freeswan-snap2003nov07h on uclibc -- SUCCESS -- only minor problems with solutions
Niki Waibel <[email protected]> Fri, 07 Nov 2003 18:41:48 +0100 (MET)
| Newsgroups | gmane.network.freeswan.user,gmane.network.freeswan.devel |
|---|---|
| Message-ID | <[email protected]> |
i got an encrypted tunnel running between
freeswan-1.98 (linux-2.4) <-> freeswan-snap2003nov07h (native linux-2.6 ipsec)
on my embedded uclibc, busybox, tinylogin system (linux-2.6 kernel without modules).
there are few small issues:
a) busybox ip command does not like "ip route del" ... it has to be "ip route delete"
-> modified
programs/_updown/_updown.c
programs/_updown/_updown.ip2.in
patch: see below
b) as i use a linux kernel without modules i had to modify
programs/_startklips/_startklips.in
patch: see below
c) uclibc (in its default config) has a different behavior then glibc when using
malloc(0)
this can happen in freeswan-snap2003nov06h/programs/pluto/state.c line 849 if you call
ipsec auto --status
and you have no active tunnel.
-> 003 FATAL ERROR: unable to malloc 0 bytes for state array
uclibc sayes:
===
MALLOC_GLIBC_COMPAT: x
x The behavior of malloc(0) is listed as implementation-defined by x
x SuSv3. Glibc returns a valid pointer to something, while uClibc x
x normally return a NULL. I personally feel glibc's behavior is x
x not particularly safe, and allows buggy applications to hide very x
x serious problems. x
x When this option is enabled, uClibc will act just like glibc, and x
x return a live pointer when someone calls malloc(0). This pointer x
x provides a malloc'ed area with a size of 1 byte. This feature is x
x mostly useful when dealing with applications using autoconf's broken x
x AC_FUNC_MALLOC macro (which redefines malloc as rpl_malloc if it x
x does not detect glibc style returning-a-valid-pointer-for-malloc(0) x
x behavior). Most people can safely answer N.
===
there are 2 solutions:
freeswan-snap2003nov07h/programs/pluto/defs.c line 122
if size is 0 then change size to 1 to allocate 1 byte ...
with that it would run on uclibc and glibc.
or -- what i did (see patch) -- change
freeswan-snap2003nov07h/programs/pluto/state.c line 844
a bit.
d) if i start ipsec (/etc/init.d/ipsec --start) then it does not
fork into background. it is no problem for me, but i dont know
if that is how it should be ...
e) ipsec look wants to read /proc/net/ipsec_spigrp, /proc/net/ipsec_eroute,
/proc/net/ipsec_tncfg, /proc/net/ipsec_spi
have read that you are working on this for 2.04.
here is what i get:
===
~ # ipsec look
gw-vpn-1 Fri Nov 7 17:46:36 CET 2003
cat: /proc/net/ipsec_spigrp: No such file or directory
cat: /proc/net/ipsec_eroute: No such file or directory
egrep: /proc/net/ipsec_tncfg: No such file or directory
/usr/local/i386-linux-uclibc/opt/freeswan/snap2003nov07h/libexec/ipsec/look: 70:
paste: not found
sort: /proc/net/ipsec_spi: No such file or directory
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 172.27.255.254 0.0.0.0 UG 0 0 0 eth1
172.27.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth1
194.208.88.221 172.27.255.254 255.255.255.255 UGH 0 0 0 eth1
===
finally, here is the patch.
