[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
Re: PFkey update to get recent racoon working on NetBSD
On May 13, 6:21am, VANHULLEBUS Yvan wrote:
} On Fri, Dec 18, 2009 at 03:12:36PM +0100, Daniel Zebralla (A.P.E. IT-Security
- Hard- & Software Development) wrote:
} > I've seen your mail at  that there were recent changes in racoon
} > that need equal changes to the kernek's PFkey interface.
} > I'm currently experiencing this problem with a recent racoon (taken
} > from NetBSD-current CVS) and a NetBSD 5.0 userland,
} > the problem that I see are repeatedly created phase2 SA entries as
} > described in  by Brett Lymn.
} > Do you have any patches in this direction already, or can you
} > outline the work that needs to be done?
} Not actually, I still didn't found time to finish minor fixes and tou
} port it to NetBSD....
} I'll be on hollidays at the end of the week, I may have time to do at
} least most of that job in the next weeks.....
} > Do you have files & revisions (or URLs to source-changes mails) for
} > FreeBSD?
} Not so easy to track: the best way may be to get the diff
} between..... two patches !
} First one is the "old" patchset maintained for older versions,
} available at http://people.freebsd.org/~vanhu/NAT-T (use only patches
} without TEST or experimental, they will be the version closer to
} NetBSD's ones).
} Second patchset is commit on FreeBSD's HEAD:
} which mostly includes the "correct" version (well, there are still a
} few known bugs in specific situations, I'll have to make some test
} setups to be able to hunt them).
I found this patchset and applied what appeared to be the
pertinent parts. Unfortunately, the result was that racoon couldn't
communicate with the kernel.
} If someone starts porting that to NetBSD (don't forget that NetBSD
} still ships both IPSEC and FAST_IPSEC, work will need to be done
They use common code for key management, so not a big deal.
} twice....), please let me know, that may avoid 2 guys doing the same
} job at the same time, and I can also give some hints, code review,
Does anything need to be done with racoon? Do you have a detailed
description of the PFKey interface? Any hints? I have about three
months to finish this project for the application that I plan on using
NAT-T. Not a huge rush, but I do need to get moving on it.
}-- End of excerpt from VANHULLEBUS Yvan
Main Index |
Thread Index |