libreswan: Unbreak the package

[iblech]

On current unstable, libreswan compiles but then doesn't run because of an ABI
change in NSS.

There is an easy fix which is to land in the next version of libreswan, see
libreswan/libreswan#334; in the meantime, we can copy
this fix so that libreswan works again on unstable.

Motivation for this change

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

[SuperSandro2000]

While we are at it:

I tried building libreswan on darwin and got the following error:

$ nix-build -A libreswan
error: Package ‘iproute2-5.8.0’ in /Users/user/nixpkgs/pkgs/os-specific/linux/iproute/default.nix:48 is not supported on ‘x86_64-darwin’, refusing to evaluate.

a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowUnsupportedSystem = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowUnsupportedSystem = true; }
to ~/.config/nixpkgs/config.nix.

(use '--show-trace' to show detailed location information)

We should probably remove the darwin platform:

-    platforms = platforms.linux ++ platforms.darwin ++ platforms.freebsd;
+    platforms = platforms.linux ++ platforms.freebsd;

Edit: I found iproute2mac but I can't test right now if it works or not.

[iblech]

Good catch, thank you @SuperSandro2000! Do you have a way to test this later? How come that libreswan ever worked on darwin? (I don't run darwin and also don't really have any clue about libreswan.)

[SuperSandro2000]

Do you have a way to test this later?

I can't really fiddle with network right now. Sorry.

How come that libreswan ever worked on darwin?

This is like this since 2016 https://github.com/nixos/nixpkgs/blob/69d8cb4a6bf85b2a6546a20a9e8b9c9c0f2943ec/pkgs/tools/networking/libreswan/default.nix and probably no one ever tested it on darwin. I think it is save to remove darwin platform.

@r-burns Can maybe you help out?

[iblech]

Okay, then I'll push a commit to remove darwin for now. Thank you for your quick response. :-) If r-burns or someone else has time to look into darwin, we can always reactivate it. Right not it is broken on darwin either way, so it's not a regression to remove darwin from the supported platforms.

[r-burns]

Thanks for the ping, yeah I think removing darwin from platforms is the right call. There are a ton of linux-only dependencies beyond iproute2, and the upstream project only claims to support linux.

Builds for me on linux. Is there a command I can run to verify the fix is working?

[iblech]

Thank you for the quick review! Unfortunately, I know of no quick command for testing. You need to enable the libreswan service with some dummy configuration.

[SuperSandro2000]

Result of nixpkgs-review pr 101543 run on x86_64-linux 1

1 package marked as broken and skipped:

• hash-slinger

1 package built:

• libreswan

[iblech]

Can this pull request be merged? For as long as libreswan 3.33 is not released, this issue is unfortunately still relevant.

[iblech]

Awesome, thank you @SuperSandro2000!