Subject: [Ipsec] Issues on calling racoon in Linux kernel 2.6

From: Park Lee <[email-masked]>
Date: Thu, 18 Nov 2004 08:46:00 -0800 (PST)

Hi,
    I'm now learning native IPsec in Linux kernel 2.6, I use IPsec-Tools as the user-space tools for it.
    We know that racoon in IPsec-Tools is able to setup automatically keyed IPsec connections. In order to use automatically keyed IPsec connection, we need to define security policies without the appropiate security associations. Whenever the Linux kernel needs to protect a packet according to the security policies and when no security association is available, the Linux kernel calls racoon and asks for
the required security associations. 
    Then, Where is the code in the source code of Linux kernel 2.6 to call racoon? When kernel calls racoon, can it transfer some additional attributes to racoon (so that racoon can finally setup a IPsec SA with these additional attributes) ?
 
Thanks,

--
Best Regards,
Park Lee <[email-masked]> 

---------------------------------
Do you Yahoo!?
 Discover all that’s new in My Yahoo!

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Park Lee <[email-masked]>
Date: Thu, 25 Nov 2004 06:49:50 -0800 (PST)

On Fri, 19 Nov 2004 at 08:52, Aidas Kasparas wrote:
>
> Park Lee wrote:
> >    Then, Where is the code in the source code of Linux kernel 2.6 
> > to call racoon?
> > ......
> 
> The code is at net/key/af_key.c . It implements PF_KEY protocol. 
> Requests to establish a SA are sent to every program, which have 
> open PF_KEY socket and requested to receive such requests. Basis 
> for PF_KEY protocol is documented in RFC 2367, but linux kernel 
> and racoon implement extended version of that spec (I don't know 
> better documentation for extensions than source).
 
   In net/key/af_key.c, there is a function pfkey_send_acquire(). I think this function is used by kernel to send the PF_KEY SADB_ACQUIRE message to racoon. But, It seems that in kernel source there is no other functions who call this one. 
    Then, How is pfkey_send_acquire() used by kernel? and Eventually How is  the SADB_ACQUIRE message sent by kernel in IPv4 when no security associations currently exist for IPsec to use? Is it begins in the xfrm_find_bundle() function which is called by xfrm_lookup() function (in net/xfrm/xfrm_policy.c)? 
 
Thank you.

		
---------------------------------
Do you Yahoo!?
 Meet the all-new My Yahoo! – Try it today!