Cisco VPN Client on FC6 2.6.20 "invalid module format"
 

I just upgraded my FC6 kernel to 2.6.20.blah.blah.blah i686 and now the Cisco VPN Client vpnclient-linux-x86_64-4.8.00.0490-k9.tar.gz won't compile. I checked to make sure kernel-devel and kernel are matching architecture (i686). I got it to compile and install fine with 2.6.18.blah.blah.blah, but now it errors out of the compile during interceptor.c, which I know has always generated errors in the past, but not to the point where it stops the compilation. Here is the output:

Cisco Systems VPN Client Version 4.8.00 (0490) Linux Installer
Copyright (C) 1998-2005 Cisco Systems, Inc. All Rights Reserved.

By installing this product you agree that you have read the
license.txt file (The VPN Client license) and will comply with
its terms.


Directory where binaries will be installed [/usr/local/bin]

Automatically start the VPN service at boot time [yes]

In order to build the VPN kernel module, you must have the
kernel headers for the version of the kernel you are running.


Directory containing linux kernel source code [/lib/modules/2.6.20-1.2933.fc6/build]

* Binaries will be installed in "/usr/local/bin".
* Modules will be installed in "/lib/modules/2.6.20-1.2933.fc6/CiscoVPN".
* The VPN service will be started AUTOMATICALLY at boot time.
* Kernel source from "/lib/modules/2.6.20-1.2933.fc6/build" will be used to build the module.

Is the above correct [y]

Shutting down /opt/cisco-vpnclient/bin/vpnclient: module cisco_ipsec is not running.
Stopped: /etc/init.d/vpnclient_init (VPN init script)
Making module
make -C /lib/modules/2.6.20-1.2933.fc6/build SUBDIRS=/home/rrautens/Desktop/vpnclient modules
make[1]: Entering directory `/usr/src/kernels/2.6.20-1.2933.fc6-i686'
CC [M] /home/rrautens/Desktop/vpnclient/linuxcniapi.o
CC [M] /home/rrautens/Desktop/vpnclient/frag.o
CC [M] /home/rrautens/Desktop/vpnclient/IPSecDrvOS_linux.o
CC [M] /home/rrautens/Desktop/vpnclient/interceptor.o
/home/rrautens/Desktop/vpnclient/interceptor.c: In function ‘handle_vpnup’:
/home/rrautens/Desktop/vpnclient/interceptor.c:310: warning: assignment from incompatible pointer type
/home/rrautens/Desktop/vpnclient/interceptor.c:334: warning: assignment from incompatible pointer type
/home/rrautens/Desktop/vpnclient/interceptor.c:335: warning: assignment from incompatible pointer type
/home/rrautens/Desktop/vpnclient/interceptor.c: In function ‘do_cleanup’:
/home/rrautens/Desktop/vpnclient/interceptor.c:378: warning: assignment from incompatible pointer type
/home/rrautens/Desktop/vpnclient/interceptor.c: In function ‘recv_ip_packet_handler’:
/home/rrautens/Desktop/vpnclient/interceptor.c:553: error: ‘CHECKSUM_HW’ undeclared (first use in this function)
/home/rrautens/Desktop/vpnclient/interceptor.c:553: error: (Each undeclared identifier is reported only once
/home/rrautens/Desktop/vpnclient/interceptor.c:553: error: for each function it appears in.)
/home/rrautens/Desktop/vpnclient/interceptor.c:557: error: too many arguments to function ‘skb_checksum_help’
/home/rrautens/Desktop/vpnclient/interceptor.c: In function ‘do_cni_send’:
/home/rrautens/Desktop/vpnclient/interceptor.c:680: error: ‘CHECKSUM_HW’ undeclared (first use in this function)
/home/rrautens/Desktop/vpnclient/interceptor.c:683: error: too many arguments to function ‘skb_checksum_help’
make[2]: *** [/home/rrautens/Desktop/vpnclient/interceptor.o] Error 1
make[1]: *** [_module_/home/rrautens/Desktop/vpnclient] Error 2
make[1]: Leaving directory `/usr/src/kernels/2.6.20-1.2933.fc6-i686'
make: *** [default] Error 2
Failed to make module "cisco_ipsec.ko".


Any help would be greatly appreciated. Does anyone know what the differences would be between 2.6.18 and 2.6.20 to cause this? I also tried it with 2.6.19 in the past and it would not work. Guess I should have known better than to try it again. Oh well.

Hya,

Did you uninstall old one?

Happy Penguins!

