Description:

ipsec-tools uses autoconf to detect if it's running on a version of linux that requires separate forwarding rules for tunnels. Unfortunately the kernel headers conflict with some of the glibc headers. This causes compilation of the feature check to fail, which autoconf interprets as the feature being missing, so the package is built without the necessary forwarding support.

In any case, ipsec-tools only needs the kernel API headers, not the full kernel headers. If '--with-kernel-headers=/usr/include' is passed to configure instead, it will build correctly, with forwarding support enabled.


Steps to reproduce:

The simplest way to check if ipsec-tools was configured correctly for recent linux versions is to run 'sudo setkey -k'. If it prints 'warning: -r and -k options are not supported in this environment', then the package was built incorrectly.