[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: FreeBSD NAT-T patch integration
- To: freebsd-net_(_at_)_freebsd_(_dot_)_org
- Subject: Re: FreeBSD NAT-T patch integration
- From: VANHULLEBUS Yvan <vanhu_bsd_(_at_)_zeninc_(_dot_)_net>
- Date: Thu, 26 Jun 2008 09:53:07 +0200
On Wed, Jun 25, 2008 at 07:13:59PM -0500, mgrooms wrote:
> To my knowledge, here are the latest patch sets ...
Yes: latest version of the patch will always be the file at that
location with the most recent date.
I have copies of repositories for HEAD, RELENG7 and RELENG6, and I can
generate more up-to date patches if needed.
I use patch for freebsd6 and freebsd7 in daily production, and can
quite quickly test new versions if needed.
I do NOT use directly the patch for HEAD actually, but should have a
testing device for that soon.
If some people have their own changes for those patches, please send
them to me !!!
What still lacks afaik in that patch:
- support for NAT-OA.
This is needed for transport mode when traffic is TCP (and when UDP
traffic have a non zero checksum), such support needs some stuff in
decapsulation process, complete support for NAT-OA payloads in PFKey,
and complete support in userland.
- Cleanup of PFKeyV2.
Actually, NAT-T ports are not sent in a RFC compliant way (but it
That cleanup needs also to be done in userland, and is on my TODO list
(both kernel and userland).
- Better detection of NAT-T support.
Actually, ipsec-tools guess kernel support for NAT-T by checking some
stuff in /usr/include.
That just means you appliend the NAT-T patch, but that doesn't means
you enabled NAT-T support in your kernel.
Same problem exists for other implementations (at least Linux 2.6+ and
NetBSD), a cleaner detection should also do "some checks" at runtime
to ensure actual kernel really supports NAT-T.
But that's an userland problem, and you can easilly force ipsec-tools
compilation WITHOUT NAT-T support.
freebsd-net_(_at_)_freebsd_(_dot_)_org mailing list
To unsubscribe, send any mail to "freebsd-net-unsubscribe_(_at_)_freebsd_(_dot_)_org"