Ha, nope. Didn't even think of trying that. I'll give that a shot.

patch
 

I collected all the patch tidbits I found by googling for "cisco vpnclient CHECKSUM_HW" and other similar strings referring to error messages in my build output. I pulled them together, and wrote this patch, which compiled and ran for me on kernel 2.6.20.

Apply and build:

tar -xvzf vpnclient-linux-x86_64-4.8.00.0490-k9.tar.gz
patch -p0 vpnclient-linux-x86_64-4.8.00.0490-k9.patch
cd vpnclient
./vpn_install

Contents of vpnclient-linux-x86_64-4.8.00.0490-k9.patch :

--- vpnclient/IPSecDrvOS_linux.c 2005-11-22 03:43:57.000000000 -0600
+++ vpnclient.new/IPSecDrvOS_linux.c 2007-04-23 17:12:58.000000000 -0500
@@ -11,8 +11,17 @@
*
*
***************************************************************************/
-#include <linux/config.h>
#include <linux/version.h>
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,18)
+#include <linux/utsrelease.h>
+#endif
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,18)
+#include <linux/config.h>
+#else
+#include <linux/autoconf.h>
+#endif
+
#include <linux/vmalloc.h>
#include <linux/sched.h>
#include <linux/string.h>
diff -Naur vpnclient/frag.c vpnclient.new/frag.c
--- vpnclient/frag.c 2005-11-22 03:43:57.000000000 -0600
+++ vpnclient.new/frag.c 2007-04-23 17:13:22.000000000 -0500
@@ -1,5 +1,14 @@
-#include <linux/config.h>
#include <linux/version.h>
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,18)
+#include <linux/utsrelease.h>
+#endif
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,18)
+#include <linux/config.h>
+#else
+#include <linux/autoconf.h>
+#endif
+
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
#include <linux/skbuff.h>
diff -Naur vpnclient/interceptor.c vpnclient.new/interceptor.c
--- vpnclient/interceptor.c 2005-11-22 03:43:57.000000000 -0600
+++ vpnclient.new/interceptor.c 2007-04-23 18:24:33.000000000 -0500
@@ -8,8 +8,17 @@
***************************************************************************
* This module implements the linux driver.
***************************************************************************/
-#include <linux/config.h>
#include <linux/version.h>
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,18)
+#include <linux/utsrelease.h>
+#endif
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,18)
+#include <linux/config.h>
+#else
+#include <linux/autoconf.h>
+#endif
+
#include <linux/module.h>
#include <linux/init.h>
#include <linux/kernel.h>
@@ -33,6 +42,14 @@
#include "mtu.h"
#include "unixkernelapi.h"

+// With linux 2.6.19, they renamed CHECKSUM_HW to CHECKSUM_COMPLETE
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,19)
+ #define CHECKSUM_HW CHECKSUM_COMPLETE
+ #define SKB_CHECKSUM_HELP(a,b) skb_checksum_help((a))
+#else
+ #define SKB_CHECKSUM_HELP(a,b) skb_checksum_help((a),(b))
+#endif
+
static uint8_t interceptor_eth_addr[] = { 0x00, 0x0b, 0xfc, 0xf8, 0x01, 0x8f };

// packet statistics
@@ -61,7 +78,12 @@
/*packet handler functions*/
static int recv_ip_packet_handler(struct sk_buff *skb,
struct net_device *dev,
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,14)
struct packet_type *type);
+#else
+ struct packet_type *type,
+ struct net_device *tbd);
+#endif
static int replacement_dev_xmit(struct sk_buff *skb, struct net_device *dev);

static int handle_netdev_event(struct notifier_block *self, unsigned long,
@@ -71,7 +93,11 @@
{
struct packet_type *pt;
int (*orig_handler_func) (struct sk_buff *, struct net_device *,
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,14)
struct packet_type *);
+#else
+ struct packet_type *, struct net_device *);
+#endif
};
static struct packet_type_funcs original_ip_handler;

@@ -494,7 +520,12 @@

static int
recv_ip_packet_handler(struct sk_buff *skb,
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,14)
struct net_device *dev, struct packet_type *type)
+#else
+ struct net_device *dev, struct packet_type *type,
+ struct net_device *tbd)
+#endif
{
int rc2 = 0;
int tmp_rc = 0;
@@ -513,14 +544,22 @@
#endif
if (dev->type == ARPHRD_LOOPBACK)
{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,14)
rc2 = original_ip_handler.orig_handler_func(skb, dev, type);
+#else
+ rc2 = original_ip_handler.orig_handler_func(skb, dev, type, 0);
+#endif
goto exit_gracefully;
}

