[Swan] Version 3.30 XFRM implementation

Paul Overton Paul at trustedcyber.co.uk
Wed Feb 19 12:40:42 UTC 2020


Continuing: 

I believe the correct key work for specifying the XRFMi ipsec interface IP is:  interface-ip preceded by either right or left. However presently when specified this comes up as obsolete. 

I don't see any alternative options in the code to replace this. 

In the CHANGES document, it is suggested that the new command is "iface-ip" but there is no code to support this so far as I can see. 

Do we assume that the code to do this has not yet been written ?

Regards Paul

-----Original Message-----
From: Swan [mailto:swan-bounces at lists.libreswan.org] On Behalf Of Paul Overton
Sent: 19 February 2020 11:11
To: Paul Wouters <paul at nohats.ca>
Cc: Swan at lists.libreswan.org
Subject: Re: [Swan] Version 3.30 XFRM implementation

Thanks Paul,

Some progress, it seems that the iface-ip= directive is causing the failure to start, if I don't include this directive, and only use  ipsec-interface=yes An interface ipsec1 is created and the tunnels are created, but the interface does not have a local IP address. I can add this after though. 

This is the error I get when including the iface-ip= statement:

cannot load config '/etc/ipsec.conf': /etc/ipsec.d/connections.conf:26: syntax error, unexpected STRING [iface-ip]

I have tried adding a number of ipsec interfaces, it would appear the 2 per external interface is the limit. 

Regards Paul

-----Original Message-----
From: Paul Wouters [mailto:paul at nohats.ca]
Sent: 18 February 2020 17:18
To: Paul Overton <Paul at trustedcyber.co.uk>
Cc: Swan at lists.libreswan.org
Subject: Re: [Swan] Version 3.30 XFRM implementation

On Tue, 18 Feb 2020, Paul Overton wrote:

> I have just updated one of my machines to run Version 3.30 from 3.29.

> I would like to change this to use XFRM, and note the new directives 
> ipsec-interface= and iface-ip=, I have tried using these directives, but Pluto hangs on restart when I try.

We have not experienced that. Can you perhaps get more logs and/or strace output to see what's going on?

> Are there any definitive instructions/examples of the configuration 
> and do I need to preload any of the kernel modules ?

if you run with our init system support, which calls _stackmanager, then it should already load the xfrm_interface.ko module.

Paul
_______________________________________________
Swan mailing list
Swan at lists.libreswan.org
https://lists.libreswan.org/mailman/listinfo/swan


More information about the Swan mailing list