RE: pfkeyv2 : proto feild in address extension

Well,

from what I recall from the mailinglist, only the latest version of Andreas's patch correctly using port and protocol granularity. This is not the patch we used to support x.509 certs for IPv6.
To implement this, the patch also changes files of KLIPS and PF_KEY. This changes we will not include as the KLIPS version we have in our IPv6 enabled FreeS/WAN is still based on 1.91. For X.509 support we did only change the Pluto daemon.

Hope this helps,

	Gerhard

--------------------------------------------
Gerhard Geßler

Communication Networks, IABG mbH
Einsteinstr. 20
85521 Ottobrunn, Germany

Telefon: +49 89 6088 - 2021
Fax: +49 89 6088 - 2845

E-Mail: [email protected] 

  > -----Original Message-----
  > From: Kaustubh Kumbhalkar 
  > [mailto:[email protected]] 
  > Sent: Tuesday, February 18, 2003 6:41 AM
  > To: Gessler Gerhard
  > Cc: [email protected]
  > Subject: RE: [Design] pfkeyv2 : proto feild in address extension
  > 
  > 
  > 
  > hi
  > the protocol and proto level granularity has been provided 
  > by andreas
  > steffen in his x.509 patch , which was the one used by iabg 
  > for its new
  > release of ipsec6 with certificate support ( i suppose ). 
  > then weren't
  > these functionalities included .
  > 
  > thanks and regards.
  > 
  > 
  > ------------------------------------------------------------
  > ---------------------------------------------
  > 
  > The greatest pleasure in life is doing
  > what people say you cannot do.
  > ~ Walter Bagehot ~
  > 
  > 
  >                                                             
  >                                                             
  >                
  >                       "Gessler Gerhard"                     
  >                                                             
  >                
  >                       <[email protected]>        To:       
  > <[email protected]>, 
  > <[email protected]>            
  >                                                cc:          
  >                                                             
  >                
  >                       07/02/2003 07:11         Subject:  
  > RE: [Design] pfkeyv2 : proto feild in address extension     
  >                   
  >                       PM                                    
  >                                                             
  >                
  >                                                             
  >                                                             
  >                
  >                                                             
  >                                                             
  >                
  > 
  > 
  > 
  > 
  > Hi,
  > 
  > we (IABG) did not implement further pfkeyv2 code for 
  > handling port and
  > protocal as Pluto (the FreeS/WAN IKE-daemon) was not able 
  > to negotiate SAs
  > with that granularity at that time.
  > I think Pluto is still only able to do this with an 
  > additional patch, if my
  > memory serves.
  > 
  > Hope this helps,
  > 
  >              Gerhard
  > 
  > --------------------------------------------
  > Gerhard Geßler
  > 
  > Communication Networks, IABG mbH
  > Einsteinstr. 20
  > 85521 Ottobrunn, Germany
  > 
  > Telefon: +49 89 6088 - 2021
  > Fax: +49 89 6088 - 2845
  > 
  > E-Mail: [email protected]
  > 
  >   > -----Original Message-----
  >   > From: [email protected]
  >   > [mailto:[email protected]]
  >   > Sent: Friday, February 07, 2003 1:12 PM
  >   > To: [email protected]
  >   > Cc: Gessler Gerhard
  >   > Subject: [Design] pfkeyv2 : proto feild in address extension
  >   >
  >   >
  >   > hi
  >   > while trying to add protocol entry into the sadb from used
  >   > space i saw in
  >   > the pfkeyv2 code that the proto element within the address
  >   > extension has
  >   > not been used.The pf key v2  RFC also gives it  as a MUST
  >   > condition, that
  >   > the transport layer protocol should be given within the
  >   > proto feild of the
  >   > address extension.
  >   >
  >   > i wanted to know why proto field within the address
  >   > extension has not been
  >   > used by freeswan to implement protocol level granularity, i
  >   > havent tried
  >   > doing this myself yet, so i wanted to enquire if there are
  >   > some problems to
  >   > it.
  >   >
  >   > thanks and regards.
  >   >
  >   > _______________________________________________
  >   > Design mailing list
  >   > [email protected]
  >   > http://lists.freeswan.org/mailman/listinfo/design
  >   >
  > 
  > 
  > 
  > 
  >