[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Simplifying IKE
> So, you wouldn't consider PF_KEY to be a standard API for use with IPsec?
> I don't like it much personally, as it isn't as flexible as RFC 2401 would
> allow an API to be, but still, it is there....
Bill already mentioned that PF_KEY is not the sort of policy API that people
have been talking about.
What people would like (I suspect) is something like my old "Simple IPsec
Socket API" or Craig Metz's later work that also includes QoS type features.
Basically, what I suspect people want would be a way to take a socket, and
say "Use IPsec for traffic on this socket," or ask "Does this socket secure
its traffic, and if so, how?"
To implement something even close to this requires a fully integrated IPsec
implementation. Examples I know of even simple IPsec socket options are in
the NRL code, Solaris 8 and beyond ("man ipsec" for docs), and the KAME code.
There may be others as well that I'm not aware of, and I'd like to hear about
them.
Dan
References: