High performance policy routed IPsec mesh SD-WAN

高性能策略路由 IPsec 网状 SD-WAN

Transport: Userspace ESP (RFC 4303) in tunnel mode over UDP (RFC 3948). Handshake: IKEv2 (RFC 7296) with hybrid ML-KEM (FIPS 203) key exchange (RFC 9370). Routing: Embedded Babel speaker (RFC 8966) with RTT metrics (RFC 9616) and source specific routes (RFC 9079). Steering: SRv6 (RFC 8986) by source/destination prefix.

传输：基于 UDP (RFC 3948) 隧道模式的用户空间 ESP (RFC 4303)。握手：采用混合 ML-KEM (FIPS 203) 密钥交换 (RFC 9370) 的 IKEv2 (RFC 7296)。路由：内置 Babel 协议 (RFC 8966)，支持 RTT 指标 (RFC 9616) 和源地址特定路由 (RFC 9079)。流量引导：基于源/目的前缀的 SRv6 (RFC 8986)。

Peers only need standard IKEv2, ESP, Babel and SRv6. Interoperability is checked against strongSwan (IKEv2 and ESP sessions with Ed25519 keys), BIRD (Babel routes with RTT metrics), and Linux Kernel (seg6local acts on the SRv6 headers ranet3 writes). Any other router or switch that supports IKEv2 with Ed25519 keys, Babel and SRv6 should interoperate as well.

对等节点仅需支持标准的 IKEv2、ESP、Babel 和 SRv6。互操作性已通过 strongSwan（使用 Ed25519 密钥的 IKEv2 和 ESP 会话）、BIRD（带有 RTT 指标的 Babel 路由）以及 Linux 内核（seg6local 处理 ranet3 写入的 SRv6 报头）进行了验证。任何支持 Ed25519 密钥 IKEv2、Babel 和 SRv6 的路由器或交换机均应能实现互操作。

Babel measures the round trip of every link and routes through a relay whenever the direct link is slower. RTT is measured continuously, and packet loss and outages count against a link. Traffic always takes the fastest path, moving back to the direct link once it is faster again.

Babel 协议会测量每条链路的往返时间，并在直接链路速度较慢时通过中继进行路由。RTT 会被持续测量，丢包和中断情况也会计入链路评估。流量始终选择最快路径，一旦直接链路恢复更快，流量便会切回。

A policy on source and destination prefix sends traffic through chosen waypoints and out at a chosen exit. Segment routing is implemented in userspace and works even on macOS, whose XNU kernel has no support for it. Waypoints can come in any order the user specifies and may repeat.

基于源和目的前缀的策略可将流量发送至选定的路径点，并从指定的出口发出。分段路由在用户空间实现，即使在不支持该功能的 macOS XNU 内核上也能运行。路径点可以按用户指定的任意顺序排列，并允许重复。

Userspace dataplanes copy every packet into their own process and are usually expected to be slower than kernel ones. However, ranet3 achieves 8.39 Gbit/s (95% of the 10 GbE line limit) in one-way traffic, outperforming kernel-based WireGuard and IPsec implementations in these benchmarks.

用户空间数据平面会将每个数据包复制到其进程中，通常预期速度会慢于内核态实现。然而，ranet3 在单向流量测试中达到了 8.39 Gbit/s（达到 10 GbE 线路限制的 95%），在这些基准测试中表现优于基于内核的 WireGuard 和 IPsec 实现。