From owner-freebsd-stable Fri Jan 31 13:54:23 2003 Delivered-To: freebsd-stable@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 6854837B401 for ; Fri, 31 Jan 2003 13:54:21 -0800 (PST) Received: from sep.oldach.net (sep.oldach.net [194.180.25.6]) by mx1.FreeBSD.org (Postfix) with ESMTP id DCE2E43F43 for ; Fri, 31 Jan 2003 13:54:19 -0800 (PST) (envelope-from hmo@sep.oldach.net) Received: from sep.oldach.net (localhost [127.0.0.1]) by sep.oldach.net (8.12.6/8.12.6/hmo29jun02) with ESMTP id h0VLs2P9030638 (version=TLSv1/SSLv3 cipher=EDH-DSS-DES-CBC3-SHA bits=168 verify=NO); Fri, 31 Jan 2003 22:54:03 +0100 (CET) (envelope-from hmo@sep.oldach.net) Received: (from hmo@localhost) by sep.oldach.net (8.12.6/8.12.6/Submit) id h0VLrs0Y030635; Fri, 31 Jan 2003 22:53:54 +0100 (CET) (envelope-from hmo) Message-Id: <200301312153.h0VLrs0Y030635@sep.oldach.net> Subject: Re: HEADS UP: fast ipsec committed In-Reply-To: <174301c2c36b$00f68c70$52557f42@errno.com> from Sam Leffler at "Jan 23, 2003 9:39:45 pm" To: sam@errno.com (Sam Leffler) Date: Fri, 31 Jan 2003 22:53:53 +0100 (CET) Cc: freebsd-stable@freebsd.org From: Helge Oldach X-Message-Flag: No HTML mail please MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Sam Leffler: > I just commited my "Fast IPsec" support. This is an implementation of the > IPsec protocols that makes use of the kernel crypto framework. > [...] > > There should be minimal user-visible differences from the KAME IPsec code. > In particular you should be able to use racoon, setkey, isakmpd, or whatever > as with KAME. I had problems with racoon. My previous buildworld and kernel was of January 19th while today's build (January 31st) effectively disabled racoon. After tracing around a bit it seemed that racoon had problems to parse its configuration file and some tokens were tracked down to the wrong constants. I am using hmac_md5 authentication and racoon was complaining "algorithm 1 not supported". Yes - "1" instead of a string with the algorithm name. It turned out that this (abridged) change was the culprit: diff -r /usr/include/net/pfkeyv2.h /mnt/usr/include/net/pfkeyv2.h 1c1 < /* $FreeBSD: src/sys/net/pfkeyv2.h,v 1.4.2.4 2003/01/24 05:11:33 sam Exp $ */ --- > /* $FreeBSD: src/sys/net/pfkeyv2.h,v 1.4.2.3 2001/10/24 19:49:13 ume Exp $ */ 303,305c303,305 < #define SADB_AALG_MD5HMAC 2 < #define SADB_AALG_SHA1HMAC 3 < #define SADB_AALG_MAX 251 --- > #define SADB_AALG_MD5HMAC 1 /*2*/ > #define SADB_AALG_SHA1HMAC 2 /*3*/ > #define SADB_AALG_MAX 8 Reinstalling racoon instantly fixed the issue. Probably other ISAKMP daemons (e.g. isakmpd) are affected as well. Note that quite a number of other constants were redefined by this change, not just the ones mentioned in the diff excerpt above. Regards, Helge To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message