Subject: [Ipsec] How to send additional data from kernel to racoon?

From: Park Lee <[email-masked]>
Date: Sat, 20 Nov 2004 09:18:39 -0800 (PST)

Hi,
   I'm using racoon of IPsec-Tools to automately set up SA for native IPsec in Linux kernel 2.6.
    Now, I'm doing some research on IPsec. Here in kernel space, I've acquired some data (These data have nothing with the original IPsec, It's merely some data I got in the kernel space). What I want to do is to send these data from kernel to racoon before racoon begins its negotiation. and thus when racoon begins the negotiation, it can also send these data to its peer when setting up a SA (i.e. when racoon finish its work, these data should also be included in the SA on both sides for later use). 
  I've looked through the RFC2367 (PF_KEY Key Management API, Version 2), But it seems that the messages, such as SADB_ACQUIRE, are unsuitable to carry my data from kernel to racoon. How to acheive this? Could you please give me some hints?   
 
Thank you.

--
Best Regards,
Park Lee <[email-masked]> 

---------------------------------
Do you Yahoo!?
 Meet the all-new My Yahoo! – Try it today! 

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Dan McDonald <[email-masked]>
Date: Sat, 20 Nov 2004 18:29:12 -0500

Ahhh, here's the original...

On Sat, Nov 20, 2004 at 09:18:39AM -0800, Park Lee wrote:
> Hi,
>    I'm using racoon of IPsec-Tools to automately set up SA for native IPsec
>    in Linux kernel 2.6.  Now, I'm doing some research on IPsec. Here in
>    kernel space, I've acquired some data (These data have nothing with the
>    original IPsec, It's merely some data I got in the kernel space). What I
>    want to do is to send these data from kernel to racoon before racoon
>    begins its negotiation. and thus when racoon begins the negotiation, it
>    can also send these data to its peer when setting up a SA (i.e. when
>    racoon finish its work, these data should also be included in the SA on
>    both sides for later use).  > I've looked through the RFC2367 (PF_KEY
>    Key Management API, Version 2), But it seems that the messages, such as
>    SADB_ACQUIRE, are unsuitable to carry my data from kernel to racoon. How
>    to acheive this? Could you please give me some hints?

... but what sort of data is this?  Obviously it's something to be shared on
the wire during a negotiation, so you may wish to augment the ACQUIRE message
with an sadb_x_<foo>_t extension of some sort.

Dan