===
[niki@epiam-1 packages]$ diff -u -r freeswan-snap2003nov07h.orig freeswan-snap2003nov07h
diff -u -r freeswan-snap2003nov07h.orig/Makefile.inc freeswan-snap2003nov07h/Makefile.inc
--- freeswan-snap2003nov07h.orig/Makefile.inc 2003-11-07 03:58:06.000000000 +0100
+++ freeswan-snap2003nov07h/Makefile.inc 2003-11-07 17:31:48.409715144 +0100
@@ -62,7 +62,7 @@
DESTDIR?=
# "local" part of tree, used in building other pathnames
-INC_USRLOCAL=/usr/local
+INC_USRLOCAL=/usr/local/i386-linux-uclibc/opt/freeswan/snap2003nov07h
# PUBDIR is where the "ipsec" command goes; beware, many things define PATH
# settings which are assumed to include it (or at least, to include *some*
diff -u -r freeswan-snap2003nov07h.orig/programs/pluto/Makefile freeswan-snap2003nov07h/programs/pluto/Makefile
--- freeswan-snap2003nov07h.orig/programs/pluto/Makefile 2003-11-07 03:58:07.000000000 +0100
+++ freeswan-snap2003nov07h/programs/pluto/Makefile 2003-11-07 17:21:29.164854672 +0100
@@ -109,6 +109,8 @@
# -DLEAK_DETECTIVE
CPPFLAGS = $(HDRDIRS) $(DEFINES) \
+ -I/usr/local/opt/gcc/3.3.1/lib/gcc-lib/i686-pc-linux-gnu/3.3.1/include \
+ -I/usr/local/i386-linux-uclibc/include \
-DSHARED_SECRETS_FILE=\"${FINALCONFDIR}/ipsec.secrets\" \
-DPOLICYGROUPSDIR=\"${FINALCONFDDIR}/policies\" \
-DPERPEERLOGDIR=\"${FINALLOGDIR}/pluto/peer\"
diff -u -r freeswan-snap2003nov07h.orig/programs/pluto/state.c freeswan-snap2003nov07h/programs/pluto/state.c
--- freeswan-snap2003nov07h.orig/programs/pluto/state.c 2003-11-07 03:58:07.000000000 +0100
+++ freeswan-snap2003nov07h/programs/pluto/state.c 2003-11-07 18:14:24.354152528 +0100
@@ -841,42 +841,45 @@
}
}
- /* build the array */
- array = alloc_bytes(sizeof(struct state *)*count, "state array");
- count = 0;
- for (i = 0; i < STATE_TABLE_SIZE; i++)
+ if (count != 0)
{
- struct state *st;
-
- for (st = statetable[i]; st != NULL; st = st->st_hashchain_next)
+ /* build the array */
+ array = alloc_bytes(sizeof(struct state *)*count, "state array");
+ count = 0;
+ for (i = 0; i < STATE_TABLE_SIZE; i++)
{
- array[count++]=st;
+ struct state *st;
+
+ for (st = statetable[i]; st != NULL; st = st->st_hashchain_next)
+ {
+ array[count++]=st;
+ }
}
- }
- /* sort it! */
- qsort(array, count, sizeof(struct state *), state_compare);
+ /* sort it! */
+ qsort(array, count, sizeof(struct state *), state_compare);
- /* now print sorted results */
- for (i = 0; i < count; i++)
- {
- struct state *st;
+ /* now print sorted results */
+ for (i = 0; i < count; i++)
+ {
+ struct state *st;
- st = array[i];
+ st = array[i];
- fmt_state(st, n, state_buf, sizeof(state_buf)
- , state_buf2, sizeof(state_buf2));
- whack_log(RC_COMMENT, state_buf);
- if (state_buf2[0] != '\0')
- whack_log(RC_COMMENT, state_buf2);
-
- /* show any associated pending Phase 2s */
- if (IS_PHASE1(st->st_state))
- show_pending_phase2(st->st_connection->host_pair, st);
- }
+ fmt_state(st, n, state_buf, sizeof(state_buf)
+ , state_buf2, sizeof(state_buf2));
+ whack_log(RC_COMMENT, state_buf);
+ if (state_buf2[0] != '\0')
+ whack_log(RC_COMMENT, state_buf2);
+
+ /* show any associated pending Phase 2s */
+ if (IS_PHASE1(st->st_state))
+ show_pending_phase2(st->st_connection->host_pair, st);
+ }
- /* free the array */
- pfree(array);
+ /* free the array */
+ pfree(array);
+ }
}
/* Given that we've used up a range of unused CPI's,
diff -u -r freeswan-snap2003nov07h.orig/programs/_startklips/_startklips.in freeswan-snap2003nov07h/programs/_startklips/_start
klips
.in
