Re: Add IPSec IP Range in Linux kernel

[Daniil Stolnikov <danila.st@mail.ru>]

> From: Daniil Stolnikov <danila.st@mail.ru>
> Date: Tue, 08 Nov 2011 12:40:13 +0400

>> I turned to you, the developers, but rather to urge you to implement
>> this feature using IP range.

> This won't be implemented, the keys used for IPSEC rule lookups supported by
> the kernel are already way too complex.

> From: Alexey Dobriyan <adobriyan@gmail.com>
> Date: Tue, 8 Nov 2011 14:08:24 +0200

>> changing addr_match() is trivial for ipv4 and easy for ipv6. :-)

> No, this is not happening.  This added complexity screws up all the hash table
> and lookup optimizations we have in the XFRM layer.

I never imagined that it will cause some difficulties. Several questions arise:

1) How complex is this implementation?
2) How to do this time?
3) Will this feature is implemented vsetaki? If so, how soon and what will it take?


> Ranges can be synthesized by userspace, and that's the way it has to
> be supported.

That is, you want to say that all this can be done at the user level? How so?

In general, if there are alternative implementations of this feature without support at the kernel level? What are some loopholes, tricks? It is meant to create multiple connections to the same subnet subranges without the use of masks such as / 29. Perhaps this can be achieved through l2tp? There, in the present setup IP range. Or is it both?