Date: Thu, 6 Oct 2016 15:34:04 +0300 From: "Andrey V. Elsukov" <ae@FreeBSD.org> To: Rafa Marin Lopez <rafa@um.es>, freebsd-net@freebsd.org Cc: Gabriel Lopez <gabilm@um.es> Subject: Re: IPsec implementation key_spdacquire Message-ID: <53a3073d-2098-76fb-2d1d-d144397fa6f2@FreeBSD.org> In-Reply-To: <E94ABEFA-1B47-47B2-999C-6E26DE358CE5@um.es> References: <E94ABEFA-1B47-47B2-999C-6E26DE358CE5@um.es>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--w3Oq431gXSV8htaIXOujUBKUrJvakL9Hi
Content-Type: multipart/mixed; boundary="rEpBDI09EC5ccQV5u7DeuKkpGTedrNVhr";
protected-headers="v1"
From: "Andrey V. Elsukov" <ae@FreeBSD.org>
To: Rafa Marin Lopez <rafa@um.es>, freebsd-net@freebsd.org
Cc: Gabriel Lopez <gabilm@um.es>
Message-ID: <53a3073d-2098-76fb-2d1d-d144397fa6f2@FreeBSD.org>
Subject: Re: IPsec implementation key_spdacquire
References: <E94ABEFA-1B47-47B2-999C-6E26DE358CE5@um.es>
In-Reply-To: <E94ABEFA-1B47-47B2-999C-6E26DE358CE5@um.es>
--rEpBDI09EC5ccQV5u7DeuKkpGTedrNVhr
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
On 06.10.2016 14:01, Rafa Marin Lopez wrote:
> In the file key.c in netipsec there is a function:
>=20
> key_spdacquire(struct secpolicy *sp)
>=20
> which is implemented but in the table:
>=20
>=20
> static int (*key_typesw[])(struct socket *, struct mbuf *, const
> struct sadb_msghdr *) =3D { ...
>=20
> NULL, /* SADB_X_SPDACQUIRE */
>=20
>=20
> Does it mean it is not usable?
>=20
> We are interested because we are dealing with handling IPsec by using
> SDN paradigm
> (https://tools.ietf.org/html/draft-abad-i2nsf-sdn-ipsec-flow-protection=
-00)
> and we would need an event when a IP packet needs a policy to be
> configured for an outbound packet.
Hi,
Yes, it isn't usable.
In my understanding SADB_X_SPDACQUIRE should be used in conjunction with
SADB_X_SPDSETIDX and SADB_X_SPDUPDATE in the similar way like currently
SADB_GETSPI+SADB_ACQUIRE+SADB_UPDATE works.
Currently I have done a heavy redesign of SADB/SPDB and also just
removed SADB_X_SPDSETIDX and SADB_X_SPDACQUIRE support, since
1) it is unused;
2) I failed to find IKEd that supports it;
3) there is no code in the IPsec that assumes such usage.
My work is still in progress, currently we are doing testing. But if you
have software that will use this, I will think how to implement it.
--=20
WBR, Andrey V. Elsukov
--rEpBDI09EC5ccQV5u7DeuKkpGTedrNVhr--
--w3Oq431gXSV8htaIXOujUBKUrJvakL9Hi
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQEsBAEBCAAWBQJX9kS8DxxhZUBmcmVlYnNkLm9yZwAKCRABxeoEEMihevkyCACE
nKUd6UPQDE29RcnwShT4jMT4HiAbQvTnp7o2ZVQti50xuBePicy/2bzl329YeQKR
aijfKio6RG9S3OgE5nl5VFP9+72LmD4Sw6EO2DRiLATs3hMSL9cA3u+6m7l07Iz+
xqx1q5759dumpTWVAsEY/0ECSVV+0e6UtwGj3nzf6Z1DJaDFyvCIv6EbeVvaBix7
ivzn7n+jirldSiXBhU3O6WFYppizHhVTEU1mlwNxiY6MB63nRy8BzqHFOid9J9fY
ciD9ZYCidNmY8Qzvn0BfxC4fcVSBdxnbzcEhdAG4w+8qTL1PQioshRmHSGFfsdQk
lCrdsHv5FNdUnLweBAEt
=I6yH
-----END PGP SIGNATURE-----
--w3Oq431gXSV8htaIXOujUBKUrJvakL9Hi--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?53a3073d-2098-76fb-2d1d-d144397fa6f2>