(review request) ipfw and ipsec processing order for outgoing packets

From: Joost Bekkers (joost_at_jodocus.org)
Date: 11/29/04

  • Next message: Andre Oppermann: "Re: (review request) ipfw and ipsec processing order for outgoingpackets" 
    Date: Mon, 29 Nov 2004 11:09:49 +0100
To: freebsd-net@freebsd.org

    Hi

    A while ago there was a discussion about passing packet through pfil before
    they are processed by ipsec. I've posted a rough patch back then and I've
    finally had time to polish it.

    Although the changes seem very invasive at first glance, the .o files created
    are identical as long as IPSEC_FILTERGIF is not defined. With FAST_IPSEC diff(1)
    will tell you otherwise, but that is due to changed linenumbers which are used
    as arguments in two places. I've checked for differences by disassembling (objdump -d)
    the .o files.

    The attached patch is against 5.3R

    I'm running it myself with FAST_IPSEC. The combination of this patch and the kame
    ipsec could do with some more testing. 

    -- 
greetz Joost
joost@jodocus.org

    _______________________________________________
    freebsd-net@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-net
    To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"

  • Next message: Andre Oppermann: "Re: (review request) ipfw and ipsec processing order for outgoingpackets"

    Relevant Pages

    • Re: FreeBSD NAT-T patch integration
      ... committing things to security tools without very careful audit. ... IPsec and NAT-T code is doing and what it is required to do can do the ... I asked what the state of the review and testing process was and, in the opinion of my betters, if the patch could kindly be applied. ...
      (freebsd-net)
    • NAT Traversal Patches ...
      ... I understand that FreeBSD is a volunteer project, ... have any information regarding the status of the IPsec NAT Traversal ... patches and their inclusion with FeeBSD? ... But the most recent patch set also offers support for ...
      (freebsd-net)
    • Re: FAST_IPSEC and NAT-T
      ... When installing the ipsec-tools it says if you want NAT-T you need to install this patch, ... Can any one tell me if this patch works with Fast_ipsec or is it just for the other ipsec? ... Also I just tried to compile a kernel with that Nat-T patch on the other IPSEC kernel on 6.1-release and it failed. ...
      (freebsd-net)
    • Re: IPCOMP on IPSEC
      ... I also proposed a patch for IPSEC (with IPCOMP) to work ... > I configured a tunnel between two FreeBSD machines with IPSEC, ...
      (freebsd-net)
    • RFC: Latest FAST_IPSEC + IPv6 patch
      ... patch that removes Kame IPsec and adds support for IPv6 to ... I have produced a patch which applies and compiles here: ... The TAHI test suite has 180 or so tests for IPsec on IPv6 and ...
      (freebsd-net)