Re: [vserver] OpenSwan and vServer

From: Herbert Poetzl <herbert_at_13thfloor.at>
Date: Fri 11 Feb 2011 - 16:27:04 GMT
Message-ID: <20110211162704.GI11496@MAIL.13thfloor.at>

On Tue, Feb 08, 2011 at 09:32:08AM +0100, Christian Bäcker wrote:
> Hi,

> I have a problem with ipsec compiled as kernel modules and vServer.
> When I start ipsec in my vServer I get following error messages.

in general, there is no difference if you build a module
into the kernel or load it before it is used, but ....

> vserver1:/# /etc/init.d/ipsec start
> ipsec_setup: Starting Openswan IPsec 2.4.12...
> ipsec_setup: ERROR: Failed to load or detect KLIPS and NETKEY
> ipsec_setup: Broken 2.6 kernel without kallsyms, skipping calcgoo (Fedora rpm?)
> ipsec_setup: FATAL: Module ipsec not found.
> ipsec_setup: kernel appears to lack IPsec support (neither CONFIG_KLIPS or CONFIG_NET_KEY are set)

> I checked that all modules, e.g. af_key, are loaded and also tried to
> give my vServer all possible (b,c,n)capabilities, without any success.
> I got the same result with the Debian Lenny vServer-kernel.

... make sure that the modules and all required submodules
are loaded before the guest tries to use them, as the guest
would not be permitted to load them (and if, it would not
be able to successfully load them in most cases)

> Because I could successfully establish a connection on my host
> system, I recompiled the kernel, now with ipsec included, not as
> modules. I suspect that NET_KEY would be sufficient. Now, ipsec starts
> successfully in my vServer too.

> I did not found any usefull information or similar problem
> description. Did I had overseen something or is this a bug? Links
> welcome.

of course, it might as well be that the script or tool
used to configure ipsec 'detects' that there is a module
and decides to do something differently than when compiled
into the kernel (like unloading and reloading the module
with certain options or so)

> ipsec-tools: 0.7.3-12
> openswan: 2.6.28+dfsg-5
> util-vserver: 0.30.216~r2772-6
> vserver: 2.3.0.35

you might want to update kernel and util-vserver and try
again, maybe comparing the actual actions between both
setups (e.g. with strace or similar)

best,
Herbert

> Chris
Received on Fri Feb 11 16:27:13 2011

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Fri 11 Feb 2011 - 16:27:13 GMT by hypermail 2.1.8