<HTML><BODY style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space; "><DIV><DIV><BLOCKQUOTE type="cite"><DIV> Great - thanks for the pointers. I'll try those lists now. I take it <A href="http://marc.info/?l=linux-netdev">http://marc.info/?l=linux-netdev</A> is the best place to ask for questions about XFRM and KLIPS and the NETKEY interface?</DIV> <DIV> </DIV></BLOCKQUOTE>Depends, first you have to decide which IPSec implementation you want to extend for your needs, KLIPS or Native IPSec.</DIV><DIV>For KLIPS you're right on this list, for the latter one netdev is the right place.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV><BR><BLOCKQUOTE type="cite"> <DIV>On the question of IP fragmentation - in my scenario all packets to be sent over these SAs are (or should be) originated by my application and sent over the standard sockets interface. So any IP fragments should only be created by the outbound IP stack. I believe (and my reading seems to confirm this), that IPsec encapsulation of an outgoing packet occurs before any IP fragmentation of those packets. So hopefully my ports will still be available.</DIV> <DIV> </DIV></BLOCKQUOTE>You are right, that could work.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV><BR><BLOCKQUOTE type="cite"> <DIV>Of course in the general case of traffic forwarding (say if the device is acting as a router), you're correct that this approach will not work.</DIV> <DIV> </DIV> <DIV>Please let me know if I've misunderstood, or if you know of an easier way to achieve what I want (say a socket option that allows you to specify the SA to use for traffic sent over this socket).</DIV> <DIV> </DIV></BLOCKQUOTE><DIV>Have a look at selinux ipsec. Seems they have already implementet something with socket base IPSec SAs:</DIV><DIV><A href="http://www.nsa.gov/selinux/papers/ols2006.odp">http://www.nsa.gov/selinux/papers/ols2006.odp</A></DIV><BLOCKQUOTE type="cite"></BLOCKQUOTE></DIV><BR></DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>Cheers</DIV><DIV> Ulrich</DIV></BODY></HTML>