GSoC 2026: a student tames NetBSD's racoon2 IKE daemon

racoon2 is a suite of services for exchanging and installing IPsec security parameters: an IKEv1/IKEv2 key-exchange daemon, a security-policy management daemon, and a Kerberos-based key-exchange daemon. The project is being modernized so it can serve as a reliable L2TP/IPsec or IKEv2 VPN server on NetBSD and Linux for the built-in VPN clients of Windows, iOS and Android. For Google Summer of Code 2026, Artem Belan — mentored by Christos Zoulas — worked through the TODO list and closed nearly every item on it. All changes were merged into the gsoc2026 branch through pull requests #13–#39 between June and September 2026.

NAT traversal, by the RFC

NAT handling was the bulk of the work. The daemon now fragments and reassembles large IKE messages per RFC 7383 for both protocol versions: previously, reassembled packets could be misrecognized and oversized ones could crash the daemon; now outsized packets are rejected with a clear log line. NAT-OA payloads in IKEv1 Quick Mode (RFC 3947) are handled properly, with the client's original addresses passed down to the kernel so it can do incremental checksum fixups instead of recomputing over whole packets.

The heart of the project was address substitution in NAT-T transport mode (RFC 7296 §2.23.1). Before, when a NAT device sat in the path, the addresses a peer proposed did not match the configured selectors, so admins had to add extra "workaround" selectors. Now the addresses observed on the wire are substituted into the negotiated selectors automatically, and the workarounds are gone.

IPv6, macros and negotiation

IPv6 support had existed for years but worked crooked: even when told to use all addresses, the daemon behaved as if only IPv4 existed. Address-matching and prefix-length bugs were fixed, and IPv6 is now on by default — no switch to flip. The confusing wildcard address macros were unified into a single consistent notion that behaves the same everywhere and emits clear diagnostics. Policies in transport and tunnel mode are now built from the configured SA addresses, and the negotiated proposal is built from what the peer actually sends — improving interoperability with stock Windows, iOS and Android clients.

Tests for old code

The project had no automated tests at all; every change was validated by reading code and running the daemon by hand. Now a small, self-contained test framework with no external dependencies is built in, with tests running under sanitizers. Four new programs cover exactly the logic this project introduced; the full suite of five tests passes cleanly, zero failures.

Only one TODO item remains open — a racoon2ctl tool for graceful connect and disconnect that sends delete notifications to the peer. End-to-end IPv6 testing in real scenarios and extending the test framework to the rest of the daemon are the natural next steps.

Source: Lobsters