From owner-freebsd-net@FreeBSD.ORG Thu Jul 17 20:21:42 2008 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 5B5A7106564A for ; Thu, 17 Jul 2008 20:21:42 +0000 (UTC) (envelope-from lab@gta.com) Received: from mailgate.gta.com (mailgate.gta.com [199.120.225.20]) by mx1.freebsd.org (Postfix) with SMTP id D75B58FC17 for ; Thu, 17 Jul 2008 20:21:41 +0000 (UTC) (envelope-from lab@gta.com) Received: (qmail 69891 invoked by uid 1000); 17 Jul 2008 20:21:41 -0000 Date: Thu, 17 Jul 2008 16:21:41 -0400 From: Larry Baird To: Sam Leffler Message-ID: <20080717202141.GA65940@gta.com> References: <20080630040103.94730.qmail@mailgate.gta.com> <486A45AB.2080609@freebsd.org> <487EC62A.3070301@freebsd.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <487EC62A.3070301@freebsd.org> User-Agent: Mutt/1.4.2.3i Cc: freebsd-net@freebsd.org, vanhu_bsd@zeninc.net Subject: Re: FreeBSD NAT-T patch integration [CFR/CFT] X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Jul 2008 20:21:42 -0000 Sam, > Please test/review the following patch against HEAD: > > http://people.freebsd.org/~sam/nat_t-20080616.patch > > This adds only the kernel portion of the NAT-T support; you must provide > the user-level code from another place. > > The main difference from the patches floating around are in the > ctloutput path (adding proper locking for HEAD) and decap of ESP-in-UDP > frames. Assuming folks are ok w/ these changes I'll commit to HEAD. > Once this stuff goes in we can look at getting the user-mode mods into > the tree. I should have time to begin to look at this tomorrow. I also have an additional patch that needs adding. In sys/netipsec/ipsec_mbuf.c the function m_makespace() has an assert/comment stating "code doesn't handle clusters". If using NAT-T with crypto acceleration you can hit this case. I'll email this patch to you within the next couple of days. Larry -- ------------------------------------------------------------------------ Larry Baird | http://www.gta.com Global Technology Associates, Inc. | Orlando, FL Email: lab@gta.com | TEL 407-380-0220, FAX 407-380-6080