This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enigCE3F5461D95C22B248165EB3
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Thor Lancelot Simon wrote:
> On Sun, Jan 22, 2006 at 01:59:49PM +0000, Thomas E. Spanjaard wrote:
>  =20
>> Note that IPsec ESP/AH authentication isn't operational yet,=20
>> as someone(*cough* riz *cough* ;)) needs to upgrade our IPsec/SA stuff=
=20
>> to what OpenBSD has.
>>    =20
>
> What exactly is involved in this "upgrade"?  The interface in question
> is standard across the KAME stack and the "fast IPsec" (Keromytis/Leffl=
er)
> stack in most BSD operating systems (in fact, all of them except OpenBS=
D,
> if they've changed it somehow).  AFAICT it offers everything one needs =
to
> require ESP or AH on a per-socket basis; is the implementation broken, =
or
> are we talking about an interface change, and if so, why?
>
> Thor
>  =20
What he's talking about here is some vague handwaving I've done in other
forums about this;  not an interface change, but rather adapting the
tcp-md5 bits to be fully dynamic using (effectively) the same interface
the IPsec stuff has now.  OpenBSD already has this capability (albeit
with their own AP), so what I've actually meant is "use OpenBSD's
working implementation as a guide to how we might implement it in
NetBSD".  Where "ESP/AH" came from, I have no idea - that works fine in
NetBSD.  :)

The primary issue with the TCP_SIGNATURE code ("RFC2385") in NetBSD
right now is that it *requires* the use of an SPI of 0x1000, which
limits associations to per-host granularity (as referenced in setkey(8)).=


I've worked with a proprietary route server that used the OpenBSD API to
get rfc2385-protected BGP sessions working;  my recollection is that
NetBSD's API for rfc2385 just didn't have the flexibility required for
that application (which is why OpenBSD wound up getting chosen as the
platform for that route server).  My goal is to eventually fix the
NetBSD code to add the needed flexibility.  Since I haven't looked
seriously at it in something approaching two years, my advice is for
folks not to hold their breath.  :)   (IE, I'd love to get to it
eventually, but that shouldn't stop anyone who wants it working sooner
from doing something about it)

+j


--------------enigCE3F5461D95C22B248165EB3
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iQCVAwUBQ9QDD7OuUtxCgar5AQOinwP/Z3+KVi1ICw/navjG6tg8xa5zwx0CkL4p
MN/FcxJhK4iw0BYGMgRoC9yhCKvro6CqdmD8SwHYKXvcKKMNK3QUMxs8JjgjosmQ
GD/Pq0dLhT4qb0BM4mHc7z6zRiSVtKQfMOubmQika7ozTSOjYyo3YeUdoyT7W0PU
mHWCk2nTKd4=
=NDPD
-----END PGP SIGNATURE-----

--------------enigCE3F5461D95C22B248165EB3--