/* Don't handle non-eth non-ppp packets */
if (!supported_device(dev))
{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,14)
rc2 = original_ip_handler.orig_handler_func(skb, dev, type);
+#else
+ rc2 = original_ip_handler.orig_handler_func(skb, dev, type, 0);
+#endif
goto exit_gracefully;
}

@@ -539,14 +578,22 @@
firsttime = 0;
}

+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,14)
rc2 = original_ip_handler.orig_handler_func(skb, dev, type);
+#else
+ rc2 = original_ip_handler.orig_handler_func(skb, dev, type, 0);
+#endif
goto exit_gracefully;
}

//only need to handle IP packets.
if (skb->protocol != htons(ETH_P_IP))
{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,14)
rc2 = original_ip_handler.orig_handler_func(skb, dev, type);
+#else
+ rc2 = original_ip_handler.orig_handler_func(skb, dev, type, 0);
+#endif
goto exit_gracefully;
}

@@ -554,9 +601,9 @@
{
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,7)
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,10)
- if (skb_checksum_help(skb,1))
+ if (SKB_CHECKSUM_HELP(skb,1))
#else
- if (skb_checksum_help(&skb,1))
+ if (SKB_CHECKSUM_HELP(&skb,1))
#endif // LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,10)
{
dev_kfree_skb(skb);
@@ -626,7 +673,11 @@
tmp_rc = CNICallbackTable.ReceiveComplete(pBinding,
lpReceiveContext, NewPacket);

+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,14)
rc2 = original_ip_handler.orig_handler_func(skb, dev, type);
+#else
+ rc2 = original_ip_handler.orig_handler_func(skb, dev, type, 0);
+#endif

if (pBinding->recv_stat.called)
{
@@ -680,11 +731,11 @@
if (skb->ip_summed == CHECKSUM_HW)
{
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,10)
- if (skb_checksum_help(skb,0))
+ if (SKB_CHECKSUM_HELP(skb,0))
#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,7)
- if (skb_checksum_help(&skb,0))
+ if (SKB_CHECKSUM_HELP(&skb,0))
#else
- if ((skb = skb_checksum_help(skb)) == NULL)
+ if ((skb = SKB_CHECKSUM_HELP(skb)) == NULL)
#endif //LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,7)
{
goto exit_gracefully;
diff -Naur vpnclient/linuxcniapi.c vpnclient.new/linuxcniapi.c
--- vpnclient/linuxcniapi.c 2005-11-22 03:43:57.000000000 -0600
+++ vpnclient.new/linuxcniapi.c 2007-04-23 18:25:22.000000000 -0500
@@ -9,8 +9,17 @@
* This module implements a translation layer between the CNI API and the
* Linux Interceptor driver.
***************************************************************************/
-#include <linux/config.h>
#include <linux/version.h>
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,18)
+#include <linux/utsrelease.h>
+#endif
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,18)
+#include <linux/config.h>
+#else
+#include <linux/autoconf.h>
+#endif
+
#include <linux/netdevice.h>
#include <linux/if.h>
#include <linux/if_arp.h>
@@ -342,7 +351,11 @@
rx_bytes+=skb->len;
#endif

+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,14)
pBinding->recv_stat.rc = pBinding->InjectReceive(skb, skb->dev, pBinding->pPT);
+#else
+ pBinding->recv_stat.rc = pBinding->InjectReceive(skb, skb->dev, pBinding->pPT, 0);
+#endif

exit_gracefully:
CNICallbackTable.ReceiveComplete(Binding, ReceiveContext, Packet);
diff -Naur vpnclient/linuxcniapi.h vpnclient.new/linuxcniapi.h
--- vpnclient/linuxcniapi.h 2005-11-22 03:43:57.000000000 -0600
+++ vpnclient.new/linuxcniapi.h 2007-04-23 18:26:24.000000000 -0500
@@ -23,7 +23,11 @@
struct net_device *pDevice;
struct packet_type *pPT;
int (*InjectReceive) (struct sk_buff *, struct net_device *,
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,14)
struct packet_type *);
+#else
+ struct packet_type *, struct net_device *);
+#endif
int (*InjectSend) (struct sk_buff * skb, struct net_device * dev);

int recv_real_hh_len;

Hi andrewes,

could you provide your patch as an attachment or ortherwise downloadable via a direct URL? If I copy & paste it to a file, it it not parseable by the patch program. Maybe surrounding it this some "code" tags which ensure spaces would suffice to but I'm not sure about that.

