[Swan-dev] expirimental : ipsec device/interface aka XFRMi
Paul Wouters
paul at nohats.ca
Wed Jan 22 21:32:42 UTC 2020
On Wed, 22 Jan 2020, Antony Antony wrote:
>> As no other people are weighing in, I'll stop objecting provided the
>> parser crashers are resolved.
>
> thanks! lets give the new idea a shot.
That's not how API's really work. Once we have it, we cannot change it anymore :(
That is why I was trying to resolve this situation before release.
> The crasher is gone since this afternoon. another xauth error appeared.
> https://swantest.libreswan.fi/s2/v3.28-1496-g02dec310b1-testrun-xfrmi/xauth-pluto-27/OUTPUT/road.console.diff
I have seen this. It seems to be a race condition sometimes.
> Is it from glibc?
> As far as I see it is in kernel-headers-5.4.7-100.fc30.x86_64 If the kernel
> and headers match IFLA_XFRM_IF_ID will be defined.
>
> grep IFLA_XFRM_IF_ID /usr/include/linux/if_link.h IFLA_XFRM_IF_ID,
> IFLA_XFRM_IF_ID
>
> dnf provides /usr/include/linux/if_link.h
Sure, if you want to wait for RHEL9 that will be useful. But if you want
to run a newer kernel, you cannot just install a newer kernel-headers file
because the glibc installed is compiled against the old kernel-headers. so
then you also need to recompile glibc. So then no one can install just a
new kernel, like from the elrepo repository, and compile libreswan.
Since we are only adding a value, it is safe to define it ourselves.
> you can't ifndef check, it is an enum. which means you would need something
> like
Oh right. That's why I hadnt done it in the past. thanks for reminding me.
> https://github.com/libreswan/libreswan/pull/212/commits/9126ec99ca9e136666cbba5b48a8a02cb11350e0
> https://github.com/libreswan/libreswan/pull/212
> which we are resisting so far?
Yes we cannot do that without cross compile complications.
We could add a USE_XFRM_HEADER_XFRMI?=false that people can set to true?
> One concern is if we add a local defination for this enum and compile on
> CentOS7, at run time on old kernel dragons way be woken up:) Try compiling
> with enum defination and run it on CentOS/RHEL 7 or old Fedora.
Well, that should give something like NOTIMP ? :P
I'm okay with a manual flag to add. That way we can put the compile
error in the FAQ with the workaround.
Paul
More information about the Swan-dev
mailing list