Date: Fri, 31 Jan 2003 13:56:33 -0800 From: "Sam Leffler" <sam@errno.com> To: "Helge Oldach" <stable31jan03@oldach.net> Cc: <freebsd-stable@freebsd.org> Subject: Re: HEADS UP: fast ipsec committed Message-ID: <100c01c2c973$9e7decf0$52557f42@errno.com> References: <200301312153.h0VLrs0Y030635@sep.oldach.net>
next in thread | previous in thread | raw e-mail | index | archive | help
> Sam Leffler:
> > I just commited my "Fast IPsec" support. This is an implementation of
the
> > IPsec protocols that makes use of the kernel crypto framework.
> >
> [...]
> >
> > There should be minimal user-visible differences from the KAME IPsec
code.
> > In particular you should be able to use racoon, setkey, isakmpd, or
whatever
> > as with KAME.
>
> I had problems with racoon. My previous buildworld and kernel was of
> January 19th while today's build (January 31st) effectively disabled
> racoon. After tracing around a bit it seemed that racoon had problems
> to parse its configuration file and some tokens were tracked down to
> the wrong constants. I am using hmac_md5 authentication and racoon was
> complaining "algorithm 1 not supported". Yes - "1" instead of a string
> with the algorithm name.
>
> It turned out that this (abridged) change was the culprit:
>
> diff -r /usr/include/net/pfkeyv2.h /mnt/usr/include/net/pfkeyv2.h
> 1c1
> < /* $FreeBSD: src/sys/net/pfkeyv2.h,v 1.4.2.4 2003/01/24 05:11:33 sam Exp
$ */
> ---
> > /* $FreeBSD: src/sys/net/pfkeyv2.h,v 1.4.2.3 2001/10/24 19:49:13 ume Exp
$ */
> 303,305c303,305
> < #define SADB_AALG_MD5HMAC 2
> < #define SADB_AALG_SHA1HMAC 3
> < #define SADB_AALG_MAX 251
> ---
> > #define SADB_AALG_MD5HMAC 1 /*2*/
> > #define SADB_AALG_SHA1HMAC 2 /*3*/
> > #define SADB_AALG_MAX 8
>
> Reinstalling racoon instantly fixed the issue. Probably other ISAKMP
> daemons (e.g. isakmpd) are affected as well.
>
> Note that quite a number of other constants were redefined by this
> change, not just the ones mentioned in the diff excerpt above.
Yes, I missed this in my commit. I should revert pfkeyv2.h's constants to
maintain binary compatibility. Unfortunately this will require another
rebuild of racoon. Sorry.
Sam
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?100c01c2c973$9e7decf0$52557f42>