Subject: Re: [vserver] OpenSwan and vServer
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Fri, 11 Feb 2011 17:27:04 +0100

On Tue, Feb 08, 2011 at 09:32:08AM +0100, Christian Bäcker wrote:
> Hi,

> I have a problem with ipsec compiled as kernel modules and vServer.
> When I start ipsec in my vServer I get following error messages. 

in general, there is no difference if you build a module
into the kernel or load it before it is used, but ....

> vserver1:/# /etc/init.d/ipsec start
> ipsec_setup: Starting Openswan IPsec 2.4.12...
> ipsec_setup: ERROR: Failed to load or detect KLIPS and NETKEY
> ipsec_setup: Broken 2.6 kernel without kallsyms, skipping calcgoo (Fedora rpm?)
> ipsec_setup: FATAL: Module ipsec not found.
> ipsec_setup: kernel appears to lack IPsec support (neither CONFIG_KLIPS or CONFIG_NET_KEY
are set)

> I checked that all modules, e.g. af_key, are loaded and also tried to
> give my vServer all possible (b,c,n)capabilities, without any success.
> I got the same result with the Debian Lenny vServer-kernel.

... make sure that the modules and all required submodules
are loaded before the guest tries to use them, as the guest
would not be permitted to load them (and if, it would not
be able to successfully load them in most cases)

> Because I could successfully establish a connection on my host
> system, I recompiled the kernel, now with ipsec included, not as
> modules. I suspect that NET_KEY would be sufficient. Now, ipsec starts
> successfully in my vServer too.

> I did not found any usefull information or similar problem
> description. Did I had overseen something or is this a bug? Links
> welcome.

of course, it might as well be that the script or tool
used to configure ipsec 'detects' that there is a module
and decides to do something differently than when compiled
into the kernel (like unloading and reloading the module
with certain options or so) 

> ipsec-tools: 0.7.3-12
> openswan: 2.6.28+dfsg-5
> util-vserver: 0.30.216~r2772-6
> vserver: 2.3.0.35

you might want to update kernel and util-vserver and try
again, maybe comparing the actual actions between both
setups (e.g. with strace or similar)

best,
Herbert

> Chris