openvpn: set_ipsec_bypass() doesn't work for IPV6 connections

[pyhalov]

No description provided.

[pyhalov]

@danmcd , @gwr : please, review

[danmcd]

"IPsec not loaded" is a more accurate description.

[pyhalov]

Have one more question... If I receive EPROTONOSUPPORT error in zone, but it works in GZ, does this mean that zone misses some privileges?

[pyhalov]

Also if it fails in zone with EPROTONOSUPPORT, in GZ when run as usual user, it will fail with EPERM (so tests will fail). The question is if we should also handle this fail gracefully (I mean, ignore EPERM as we do with EPROTONOSUPPORT)?

[danmcd]

A regular user needs the privilege IP_CONFIG to trigger policy bypasses. EPERM is not ignorable like EPROTONOSUPPORT is.

[pyhalov]

yes, after ipseckey flush it fails differently - EPERM.

[danmcd]

So clearly we do the is-loaded check BEFORE the privilege check. A regular user will need the IP_CONFIG privilege to bypass. (I thought openvpn needed this privilege anyway?!)

[pyhalov]

well, at least openvpn tests run without root privileges (without this patch). It can do simple client-server pings...

[pyhalov]

Now the only question is if we are going to ignore EPERM error, like we do for EPROTONOSUPPORT.

[pyhalov]

With this patch applied openvpn needs IP_CONFIG privilege, so test can fail with EPERM