[Openswan dev] First pass README update
Harald Jenny
harald at a-little-linux-box.at
Thu Oct 14 03:04:29 EDT 2010
Thanks for your work!
On Thu, Oct 14, 2010 at 01:59:20PM +1000, David McCullough wrote:
>
> Jivin Paul Wouters lays it down ...
> >
> >
> > My comments :)
> >
> > > #########################################################################
> > > # Openswan 2.X Release Notes
> > > #########################################################################
> > > ************ See docs/RELEASE-NOTES.txt for more information ************
> > >
> > > Openswan is an IPsec implementation for Linux. It has support for most
> > > of the extensions (RFC + IETF drafts) related to IPsec, including
> > > IKEv2, X.509 Digital Certificates, NAT Traversal, and many others.
> > >
> > > Openswan was originally based on FreeS/WAN 2.04 CVS, along with some
> > > minor bug fixes from 2.05 and 2.06. See CREDITS for the history.
> >
> > I would probably say FreeS/WAN 2.04 CVS with the X.509 Patch from Andreas
> > and the NAT-T patch from Arkoon networks. I know Andreas doesn't like to
> > credit us for anything, but we try give proper credits.
> >
> > > Download it from http://www.openswan.org/code
> >
> > or ftp://ftp.openswan.org/openswan/
> >
> > > 1. libgmp + libgmp-devel headers. (GNU Math Precision Library)
> >
> > Maybe explain this is gmp/gmp-devel on rpm and libgmp3/libgmp3-devel on apt distros?
> >
> > > 2. gawk, flex and bison (usually included in all distributions)
> >
> > Perhaps add runtime requirements too? iproute2, iptables, if used on embedded
> > systems a busybox with enough features enabled to get a mostly full /bin/sh
>
> done.
>
> >
> > > #########################################################################
> > > # HOW TO INSTALL on Kernel 2.6 (And Kernels with 2.6 IPsec backport)
> > > #########################################################################
> > >
> > > NETKEY (Native linux IPsec stack)
> > > ---------------------------------
> > >
> > > To use Openswan with the linux native (builtin) IPsec stack, then the
> > > following steps should be all that are needed. Please use at least kernel
> > > version 2.6.6, as prior versions of the kernel have serious bugs in the
> >
> > I would say 2.6.9 as the earliest version.
>
> done
>
> >
> > > native IPsec stack. From the openswan directory:
> > >
> > > make programs
> > > sudo make install
> >
> > This reminds me we should fix not creating man pages as root in the install phase......
>
> Perhaps we should build them in the programs step and only install them
> in the install step, what could possibly go wrong :-) :-)
>
> > > Note: The ipsec-tools package is no longer needed. Instead iproute2 >= 2.6.8
> > > is required. For backported kernels, setkey and thus ipsec-tools might still
> > > be required. Run 'ipsec verify' to determine if your system has either one
> > > of the requirements.
> >
> > of course "ipsec verify" requires perl (and I'd like to redo it in python)
>
> added.
>
> >
> > > KLIPS (Openswan IPsec stack)
> > > ----------------------------
> > >
> > > To use the Openswan KLIPS IPsec stack (ipsec0 devices) for Linux
> > > Kernels 2.6.23 and higher, the following steps should work. From the
> > > openswan directory:
> > >
> > > make programs
> > > make KERNELSRC=/lib/modules/`uname -r`/build module
> > > sudo make KERNELSRC=/lib/modules/`uname -r`/build install minstall
> > >
> > > For Linux 2.6 Kernels before 2.6.23, the kernel requires patching if
> > > NAT-T support is required.
> >
> > Perhaps say "including linux 2.4 kernels"
>
> joined it all together
>
> > > Add NAT-T support.
> > >
> > > NAT-T support needs to patch the kernel and build a new bzImage.
> > > From the Openswan source directory:
> > >
> > > make KERNELSRC=/lib/modules/`uname -r`/build nattpatch | \
> > > (cd /usr/src/linux-2.6 && patch -p1 && make bzImage)
> >
> > Add the bit about make sarefpatch here for KLIPSNG (Mast) support with SAref tracking?
