(usagi-users 03135) Re: [Ipsec-tools-devel] How to send additional data from kernel to racoon?

[Park Lee <parklee_sel@xxxxxxxxx>]

On Sat, 20 Nov 2004 at 20:01, Aidas Kasparas wrote:

> Park, if you would tell us what's wrong with acquire it would be MUCH

> easier for us to suggest something sensible.

> I guess, you need separate IPSec SA for for every group of network

> objects with equal color code. Right?

 

Yes, that's what I want. Thanks.

 

>Then, I would:

> - add field for colorcoding into SA datastructure;
> - extend SA selection algorithm to include check for color code;
> - if kernel will not find appropriate SA, it will send ACQUIRE

> message, which has to be extended with required colorcode ant other

> info you need (most likely by adding KMPRIVATE extension);

 

But, In  Appendix C: Key Management Private Data Extension(RFC2367), It says: The Key Management Private Data extension is attached to either an SADB_ADD or SADB_UPDATE message. It attaches a single piece of arbitrary data to a security association....

 

Then, Would you please tell me Can KMPRIVATE extension also be attached to SADB_ACQUIRE message?  

 

> - extend racoon to understand that data and exchange it with peer.

> After successfull negotiation new SA will be added by racoon;

> - kernel will find that SA and use it for sending data to peer.
> If I'm answering the wrong question, please let us know what the

> question is.

Your answer is exactly what I want.

Thank you very much.

--
Best Regards,
Park Lee <parklee_sel@xxxxxxxxx>

 

---

Do you Yahoo!?
 
The all-new My Yahoo! ? Get yours free!