From owner-freebsd-stable Fri Jan 31 13:56:36 2003 Delivered-To: freebsd-stable@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D3C1E37B401 for ; Fri, 31 Jan 2003 13:56:34 -0800 (PST) Received: from ebb.errno.com (ebb.errno.com [66.127.85.87]) by mx1.FreeBSD.org (Postfix) with ESMTP id 4D67743F75 for ; Fri, 31 Jan 2003 13:56:34 -0800 (PST) (envelope-from sam@errno.com) Received: from melange (melange.errno.com [66.127.85.82]) (authenticated bits=0) by ebb.errno.com (8.12.5/8.12.1) with ESMTP id h0VLuXnN032576 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NO); Fri, 31 Jan 2003 13:56:33 -0800 (PST)?g (envelope-from sam@errno.com)œ X-Authentication-Warning: ebb.errno.com: Host melange.errno.com [66.127.85.82] claimed to be melange Message-ID: <100c01c2c973$9e7decf0$52557f42@errno.com> From: "Sam Leffler" To: "Helge Oldach" Cc: References: <200301312153.h0VLrs0Y030635@sep.oldach.net> Subject: Re: HEADS UP: fast ipsec committed Date: Fri, 31 Jan 2003 13:56:33 -0800 Organization: Errno Consulting MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4807.1700 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4807.1700 Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG > Sam Leffler: > > I just commited my "Fast IPsec" support. This is an implementation of the > > IPsec protocols that makes use of the kernel crypto framework. > > > [...] > > > > There should be minimal user-visible differences from the KAME IPsec code. > > In particular you should be able to use racoon, setkey, isakmpd, or whatever > > as with KAME. > > I had problems with racoon. My previous buildworld and kernel was of > January 19th while today's build (January 31st) effectively disabled > racoon. After tracing around a bit it seemed that racoon had problems > to parse its configuration file and some tokens were tracked down to > the wrong constants. I am using hmac_md5 authentication and racoon was > complaining "algorithm 1 not supported". Yes - "1" instead of a string > with the algorithm name. > > It turned out that this (abridged) change was the culprit: > > diff -r /usr/include/net/pfkeyv2.h /mnt/usr/include/net/pfkeyv2.h > 1c1 > < /* $FreeBSD: src/sys/net/pfkeyv2.h,v 1.4.2.4 2003/01/24 05:11:33 sam Exp $ */ > --- > > /* $FreeBSD: src/sys/net/pfkeyv2.h,v 1.4.2.3 2001/10/24 19:49:13 ume Exp $ */ > 303,305c303,305 > < #define SADB_AALG_MD5HMAC 2 > < #define SADB_AALG_SHA1HMAC 3 > < #define SADB_AALG_MAX 251 > --- > > #define SADB_AALG_MD5HMAC 1 /*2*/ > > #define SADB_AALG_SHA1HMAC 2 /*3*/ > > #define SADB_AALG_MAX 8 > > Reinstalling racoon instantly fixed the issue. Probably other ISAKMP > daemons (e.g. isakmpd) are affected as well. > > Note that quite a number of other constants were redefined by this > change, not just the ones mentioned in the diff excerpt above. Yes, I missed this in my commit. I should revert pfkeyv2.h's constants to maintain binary compatibility. Unfortunately this will require another rebuild of racoon. Sorry. Sam To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message