Subject: FYI: Fix for (non-IPsec) IPv6 with FAST_IPSEC
To: None <tech-net@netbsd.org>
From: Jonathan Stone <jonathan@dsg.stanford.edu>
List: tech-net
Date: 04/25/2004 19:54:44
As of now, NetBSD-current kernels with both ``options FAST_IPSEC' and
``options INET6'' should work, for IPv4 traffic with or without IPsec;
and for IPv6 traffic without IPsec. (Attempts to IPsec IPv6 traffic
just plain don't work: they cause the traffic to be output as
cleartext, and blackholed on reception).

The salient change was to sys/netinet6/in6_pcb.c,rev 1.63->1.64, to
properly initialize the per-PCB IPsec cache. It now works for me,
over lo0, which is all the IPv6 connectivity I have.

I'd appreciate it if another few sets of eyes could look over the
change. I'm also interested in hearing from anyone who builds a kernel
(e.g., sys/i386/conf/GENERIC.FAST_ISPEC), and tries it out.

This change only affects kernels configured with FAST_IPSEC, who also
turn on IPv6, and use it; which would trigger a panic every time.
(Things can't get any worse than that.) It doesn't affect configs without
FAST_IPSEC, or with FAST_IPSEC but without INET6.  So it seems like
a good candidate for a pullup. Comments?