Date: Thu, 26 Jun 2008 09:53:07 +0200 From: VANHULLEBUS Yvan <vanhu_bsd@zeninc.net> To: freebsd-net@freebsd.org Subject: Re: FreeBSD NAT-T patch integration Message-ID: <20080626075307.GA1401@zen.inc> In-Reply-To: <7ec5b81263bb9dc933d392a8efb26136@localhost> References: <48629DE0.5000407@elischer.org> <7ec5b81263bb9dc933d392a8efb26136@localhost>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Jun 25, 2008 at 07:13:59PM -0500, mgrooms wrote: [...] > To my knowledge, here are the latest patch sets ... > > http://vanhu.free.fr/FreeBSD/patch-natt-freebsd6-2007-05-31.diff > http://vanhu.free.fr/FreeBSD/patch-natt-freebsd7-2008-03-11.diff > http://vanhu.free.fr/FreeBSD/patch-natt-freebsd-HEAD-2008-03-19.diff Yes: latest version of the patch will always be the file at that location with the most recent date. I have copies of repositories for HEAD, RELENG7 and RELENG6, and I can generate more up-to date patches if needed. I use patch for freebsd6 and freebsd7 in daily production, and can quite quickly test new versions if needed. I do NOT use directly the patch for HEAD actually, but should have a testing device for that soon. If some people have their own changes for those patches, please send them to me !!! What still lacks afaik in that patch: - support for NAT-OA. This is needed for transport mode when traffic is TCP (and when UDP traffic have a non zero checksum), such support needs some stuff in decapsulation process, complete support for NAT-OA payloads in PFKey, and complete support in userland. - Cleanup of PFKeyV2. Actually, NAT-T ports are not sent in a RFC compliant way (but it works). That cleanup needs also to be done in userland, and is on my TODO list (both kernel and userland). - Better detection of NAT-T support. Actually, ipsec-tools guess kernel support for NAT-T by checking some stuff in /usr/include. That just means you appliend the NAT-T patch, but that doesn't means you enabled NAT-T support in your kernel. Same problem exists for other implementations (at least Linux 2.6+ and NetBSD), a cleaner detection should also do "some checks" at runtime to ensure actual kernel really supports NAT-T. But that's an userland problem, and you can easilly force ipsec-tools compilation WITHOUT NAT-T support. Yvan. -- NETASQ http://www.netasq.com
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20080626075307.GA1401>