From owner-freebsd-jail@freebsd.org  Wed Nov 29 11:40:16 2017
Return-Path: <owner-freebsd-jail@freebsd.org>
Delivered-To: freebsd-jail@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id E4BB8E4FB32
 for <freebsd-jail@mailman.ysv.freebsd.org>;
 Wed, 29 Nov 2017 11:40:16 +0000 (UTC)
 (envelope-from srs0=oboh=c3=sigsegv.be=kristof@codepro.be)
Received: from venus.codepro.be (venus.codepro.be [IPv6:2a01:4f8:162:1127::2])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256
 bits))
 (Client CN "*.codepro.be", Issuer "Gandi Standard SSL CA 2" (verified OK))
 by mx1.freebsd.org (Postfix) with ESMTPS id AEF6A70592
 for <freebsd-jail@FreeBSD.org>; Wed, 29 Nov 2017 11:40:16 +0000 (UTC)
 (envelope-from srs0=oboh=c3=sigsegv.be=kristof@codepro.be)
Received: from [172.16.5.2] (vega.codepro.be [IPv6:2a01:4f8:162:1127::3])
 (Authenticated sender: kp)
 by venus.codepro.be (Postfix) with ESMTPSA id D667F3398E;
 Wed, 29 Nov 2017 12:40:13 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sigsegv.be; s=mail;
 t=1511955613; bh=+PPXCSc6zg5XiDFe5rz/yG92uV+f6tj1YAUoVwEbKAE=;
 h=From:To:Cc:Subject:Date:In-Reply-To:References;
 b=MobAgx8BUCR3hEVJUzPeJlefF9ea6uSQGchqVCFp6uiOaUTHr2eeiNdBj07Wy3ntE
 zxwQehPmD/tU5Rs7WgVH5h/K9yh47tlDZpgEx/BYDipcEAbOatt+A2NeyNy6cEZfYf
 IKxOms8qNV81iYVnhlYYj4gmqvBQD0i5vNuk6HOM=
From: "Kristof Provost" <kristof@sigsegv.be>
To: "Matthias Meyser" <matthias@harz.de>
Cc: freebsd-jail@FreeBSD.org
Subject: Re: IPSEC in VNET Jails
Date: Wed, 29 Nov 2017 12:40:22 +0100
X-Mailer: MailMate (2.0BETAr6098)
Message-ID: <20A48018-1601-4AFC-95E5-AA9725E79E3D@sigsegv.be>
In-Reply-To: <f144fcea-b5c2-683e-c7ca-5a86bc45ffbc@harz.de>
References: <f144fcea-b5c2-683e-c7ca-5a86bc45ffbc@harz.de>
MIME-Version: 1.0
Content-Type: text/plain; format=flowed
X-BeenThere: freebsd-jail@freebsd.org
X-Mailman-Version: 2.1.25
Precedence: list
List-Id: "Discussion about FreeBSD jail\(8\)" <freebsd-jail.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-jail>,
 <mailto:freebsd-jail-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-jail/>
List-Post: <mailto:freebsd-jail@freebsd.org>
List-Help: <mailto:freebsd-jail-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-jail>,
 <mailto:freebsd-jail-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 29 Nov 2017 11:40:17 -0000

On 29 Nov 2017, at 12:16, Matthias Meyser wrote:
> Hi
>
> i use a IPSEC Tunnel inside a VNET jail without problems.
>
> Annoyingly /etc/rc.d/ipsec dos not run in VNET jails.
>
> This is fixed in head see
> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=211364
>
> This is NOT MFCed to stable/11 because the author isn't convinced that 
> VNET jails are "is sufficiently robust in stable/11 to encourage 
> people to use it"
>
> As this fix only makes a difference if you
>
> 1) Have compiled a Kernel WITH VIMAGE support
> 2) Setup and configured a VNET jail.
> 3) Setup IPSEC inside the VNET jail.
>
> i think this should be MFCed.
>
I stand by my initial assessment that VNET is not sufficiently stable in 
stable/11 to encourage its use there.
There are still issues with IPSec, even in head. See 
https://reviews.freebsd.org/D13017 for some more information on that.
Those issues are being addressed in head, but I do not expect VNET to 
ever become robust in 11.

Regards,
Kristof