Difference between revisions of "Linux IPsec Summit 2018 wishlist"
Jump to navigation
Jump to search
Paul Wouters (talk | contribs) |
Paul Wouters (talk | contribs) |
||
Line 36: | Line 36: | ||
/proc/sys/net/core/xfrm_aevent_rseqth | /proc/sys/net/core/xfrm_aevent_rseqth | ||
/proc/sys/net/core/xfrm_larval_drop | /proc/sys/net/core/xfrm_larval_drop | ||
+ | |||
+ | * fixup for userland using xfrm.h include * | ||
+ | |||
+ | Our kernel_netlink.c code contains: | ||
+ | |||
+ | <pre> | ||
+ | #include "linux/xfrm.h" /* local (if configured) or system copy */ | ||
+ | #include "libreswan.h" /* before xfrm.h otherwise break on F22 */ | ||
+ | </pre> | ||
+ | |||
+ | Depending on how new glibc/userland and/or kernel is we need to swap these two lines :( | ||
+ | |||
+ | Introduce some kind of #ifdef _KERNEL_ that protects xfrm.h from loading too much kernel related defines, so we only get the XFRM_ values we need to have available in userland. Now on older glibc we get: | ||
+ | |||
+ | <pre> | ||
+ | In file included from /source/programs/pluto/linux-copy/linux/xfrm.h:4:0, | ||
+ | from /source/programs/pluto/kernel_netlink.c:54: | ||
+ | /usr/include/netinet/in.h:99:5: error: expected identifier before numeric constant | ||
+ | IPPROTO_HOPOPTS = 0, /* IPv6 Hop-by-Hop options. */ | ||
+ | ^ | ||
+ | In file included from /source/linux/include/libreswan.h:76:0, | ||
+ | from /source/programs/pluto/kernel_netlink.c:55: | ||
+ | /usr/include/netinet/in.h:209:8: error: redefinition of ‘struct in6_addr’ | ||
+ | struct in6_addr | ||
+ | ^ | ||
+ | In file included from /source/programs/pluto/linux-copy/linux/xfrm.h:4:0, | ||
+ | from /source/programs/pluto/kernel_netlink.c:54: | ||
+ | /usr/include/linux/in6.h:32:8: note: originally defined here | ||
+ | struct in6_addr { | ||
+ | ^ | ||
+ | [more errors left out] | ||
+ | </pre> |
Revision as of 01:05, 3 February 2018
A scratchpad for things we'd like to talk about during the ipsec meetup
- larval acquire saying "transport mode" - would be nice to not say mode at all
src 192.0.2.100 dst 192.1.2.23 proto esp spi 0xSPISPIXX reqid REQID mode transport replay-window 0 sel src 192.0.2.100/32 dst 192.1.2.23/32 proto icmp type 8 code 0 dev eth0
- add support for Populate-From-Packet flag. Cause acquires for each different policy hit
- some clarification or documentation for these:
FLAG := noecn | decap-dscp | nopmtudisc | wildrecv | icmp | af-unspec | align4 | esn EXTRA-FLAG-LIST := [ EXTRA-FLAG-LIST ] EXTRA-FLAG EXTRA-FLAG := dont-encap-dscp ip xfrm policy help shows: FLAG := localok | icmp XFRM-PROTO := esp | ah | comp | route2 | hao MODE := transport | tunnel | beet | ro | in_trigger LEVEL := required | use
- some clarification or documentation for these:
/proc/sys/net/core/xfrm_acq_expires /proc/sys/net/core/xfrm_aevent_etime /proc/sys/net/core/xfrm_aevent_rseqth /proc/sys/net/core/xfrm_larval_drop
- fixup for userland using xfrm.h include *
Our kernel_netlink.c code contains:
#include "linux/xfrm.h" /* local (if configured) or system copy */ #include "libreswan.h" /* before xfrm.h otherwise break on F22 */
Depending on how new glibc/userland and/or kernel is we need to swap these two lines :(
Introduce some kind of #ifdef _KERNEL_ that protects xfrm.h from loading too much kernel related defines, so we only get the XFRM_ values we need to have available in userland. Now on older glibc we get:
In file included from /source/programs/pluto/linux-copy/linux/xfrm.h:4:0, from /source/programs/pluto/kernel_netlink.c:54: /usr/include/netinet/in.h:99:5: error: expected identifier before numeric constant IPPROTO_HOPOPTS = 0, /* IPv6 Hop-by-Hop options. */ ^ In file included from /source/linux/include/libreswan.h:76:0, from /source/programs/pluto/kernel_netlink.c:55: /usr/include/netinet/in.h:209:8: error: redefinition of ‘struct in6_addr’ struct in6_addr ^ In file included from /source/programs/pluto/linux-copy/linux/xfrm.h:4:0, from /source/programs/pluto/kernel_netlink.c:54: /usr/include/linux/in6.h:32:8: note: originally defined here struct in6_addr { ^ [more errors left out]