I need IPSec support on BPI r4

[akibsayyed]

Dear Frank

Thank you for great REPO.I was able to install and get it working but I dont have user level IPSec capability using user xfrm module.

Can you tell me how to compile as part of this image or add only module to existing module.

Thanks.

[frank-w]

this is kernel only, but you can build it with your needed config option (./build.sh config after importconfig) and install to one of my debian/ubuntu images.

have not done anything with ipsec, so i do not know which options are needed for it

i only have seen offloading for ipsec on a quick search

maybe this is related (INET_XFRM_TUNNEL and INET_IPCOMP seems not selected):

  │ Symbol: INET_XFRM_TUNNEL [=n]                                                                                                            │  
  │ Type  : tristate                                                                                                                         │  
  │ Defined at net/ipv4/Kconfig:415                                                                                                          │  
  │   Depends on: NET [=y] && INET [=y]                                                                                                      │  
  │ Selects: INET_TUNNEL [=y]                                                                                                                │  
  │ Selected by [n]:                                                                                                                         │  
  │   - INET_IPCOMP [=n] && NET [=y] && INET [=y]                                                                                            │  
  │                                                                                                                                          │  
  │                                                                                                                                          │  
  │ Symbol: NFT_XFRM [=m]                                                                                                                    │  
  │ Type  : tristate                                                                                                                         │  
  │ Defined at net/netfilter/Kconfig:630                                                                                                     │  
  │   Prompt: Netfilter nf_tables xfrm/IPSec security association matching

maybe you have any errors in running system which point to the missing options?

[akibsayyed]

I am trying to complile kernel but after compilation i am facing following error
make[1]: Entering directory '/home/akib/build'

ERROR: Kernel configuration is invalid.
include/generated/autoconf.h or include/config/auto.conf are missing.
Run 'make oldconfig && make prepare' on kernel src to fix it.

/home/akib/BPI-Router-Linux/Makefile:730: include/config/auto.conf: No such file or directory
make[2]: *** [/home/akib/BPI-Router-Linux/Makefile:795: include/config/auto.conf] Error 1
make[1]: *** [/home/akib/BPI-Router-Linux/Makefile:224: __sub-make] Error 2
make[1]: Leaving directory '/home/akib/build'
make: *** [Makefile:224: __sub-make] Error 2
find: '../SD/BPI-ROOT/lib/modules/*': No such file or directory

[frank-w]

Do you always use build.sh?

[akibsayyed]

got it working
forgot to use prepare config (sorry importconfig)

[frank-w]

importconfig before should be enough

[akibsayyed]

I want to build header deb package what is the procedure for same ?

[frank-w]

It is done in pipeline (.github/workflows/build.yml) afair build_debs

[akibsayyed]

I am trying ./build.sh pack_debs will it work too ? or just build_debs
cause build_debs only built kernel deb

[frank-w]

Could also be pack_debs...i do not do this manually :)

[akibsayyed]

I am not getting support for tunnel in transport mode
unable to set CONFIG_INET_XFRM_MODE_TRANSPORT

[frank-w]

You mean you cannot enable it? When you have menuconfig (./build.sh config) and search for it with "/" you see depends on,i guess something there is missing and have to be enabled before your option. Also depencies can have depencies...

[akibsayyed]

it says no match found when i search it

[akibsayyed]

Can you help I need ipsec in transport mode
also is there a way to compile it as external module and then use ?

[frank-w]

it says no match found when i search it

same for me...as i said i have not done anything with ipsec yet, so i have no idea how to archive this...if there is additional code you could also add it to your kernel tree. building external module ist mostly more complex as you still need headers for same kernel version and manual copy module etc.

maybe ipsec support was dropped due to wireguard integration?

seems earlier dropped

https://cateee.net/lkddb/web-lkddb/INET_XFRM_MODE_TRANSPORT.html

but looks like the option is not needed since then ;)

$ git logone -SINET_XFRM_MODE_TRANSPORT net/ipv4/Kconfig
4c145dce2601 2019-03-29 xfrm: make xfrm modes builtin Florian Westphal 
b59f45d0b287 2006-05-27 [IPSEC] xfrm: Abstract out encapsulation modes Herbert Xu 

but top commit removing the option is in since 5.3...cateee tells about this option available till 5.1 (should be 5.2), but this is only detail