Modifying Cryptography Code

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello everyone,
I need to modify some CRYPTOGRAPHY code in Linux Kernel to get a specific VPN behavior, but I don't know where to start.

The situation is the following:

I have a VPN gateway (Linux kernel 2.6.10 with Openswan 2.3.1 installed). I have only installed the user land tools from openswan package in order to use the native ipsec stack in the kernel. I have 30 laptops equipped with Windows XP configured to launch secure tunnels towards the VPN gateway (so I have 30 tunnels). The laptops can communicate securely VIA the gateway and everything works fine but..

the problem is the following:

Each packet sent from a given client to the other get processed 4 times (encryption at the sender, decryption at the gateway, encryption at the gateway, decryption at the receiver). This is the normal behavior but it imposes too much processing overhead on the linux VPN gateway. The required behavior is that the VPN gateway just RELAYS encrypted data (ESP envelopes) without decrypting them. This is impossible in the current ipsec implementation since"the end of a tunnel HAS ALWAYS to be decrypted".

Note that this required behavior can be achieved by launching a tunnel from each client to every other client making the VPN gateway transparent..BUT..this would mean 900 tunnels!! instead of 30, so it is not the answer.

What I am looking for is the portion of the C code in the kernel where the Decryption function is called to decrypt a received packet. When I find this statement, maybe i can make it conditionnal such as: If the destination is me then Decrypt else DO NOT!

I hope that someone can help me with finding this portion of the code and modify it. By the way I searched in the kernel file "esp4.c" but can't seem to find what I want.




----------------------------------------------------------WinXP(1)
         |
Openswan box------------------------------------------------------------WinXP(2)
         |
----------------------------------------------------------WinXP(3)
         |
         |
         |
         |
---------------------------------------------------------WinXP(30)

_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today - it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/


-
Linux-crypto:  cryptography in and on the Linux system
Archive:       http://mail.nl.linux.org/linux-crypto/


[Index of Archives]     [Kernel]     [Linux Crypto]     [Gnu Crypto]     [Gnu Classpath]     [Netfilter]     [Bugtraq]
  Powered by Linux