<br>I checked the Kernel code used by my hosts, it's 2.6.27, it seems to be there is a bug in this version Kernel source code when IPV6 is disabled on hosts, and it has been fixed in later Kernel version.<br><br>
<div><font face="Arial" size="2"><span>/net/xfrm/xfrm_state.c:</span></font></div>
<div><font face="Arial" size="2"><span></span></font> </div>
<div><font face="Arial" size="2"><span>Function
xfrm_init_state(), line 2024 to 2035:</span></font></div>
<div><font face="Arial" size="2"><span></span></font> </div>
<div><font face="Arial" size="2"><span>...</span></font></div>
<div><font face="Arial" size="2"><span> inner_mode =
xfrm_get_mode(x->props.mode, AF_INET);<br> if (inner_mode ==
NULL)<br> goto error;</span></font></div>
<div> </div>
<div><font face="Arial" size="2"><span> if
(!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL))
{<br> xfrm_put_mode(inner_mode);<br> goto error;<br> }</span></font></div>
<div> </div>
<div><font face="Arial" size="2"><span> inner_mode_iaf =
xfrm_get_mode(x->props.mode, AF_INET6);<br> if (inner_mode_iaf ==
NULL)<br> goto error;<br>.....<br><br>On my hosts, IPv6 is disable, </span></font><font face="Arial" size="2"><span>inner_mode_iaf
==
NULL will be true, </span></font>this function will return error.<br><br><font face="Arial" size="2"><span>The code has changed in latest Kernel version 2.6.31, but I didn't find the detailed patch info about this modification:<br>
</span></font><div>
<font face="Arial" size="2"><span>...</span></font></div>
<div><font face="Arial" size="2"><span> inner_mode =
xfrm_get_mode(x->props.mode, x->props.family);<br> if (inner_mode ==
NULL)<br> goto error;</span></font></div>
<div> </div>
<div><font face="Arial" size="2"><span> if
(!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL))
{<br> xfrm_put_mode(inner_mode);<br> goto
error;<br> }<br> x->inner_mode = inner_mode;</span></font></div>
<div> </div>
<div><font face="Arial" size="2"><span> if
(x->props.family == AF_INET)<br> iafamily = AF_INET6;</span></font></div>
<div> </div>
<div><font face="Arial" size="2"><span> inner_mode_iaf =
xfrm_get_mode(x->props.mode, iafamily);<br> if (inner_mode_iaf) {<br> if
(inner_mode_iaf->flags &
XFRM_MODE_FLAG_TUNNEL)<br> x->inner_mode_iaf =
inner_mode_iaf;<br> else<br> xfrm_put_mode(inner_mode_iaf);<br> }</span></font></div>
<div><font face="Arial" size="2"><span>....</span></font></div><br></div><br><br><br><br><div class="gmail_quote">On Mon, Apr 12, 2010 at 5:38 PM, MingM Xia <span dir="ltr"><<a href="mailto:macguffin.xia@gmail.com" target="_blank">macguffin.xia@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">Hi,<br><br>I try to switch "Racoon" to "strongswan" on some Power PC machines, I met a "<a href="mailto:esp.5dd3baaa@10.19.156.194" target="_blank">esp.5dd3baaa@10.19.156.194</a> included errno 93: Protocol not support" netlink error in "tunnel mode" when strongwan try to build CHILD SA. strongswan IKEv2 charon also has a similar problem on my machines in "tunnel" mode:"add sa", kernel return "protocol not support".<br>
