From owner-freebsd-questions@FreeBSD.ORG Fri Dec 6 16:02:08 2013 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 79C90A52 for ; Fri, 6 Dec 2013 16:02:08 +0000 (UTC) Received: from mail-wi0-f181.google.com (mail-wi0-f181.google.com [209.85.212.181]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 053081971 for ; Fri, 6 Dec 2013 16:02:07 +0000 (UTC) Received: by mail-wi0-f181.google.com with SMTP id hq4so1035332wib.8 for ; Fri, 06 Dec 2013 08:02:06 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:message-id:references:to; bh=LeyTXCSP2dqhVHEmX7J5/r+YN26pdez+jf4ogQkpVfo=; b=cNdNcJ9j7Br8HIdp5vTfvRuMKU9Y6zrowRbsScu/vIbIhy7kpOKEuWvG5FhCAQwkI+ 7XcK5kdxgsE0dDXex4/NXcnirVVqqx2NXat30qxXczNdW+1fnjR20WOjYHuX8aftZ9O0 /SDledpBWxosgwlJqcx3S1lygFtF7Z70QpWVZZjAjO5KDdVyfITZEL/zZwDNtRQ5uak1 wgR5aNfLxNGw6O4S4i9XnZ27S28o/CsZsDHp/PAoQNy1hxedgELBVZ2qHlOHkWB8MjiM bNbEplMFHe2OFG6CGNgE5QacWQ86w90xEUuZ+olPHLASJhTzBMQl1++Cv1jAPvpMPb5l lDdA== X-Gm-Message-State: ALoCoQmBhTlOFBJbL0QKfiH6/5q2/GXD90J5jxBxOPkT4gs4zwY5hpwt65IksMn8nHZtuEVl9aFD X-Received: by 10.180.39.140 with SMTP id p12mr3230023wik.12.1386345725951; Fri, 06 Dec 2013 08:02:05 -0800 (PST) Received: from dfleuriot.paris.hi-media-techno.com ([83.167.62.196]) by mx.google.com with ESMTPSA id e10sm7409438wiy.7.2013.12.06.08.02.04 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 06 Dec 2013 08:02:05 -0800 (PST) Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) Subject: Re: do I have to compile a new kernel? or just add options somehow? From: Fleuriot Damien In-Reply-To: Date: Fri, 6 Dec 2013 17:02:03 +0100 Message-Id: <6442241B-5DA7-4F04-A382-F691EF2B120E@my.gd> References: <1A249B2C-B341-4270-B343-627901FD9562@my.gd> <9909F4F0-623F-46F1-BD21-B3D2D9E4653A@my.gd> To: "firmdog@gmail.com" X-Mailer: Apple Mail (2.1510) Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable X-Content-Filtered-By: Mailman/MimeDel 2.1.17 Cc: freebsd-questions@freebsd.org X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Dec 2013 16:02:08 -0000 I don't think you'll be able to pass options to the module at load time. man 4 crypto yields a tiny bit of info, but doesn't answer your = question. On Dec 6, 2013, at 2:55 PM, "firmdog@gmail.com" = wrote: >=20 > Is there a way to pass options to a module at boot time? That is the = part that I can't understand. >=20 > "crypto" is easy to load as a module or simply load at boot time with = loader.conf .... But how to enable the options? (like IPSEC and = IPSEC_NAT_T ) >=20 >=20 >=20 >=20 >=20 >=20 > On Fri, Dec 6, 2013 at 5:46 AM, Fleuriot Damien wrote: > As I said earlier, you might not need to rebuild it, but I can't say = if IPsec Nat Traversal is enabled in the module. >=20 >=20 >=20 > On Dec 5, 2013, at 9:41 PM, "firmdog@gmail.com" = wrote: >=20 >>=20 >> I ran #kldload crypto. Did you see that? Then I ran kldstat and it = shows the module loaded. >>=20 >> Why do I have to recompile the kernel if I can run kldload or use = loader.conf to load the module at boot time? >>=20 >>=20 >>=20 >>=20 >>=20 >> On Thu, Dec 5, 2013 at 12:13 PM, Fleuriot Damien wrote: >> Merely adding the options and rebooting is not sufficient to get the = options from your kernel as opposed to a module. >>=20 >> You need to actually recompile the kernel, I hope you did that. >>=20 >>=20 >> On Dec 5, 2013, at 5:48 PM, "firmdog@gmail.com" = wrote: >>=20 >>>=20 >>> Looks like it "might have" worked for me. First I added a couple of = options to the GENERIC config: >>>=20 >>> root@:~ # grep IPSEC /usr/src/sys/i386/conf/GENERIC >>> options IPSEC # IP security (requires device = crypto) >>> options IPSEC_NAT_T # NAT-T support, UDP encap of ESP >>>=20 >>> Then rebooted: >>>=20 >>> root@:~ # uname -a >>> FreeBSD 8.4-RELEASE FreeBSD 8.4-RELEASE #0 r251259: Mon Jun 3 = 01:14:28 UTC 2013 = root@bake.isc.freebsd.org:/usr/obj/usr/src/sys/GENERIC i386 >>>=20 >>> root@:~ # kldload crypto >>> root@:~ # kldstat=20 >>> Id Refs Address Size Name >>> 1 5 0xc0400000 d5c4ec kernel >>> 2 1 0xc58eb000 23000 crypto.ko >>> 3 1 0xc58da000 a000 zlib.ko >>>=20 >>>=20 >>> The reason I am doing this is because a new Cisco VPN router will = not work with my IPF Freebsd firewall. The IPF firewall blocks the UDP = ipsec packets on port 4500. So now I need to see if doing the above = exercise helps with IPF blocking IPsec traversal across NAT >>>=20 >>>=20 >>>=20 >>>=20 >>> On Thu, Dec 5, 2013 at 10:57 AM, Fleuriot Damien wrote: >>> Oh but you can load modules at boot time for GENERIC just fine. >>>=20 >>> While there is a "crypto" module nested under = /usr/src/sys/modules/crypto/ , I'm not familiar enough with it to say = whether it incorporates both the device and the IPSEC options you're = interested in. >>>=20 >>> You're better off rebuilding GENERIC, or your own kernel, IMHO. >>>=20 >>>=20 >>>=20 >>> If you're curious, you can always run : >>> kldload crypto >>>=20 >>> If kldload says the module doesn't exist (I think it should, for = GENERIC), you'll need to build it: >>> cd /usr/src/sys/modules/crypto/ && make && make install >>>=20 >>>=20 >>>=20 >>> Here's little me trying to load it under a brand new 8.4 box: >>>=20 >>> # kldload /boot/kernel/crypto.ko >>> kldload: can't load /boot/kernel/crypto.ko: Exec format error >>>=20 >>>=20 >>> If you run into this error like me, "dmesg" will provide you with a = clue, as it does in my case: >>> KLD crypto.ko: depends on zlib - not available or version mismatch >>> linker_load_file: Unsupported file type >>>=20 >>>=20 >>>=20 >>> I really encourage you to rebuild your own kernel, stripped of all = the stuff you don't want/need (ISA NICs, wifi, firewire, floppy = controller... ) >>>=20 >>>=20 >>> Warren Block has written pretty cool articles, here: >>> http://www.wonkity.com/~wblock/docs/html/buildworld.html >>> http://www.wonkity.com/~wblock/docs/html/kernelconfig.html >>>=20 >>>=20 >>>=20 >>>=20 >>> I hope that helps, >>>=20 >>>=20 >>> On Dec 5, 2013, at 4:30 PM, "firmdog@gmail.com" = wrote: >>>=20 >>>>=20 >>>> So the answer is that it's NOT possible to load modules at boot = time for GENERIC? I have to actually build a new kernel? >>>>=20 >>>> Thanks! >>>>=20 >>>>=20 >>>> On Thu, Dec 5, 2013 at 9:42 AM, Fleuriot Damien wrote: >>>>=20 >>>> On Dec 5, 2013, at 3:35 PM, "firmdog@gmail.com" = wrote: >>>>=20 >>>> > I am having difficulty understanding what is compiled into the = GENERIC >>>> > kernel. >>>> > >>>> > I need to enable "device crypto" with IPSEC and IPSEC_NAT_T = options. >>>> > >>>> > Can I just configure the GENERIC kernel in a config file? Or do I = have to >>>> > compile a totally new kernel? >>>> > _______________________________________________ >>>> > freebsd-questions@freebsd.org mailing list >>>> > http://lists.freebsd.org/mailman/listinfo/freebsd-questions >>>> > To unsubscribe, send any mail to = "freebsd-questions-unsubscribe@freebsd.org" >>>>=20 >>>>=20 >>>> While it's far from being a good practice, you can simply add your: >>>> device crypto >>>> options IPSEC >>>> options IPSEC_NAT_T >>>>=20 >>>> to /sys/amd64/conf/GENERIC (assuming you're running a 64bit release = that is). >>>>=20 >>>>=20 >>>> Then: cd /usr/src && make kernel-toolchain && make buildkernel >>>>=20 >>>> Once the kernel is built, you only need to "make installkernel" and = reboot. >>>>=20 >>>> It is good practice, before rebooting, to run "mergemaster -p" , = even if you've only done a minor upgrade, let good habits sink in ;) >>>>=20 >>>>=20 >>>>=20 >>>>=20 >>>> Regarding what is compiled in the GENERIC kernel, you can find the = included options and devices at: >>>> /sys/amd64/conf/GENERIC >>>> or >>>> /sys/i386/conf/GENERIC >>>>=20 >>>> You may also run config -x /boot/kernel/kernel , if your kernel was = built with INCLUDE_CONFIG_FILE , which GENERIC does. >>>>=20 >>>>=20 >>>=20 >>>=20 >>=20 >>=20 >=20 >=20