Re: Add IPSec IP Range in Linux kernel

From: Daniil Stolnikov <redacted>
Date: Tue, 08 Nov 2011 12:40:13 +0400

quoted

I turned to you, the developers, but rather to urge you to implement
this feature using IP range.

This won't be implemented, the keys used for IPSEC rule lookups supported by
the kernel are already way too complex.

From: Alexey Dobriyan <redacted>
Date: Tue, 8 Nov 2011 14:08:24 +0200

quoted

changing addr_match() is trivial for ipv4 and easy for ipv6. :-)

No, this is not happening.  This added complexity screws up all the hash table
and lookup optimizations we have in the XFRM layer.

I never imagined that it will cause some difficulties. Several questions arise:

1) How complex is this implementation?
2) How to do this time?
3) Will this feature is implemented vsetaki? If so, how soon and what will it take?

Ranges can be synthesized by userspace, and that's the way it has to
be supported.

That is, you want to say that all this can be done at the user level? How so?

In general, if there are alternative implementations of this feature without support at the kernel level? What are some loopholes, tricks? It is meant to create multiple connections to the same subnet subranges without the use of masks such as / 29. Perhaps this can be achieved through l2tp? There, in the present setup IP range. Or is it both?