Hello,
Does someone has experience programming with IPsec on C and could appoint me to good API's? I have no experience with IPsec, but I really need to learn it.
I'm trying to develop a C application on linux using IPsec and I'm unable to find out how to do it or API's for it. I tried IPsec-tools, but seems that it uses some headers that should be present in the kernel and isn't.
I'm using the 2.6.15 kernel and I've been trying to install the 2.6.24 version so I can enable the IPsec options, as I was unable to find then on 2.6.15, but I've never done it before and I'm not doing it right, I got how to compile alright, but I seem to have been configuring the kernel wrongly, as it always shows some error message when I boot it.
I would really be glade if I don't have to change the kernel version, I'm interest in learning it, but for now it is just delaying me and I have lots to do, for my graduation and for my job.

Thanks,
Gustavo.

When I think of IPSec, as in VPN, I think of a secure tunnel that is, from a program's point-of-view, "just there." The IP-addresses that are designated to "flow through the tunnel" appear simply to be ... IP-addresses just like any other.

The "kernel magic" that you speak of is what enables the data sent to and from these IP-addresses to be "automagically" diverted through the tunnel.

Probably the best place to start is elsewhere on the Internet where various introductions and HOWTOs, of admittedly-varying quality, exist in abundance.

I found it very hard to wrap my cranium around IPSec, and I've been in this business for ... well, nevermind. "A very long time now."

Thanks, now that I know that I don't need to program oriented to IPsec I could find out a lot of thing, but I tried and I'm still trying the HOWTOs everywhere I can find then, and I'm only able to find HOWTO VPN.

I don't want to build a VPN, I just want to config the IPsec policy with two sockets, one for sending and another receiving. I want to config a "per-socket" policy, but can seen to find it anywhere.

the closer I found from what I want is the ipsec FAQ from netBSD.org