(usagi-users 03132) Re: [Ipsec-tools-devel] How to send additional data from kernel to racoon?

[Aidas Kasparas <a.kasparas@xxxxxx>]

Park Lee wrote:
>  >Then, I would:
>  > - add field for colorcoding into SA datastructure;
>  > - extend SA selection algorithm to include check for color code;
>  > - if kernel will not find appropriate SA, it will send ACQUIRE
>  > message, which has to be extended with required colorcode ant other
>  > info you need (most likely by adding KMPRIVATE extension);
>  
> But, In  Appendix C: Key Management Private Data Extension(RFC2367), It 
> says: The Key Management Private Data extension is attached to either an 
> SADB_ADD or SADB_UPDATE message. It attaches a single piece of arbitrary 
> data to a security association....
>  
> Then, Would you please tell me Can KMPRIVATE extension also be attached 
> to SADB_ACQUIRE message?  
>  

Technically, yes, it can be attached. Extensions are constructed the 
way, that even unknown extension can be skipped over and dealt with only 
those, what are known to application. On the other hand, both, kernel 
and racoon "normalizes" packet first, and only then takes required 
information from normalized packet.

Politically... politically maybe you'd better invent extension 
specifically for your application (as there are others invented for 
NAT-T, etc; see /usr/include/linux/pfkeyv2.h SADB_EXT* SADB_X_EXT* 
definitions) document and implement it. Then you'll be free to define 
which messages it can be attached.

--
Aidas Kasparas
IT administrator
GM Consult Group, UAB