On Tue, Feb 17, 2009 at 02:48:06PM +0200, Riaan Kruger wrote: > I see a lot of good work done on the nat-t patches for FreeBSD and > ipsec-tools.
That's what we're trying to do, even if we know that there is still some work to do ! > I was wondering if the base setkey is due for an update? > If so is anyone looking to update it? Upgrading FreeBSD's setkey is not a new question.... Basically, there are various scenarios: - keep it (almost) without changes, it is enouth for basic (static) IPsec, and people who want to do dynamic keying, NAT-T, etc... will install ipsec-tools, so will have /usr/local/sbin/setkey. - same as upper, but do "something" to solve the problem when both /sbin/setkey and /usr/local/sbin/setkey (same for libipsec) are installed. - just remove setkey/libipsec from base system. People who want "real IPsec" will need ipsec-tools or something else, but we can't ensure no one will just need setkey/libipsec... - sync FreeBSD's setkey/libipsec from ipsec-tools. That won't solve all issues (/sbin Vs /usr/local/sbin), and this will need regular syncs with ipsec-tools. - Same as upper, but remove sources from /usr/src, consider ipsec-tools as a contrib (in /usr/src/contrib) and do "something" to automagically update sources when needed (as in /usr/ports). All those solutions solve some parts of the problems (except the first one, of course), but keeps/generates some others.... If someone has a magic solution without drawbacks, please tell us ! > Has anyone had any success using the patched FreeBSD along with racoon2. I just don't know what's the actual status of racoon2, but nat-t patchset is public and everyone can send changes if that helps interaction with other daemons (without breaking again the API if possible.....). Yvan. _______________________________________________ freebsd-net@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"