The main problems are the same you would have had installing it on 2.6.19 kernels, you would have had to have either edited the .o files to comment out the linux/config.h libs as they are not included in FC6, as well as the new CHKSUM_HW CHKSUM changes

You shouldn't have to uninstall the old one .. I have it running compiled in three different kernels

I found a download link for a matching patch myself in the meanwhile. Here's the URL:

http://tuxx-home.at/projects/cisco-v....19+-rev1.diff

So long

Patch URL
 

Sure:

http://andrewes.0catch.com/vpnclient....0490-k9.patch

tried it
 

errror, I tried the one you linked to. It seemed to make my machine incredibly unstable. andrewes, I'm going to try yours in the next couple of days and see what happens.

I'm sorry to inform you, that your link is not working (at least like that):
Maybe just provide a simple HTML site too and like to that page instead of directly.
Hint for others having the same problem as me: If I paste the link directly into the browser (navigated to the same URL before and gotten this error message above) it works!

I haven't tested the new driver very deep yet. Primary goal was to build it. Will do deeper testing in the afternoon.

thanks
 

errror, thanks for your help. no problem on the testing. if it helps, it seemed to work for about 10 to 15 minutes, then my enitre machine would freeze. especially, if i was running something chatty over the tunnel, like RDP.

Try this, I can see it:

http://andrewes.0catch.com/vpnclient....0490-k9.patch

Also, when you say "it" doesn't work, I am having trouble following which patch you're
referring to. I didn't advocate any patch except, the one pointed at above. It's the same as the text I pasted here first.

nm, that doesn't work either. Copy the link and paste it into a new window. It works.

Patch won't apply :-(
 

Hi There,
I'm trying to apply the patch in order install the vpn client but for some reason it won't go. I must be missing something obvious here.

Relevant Output
---------------
[root@lenovo Desktop]# ll
total 2040
drwxr-xr-x 2 503 wheel 4096 Nov 22 2005 vpnclient
-rw-r--r-- 1 josborg josborg 6687 May 18 16:19 vpnclient-linux-4.8.00.0490-readme.txt
-rwxrwxrwx 1 root root 8173 May 18 20:09 vpnclient-linux-x86_64-4.8.00.0490-k9.patch
-rw-r--r-- 1 josborg josborg 2045213 May 18 16:17 vpnclient-linux-x86_64-4.8.00.0490-k9.tar.gz

[root@lenovo Desktop]# uname -a
Linux lenovo.local 2.6.20-1.2948.fc6 #1 SMP Fri Apr 27 19:48:40 EDT 2007 i686 i686 i386 GNU/Linux
[root@lenovo Desktop]#

[root@lenovo Desktop]# chmod 777 vpnclient-linux-x86_64-4.8.00.0490-k9.patch
[root@lenovo Desktop]# patch -p0 vpnclient-linux-x86_64-4.8.00.0490-k9.patch

For some reason, patch just gets stuck like that; no output is shown. After it being stuck for sometime like that, my only option is to kill it using Crtl^C.

Any ideas why the patch won't run? This is probably a very obvious question; apologies in advance, I'm a newbie to all this.

Joe

Answered my own question...forgot the '<' redirection in front of the patch file.

I've been talking with Cisco
 

Have been talking with Cisco's support about these issues, and it doesn't look like there's going to be an official fix for a few months. They say they're struggling to keep up with us.

I'm running Fedora Core 6. To get the module to compile/install, I had to either hand-edit or apply andrewes' patch. Unfortunately, that doesn't give me a working client:

# /etc/rc.d/init.d/vpnclient_init start
Starting /opt/cisco-vpnclient/bin/vpnclient: insmod: error inserting '/lib/modules/2.6.18-1.2849.fc6/CiscoVPN/cisco_ipsec.ko': -1 Invalid module format
Failed (insmod)


Oh, I did run the vpn_uninstall AND I manually deleted the old module (which their script doesn't do).

Have had same results with the 2.6.20-1.2933.fc6 kernel.

Dan

Hya,

My Penguin is 2.6.20.11 (from Kernel.org) on Debian etch. I had no problem with andrew's patch.

However, when I was working with my other penguin, 2.6.18.?? (I forgot..) Debian Sarge, I had similar problem. It turned out to be kernel source path. Without a symlink to my real kernel path from /usr/src/linux, something went wrong and resulted in "invalid module format" If I remember correct, problem was Makefile with KERNEL_PATH. Apology for somewhat unclear info, everything is on my memory and that penguin is not around me at this moment.

Happy Penguins!