<br>I use the latest version of strongswan 4.3.6.<br><br>ERROR: netlink response for Add SA <a href="mailto:esp.383251e8@10.19.156.242" target="_blank">esp.383251e8@10.19.156.242</a> included errno 93: Protocol not supported<br>
<br>....<br>
Apr 12 02:23:23 localhost pluto[25980]: | install_inbound_ipsec_sa() checking if we can route<br>Apr 12 02:23:23 localhost pluto[25980]: | route owner of "host-host" unrouted: NULL; eroute owner: NULL<br>Apr 12 02:23:23 localhost pluto[25980]: | kernel_alg_esp_info():transid=12, auth=2, ei=0x10086cc8, enckeylen=32, authkeylen=20, encryptalg=12, authalg=3<br>
Apr 12 02:23:23 localhost pluto[25980]: | configured authentication algorithm DES_MAC with key size 160<br>Apr 12 02:23:23 localhost pluto[25980]: | configured esp encryption algorithm AES_CBC with key size 128<br>Apr 12 02:23:23 localhost pluto[25980]: | req.p.mode = 1; req.p.family = 2; req.p.flags = 32; req.p.id.spi = 942821864; req.p.id.proto = 50; req.p.sel.family = 0; req.p.sel.proto = 0<br>
Apr 12 02:23:23 localhost pluto[25980]: "host-host" #2: ERROR: netlink response for Add SA <a href="mailto:esp.383251e8@10.19.156.242" target="_blank">esp.383251e8@10.19.156.242</a> included errno 93: Protocol not supported<br>
Apr 12 02:23:23 localhost pluto[25980]: | state transition function for STATE_QUICK_R0 had internal error<br>Apr 12 02:23:23 localhost pluto[25980]: | next event EVENT_SO_DISCARD in 0 seconds for #2<br>Apr 12 02:23:23 localhost pluto[25980]: | <br>
Apr 12 02:23:23 localhost pluto[25980]: | *time to handle event<br>Apr 12 02:23:23 localhost pluto[25980]: | event after this is EVENT_REINIT_SECRET in 3476 seconds<br>Apr 12 02:23:23 localhost pluto[25980]: | ICOOKIE: 63 de a2 6a 57 3b ff bb<br>
Apr 12 02:23:23 localhost pluto[25980]: | RCOOKIE: 2d cb 1f a4 81 d6 ec 1e<br>Apr 12 02:23:23 localhost pluto[25980]: | peer: 0a 13 9c c2<br>Apr 12 02:23:23 localhost pluto[25980]: | state hash entry 8<br>Apr 12 02:23:23 localhost pluto[25980]: | next event EVENT_REINIT_SECRET in 3476 seconds<br>
Apr 12 02:23:33 localhost pluto[25980]: | <br>...<br><br>"Apr 12 02:23:23 localhost pluto[25980]: | req.p.mode = 1; req.p.family = 2; req.p.flags = 32; req.p.id.spi = 942821864; req.p.id.proto = 50; req.p.sel.family = 0; req.p.sel.proto = 0" is something I print out before netlink_add_sa() try to send_netlink_msg "add SA" to Kernel, the prarameter looks fine.<br>
<br>I have no idea whether there are some different kernel modules requirement between "Racoon" and "strongswan", but I'm sure "Racoon" works well with "tunnel mode" on those machines. <br>
Kernel configuration(network related):<br>CONFIG_PACKET y<br>CONFIG_PACKET_MMAP y<br>CONFIG_UNIX y<br>CONFIG_XFRM y<br>CONFIG_XFRM_USER y<br>CONFIG_XFRM_SUB_POLICY not set<br>CONFIG_XFRM_MIGRATE y<br>
