From Libreswan
Jump to: navigation, search

Antony's unsorted pages that I want to access quickly. These are mostly related to IPsec/libreswan and when I think I know this page exist but where is it.


KVM/QEMU virtiofs to replace 9pfs: libvirt 6.2, qemu 5.0, kernel 5.4

KVM/QEMU + vsock NFS to replace 9pfs

KVM support for vsock and nfs support could have a better performance than 9pfs. This work could be interesting to libreswan KVM testing. It started in 2015. Slowly picking up, as 2018 it seems AWS and firecracker is pushing it. We are almost there.

Linux Kernel developments

XFRM Offload : starting 4.14

 * NAT support ??? 
 * What if the interface is a member of bridge? can libreswan/strongswan configure SA correctly? bridge
 * what if the packets arrive on different interface would that get decrypted correctly?
 * Bonded NIC card


 * idea presentation Steffen Klassert Linux Netconf, Boston, June, 2019

Linux Per CPU efforts

Userspace IPsec Stacks

Over last few years specialized user space IPSec(ESP) stacks and IKE implementations are becoming popular.

VPP + DPDK (Userspace ESP + IKE)

VPP has its own IKEv2 and ESP implimentation.

Snabb ESP userspace stack

Snabb as of 2020 has ESP. No IKE, it can easily use of the shelf IKE say strongswan for IKE and and few command line calls to install snabb esp Snabb FOSDEM 2020 snabb ipsec podcast Strongswan inegeration



iptable rule to drop IKEv2 message id X


# drop ike message ID 6
iptables -A INPUT -m u32 --u32 '0x6 & 0xFF = 0x11 && 0x30 & 0xFFFFFFFF = 0x4' -j DROP

Hardware offload

XFRM offload

  • Mellonax Innova or ConnectX 6DX
  • Intel

Intel QAT


Intel AES NI

Historic OCF

Back in the 90 there was alo


Interesting Linux referecncs

Linux packet path