netdev - Re: Add IPSec IP Range in Linux kernel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20111108.204253.891598837549584662.davem@davemloft.net>
Date:	Tue, 08 Nov 2011 20:42:53 -0500 (EST)
From:	David Miller <davem@...emloft.net>
To:	danila.st@...l.ru
Cc:	linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
	linux-crypto@...r.kernel.org,
	linux-security-module@...r.kernel.org, adobriyan@...il.com,
	peter.p.waskiewicz.jr@...el.com
Subject: Re: Add IPSec IP Range in Linux kernel

From: Daniil Stolnikov <danila.st@...l.ru>
Date: Wed, 9 Nov 2011 09:36:07 +0800

> I never imagined that it will cause some difficulties.

Ever feature has side effects and costs associated with it.  Some of
which can be non-trivial.

Like I said, if you want address ranges, ask the userland IPSEC daemon
authors to synthesize it.

I'm really not able to devote the time necessary to explain every
nuance of how we store IPSEC rules in the kernel side database and
what implications that has for expanding the kind of match keys we
support.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html