Re: [Swan-dev] config file diagnostics

2017-07-04 Thread Antony Antony
On Mon, Jul 03, 2017 at 04:09:24PM -0400, Paul Wouters wrote: > On Mon, 3 Jul 2017, D. Hugh Redelmeier wrote: > > > Thanks, Paul, for dealing with the one I reported. > > > > Here's from last night's run. Could you fix these too? Or hand them > > off to whoever understands the particular test?

[Swan-dev] [Swan] Specific kernel versions for VTI support?

2017-07-04 Thread Paul Wouters
The Route-based VPN using VTI article states that we need "a recent linux-3.x or 4.x kernel".  Does anyone know specifically what's the minimum 3.x and 4.x kernels for this?  Apologies, my searches didn't find it. The later the better. It's been actively developed and we know there are still k

[Swan-dev] resolve_myid()

2017-07-04 Thread Paul Wouters
What's the point of resolve_myid()? It seems like it doesn't do anything (formally: it is the identity function). Did it formerly have a purpose? Does it have a future purpose? It was used for roadwarriors to declare their ID to allow forward DNS lookups for IPSECKEY (aka "Initiator only OE

[Swan-dev] algparse makefile build fail

2017-07-04 Thread Ilan Tayari
Hi Andrew, I am trying to build libreswan master on a CentOS 7.1 system. I have the following in Makefile.inc.local: USE_DNSSEC=false USE_SYSTEMD_WATCHDOG=false I do 'make all', it builds pluto and others, and then I get this error: make[2]: Leaving directory `/net/gen-l-vrt-103/images/ipsec/l

Re: [Swan-dev] algparse makefile build fail

2017-07-04 Thread Paul Wouters
On Tue, 4 Jul 2017, Ilan Tayari wrote: I am trying to build libreswan master on a CentOS 7.1 system. I have the following in Makefile.inc.local: USE_DNSSEC=false USE_SYSTEMD_WATCHDOG=false I do 'make all', it builds pluto and others, and then I get this error: make[2]: Leaving directory `/ne

Re: [Swan-dev] algparse makefile build fail

2017-07-04 Thread Ilan Tayari
> -Original Message- > From: Paul Wouters [mailto:p...@nohats.ca] > Subject: Re: [Swan-dev] algparse makefile build fail > > On Tue, 4 Jul 2017, Ilan Tayari wrote: > > > I am trying to build libreswan master on a CentOS 7.1 system. > > > > I have the following in Makefile.inc.local: > > U

[Swan-dev] Libreswan nic-offload automatic and fallback

2017-07-04 Thread Ilan Tayari
Hi Paul, Antony, and all, I want to discuss an improvement to the basic Libreswan nic-offload feature. We (Mellanox) propose the following change: * Upgrade the nic-offload configuration option from bool to tristate enum: * Never – old behavior, never attempt to perform nic-offload.

Re: [Swan-dev] resolve_myid()

2017-07-04 Thread D. Hugh Redelmeier
I'm sorry that my question wasn't clearer. Here's the definition: const struct id *resolve_myid(const struct id *id) { return id; } It clearly does NOTHING. It does not allow roadwarriors to declare their ID since it does nothing. If we intend to build on it later, that's fine. But a

Re: [Swan-dev] config file diagnostics

2017-07-04 Thread D. Hugh Redelmeier
| From: D. Hugh Redelmeier | Thanks, Paul, for dealing with the one I reported. Paul's commit was 22e805518d6948b1991fd5d97a004a361a903af4 It removed a lot of definitions of conn us (and some others). Unfortunately there are still references to conn us. All six that I've found have been in

Re: [Swan-dev] config file diagnostics

2017-07-04 Thread Paul Wouters
Those are all old obsolete conns not used since freeswan. Just delete them all Sent from my iPhone > On Jul 4, 2017, at 18:02, D. Hugh Redelmeier wrote: > > | From: D. Hugh Redelmeier > > | Thanks, Paul, for dealing with the one I reported. > > Paul's commit was 22e805518d6948b1991fd5d97a004

Re: [Swan-dev] resolve_myid()

2017-07-04 Thread Paul Wouters
Kill it Sent from my iPhone > On Jul 4, 2017, at 17:59, D. Hugh Redelmeier wrote: > > I'm sorry that my question wasn't clearer. > > Here's the definition: > > const struct id *resolve_myid(const struct id *id) > { >return id; > } > > It clearly does NOTHING. It does not allow roadwarri

[Swan-dev] ikev2-ddns-02

2017-07-04 Thread D. Hugh Redelmeier
This looks as if reference output needs updating. But there is more going on. The commit that caused this problem seem to be in 8a0b5b79e440468856b985539d8367a8fe6f59f2 ikev2-ddns-02/OUTPUT/west.console.diff: - cp unbound.service /etc/systemd/system/unbound.service + cat /lib/systemd/system/unb

[Swan-dev] ikev2-16-alias-whack-up

2017-07-04 Thread D. Hugh Redelmeier
1) it uses "norhtnet-eastnets" as a connection name. Is there a reason for this spelling, or is it a typo? 2) ikev2-16-alias-whack-up/OUTPUT/east.console.diff: cannot find conn 'road-east-common' needed by conn 'norhtnet-eastnets' 3) ikev2-16-alias-whack-up/OUTPUT/north.console.diff: +cannot fi

Re: [Swan-dev] resolve_myid()

2017-07-04 Thread D. Hugh Redelmeier
| From: D. Hugh Redelmeier | Here's the definition: | | const struct id *resolve_myid(const struct id *id) | { | return id; | } I'm quite wrong. That is only one definition, in lib/liblswlog/lswid.c There is another definition in programs/pluto/myid.c That one does do something useful.