freebsd security - Apr 2005 - Fwd: (KAME-snap 9012) racoon in the kame project

FYI, looks like support for Racoon is ending.  Does anyone have any 
experience with the version in ipsec-tools ?

         ---Mike

>Racoon users,
>
>This is the announcement that the kame project will quit providing
>a key management daemon, the racoon, and that "ipsec-tools" will
become
>the formal team to release the racoon.
>The final release of the racoon in the kame project will be on 4/25.
>
>Because there were some problem for users currently,
>         - I did not add new feature.
>         - I intent to fix security holes and apply patches.
>           however, it could not be enough done.
>         - I could not reply your questions, bug reports and
>           useful suggestions.
>I was sorry that it was not enough support for users.  I was thinking
>that I would not want to make trouble for users anymore.
>
>There is another racoon as known as "ipsec-tools" in the
sourceforge.
>It is being developed very actively, is stable than racoon and
>implemented radical feature.  But it is sometime trouble for users
>that double racoons are released.  It is also wasteful that development
>resource is devided.  I was thinking that two racoon could be merged.
>
>There was an oppotunity having a meeting with some of
"ipsec-tools"
>developers at the IETF 62th in Minneapolis.  I told my thought to
>the developers.  They willingly agreed with my proposal.
>
>They told me that they could become the formal support team.  So the kame
>project decided to quit providing, and supporting racoon.
>
>If you are interesting in the "ipsec-tools", please visit thier
web page,
>         http://ipsec-tools.sourceforge.net/
>and subscribe to the mailing list by yourself.
>         http://lists.sourceforge.net/lists/listinfo/ipsec-tools-devel
>
>Thank you up to now, and best regards,
>
>P.S.
>Some people interested in "racoon2".  It is still pre-alpha
version,
>not satisfied with users.  I will concentrate developping
"racoon2"
>to be stable.  It needs more than one year at least.
>
>//Shoichi Sakane
--------------------------------------------------------------------
Mike Tancsa,                                      tel +1 519 651 3400
Sentex Communications,                            mike@sentex.net
Providing Internet since 1994                    www.sentex.net
Cambridge, Ontario Canada                         www.sentex.net/mike

In article <6.2.1.2.0.20050421090724.04cc1668@64.7.153.2> you
wrote:
> FYI, looks like support for Racoon is ending.  Does anyone have any 
> experience with the version in ipsec-tools ?
I have been using it with FreeBSD 4.11.  The only issues I have ran
into is that some of its debug messages use %zu and %zd.  The %z
isn't know by 4.x libc and causes a core dump.  This issue is easily
fixed with sed.  Since 5.x know about %z, this should be a non-issue
for more current versions of FreeBSD.  

The ipsec-tools version has support for NAT-T if the kernel has
support.  There exist patches for use with the IPSEC option of 4.x
at ipsec-tools source forge site.  Yesterday I posted updated patches
to support FAST_IPSEC under 4.11.  I had made patches for 5.x but
accidently clobered them.  The port is very straight forward.

To save you some time looking for them, The FreeBSD kernel patches
can be found here:
http://cvs.sourceforge.net/viewcvs.py/ipsec-tools/htdocs/

Larry

-- 
------------------------------------------------------------------------
Larry Baird                        | http://www.gta.com
Global Technology Associates, Inc. | Orlando, FL
Email: lab@gta.com                 | TEL 407-380-0220, FAX 407-380-6080