Hello,

I've been reading through Christian Benvenuti's book "Understanding Linux Network Internals" and have been finding it extremely informative. However, my ultimate interest is to better understand the internals of the linux ipsec solution and how it uses tun/tap interfaces to achieve the goal. So, I'm looking for something on the level of technical detail provided by Christian Benvenuti. I've spent time googling as well as searching the source code. But, haven't been able to find what I'm looking for. I'll be much appreciative if someone could point me to any documentation that would help me. Thanks very much.

IPSec wouldn't use a tun or tap interface, it could traverse those interfaces but ipsec is a security extension to the IPv4 protocol and an inherent feature of the IPv6 protocol, neither of which is tied to any virtual or physical interface. This is from CISCO but it explains basically how a IPSec connection is made, really it's all based in software.

Hello, thanks so much for your reply. Hmm... Actually, I'm troubleshooting a problem on Mac with the Racoon IKE service. So, right, it's probably different than linux, but I thought, if I understood the linux implementation, I might be able to reason better about the Racoon implementation. Racoon uses a tun interface. So, I assumed linux did the same. I'm aware that linux provides the xfrm4_xxx apis for hooks that do the actual header encapsulation. The tun interface simply provides a way to associate an IP address (provisioned by the VPN headend) that can be routed to. I don't know the internals of how the tun works but I was surmising that all it really needs to do (assuming Racoon populated the hooks with the encapsulation logic) would be to pass the packet back into the IP layer requesting the VPN headend as the destination address. Then, the hook logic could detect that this is a packet destined for the VPN headend and encapsulate properly. Anyway, I'm really just trying to find anything I can that would explain this stuff in detail to the degree that Benvenuti does in his book. I've been scouring the internet but just keep coming up empty handed. Tahnks much.

At some point a cipher interfaces within the stack. Not sure exactly where though.