Re: [Ipsec-tools-devel] problem adding manual ESP SAs on Linux

[Timo T. <tim...@ik...>]

Christopher Smith wrote:
>> Try "modprobe esp4" and retry setkey operation. There seems to be a
>> kernel bug that it does not autoload the esp4 module which is needed
>> for ESP SAs.
> 
> I neglected to mention that I had already ensured the module was 
> present.  In further investigation, I found that the working system was 
> running 2.6.24 and the broken ones 2.6.25; upgrading the working system 
> caused it to break identically, so it appears to be a bug introduced in 
> 2.6.25.  Is anyone familiar with what's happening?

The only kernel related thing I know of is that esp4 module was changed
to use aead api / authenc. Modprobing 'aead' might help. I remember that
there was even a bug earlier that it was not compiled by default, so
you might check your kernel config if that module is missing. But that
should have been fixed for the official release.

Other than that, I'm not so sure. Since this is a Linux kernel related
problem you might ask the folks at ne...@vg....

- Timo