(usagi-users 03127) Re: [Ipsec-tools-devel] Issues on calling racoon in Linux kernel 2.6

[Aidas Kasparas <a.kasparas@xxxxxx>]

Park Lee wrote:
>     Then, Where is the code in the source code of Linux kernel 2.6 to 
> call racoon? When kernel calls racoon, can it transfer some additional 
> attributes to racoon (so that racoon can finally setup a IPsec SA with 
> these additional attributes) ?
>  

The code is at net/key/af_key.c . It implements PF_KEY protocol. 
Requests to establish a SA are sent to every program, which have open 
PF_KEY socket and requested to receive such requests. Basis for PF_KEY 
protocol is documented in RFC 2367, but linux kernel and racoon 
implement extended version of that spec (I don't know better 
documentation for extensions than source).

Taking your previous messages into account I would like to point you 
that even RFC version has "Sensitivity Extension" (see 2.3.6). Both 
kernel and racoon knows about this structure, but do not use it AFAIK.

If this is not suits your needs, kernel has KMPRIVATE extension, which 
can be used for whatever. I'm not aware about rules how to use and how 
not to use it.


--
Aidas Kasparas
IT administrator
GM Consult Group, UAB