At 11:05 AM 6/22/2008, Patrick Lamaizière wrote:
Le Fri, 6 Jun 2008 23:41:35 +0200,
Patrick Lamaizière <[EMAIL PROTECTED]> a écrit :
Hello,
> I'm trying to port the glxsb driver from OpenBSD to FreeBSD 7-STABLE
> (via the NetBSD port).
> " The glxsb driver supports the security block of the Geode LX
> series processors. The Geode LX is a member of the AMD Geode family
> of integrated x86 system chips.
Hi,
Thanks for porting this over! I am just
trying it now with ipsec on a soekris 5501
Without the module loaded, I can do something simple like
# sh s
# cat s
MEOUTSIDE=64.x.x.x
MEINSIDE=192.168.5.0/24
REMOTEOUTSIDE=64.y.y.y
REMOTEINSIDE=192.168.1.0/24
IPSECKEY=zxzpprlNH61N11SGfrCa8dxZ
setkey -c <<EOF
add $MEOUTSIDE $REMOTEOUTSIDE esp 1049
-m any -E rijndael-cbc "$IPSECKEY";
add $REMOTEOUTSIDE $MEOUTSIDE esp 1049
-m any -E rijndael-cbc "$IPSECKEY";
spdadd $MEINSIDE $REMOTEINSIDE any -P
out ipsec esp/tunnel/$MEOUTSIDE-$REMOTEOUTSIDE/require;
spdadd $REMOTEINSIDE $MEINSIDE any -P
in ipsec esp/tunnel/$REMOTEOUTSIDE-$MEOUTSIDE/require;
EOF
But if I load the glxsb modules, setkey fails on the same policy.
# setkey -F
# setkey -FP
# setkey -DP
No SPD entries.
# kldload glxsb
# dmesg | tail
vr0: link state changed to DOWN
vr0: link state changed to UP
vr0: promiscuous mode enabled
vr0: promiscuous mode disabled
vr1: promiscuous mode enabled
vr1: promiscuous mode disabled
vr1: promiscuous mode enabled
vr1: promiscuous mode disabled
glxsb0: detached
glxsb0: <AMD Geode LX Security Block
(AES-128-CBC,RNG)> mem 0xa0000000-0xa0003fff irq 10 at device 1.2 on pci0
# sh s
The result of line 1: Invalid argument.
The result of line 2: Invalid argument.
#
What is the proper AES encryption to use for
IPSEC ? Why is there a difference in syntax
? This is RELENG_7 from a few days ago. If I
change the crypto to 3des-cbc, it works, but its
not making use of the crypto offload of course.
---Mike
_______________________________________________
freebsd-stable@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
