Subject: NetBSD diffs for swIPe "floppy" release

From: John Kohl <[email-masked]>

see ftp.atria.com:/pub/swIPe-netbsd.tgz (gzipped tar file)

README file for swIPe diffs for NetBSD-1.0_BETA.

Porting work by John Kohl <[email-masked]>, on i386 box.  YMMV if
you use another NetBSD platform (but please report results!).

(a) You need a modified version of the modload program.  The one in the
official sources doesn't call a post-load program.  See modload-diffs,
and apply them to /usr/src/sys/sbin/modload/*

(b) You need the diffs for swIPe itself.  These are based on the
"floppy" version of swIPe (that came on the "swIPe this disk!" disks
from USENIX Summer '94 (Boston).

(c) There is a problem with large TCP transfers--somewhere the TCP
receiver is screwing up.  When packets are corrupted, sometimes this
corruption seeps up to the program which is reading from TCP.  For
example, an FTP'ed file can be garbage.  I ran into these problems
running swIPe over a PPP link with a 14.4k modem.  I have some hints on
what may be wrong inside TCP, and I'll investigate.

To build the NetBSD version of swIPe:
(1) make sure you have "options LKM" in your kernel--swIPe is a loaded
kernel module, and needs the loadable kernel module support.

(2) type 'make -f Makefile.netbsd' in the modload subdirectory

(3) run make in the user subdirectory

(4) read the directions in doc/README.  For the 'route' commands, use
this syntax instead:
	route add -host 192.9.200.2 1.1.1.1

Let me know if you have any problems, of course!

==John Kohl
<[email-masked]>

---

From: Peter Galbavy <[email-masked]>

> README file for swIPe diffs for NetBSD-1.0_BETA.

Anychance of telling us ignorant of the facts, what is swIPe ?

Regards,
-- 
Peter Galbavy					work: [email-masked]
Wonderland					rest: [email-masked]
						play: http://www.wonderland.org/
"The 'net interprets censorship as damage and routes around it." - John Gilmore

---

From: John Kohl <[email-masked]>

Oh, sorry, I did forget to mention what swIPe is.  It's "software IP
encryption", a hack which provides a new virtual network interface that
encrypts on the way out and decrypts on the way in.

You can FTP the swIPe distribution from within the US.  I forget where
to find it--try asking archie.

==John

---

From: "Charles M. Hannum" <[email-masked]>

IP encryption.  Not exportable.

---

From: Darren Reed <[email-masked]>

> IP encryption.  Not exportable.

Only the DES portion of swIPe should be non-exportable (?).
But I guess that's the crux of it...

The rest of it (mainly an implementation of an encapsulated IP
protocol) should be.  I've got it around somewhere ;) and I think
it is fairly easy to use an encrpytion protocol other than DES
(such as IDEA).  MD5 is also used.  Not something I'd want to run
on a 486-33 ;)

darren

p.s. where was the ftp place for the netbsd port ?

---

From: "Charles M. Hannum" <[email-masked]>

Things that involve `key management' and other infrastructure to
support encryption are also potentially restricted.

It's all pretty fuzzy, though.