Re: [dhcwg] DHCP hackathon in Prague: SeDHCPv6

[Francis Dupont <[e-mail]>]

 In your previous mail you wrote:

>  The point of this joke is that actually I don't have any problem with =
>  encryption being done in the kernel, but I don't see how to make it work =
>  for this use case, because we don't have end-to-end communication with =
>  the server.

=> the theory of IPsec operations is very simple: you have two databases:
 - the Security Association DataBase
 - the Security Policy Database.
When you have a packet you see in the SPD what to do. If the policy is
to do some IPsec processing on the packet you look for the parameters
in the SADB and if there is no SA when there should be one then you ask
IKE to create one (in fact a pair).
So the configuration consists into populating the SPD (e.g. by setkey)
and to say to IKE what to do (define peers, credentials, a zillion of
options).

Regards

[e-mail]