IPSec client (ipsec-tools) - build

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Generic Questions
Goto page 1, 2  Next
Author Message
gregd72002
DD-WRT User


Joined: 06 Jan 2010
Posts: 81

PostPosted: Mon Dec 06, 2010 16:43    Post subject: IPSec client (ipsec-tools) - build Reply with quote
Hello everyone,

As we all know, DDWRT supports Openvpn and PPTP vpn. Unfortunately, due to licensing issues, it does not (and will not ever) support IPSec. IPSec is becoming more and more popular especially within high security environments. So why not to add the support ourselves? I believe IPsec Tools (http://ipsec-tools.sourceforge.net/) is the way to go, especially that it should fit perfectly into the resources we have. Moreover, IPsec Tools are highly configurable and can be used to connect to many different IPSec implementations.

In this thread, I hope to keep a log of my efforts and I hope some smart people around here (I know that ones exists in here!) can help out!

My testing platform: Asus RT-N16
Build platform: x64 (Debian 5.0) - please note, the current toolkit has been compiled for x64

So far I am in the process of setting up the environment:
- getting toolchains - http://www.dd-wrt.com/dd-wrtv2/downloads/others/sourcecode/toolchains/current-toolchains.tar.bz2
- getting the linux src - svn://svn.dd-wrt.com/DD-WRT/src/linux/brcm/linux-2.6.23
- getting the IPSec sources - http://sourceforge.net/projects/ipsec-tools/files/ipsec-tools/0.7.2/


UPDATE 1:
- please note, the current toolkit has been compiled for AMD64 architecture (x64); if you are on x32, you will not be able to use the current toolchain (you can try to compile your own one, however I wouldn't advise it)
- in my first attempt I tried to get Shrew VPN instead of IPSec-Tools, however Shrew VPN apparently features only keying deamon (missing client application currently), therefore there was the decision to move to IPSec-Tools


Once all the above things are downloaded:
Code:

cd linux-2.6.23
PATH=$PATH:~/toolchains/toolchain-mipsel_4.1.1_BRCM24/bin
cp .config_std .config
make menuconfig

Please note, that the path to toolchains might be different in your case (platform dependent).

If it complains about madwifi either get the madwifi drivers into place or take it out of the Kconfig script file on the line that is complaining (unless you really need the madwifi drivers in your modules).
Once that is done you can do:

Code:

make menuconfig


Here we will have to select some additional functionality as modules and compile them (Networking->Networking Options):
- PF_KEY sockets (m) (af_key.ko)
- Transformation user configuration interface (xfrm_user.ko)
- IP: AH (m) (ah4.ko)
- IP: ESP (m) (esp4.ko)
- IP: IPComp (m) (ipcomp.ko)
- IP: IPSec transport (m) (xfrm4_mode_transport.ko)
- IP: IPSec tunnel (m) (xfrm4_tunnel.ko) (xfrm4_mode_tunnel.ko)
- IP: IPSec BEET (m) (xfrm4_mode_beet.ko)
under Cryptographic API:
- Null algorithms (m) (crypto_null.ko)
- SHA256 (m) (sha256.ko)
- SHA384... (m) (sha512.ko)

Depending on your requirement, you do not have to select all, equally - you might want to install some other ones.

Exit with saving and execute:
Code:

make modules


If everything went ok, you might want to copy all the new .ko modules to your platform (router) and try loading them. If it fails, you might need to change toolchains path, or add some additional modules. Note, that the order of loading (insmod) modules does matter.

Part2:
Download and unpack ipsec-tools. To configure/compile it, you should probably (TBC) issue:
Code:
LDFLAGS=-L/home/kiwi/ddwrt/openssl-compiled CC=mipsel-linux-gcc RANLIB=mipsel-linux-ranlib CPP=mipsel-linux-cpp CXX=mipsel-linux-c++ ./configure --enable-natt-versions=kernel --with-kernel-headers=/home/kiwi/ddwrt/linux-2.6.23/include/ --enable-security-context=no --host=mipsel-linux --with-openssl=/home/kiwi/ddwrt/openssl-compiled


However, most probably we will need openssl. You can retrieve if from the official openssl webpage.
How to compile openssl (I used ver 0.9.8q):
http://www.crosscompile.org/static/pages/OpenSSL.html
using install dir: /openssl-compiled

You might also want to have flex compiled - how to compile flex:
Code:
ac_cv_func_malloc_0_nonnull=yes ac_cv_func_realloc_0_nonnull=yes CC=mipsel-linux-gcc RANLIB=mipsel-linux-ranlib CPP=mipsel-linux-cpp CXX=mipsel-linux-c++ ./configure --host=mipsel-linux --prefix=/home/kiwi/ddwrt/toolchain-mipsel_4.1.1_BRCM24/ --with-gnu-ld


This should be everything what you need to build ipsec-tools
Next step: creating .ipk files



modules.zip
 Description:
All the modules described above; note that this requires CONFIG_XFRM activated in the kernel...

