Hi! On Wed, 21 Aug 2019 23:46:18 +0200, Sabrina Dubroca wrote: > This patchset introduces support for TCP encapsulation of IKE and ESP > messages, as defined by RFC 8229 [0]. It is an evolution of what > Herbert Xu proposed in January 2018 [1] that addresses the main > criticism against it, by not interfering with the TCP implementation > at all. The networking stack now has infrastructure for this: TCP ULPs > and Stream Parsers. > [...]
Thank you very much for the patchset. Where I live, a substantial amount of free and paid Wifi networks restrict UDP to port 53. TCP ports are usually unaffected by such restrictions. Running IKE/ESP over TCP is sometimes the only remaining option, and this patch makes that option available. > The main omission in this submission is IPv6 support. ESP > encapsulation over UDP with IPv6 is currently not supported in the > kernel either, as UDP encapsulation is aimed at NAT traversal, and NAT > is not frequently used with IPv6. Side note: The lack of support for ESP over UDP with IPv6 is the reason why third-party Android IPsec management apps (e.g. the strongswan app) can't connect to IPv6-only remote endpoints. AFAIK Android apps do not have permission to send ESP packets directly, whereas establishing TCP connections and sending UDP datagrams is permitted. But even without IPv6 support, this patch is a great step forward. Regards, Carl-Daniel
