[IPsec] Re: IPsec as an address family

2025-01-15 Thread Theodore Ts'o
On Wed, Jan 15, 2025 at 07:58:24AM -0300, Soni "It/Its" L. wrote: > > > On 2025-01-14 17:36, Michael Richardson wrote: > > > > I don't think you need any IANA allocation or bits on the wire changes, I > > think you > > should just *do it* and tell us. If you need new IKEv2 Notifies, they are >

[IPsec] Re: IPsec as an address family

2025-01-15 Thread Tobias Brunner
On 14.01.25 20:41, Soni "It/Its" L. wrote: > we've been looking at various ipsec RFCs, mailing list discussions, > deployments, etc, and the protocol looks very neat, this "transport > mode" stuff looks really useful, but we see no way for an app to use it. > > we would like to propose a small e

[IPsec] Re: IPsec as an address family

2025-01-15 Thread Soni "It/Its" L.
On 2025-01-14 17:36, Michael Richardson wrote: I don't think you need any IANA allocation or bits on the wire changes, I think you should just *do it* and tell us. If you need new IKEv2 Notifies, they are easily acquired. we might need an address family allocation? https://www.iana.org/as

[IPsec] Re: IPsec as an address family

2025-01-14 Thread Soni "It/Its" L.
On 2025-01-14 18:01, Paul Wouters wrote: > On Jan 14, 2025, at 15:43, Soni "It/Its" L. wrote: > >  > >> On 2025-01-14 16:53, Paul Wouters wrote: >> On Jan 14, 2025, at 14:43, Soni "It/Its" L. wrote: >> > > we really wanna be able to use ipsec in end-user applications... >> >> If you loo

[IPsec] Re: IPsec as an address family

2025-01-14 Thread Paul Wouters
> On Jan 14, 2025, at 15:43, Soni "It/Its" L. wrote: > >  > >> On 2025-01-14 16:53, Paul Wouters wrote: >> On Jan 14, 2025, at 14:43, Soni "It/Its" L. wrote: >> > > we really wanna be able to use ipsec in end-user applications... >> >> If you look at my Opportunistic IPsec presentations (pd

[IPsec] Re: IPsec as an address family

2025-01-14 Thread Soni "It/Its" L.
On 2025-01-14 17:36, Michael Richardson wrote: Hi, "Soni \"It/Its\" L." wrote: > we've been looking at various ipsec RFCs, mailing list discussions, > deployments, etc, and the protocol looks very neat, this "transport > mode" stuff looks really useful, but we see no way for an

[IPsec] Re: IPsec as an address family

2025-01-14 Thread Soni "It/Its" L.
On 2025-01-14 16:53, Paul Wouters wrote: On Jan 14, 2025, at 14:43, Soni "It/Its" L. wrote: > > we really wanna be able to use ipsec in end-user applications... If you look at my Opportunistic IPsec presentations (pdf and videos available), you will an ondemand system triggered by DNS look

[IPsec] Re: IPsec as an address family

2025-01-14 Thread Michael Richardson
Hi, "Soni \"It/Its\" L." wrote: > we've been looking at various ipsec RFCs, mailing list discussions, > deployments, etc, and the protocol looks very neat, this "transport > mode" stuff looks really useful, but we see no way for an app to use > it. RFC2367 is kinda the only docu

[IPsec] Re: IPsec as an address family

2025-01-14 Thread Paul Wouters
On Jan 14, 2025, at 14:43, Soni "It/Its" L. wrote: > > we really wanna be able to use ipsec in end-user applications... If you look at my Opportunistic IPsec presentations (pdf and videos available), you will an ondemand system triggered by DNS lookups in the resolver. Thus an application look