Download
 Filename:  modules.zip
 Filesize:  67.53 KB
 Downloaded:  1480 Time(s)


ipsec-tools_0.7.3_mipsel.ipk.zip
 Description:
install on optware; you will probably require some modules as well (see the main post)

Download
 Filename:  ipsec-tools_0.7.3_mipsel.ipk.zip
 Filesize:  1.67 MB
 Downloaded:  1545 Time(s)



Last edited by gregd72002 on Thu Dec 09, 2010 9:30; edited 2 times in total
Sponsor
gregd72002
DD-WRT User


Joined: 06 Jan 2010
Posts: 81

PostPosted: Wed Dec 08, 2010 23:26    Post subject: Reply with quote
Ok, it looks like it will not work with the current kernel. The current kernel is not compiled with $(CONFIG_XFRM) .. this means $(CONFIG_XFRM) is missing and it cannot be compiled as a module (to my knowledge). Who can we chase to get this option compiled in?

Could someone possibly verify this?

Code:

xfrm_user: Unknown symbol xfrm_spd_getinfo
xfrm_user: Unknown symbol __xfrm_policy_destroy
xfrm_user: Unknown symbol xfrm_state_alloc
xfrm_user: Unknown symbol xfrm_find_acq
xfrm_user: Unknown symbol xfrm_policy_byid
xfrm_user: Unknown symbol xfrm_state_lookup
xfrm_user: Unknown symbol xfrm_state_add
xfrm_user: Unknown symbol xfrm_policy_alloc
xfrm_user: Unknown symbol xfrm_policy_bysel_ctx
xfrm_user: Unknown symbol sysctl_xfrm_aevent_etime
xfrm_user: Unknown symbol __xfrm_state_destroy
xfrm_user: Unknown symbol xfrm_get_acqseq
xfrm_user: Unknown symbol xfrm_ealg_get_byname
xfrm_user: Unknown symbol xfrm_nl
xfrm_user: Unknown symbol xfrm_unregister_km
xfrm_user: Unknown symbol xfrm_state_flush
xfrm_user: Unknown symbol km_policy_expired
xfrm_user: Unknown symbol xfrm_alloc_spi
xfrm_user: Unknown symbol xfrm_aalg_get_byname
xfrm_user: Unknown symbol km_query
xfrm_user: Unknown symbol xfrm_register_km
xfrm_user: Unknown symbol km_state_notify
xfrm_user: Unknown symbol __xfrm_state_delete
xfrm_user: Unknown symbol xfrm_sad_getinfo
xfrm_user: Unknown symbol xfrm_policy_flush
xfrm_user: Unknown symbol xfrm_policy_delete
xfrm_user: Unknown symbol xfrm_cfg_mutex
xfrm_user: Unknown symbol km_state_expired
xfrm_user: Unknown symbol xfrm_policy_walk
xfrm_user: Unknown symbol xfrm_state_lookup_byaddr
xfrm_user: Unknown symbol km_policy_notify
xfrm_user: Unknown symbol sysctl_xfrm_aevent_rseqth
xfrm_user: Unknown symbol xfrm_state_update
xfrm_user: Unknown symbol xfrm_policy_insert
xfrm_user: Unknown symbol xfrm_init_state
xfrm_user: Unknown symbol xfrm_calg_get_byname
xfrm_user: Unknown symbol xfrm_find_acq_byseq
xfrm_user: Unknown symbol xfrm_state_delete
xfrm_user: Unknown symbol xfrm_state_walk
gregd72002
DD-WRT User


Joined: 06 Jan 2010
Posts: 81

PostPosted: Sat Dec 11, 2010 11:51    Post subject: how to compile the kernel Reply with quote
Could someone point me out the right direction on how to re-compile a kernel for broadcom?

Is it enough if I get the sources from:
svn.dd-wrt.com/DD-WRT/src/linux/brcm/linux-2.6.23

and compile it on .config_std using toolchains 3.4.6?

Having compiled it, I should be able to extract my current firmware (firmware_mod_kit), replace the kernel file and create back a firmware image which in turn I can be loaded onto my router?

Thanks a lot for any help!
chris
Site Admin


Joined: 06 Jun 2006
Posts: 101
Location: Germany, Bensheim

PostPosted: Mon Dec 13, 2010 7:34    Post subject: Reply with quote
Hi,

> Unfortunately, due to licensing issues, it does not (and will not ever) support IPSec.

May i ask what kind of licensing issues you mean?

Thanks in advance.

_________________
NewMedia-NET GmbH
Christian Scheele (CEO)
http://www.dd-wrt.com
gregd72002
DD-WRT User


Joined: 06 Jan 2010
Posts: 81

PostPosted: Mon Dec 13, 2010 13:25    Post subject: Reply with quote
Hi Chris,

I took the 'licensing issue' from the resolution to this ticket: http://svn.dd-wrt.com:8000/dd-wrt/ticket/379

That is: 'IPSEC needs a license'.

I did not investigate it any further.

