From owner-freebsd-net@FreeBSD.ORG Fri Jun 16 15:35:36 2006
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
X-Original-To: net@freebsd.org
Delivered-To: freebsd-net@FreeBSD.ORG
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
by hub.freebsd.org (Postfix) with ESMTP id 3A79D16A47D;
Fri, 16 Jun 2006 15:35:36 +0000 (UTC)
(envelope-from max@love2party.net)
Received: from moutng.kundenserver.de (moutng.kundenserver.de
[212.227.126.188])
by mx1.FreeBSD.org (Postfix) with ESMTP id 87ED243D45;
Fri, 16 Jun 2006 15:35:35 +0000 (GMT)
(envelope-from max@love2party.net)
Received: from [88.64.178.14] (helo=amd64.laiers.local)
by mrelayeu.kundenserver.de (node=mrelayeu0) with ESMTP (Nemesis),
id 0MKwh2-1FrGMA331i-0000Cf; Fri, 16 Jun 2006 17:35:34 +0200
From: Max Laier <max@love2party.net>
Organization: FreeBSD
To: freebsd-net@freebsd.org
Date: Fri, 16 Jun 2006 17:35:27 +0200
User-Agent: KMail/1.9.1
References: <20060615225312.GB64552@heff.fud.org.nz>
In-Reply-To: <20060615225312.GB64552@heff.fud.org.nz>
X-Face: ,,8R(x[kmU]tKN@>gtH1yQE4aslGd<hB5S>u+2];
R]*pL,U>^H?)gW@49@wdJ`H<=?utf-8?q?=25=7D*=5FBD=0A=09U=5For=3D=5CmOZf764=26nYj=3DJYbR1PW0ud?=>|!~,,CPC.1-D$FG@0h3#'5"k{V]a~.<=?utf-8?q?mZ=7D44=23Se=7Em=0A=09Fe=7E=5C=5DX5B=5D=5Fxj?=(ykz9QKMw_l0C2AQ]}Ym8)fU
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="nextPart2154621.EIZNAYH37s";
protocol="application/pgp-signature"; micalg=pgp-sha1
Content-Transfer-Encoding: 7bit
Message-Id: <200606161735.33801.max@love2party.net>
X-Provags-ID: kundenserver.de abuse@kundenserver.de
login:61c499deaeeba3ba5be80f48ecc83056
Cc: arch@freebsd.org, Andrew Thompson <thompsa@freebsd.org>, net@freebsd.org
Subject: Re: enc0 patch for ipsec
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 16 Jun 2006 15:35:36 -0000
--nextPart2154621.EIZNAYH37s
Content-Type: text/plain;
charset="iso-8859-6"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
On Friday 16 June 2006 00:53, Andrew Thompson wrote:
> I have a patch attached that implements the much requested feature of
> packet filtering ipsec connections.
>
> This is a device to expose packets going in/out of ipsec and comes
> from OpenBSD. There are two functions, a bpf tap which has a basic
> header with the SPI number which our current tcpdump knows how to
> display, and handoff to pfil(9) for packet filtering.
>
> They way I have hooked it in is compiling it in with fast_ipsec and
> the extra work is only done when the enc0 interface is created. The
> interface is not created by default so its a minimal hit, the user
> will need to 'ifconfig enc0 create' in order to activate it. I
> believe the locking is correct so it can be created and destroyed at
> runtime.
I think it should get a "device enc" on its own. Some people might conside=
r=20
enc(4) to be a security problem so getting it with FAST_IPSEC automatically=
=20
isn't preferable.
Other than that, great news. Thanks a lot.
> PRs 98219 and 94829 are requesting this feature.
>
>
>
> Andrew
=2D-=20
/"\ Best regards, | mlaier@freebsd.org
\ / Max Laier | ICQ #67774661
X http://pf4freebsd.love2party.net/ | mlaier@EFnet
/ \ ASCII Ribbon Campaign | Against HTML Mail and News
--nextPart2154621.EIZNAYH37s
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (FreeBSD)
iD8DBQBEks/FXyyEoT62BG0RAtKgAJ4tmOL2iMvLf7KaAmyUB23gT0gAPgCaAyv9
JCyNxxVv06CA/LSaRXMX2d0=
=Mtlo
-----END PGP SIGNATURE-----
--nextPart2154621.EIZNAYH37s--