doc/2.6.known-issues

   1 Known issues with FreeS/WAN on a 2.6 kernel                   Claudia Schmeing
   2 -------------------------------------------
   3
   4
   5 This is an overview of known issues with FreeS/WAN on the 2.6 kernel codebase
   6 (also 2.5.x), which includes native Linux IPsec code.
   7
   8 More information on the native IPsec code is available here:
   9
  10     http://lartc.org/howto/lartc.ipsec.html
  11
  12 Tools for use with that code are here:
  13
  14     http://ipsec-tools.sourceforge.net/
  15
  16
  17 * As of FreeS/WAN 2.03, FreeS/WAN ships with some support for the 2.6 kernel
  18   IPsec code. In 2.03, this support is preliminary, but we expect to develop
  19   it fully. Many thanks to Herbert Xu for the initial code patches.
  20
  21 * Use the most recent Linux FreeS/WAN 2.x release from ftp.xs4all.nl
  22   to try our 2.6 kernel support.
  23
  24 * The installation procedure for use with 2.6 kernel IPsec is a little
  25   different from a traditional FreeS/WAN installation. Please see
  26   the latest doc/install.html.
  27
  28 * Please see the design and users' mailing lists
  29   (http://www.freeswan.org/mail.html) for more detail and the latest reports.
  30
  31
  32
  33 DESIGN-RELATED ISSUES
  34
  35
  36 * In 2.6, IPsec policies are detached from routing decisions. Because of this
  37   design, Opportunistic Encryption on the local LAN will be possible with 2.6.
  38
  39   One side effect: When contacting a node on the local LAN which is protected
  40   by gateway OE, you will get asymmetrical routing (one way through the gateway,
  41   one way direct), and IPsec will drop the return packets.
  42
  43
  44
  45 CURRENT ISSUES
  46
  47
  48 * For the moment, users wishing to test FreeS/WAN with 2.6 will require
  49   ipsec-tools' "setkey" program. Though FreeS/WAN's keying daemon, Pluto,
  50   directly sets IPsec policy, setkey is currently required to reset kernel SPD
  51   (Security Policy Database) states when Pluto restarts. We will likely add
  52   this basic functionality to an upcoming FreeS/WAN release.
  53
  54 * State information is not available to the user, eg. ipsec
  55   eroute/ipsec spi/ipsec look do not work. The exception: ipsec auto --status
  56   This will be fixed in a future release.
  57
  58 * If you're running Opportunistic Encryption, connectivity to new hosts will
  59   immediately fail. You may receive a message similar to this:
  60
  61      connect: Resource temporarily unavailable
  62
  63   The reason for this lies in the kernel code. Fairly complex discussion:
  64
  65       http://lists.freeswan.org/archives/design/2003-September/msg00073.html
  66
  67   As of 2.6.0-test6, this has not been fixed.
  68
  69 * This initial connectivity failure has an unintended side effect on DNS queries.
  70   This will result in a rekey failure for OE connections; a %pass will be
  71   installed for your destination IP before a %pass is re-instituted to your
  72   DNS server. As a workaround, please add your DNS servers to
  73   /etc/ipsec.d/policies/clear.
  74
  75 * Packets on all interfaces are considered for OE, including loopback. If you're
  76   running a local nameserver, you'll still need to exempt localhost DNS traffic
  77   as per the previous point. Since this traffic has a source of 127.0.0.1/32,
  78   the "clear" policy group will not suffice; you'll need to add the following
  79   %passthrough conn to ipsec.conf:
  80
  81   conn exclude-lo
  82           authby=never
  83           left=127.0.0.1
  84           leftsubnet=127.0.0.0/8
  85           right=127.0.0.2
  86           rightsubnet=127.0.0.0/8
  87           type=passthrough
  88           auto=route
  89
  90
  91
  92 OLD ISSUES
  93
  94
  95 None, yet.
  96
  97
  98
  99 RELATED DOCUMENTS
 100
 101
 102 FreeS/WAN Install web page        doc/install.html
 103
 104 FreeS/WAN Install guide           INSTALL
 105
 106 FreeS/WAN mailing list posts, including:
 107
 108     http://lists.freeswan.org/archives/design/2003-September/msg00057.html
 109
 110 To sign up for our mailing lists, see http://www.freeswan.org/mail.html
 111
 112