> >
> > Premade patches for some (distro kernels) are found in patches/kernel/
> > Recommended kernel is 2.6.32 and up. Documentation on SAref/MAST can be found in
> > docs/HACKING/Mast* and doc/klips/mast.xml. To understand what SAref tracking does,
> > take a look at doc/ipsecsaref.png and the overlapip= entry in the ipsec.conf man page.
>
> done
>
> > > Note: Build and install kernel as normal, as you have modified
> > > the TCP/IP stack in the kernel, so it needs to be recompiled and
> > > installed.
> > >
> > > eg: cd /usr/src/linux-2.6 && make dep bzImage install
> > >
> > > See your distribution documentation on how to install a new kernel
> > >
> > > From the openswan directory:
> > >
> > > make programs
> > > make KERNELSRC=/lib/modules/`uname -r`/build module
> > > sudo make KERNELSRC=/lib/modules/`uname -r`/build install minstall
> >
> > Stacks can be switched at runtime using protostack=<klips|netkey|mast>
>
> done
>
> > > For OCF HW offloading support, you need a patched kernel
> > > See: http://ocf-linux.sourceforge.net/
> > >
> > > #########################################################################
> > > # HOW TO INSTALL on Linux Kernel 2.4 systems
> > > #########################################################################
> > >
> > > The following instructions assume the kernel source tree is in
> > > /usr/src/linux-2.4. If this isn't the case, simply change the
> > > parameters in the instructions below.
> > >
> > > 1) Uncompress linux-2.#.#.tar.bz2 in /usr/src (or elsewhere), build a
> > > normal working kernel. This ensures any compiliation problems
> > > that occur are isolated and resolved *before* any Openswan patches
> > > are applied to the kernel.
> > >
> > > 2) If you want NAT-T support, you need to patch your kernel and build
> > > a new bzImage. From the Openswan source directory:
> > >
> > > make KERNELSRC=/usr/src/linux-2.4 nattpatch | \
> > > (cd /usr/src/linux-2.4 && patch -p1 && make bzImage)
> > >
> > > Note: Build and install kernel as normal, as you have modified
> > > the TCP/IP stack in the kernel, so it needs to be recompiled and
> > > installed.
> > >
> > > eg: cd /usr/src/linux-2.4 && make dep bzImage install
> >
> > The only difference here is the "make dep" step right? Why not integrate in the
> > text above to avoid repeats?
> >
> > > 3) From the openswan source directory, build the userland tools, and
> > > ipsec.o kernel module:
> >
> > well the one other diff is ipsec.o vs ipsec.ko I guess.
> >
> > > Bugs with the package can be filed into our Mantis system, at
> > > http://bugs.openswan.org
> >
> > redmine :)
> >
> > > #########################################################################
> > > # SECURITY HOLES
> > > #########################################################################
> > >
> > > Hopefully none :-) If you find one, please email vuln at xelerance.com with
> > > details. Please use GPG (finger vuln at xelerance.com for GPG key) for this.
> >
> > I'd say:
> >
> > All security vulnerabilities found that require public disclosure will receive
> > proper CVE tracking numbers (see http://mitre.org/) and co-ordinated via the
> > vendor-sec mailing list. A complete list of known security vulnerabilities is
> > available at: http://www.openswan.org/security/
>
> done
>
> >
> > > #########################################################################
> > > # DEVELOPMENT
> > > #########################################################################
> > >
> > > Those interested in the development, patches, beta releases of Openswan
> > > can join the development mailing list (http://lists.openswan.org -
> > > dev at lists.openswan.org) or join the development team on IRC in
> > > #openswan-dev on irc.freenode.net
> >
> > For those who want to track things a bit more closely, the commits@ mailinglist
> > will mail all the commit messages.
>
> done
>
> > > #########################################################################
> > > # DOCUMENTATION
> > > #########################################################################
> > >
> > > The most up to date docs are at http://wiki.openswan.org.
> >
> > No trailing dots on urls please :)
>
> done
>
> Thanks,
> Davidm
>
> --
> David McCullough, david_mccullough at mcafee.com, Ph:+61 734352815
> McAfee - SnapGear http://www.mcafee.com http://www.uCdot.org
More information about the Dev
mailing list