Re: [Devil-Linux-discuss] ipsec not working in 1.2.7/8

[Heiko Z. <he...@zu...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Thu, November 24, 2005 10:22, Martin Glazer wrote:
> On November 23, 2005 20:44, Heiko Zuerker wrote:
>
>> On Wed, November 23, 2005 20:44, Martin Glazer wrote:
>>
>>> On November 23, 2005 18:10, Heiko Zuerker wrote:
>>>
>>>> On Wed, November 23, 2005 16:17, Martin Glazer wrote:
>>>>
>>>>> On November 22, 2005 09:29, Martin Glazer wrote:
>>>>>
>>>>>> Looks like Openswan (ipsec) is also not working in the latest
>>>>>> builds - upon start, it complains about missing ipsec modules.
>>>>>>
>>>>>> I don't know if this is related to the other missing module
>>>>>> posts - missing ip_ttl and ipt_connmark.
>>>>>>
>>>>>> Unfortunately, I don't have much time now to take a look for
>>>>>> the cause of the problems or if they are even related.
>>>>>
>>>>> I looked into this a bit further and it looks like the ipsec
>>>>> module is being built, but then it is being installed in the
>>>>> /lib/modules/{kernel_version}
>>>>> directory of the lfssystem and not into the cdtree.
>>>>>
>>>>> The kernel install also clears out the
>>>>> cdtree/lib/modules{kernel_version} before installing the kernel
>>>>> modules there, so a manual copy will not help.
>>>>>
>>>>> How was this handled before (prior to openswan 2.4.4)?
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> Any suggestions to work around this or where else to look for a
>>>>> solution?
>>>>
>>>> I fixed the problem with the missing module.
>>>>
>>>
>>> Thanks - I thought I tried your solution manually and found that
>>> because the kernel modules were installed after openswan, they deleted
>>> the ipsec.o module - I will try again with your solution from CVS.
>>
>> The Openswan makefile doesn't honor the DESTDIR variable when
>> installing the module, that was the reason why it was missing.
>>
>
> The fix still does not work...
>
>
> Even though you copy the ipsec.o file into the kenel module directory,
> the kernel is installed after openswan and during the kernel install, it
> deletes everything in the module directory first.
>
> I see 2 possible solutions -
> - Place a conditional copy of the ipsec module in the linux kernel install
>  script after the kernel modules are installed.
>
> - Change the order of compilation and compile/install openswan after the
> kernel compile - as openswan does not patch the kernel any longer, this
> should work. The only issue is with the nat-t patch, which does patch the
>  kernel, so one would have to do a conditional patch during the kernel
> build of the nat-t patch.
>
>>>> What was that klips spelling error you mentioned?
>>>>
>>>
>>> in scrips/super-freeswan under the build option --->
>>> set_kernel_option CONFIG_KLIPS m
>>> set_kernel_option CONFIG_IPSEC_ALG y set_kernel_option
>>> CONFIG_IPSEC_ENC_AES set_kernel_option CONFIG_IPSEC_ALG_NON_LIBRE n
>>> set_kernel_option CONFIG_IPSEC_ALG_CRYPTOAPI m --->  set_kernel_option
>>> CONFIG_KLIPS m
>>> set_kernel_option CONFIG_KLIPS_IPIP y
>>>
>>> the line is repeated as well it says CONFIG_KLIBS and should read
>>> CONFIG_KLIPS
>>> P instead of B
>>>
>>
>> The module is not anymore compiled as part of the Kernel
>> We can remove all this stuff from the script (I should have enough time
>> this weekend ... hopefully).
>
> I'll play aroundand see if I can get it to work using the solutions
> above.

I think I found a better solution.
Looking at the Kernel Makefile, it only wipes out 'kernel' directory, but
leaves the rest alone.
I'll move the ipsec.o file into the '/lib/modules/2.4.*/net' directory.

- --

Regards
  Heiko Zuerker
  http://www.devil-linux.org


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFDhe97UcytMSbs+YURAnJUAJ4i/c9QdPyOcRSz7q1jssLHde9EcgCfdp0w
SepIDDTA+z6UEI6BpoNzS7E=
=F+FR
-----END PGP SIGNATURE-----