Re: [Devil-linux-develop] Freeswan failing to compile correctly?

[Martin G. <sou...@gl...>]

On December 9, 2003 07:27 am, hzu...@ra... wrote:
> I didn't see this error before, but I'm also not using FreeS/WAN. Just turn
> off ALG for now. ;-)

I have - it actually only affects ALG-sha2, all the others are OK. I just 
commented out the appropriate line in the script and deleted the 
corresponding file.

> BUT I just did a few full compiles this week and it compiled fine, no
> aborts. Did you modify anything ?
>

My build (non modified, straight from CVS) also compiles fine with no aborts, 
even though it fails on sha2 and also a bit later on spi.c (different 
problem). I was surprised that the whole build didn't fail, but I haven't 
checked yet why not.

See if you have /usr/lib/ipsec/whack or /usr/lib/ipsec/pluto on your resulting 
build.

> We have anyway the following task outstanding: either move to
> SuperFreeS/WAN ( http://www.freeswan.ca ) or to FreeS/WAN 2.0x
> When I asked last time, nobody answered which one is prefered.
>

I haven't worked with FreeS/WAN 2.0x yet, so I'm unsure of all the changes. 
One major difference is the use of a method called OE (Opportunistic 
Encryption), which they are promoting heavily, as a method of automagically 
encrypting all traffic between 2 Linux boxes without prearrangement. To me, 
the jury is still out on whether this will actually be adopted by any other 
vendors, but I may be wrong. I'm also unsure of the state of the ALG patches, 
NAT traversal, X509 certs, etc in the official 2 release.

On the otherhand, I have worked quite extensively with SuperFreeS/WAN, and so 
I would recommend this be the route to follow. It has all the patches 
currently in DL now as well as a few others. The DL ipsec patchset is also 
currently a patch or 2 behind. It looks like SuperFreeS/WAN is also working 
on a V2 version, but haven't quite got the official release there yet.

Martin