Hi,<br><br>I try to switch "Racoon" to "strongswan" on some Power PC machines, I met a "<a href="mailto:esp.5dd3baaa@10.19.156.194">esp.5dd3baaa@10.19.156.194</a> included errno 93: Protocol not support" netlink error in "tunnel mode" when strongwan try to build CHILD SA. strongswan IKEv2 charon also has a similar problem on my machines in "tunnel" mode:"add sa", kernel return "protocol not support".<br>
<br>I use the latest version of strongswan 4.3.6.<br><br>ERROR: netlink response for Add SA <a href="mailto:esp.383251e8@10.19.156.242">esp.383251e8@10.19.156.242</a> included errno 93: Protocol not supported<br><br>....<br>
Apr 12 02:23:23 localhost pluto[25980]: | install_inbound_ipsec_sa() checking if we can route<br>Apr 12 02:23:23 localhost pluto[25980]: | route owner of "host-host" unrouted: NULL; eroute owner: NULL<br>Apr 12 02:23:23 localhost pluto[25980]: | kernel_alg_esp_info():transid=12, auth=2, ei=0x10086cc8, enckeylen=32, authkeylen=20, encryptalg=12, authalg=3<br>
Apr 12 02:23:23 localhost pluto[25980]: | configured authentication algorithm DES_MAC with key size 160<br>Apr 12 02:23:23 localhost pluto[25980]: | configured esp encryption algorithm AES_CBC with key size 128<br>Apr 12 02:23:23 localhost pluto[25980]: | req.p.mode = 1; req.p.family = 2; req.p.flags = 32; req.p.id.spi = 942821864; req.p.id.proto = 50; req.p.sel.family = 0; req.p.sel.proto = 0<br>
Apr 12 02:23:23 localhost pluto[25980]: "host-host" #2: ERROR: netlink response for Add SA <a href="mailto:esp.383251e8@10.19.156.242">esp.383251e8@10.19.156.242</a> included errno 93: Protocol not supported<br>
Apr 12 02:23:23 localhost pluto[25980]: | state transition function for STATE_QUICK_R0 had internal error<br>Apr 12 02:23:23 localhost pluto[25980]: | next event EVENT_SO_DISCARD in 0 seconds for #2<br>Apr 12 02:23:23 localhost pluto[25980]: | <br>
Apr 12 02:23:23 localhost pluto[25980]: | *time to handle event<br>Apr 12 02:23:23 localhost pluto[25980]: | event after this is EVENT_REINIT_SECRET in 3476 seconds<br>Apr 12 02:23:23 localhost pluto[25980]: | ICOOKIE: 63 de a2 6a 57 3b ff bb<br>
Apr 12 02:23:23 localhost pluto[25980]: | RCOOKIE: 2d cb 1f a4 81 d6 ec 1e<br>Apr 12 02:23:23 localhost pluto[25980]: | peer: 0a 13 9c c2<br>Apr 12 02:23:23 localhost pluto[25980]: | state hash entry 8<br>Apr 12 02:23:23 localhost pluto[25980]: | next event EVENT_REINIT_SECRET in 3476 seconds<br>
Apr 12 02:23:33 localhost pluto[25980]: | <br>...<br><br>"Apr 12 02:23:23 localhost pluto[25980]: | req.p.mode = 1; req.p.family = 2; req.p.flags = 32; req.p.id.spi = 942821864; req.p.id.proto = 50; req.p.sel.family = 0; req.p.sel.proto = 0" is something I print out before netlink_add_sa() try to send_netlink_msg "add SA" to Kernel, the prarameter looks fine.<br>
<br>I have no idea whether there are some different kernel modules requirement between "Racoon" and "strongswan", but I'm sure "Racoon" works well with "tunnel mode" on those machines. <br>
