From: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
To: Sabrina Dubroca <sd@queasysnail.net>
Cc: herbert@gondor.apana.org.au, netdev@vger.kernel.org,
steffen.klassert@secunet.com
Subject: Re: [PATCH ipsec-next 0/7] ipsec: add TCP encapsulation support (RFC 8229)
Date: Sat, 24 Aug 2019 01:17:27 +0200 [thread overview]
Message-ID: <87c6bbfb-854b-7a7d-c88d-5c5730a8dc54@gmx.net> (raw)
In-Reply-To: <cover.1566395202.git.sd@queasysnail.net>
Hi!
On Wed, 21 Aug 2019 23:46:18 +0200, Sabrina Dubroca wrote:
> This patchset introduces support for TCP encapsulation of IKE and ESP
> messages, as defined by RFC 8229 [0]. It is an evolution of what
> Herbert Xu proposed in January 2018 [1] that addresses the main
> criticism against it, by not interfering with the TCP implementation
> at all. The networking stack now has infrastructure for this: TCP ULPs
> and Stream Parsers.
> [...]
Thank you very much for the patchset. Where I live, a substantial amount
of free and paid Wifi networks restrict UDP to port 53. TCP ports are
usually unaffected by such restrictions.
Running IKE/ESP over TCP is sometimes the only remaining option, and
this patch makes that option available.
> The main omission in this submission is IPv6 support. ESP
> encapsulation over UDP with IPv6 is currently not supported in the
> kernel either, as UDP encapsulation is aimed at NAT traversal, and NAT
> is not frequently used with IPv6.
Side note: The lack of support for ESP over UDP with IPv6 is the reason
why third-party Android IPsec management apps (e.g. the strongswan app)
can't connect to IPv6-only remote endpoints. AFAIK Android apps do not
have permission to send ESP packets directly, whereas establishing TCP
connections and sending UDP datagrams is permitted. But even without
IPv6 support, this patch is a great step forward.
Regards,
Carl-Daniel
prev parent reply other threads:[~2019-08-23 23:17 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-21 21:46 [PATCH ipsec-next 0/7] ipsec: add TCP encapsulation support (RFC 8229) Sabrina Dubroca
2019-08-21 21:46 ` [PATCH ipsec-next 1/7] net: add queue argument to __skb_wait_for_more_packets and __skb_{,try_}recv_datagram Sabrina Dubroca
2019-08-23 2:39 ` kbuild test robot
2019-08-21 21:46 ` [PATCH ipsec-next 2/7] skbuff: Avoid sleeping in skb_send_sock_locked Sabrina Dubroca
2019-08-21 21:46 ` [PATCH ipsec-next 3/7] xfrm: introduce xfrm_trans_queue_net Sabrina Dubroca
2019-08-21 21:46 ` [PATCH ipsec-next 4/7] xfrm: add route lookup to xfrm4_rcv_encap Sabrina Dubroca
2019-08-21 21:46 ` [PATCH ipsec-next 5/7] esp4: prepare esp_input_done2 for non-UDP encapsulation Sabrina Dubroca
2019-08-21 21:46 ` [PATCH ipsec-next 6/7] esp4: split esp_output_udp_encap and introduce esp_output_encap Sabrina Dubroca
2019-08-21 21:46 ` [PATCH ipsec-next 7/7] xfrm: add espintcp (RFC 8229) Sabrina Dubroca
2019-08-29 7:04 ` Steffen Klassert
2019-08-29 12:34 ` Sabrina Dubroca
2019-08-23 23:17 ` Carl-Daniel Hailfinger [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87c6bbfb-854b-7a7d-c88d-5c5730a8dc54@gmx.net \
--to=c-d.hailfinger.devel.2006@gmx.net \
--cc=herbert@gondor.apana.org.au \
--cc=netdev@vger.kernel.org \
--cc=sd@queasysnail.net \
--cc=steffen.klassert@secunet.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).