Subject: [Ipsec] Re: [Ipsec-tools-devel] How to send additional data from kernel to racoon?

From: Park Lee <[email-masked]>
Date: Sat, 20 Nov 2004 10:32:44 -0800 (PST)

On Sat, 20 Nov 2004 at 20:01, Aidas Kasparas wrote:
> Park, if you would tell us what's wrong with acquire it would be MUCH 
> easier for us to suggest something sensible.
> I guess, you need separate IPSec SA for for every group of network 
> objects with equal color code. Right? 
 
Yes, that's what I want. Thanks.
 
>Then, I would:
> - add field for colorcoding into SA datastructure;
> - extend SA selection algorithm to include check for color code;
> - if kernel will not find appropriate SA, it will send ACQUIRE 
> message, which has to be extended with required colorcode ant other 
> info you need (most likely by adding KMPRIVATE extension);
 
But, In  Appendix C: Key Management Private Data Extension(RFC2367), It says: The Key Management Private Data extension is attached to either an SADB_ADD or SADB_UPDATE message. It attaches a single piece of arbitrary data to a security association....
 
Then, Would you please tell me Can KMPRIVATE extension also be attached to SADB_ACQUIRE message?  
 
> - extend racoon to understand that data and exchange it with peer. 
> After successfull negotiation new SA will be added by racoon;
> - kernel will find that SA and use it for sending data to peer.
> If I'm answering the wrong question, please let us know what the 
> question is.

Your answer is exactly what I want.
Thank you very much.

--
Best Regards,
Park Lee <[email-masked]> 

---------------------------------
Do you Yahoo!?
 The all-new My Yahoo! – Get yours free!    

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Park Lee <[email-masked]>
Date: Tue, 23 Nov 2004 06:11:15 -0800 (PST)

On Tue, 23 Nov 2004 at 12:13, Michal Ludvig wrote:
> I haven't closely followed the thread but ... how about moving from 
> PF_KEY to NetLink in IPsec-tools on Linux? NetLink messages are 
> more versatile I think and could better suit Park's requirements. But 
> it's just my feeling, 
> I don't know too much about NetLink either ;-)
 
Thank you.
Now, I still want to add a new extension in PF_KEY (RFC2367) in Linux 2.6. But I wouldn't find any useful information about how to do it on web.  
Would you please give me some hints on how to define a new extension in PF_KEY (RFC2367) in Linux 2.6 and How to attach it to a message (such as SADB_ACQUIRE message)?