CONFIG_XFRM_STATISTICS not set<br>CONFIG_XFRM_IPCOMP y<br>CONFIG_NET_KEY y<br>CONFIG_NET_KEY_MIGRATE not set<br>CONFIG_INTERPEAK not set<br>CONFIG_INET y<br>CONFIG_IP_MULTICAST not set<br>CONFIG_IP_ADVANCED_ROUTER not set<br>
CONFIG_IP_FIB_HASH y<br>CONFIG_IP_PNP y<br>CONFIG_IP_PNP_DHCP not set<br>CONFIG_IP_PNP_BOOTP not set<br>CONFIG_IP_PNP_RARP not set<br>CONFIG_NET_IPIP not set<br>CONFIG_NET_IPGRE y<br>CONFIG_ARPD not set<br>
CONFIG_SYN_COOKIES y<br>CONFIG_INET_AH y<br>CONFIG_INET_ESP y<br>CONFIG_INET_IPCOMP y<br>CONFIG_INET_XFRM_TUNNEL y<br>CONFIG_INET_TUNNEL y<br>CONFIG_IPSEC_NAT_TRAVERSAL not set<br>CONFIG_INET_XFRM_MODE_TRANSPORT y<br>
CONFIG_INET_XFRM_MODE_TUNNEL y<br>CONFIG_INET_XFRM_MODE_BEET y<br>CONFIG_INET_LRO not set<br>CONFIG_INET_DIAG not set<br>CONFIG_TCP_CONG_ADVANCED not set<br>CONFIG_TCP_CONG_CUBIC y<br>CONFIG_DEFAULT_TCP_CONG cubic<br>
CONFIG_TCP_MD5SIG not set<br>CONFIG_IP_VS not set<br>CONFIG_IPV6 not set<br>CONFIG_NETLABEL not set<br>CONFIG_NETWORK_SECMARK y<br>CONFIG_NETFILTER y<br>CONFIG_NETFILTER_DEBUG not set<br>CONFIG_NETFILTER_ADVANCED y<br>
<br><br>"Racoon" works well with "tunnel mode" on those machines.<br><br>root@hapWibbSc2:/etc# racoon -f racoon.conf.eric <br>root@hapWibbSc2:/etc# setkey -f setkey.conf.eric <br>root@hapWibbSc2:/etc# ping 10.19.156.194<br>
PING 10.19.156.194 (10.19.156.194) 56(84) bytes of data.<br>64 bytes from <a href="http://10.19.156.194" target="_blank">10.19.156.194</a>: icmp_seq=2 ttl=64 time=0.615 ms<br>64 bytes from <a href="http://10.19.156.194" target="_blank">10.19.156.194</a>: icmp_seq=3 ttl=64 time=0.457 ms<br>
<br>--- 10.19.156.194 ping statistics ---<br>3 packets transmitted, 2 received, 33% packet loss, time 2956ms<br>rtt min/avg/max/mdev = 0.457/0.536/0.615/0.079 ms<br>root@hapWibbSc2:/etc# <br>root@hapWibbSc2:/etc# setkey -D <br>
10.19.156.194 10.19.156.242 <br> esp mode=tunnel spi=136801471(0x08276cbf) reqid=0(0x00000000)<br> E: aes-cbc c5e0faea b1073d16 d6d12bdb 193e7cd2<br> A: hmac-sha1 d3025a94 b3e1dee2 9b6db08d d6136242 4f4cbf77<br>
seq=0x00000000 replay=4 flags=0x00000000 state=mature <br> created: Mar 1 18:50:20 2000 current: Mar 1 18:50:30 2000<br> diff: 10(s) hard: 28800(s) soft: 23040(s)<br> last: Mar 1 18:50:21 2000 hard: 0(s) soft: 0(s)<br>
current: 168(bytes) hard: 0(bytes) soft: 0(bytes)<br> allocated: 2 hard: 0 soft: 0<br> sadb_seq=1 pid=25939 refcnt=0<br>10.19.156.242 10.19.156.194 <br> esp mode=tunnel spi=240066640(0x0e4f2050) reqid=0(0x00000000)<br>
E: aes-cbc 7336dbd0 ff041a4d c339915f 27f29a75<br> A: hmac-sha1 d24d61d1 3ae183a4 01bfc0c4 4310534f 93bbb833<br> seq=0x00000000 replay=4 flags=0x00000000 state=mature <br> created: Mar 1 18:50:20 2000 current: Mar 1 18:50:30 2000<br>
diff: 10(s) hard: 28800(s) soft: 23040(s)<br> last: Mar 1 18:50:20 2000 hard: 0(s) soft: 0(s)<br> current: 252(bytes) hard: 0(bytes) soft: 0(bytes)<br> allocated: 3 hard: 0 soft: 0<br>
sadb_seq=0 pid=25939 refcnt=0<br><br><br>
</blockquote></div><br>