DEGROOTE Arnaud
2006-10-16 19:28:51 UTC
Hi everyone
I continue my work on the fast_ipsec implementation for ipv6. To
understand my problem, I give a little overview of fast_ipsec processing of
a ipv6 packet.
ip6_output
create exthdr if necessary
check policy
split the header if it is necessary
check about jumbo frame
chain exthdr if necessary
play with routing extension header if necessary
ipsec6_process_packet if necessary ( in this case, the job is finished
for this call )
lots of other stuff if we don't process the packet
ipsec_process_packet will encrypt the packet using opencrypto when the
process is done, the packet is reinjected in ip6_output with dummy
argument.
The approch is ok for basic packet ( without extension headers, no mobility
options, etc ... ). In other case, it isn't correct. Calling ip6_output
with the good argument is not really hard, I can just add a callback
parameter to ipsec6_process_packet.
The question is how to handle the second call to ip6_output. If we just
call ip6_output, exthdr will be processed two times and the packet will be
incorrect. I see two possible options and I want your opinions about it :
- cut ip6_output in two functions : the first before the ipsec
processing, the secund is after the ipsec processing. In the case
where there is no ipsec, the penalty is just an extra function
call
- add a possible flag IPV6_REENTRANT. If this flag is set, we
skip all the exthdr processing before ipsec processing.
In both case, I will write a function which can retrieve exthdr from a
mbuf, so when we come back in ip6_output, I can retrieve the exthdrs if
there are any.
Can you comment this ideas or give me some better ideas. I will listen for
any solution. Thanks a lot for your help.
PS : please CC me on reply
I continue my work on the fast_ipsec implementation for ipv6. To
understand my problem, I give a little overview of fast_ipsec processing of
a ipv6 packet.
ip6_output
create exthdr if necessary
check policy
split the header if it is necessary
check about jumbo frame
chain exthdr if necessary
play with routing extension header if necessary
ipsec6_process_packet if necessary ( in this case, the job is finished
for this call )
lots of other stuff if we don't process the packet
ipsec_process_packet will encrypt the packet using opencrypto when the
process is done, the packet is reinjected in ip6_output with dummy
argument.
The approch is ok for basic packet ( without extension headers, no mobility
options, etc ... ). In other case, it isn't correct. Calling ip6_output
with the good argument is not really hard, I can just add a callback
parameter to ipsec6_process_packet.
The question is how to handle the second call to ip6_output. If we just
call ip6_output, exthdr will be processed two times and the packet will be
incorrect. I see two possible options and I want your opinions about it :
- cut ip6_output in two functions : the first before the ipsec
processing, the secund is after the ipsec processing. In the case
where there is no ipsec, the penalty is just an extra function
call
- add a possible flag IPV6_REENTRANT. If this flag is set, we
skip all the exthdr processing before ipsec processing.
In both case, I will write a function which can retrieve exthdr from a
mbuf, so when we come back in ip6_output, I can retrieve the exthdrs if
there are any.
Can you comment this ideas or give me some better ideas. I will listen for
any solution. Thanks a lot for your help.
PS : please CC me on reply
--
Degroote Arnaud
ENSEIRB Informatique
***@enseirb.fr
--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de
Degroote Arnaud
ENSEIRB Informatique
***@enseirb.fr
--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de