Make fails with ha plugin (Ubuntu 22.04 LTS with stock/unpatched kernel) about strongswan

[thomas-strangert-emblasoft]

configure.log
make-all.log

[tobiasbrunner]

Compiling/making fails when enabling the ha plugin (--enable-ha)

kernel_netlink_ipsec.c: In function ‘add_hw_offload’:
kernel_netlink_ipsec.c:1584:38: error: ‘XFRM_OFFLOAD_PACKET’ undeclared (first use in this function); did you mean ‘HW_OFFLOAD_PACKET’?

The error has very obviously nothing to do with this option or the ha plugin.

Instead, it's the --with-linux-headers option that forces the compilation against old kernel headers. This is not necessary, just remove that option to use the shipped headers.

[thomas-strangert-emblasoft]

Oki, good yes it worked without the --with-linux-headers option.
However, the reason I used it was because it was recommended to do so in your documentation:

https://docs.strongswan.org/docs/5.9/features/highAvailability.html#_building_ha_plugin
Maybe you shouldn't write like that if it is so "obvious" that the option shouldn't be used?

[tobiasbrunner]

I see. It looks like this isn't necessary anymore since 4.5.3 (released in 2011) as the ha plugin doesn't use the jhash() implementation defined in the kernel headers anymore (it implements the different variants itself and selects the one to use based on the kernel version at runtime). Also, note that the plugin won't be fully functional on a generic Ubuntu kernel. Or have you patched and recompiled that?

[thomas-strangert-emblasoft]

(As I wrote in the issue, I have a stock/unpatched kernel.)

Is the "not fully functional" ha parts that an unpatched kernel only supports active/passive and that I can't set "local-node" to 0, but need to set it to 1 and 2 in my two different nodes?

Referring to the example in: https://docs.strongswan.org/docs/5.9/features/highAvailability.html#_clusterip

Node A:

iptables -A INPUT -i eth0 -d 192.168.0.200 -j CLUSTERIP --new
--hashmode sourceip --clustermac 01:00:5e:00:00:20
--total-nodes 2 --local-node 1

Node B:

iptables -A INPUT -i eth0 -d 192.168.0.200 -j CLUSTERIP --new
--hashmode sourceip --clustermac 01:00:5e:00:00:20
--total-nodes 2 --local-node 2

[tobiasbrunner]

No, I think it won't work correctly at all on a failover because the state (i.e. sequence numbers/replay window) of the CHILD_SAs won't be updated on the passive host (so it will send packets with duplicate sequence numbers and drop received packets as replayed packets).