Kernel configuration(network related):<br>CONFIG_PACKET y<br>CONFIG_PACKET_MMAP y<br>CONFIG_UNIX y<br>CONFIG_XFRM y<br>CONFIG_XFRM_USER y<br>CONFIG_XFRM_SUB_POLICY not set<br>CONFIG_XFRM_MIGRATE y<br>
CONFIG_XFRM_STATISTICS not set<br>CONFIG_XFRM_IPCOMP y<br>CONFIG_NET_KEY y<br>CONFIG_NET_KEY_MIGRATE not set<br>CONFIG_INTERPEAK not set<br>CONFIG_INET y<br>CONFIG_IP_MULTICAST not set<br>CONFIG_IP_ADVANCED_ROUTER not set<br>
CONFIG_IP_FIB_HASH y<br>CONFIG_IP_PNP y<br>CONFIG_IP_PNP_DHCP not set<br>CONFIG_IP_PNP_BOOTP not set<br>CONFIG_IP_PNP_RARP not set<br>CONFIG_NET_IPIP not set<br>CONFIG_NET_IPGRE y<br>CONFIG_ARPD not set<br>
CONFIG_SYN_COOKIES y<br>CONFIG_INET_AH y<br>CONFIG_INET_ESP y<br>CONFIG_INET_IPCOMP y<br>CONFIG_INET_XFRM_TUNNEL y<br>CONFIG_INET_TUNNEL y<br>CONFIG_IPSEC_NAT_TRAVERSAL not set<br>CONFIG_INET_XFRM_MODE_TRANSPORT y<br>
CONFIG_INET_XFRM_MODE_TUNNEL y<br>CONFIG_INET_XFRM_MODE_BEET y<br>CONFIG_INET_LRO not set<br>CONFIG_INET_DIAG not set<br>CONFIG_TCP_CONG_ADVANCED not set<br>CONFIG_TCP_CONG_CUBIC y<br>CONFIG_DEFAULT_TCP_CONG cubic<br>
CONFIG_TCP_MD5SIG not set<br>CONFIG_IP_VS not set<br>CONFIG_IPV6 not set<br>CONFIG_NETLABEL not set<br>CONFIG_NETWORK_SECMARK y<br>CONFIG_NETFILTER y<br>CONFIG_NETFILTER_DEBUG not set<br>CONFIG_NETFILTER_ADVANCED y<br>
<br><br>"Racoon" works well with "tunnel mode" on those machines.<br><br>root@hapWibbSc2:/etc# racoon -f racoon.conf.eric <br>root@hapWibbSc2:/etc# setkey -f setkey.conf.eric <br>root@hapWibbSc2:/etc# ping 10.19.156.194<br>
PING 10.19.156.194 (10.19.156.194) 56(84) bytes of data.<br>64 bytes from <a href="http://10.19.156.194">10.19.156.194</a>: icmp_seq=2 ttl=64 time=0.615 ms<br>64 bytes from <a href="http://10.19.156.194">10.19.156.194</a>: icmp_seq=3 ttl=64 time=0.457 ms<br>
<br>--- 10.19.156.194 ping statistics ---<br>3 packets transmitted, 2 received, 33% packet loss, time 2956ms<br>rtt min/avg/max/mdev = 0.457/0.536/0.615/0.079 ms<br>root@hapWibbSc2:/etc# <br>root@hapWibbSc2:/etc# setkey -D <br>
10.19.156.194 10.19.156.242 <br> esp mode=tunnel spi=136801471(0x08276cbf) reqid=0(0x00000000)<br> E: aes-cbc c5e0faea b1073d16 d6d12bdb 193e7cd2<br> A: hmac-sha1 d3025a94 b3e1dee2 9b6db08d d6136242 4f4cbf77<br>
seq=0x00000000 replay=4 flags=0x00000000 state=mature <br> created: Mar 1 18:50:20 2000 current: Mar 1 18:50:30 2000<br> diff: 10(s) hard: 28800(s) soft: 23040(s)<br> last: Mar 1 18:50:21 2000 hard: 0(s) soft: 0(s)<br>
current: 168(bytes) hard: 0(bytes) soft: 0(bytes)<br> allocated: 2 hard: 0 soft: 0<br> sadb_seq=1 pid=25939 refcnt=0<br>10.19.156.242 10.19.156.194 <br> esp mode=tunnel spi=240066640(0x0e4f2050) reqid=0(0x00000000)<br>
E: aes-cbc 7336dbd0 ff041a4d c339915f 27f29a75<br> A: hmac-sha1 d24d61d1 3ae183a4 01bfc0c4 4310534f 93bbb833<br> seq=0x00000000 replay=4 flags=0x00000000 state=mature <br> created: Mar 1 18:50:20 2000 current: Mar 1 18:50:30 2000<br>
diff: 10(s) hard: 28800(s) soft: 23040(s)<br> last: Mar 1 18:50:20 2000 hard: 0(s) soft: 0(s)<br> current: 252(bytes) hard: 0(bytes) soft: 0(bytes)<br> allocated: 3 hard: 0 soft: 0<br>
sadb_seq=0 pid=25939 refcnt=0<br><br><br>