Kind regards,
Gregory
chris
Site Admin


Joined: 06 Jun 2006
Posts: 101
Location: Germany, Bensheim

PostPosted: Mon Dec 13, 2010 13:28    Post subject: Reply with quote
Hi,

hm, interesting, since that is not true.

We don't like ipsec, that's the main thing, why we haven't added it.

But it seams, there are requests. We'll look into that.

_________________
NewMedia-NET GmbH
Christian Scheele (CEO)
http://www.dd-wrt.com
gregd72002
DD-WRT User


Joined: 06 Jan 2010
Posts: 81

PostPosted: Mon Dec 13, 2010 15:07    Post subject: Reply with quote
Thanks Chris!

I also created a ticket to get CONFIG_XFRM compiled in: http://svn.dd-wrt.com:8000/dd-wrt/ticket/1883

CONFIG_XFRM is the main obstacle to get started with anything related to IPSEC.

Interestingly it has been added to XSCALE: http://svn.dd-wrt.com:8000/dd-wrt/changeset/14734 but did not make its way to any other builds.
Apokrif
DD-WRT User


Joined: 22 Aug 2007
Posts: 64

PostPosted: Wed Dec 22, 2010 18:50    Post subject: Reply with quote
gregd72002,
I seemed to recall IPSec requires quite bigger binaries/libraries, then OpenVPN, but never seen any actual numbers.
Could you estimate, how much minimum flash size would it need, once compiled?
P.S. I would like to subscribe to this thread to see future progress.
gregd72002
DD-WRT User


Joined: 06 Jan 2010
Posts: 81

PostPosted: Thu Dec 23, 2010 15:46    Post subject: Reply with quote
Apokrif, I'd strongly advise to have Optware. As long as you have optware running the flash size does not matter. I am not interested in creating a flash image with IPSec built-in. However, this is feasible and someone else can do it.

Concerning numbers, from my estimates (currently) you need:
- CONFIG_XFRM (50 kbytes)
- Some modules (50-100 kbytes)
- executables (1.5 mbytes)

Again, definitely it is possible to trim down the numbers (especially executables) by not compiling the full versions of everything. My guess would be that you could manage to get everything down to roughly 800kb (cumulatively). Though, if you have optware installed the numbers do not matter.
gregd72002
DD-WRT User


Joined: 06 Jan 2010
Posts: 81

PostPosted: Thu Dec 23, 2010 15:49    Post subject: Reply with quote
Anyway.. I'm still waiting for CONFIG_XFRM ... without it I am not able to continue
Apokrif
DD-WRT User


Joined: 22 Aug 2007
Posts: 64

PostPosted: Thu Dec 23, 2010 18:52    Post subject: Reply with quote
Greg,
gregd72002 wrote:
Apokrif, I'd strongly advise to have Optware. As long as you have optware running the flash size does not matter. I am not interested in creating a flash image with IPSec built-in. However, this is feasible and someone else can do it.

I got it.

gregd72002 wrote:
Concerning numbers, from my estimates (currently) you need:
- CONFIG_XFRM (50 kbytes)
- Some modules (50-100 kbytes)
- executables (1.5 mbytes)

Again, definitely it is possible to trim down the numbers (especially executables) by not compiling the full versions of everything. My guess would be that you could manage to get everything down to roughly 800kb (cumulatively). Though, if you have optware installed the numbers do not matter.

Wow - not bad at all - even non-stripped version will fit just fine into 8MB flash (with or without OpenVPN ;-)


gregd72002 wrote:
Anyway.. I'm still waiting for CONFIG_XFRM ... without it I am not able to continue

I’m with you.

Question to chris, eco and BS:
Guys, you do compile quite many versions for different routers for every build.
Is it possible make available for download few compiled kernels as well with different settings/combinations, like $(CONFIG_XFRM) mentioned, so guys like gregd72002 can experiment?
I’m not a kernel guy - I hope my question does make sense Wink
lamaz
DD-WRT Novice


Joined: 04 May 2008
Posts: 13

PostPosted: Mon Jan 10, 2011 21:56    Post subject: Reply with quote
Bump for an update on this.
_________________
WRT610N v1 DD-WRT v24-sp2 (10/10/09) mega (build 13064). Both radios active.
WRT54GS v2.0 DD-WRT v24-sp2 in bridged mode.
gregd72002
DD-WRT User


Joined: 06 Jan 2010
Posts: 81

PostPosted: Thu Jan 13, 2011 14:43    Post subject: Reply with quote
CONFIG_XFRM is still missing in the kernel... personally I cannot do anything until someone in there will include it.
shihan
DD-WRT Novice


Joined: 25 Jan 2011
Posts: 2

PostPosted: Wed Jan 26, 2011 15:52    Post subject: Reply with quote
i'd love to see the dd-wrt support ipsec also, its the only piece of the puzzle thats really missing for me.
adam821
DD-WRT Novice


Joined: 19 Feb 2011
Posts: 1

PostPosted: Sat Feb 19, 2011 20:51    Post subject: Reply with quote
i too want ipsec!
Goto page 1, 2  Next Display posts from previous:    Page 1 of 2
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Generic Questions All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum