. If it *can* get communication over UDP, it'll use it. Otherwise it just passes packets over the TCP connection. So it needs to dynamically set up and tear down the ESP/DTLS tunnels as and when they are working. Ideally we want it such that that packets routed to the tun device get transparently encrypted and sent out on the UDP socket, and packets received from UDP and successfully decrypted will appear to have arrived on the tun device. The user may be manually tweaking the routing, or setting up firewall/NAT/etc. on the tun device. I can see how to set up an ESP in UDP tunnel such that it looks like the packets are actually departing on the *physical* interface (which in practice I suppose they are). But that's going to be fairly complex to set up, and extremely non-intuitive and hard to manage for the user. To the extent that I don't think it's actually deployable. I really was looking for some way to push down something like an XFRM state into the tun device and just say "shove them out here until I tell you otherwise". -- dwmw2
smime.p7s
Description: S/MIME cryptographic signature
