Next: 6.10 netfilter extensions
Up: 6 Milestone definitions
Previous: 6.8 creation of MAST
The transmit side will be reworked starting in October for a release in
December.
The transmit work will include:
- adapt lifetime structure and checks.
- split into pre-crypto, crypto and post-crypto stages.
- use of low-level generic algorithm functions (e.g. 3DES, SHA1, MD5) to
perform crypto.
- at the KLIPS level at least, stop overloading said SPI value usage.
This should propogate back to Pluto via new PF_KEY extensions, but
should remain compatible for a period.
- eliminate redundant lookup of eroute->TDB chain by linking eroute
directly to ipsec_sa from eroute using reference counts.
- add facility for using netfilter for SA selection. If new
``flowpolicy'' field is set, then skip eroute lookup.
- connect MAST transmit to ``default'' SA. This means that any
packets that are routed to the MAST device will have their
flowpolicy set and be send to the IPsec transmit code.
Michael Richardson
2001-09-16