Re: FreeBSD NAT-T patch integration

[VANHULLEBUS Yvan <vanhu_bsd_(_at_)_zeninc_(_dot_)_net>]

On Wed, Jun 25, 2008 at 07:13:59PM -0500, mgrooms wrote:
[...]
> To my knowledge, here are the latest patch sets  ...
> 
> http://vanhu.free.fr/FreeBSD/patch-natt-freebsd6-2007-05-31.diff
> http://vanhu.free.fr/FreeBSD/patch-natt-freebsd7-2008-03-11.diff
> http://vanhu.free.fr/FreeBSD/patch-natt-freebsd-HEAD-2008-03-19.diff

Yes: latest version of the patch will always be the file at that
location with the most recent date.


I have copies of repositories for HEAD, RELENG7 and RELENG6, and I can
generate more up-to date patches if needed.


I use patch for freebsd6 and freebsd7 in daily production, and can
quite quickly test new versions if needed.

I do NOT use directly the patch for HEAD actually, but should have a
testing device for that soon.


If some people have their own changes for those patches, please send
them to me !!!


What still lacks afaik in that patch:

- support for NAT-OA.
This is needed for transport mode when traffic is TCP (and when UDP
traffic have a non zero checksum), such support needs some stuff in
decapsulation process, complete support for NAT-OA payloads in PFKey,
and complete support in userland.

- Cleanup of PFKeyV2.
Actually, NAT-T ports are not sent in a RFC compliant way (but it
works).
That cleanup needs also to be done in userland, and is on my TODO list
(both kernel and userland).

- Better detection of NAT-T support.
Actually, ipsec-tools guess kernel support for NAT-T by checking some
stuff in /usr/include.
That just means you appliend the NAT-T patch, but that doesn't means
you enabled NAT-T support in your kernel.
Same problem exists for other implementations (at least Linux 2.6+ and
NetBSD), a cleaner detection should also do "some checks" at runtime
to ensure actual kernel really supports NAT-T.
But that's an userland problem, and you can easilly force ipsec-tools
compilation WITHOUT NAT-T support.





Yvan.

-- 
NETASQ
http://www.netasq.com
_______________________________________________
freebsd-net_(_at_)_freebsd_(_dot_)_org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscribe_(_at_)_freebsd_(_dot_)_org"