--- freeswan-snap2003nov07h.orig/programs/_startklips/_startklips.in 2003-11-07 03:58:07.000000000 +0100
+++ freeswan-snap2003nov07h/programs/_startklips/_startklips.in 2003-11-07 17:25:31.112073104 +0100
@@ -255,10 +255,13 @@
if test -f $kamepfkey
then
klips=false
- modprobe -qv ah4
- modprobe -qv esp4
- modprobe -qv ipcomp
- modprobe -qv xfrm_user
+ if test -r $modules # kernel does have modules
+ then
+ modprobe -qv ah4
+ modprobe -qv esp4
+ modprobe -qv ipcomp
+ modprobe -qv xfrm_user
+ fi
fi
if test ! -f $ipsecversion && $klips
@@ -348,4 +351,4 @@
# Revision 1.22 2003/11/07 02:58:07 mcr
# backout of port-selector and X.509 patches
#
-#
\ No newline at end of file
+#
diff -u -r freeswan-snap2003nov07h.orig/programs/_updown/_updown.c freeswan-snap2003nov07h/programs/_updown/_updown.c
--- freeswan-snap2003nov07h.orig/programs/_updown/_updown.c 2003-04-10 19:34:13.000000000 +0200
+++ freeswan-snap2003nov07h/programs/_updown/_updown.c 2003-11-07 17:23:54.818711920 +0100
@@ -105,7 +105,7 @@
if(strncmp(pluto_verb, "unroute-", 8) == 0 ||
strncmp(pluto_verb, "down-", 5) == 0) {
- argv[0]="/bin/ip"; argv[1]="route"; argv[2]="del";
+ argv[0]="/bin/ip"; argv[1]="route"; argv[2]="delete";
argv[3]=pluto_peer_client; argv[4]="dev";
argv[5]=pluto_interface; argv[6]="via"; argv[7]=pluto_me;
argv[8]=0;
@@ -114,13 +114,13 @@
if(status != 0) return status;
}
else
- printf("route del %s\n", pluto_peer_client);
+ printf("route delete %s\n", pluto_peer_client);
}
if(strncmp(pluto_verb, "prepare-", 8) == 0) {
- argv[0]="/bin/ip"; argv[1]="route"; argv[2]="del";
+ argv[0]="/bin/ip"; argv[1]="route"; argv[2]="delete";
argv[3]=pluto_peer_client; argv[4]=0;
if(!testing) {
/* We ignore any errors from this command,
@@ -132,7 +132,7 @@
status = my_system("/bin/ip", argv);
}
else
- printf("prepare del %s\n", pluto_my_client);
+ printf("prepare delete %s\n", pluto_my_client);
}
Only in freeswan-snap2003nov07h/programs/_updown: _updown.in
diff -u -r freeswan-snap2003nov07h.orig/programs/_updown/_updown.ip2.in freeswan-snap2003nov07h/programs/_updown/_updown.ip2.in
--- freeswan-snap2003nov07h.orig/programs/_updown/_updown.ip2.in 2003-10-28 22:36:17.000000000 +0100
+++ freeswan-snap2003nov07h/programs/_updown/_updown.ip2.in 2003-11-07 17:24:16.390432520 +0100
@@ -123,7 +123,7 @@
doroute add
}
downroute() {
- doroute del
+ doroute delete
}
doroute() {
parms="$PLUTO_PEER_CLIENT"
@@ -191,13 +191,13 @@
# replacing it.
parms1="0.0.0.0/1"
parms2="128.0.0.0/1"
- it="ip route del $parms1 2>&1 ; ip route del $parms2 2>&1"
- oops="`ip route del $parms1 2>&1 ; ip route del $parms2 2>&1`"
+ it="ip route delete $parms1 2>&1 ; ip route delete $parms2 2>&1"
+ oops="`ip route delete $parms1 2>&1 ; ip route delete $parms2 2>&1`"
;;
*)
parms="$PLUTO_PEER_CLIENT"
- it="ip route del $parms 2>&1"
- oops="`ip route del $parms 2>&1`"
+ it="ip route delete $parms 2>&1"
+ oops="`ip route delete $parms 2>&1`"
;;
esac
status="$?"
[niki@epiam-1 packages]$
===
(i could have attached the patch to the mail -- to get tabs and spaces correct...
but i dont know if that is ok in this lists...)
the /usr/local/i386-linux-uclibc stuff at the beginning in the makefiles
is to get it cross compiled.
i used
make KERNELSRC=/home/niki/packages/linux-2.6.0-test9-bk8 USE_LWRES=false USERCOMPILE=-Os programs
to compile freeswan.
i think that -Os would be a good idea for pluto as well -- in my case...
oh -- i am from austria -- if this territory thing is still an issue.
hope this helps improving freeswan!
niki