<div dir="ltr"><div><div><br></div></div><div class="gmail_extra"><div class="gmail_quote">On Sun, May 3, 2015 at 5:30 PM, Andreas Steffen <span dir="ltr"><<a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">Hi Alex,<br>
<br>
charon does not load the pubkey plugin and is therefore not able to<br>
process raw RSA public keys. Are you using an explicit<br>
<br>
charon {<br>
load =<br>
}<br>
<br>
statement in /etc/strongswan.conf where pubkey is missing?<br>
<br>
Best regards<br>
<br>
Andreas<div><div class="h5"><br></div></div></blockquote><div><br></div><div>Hi Andreas,<div><br></div><div>long story short yes I missed the plugin. Below more details.</div><div>BTW I think I increased the verbosity of the cfg module but still the information was poor (just "loading public key.... failed")</div><div>Is there a way to get more meaningful output from the cfg module and how?</div><div><br></div><div><div>Many thanks for spotting what the root cause was :-)</div></div><div><br></div><div>Alex</div><div><br></div><div>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br></div><div><br></div><div>My strongswan.conf was as follows</div><div><br></div><div><div>charon {</div><div> load_modular = yes</div><div> plugins {</div><div> include strongswan.d/charon/*.conf</div><div> }</div><div>}</div><div><br></div><div>include strongswan.d/*.conf</div></div></div><div><br></div><div>As per <a href="https://wiki.strongswan.org/projects/strongswan/wiki/Pluginlist">https://wiki.strongswan.org/projects/strongswan/wiki/Pluginlist</a> the plugin pubkey should have been loaded by default</div><div><br></div><div>The logs when I start ipsec (ipsec start) were as follows</div><div><br></div><div><div>May 2 16:20:03 ubuntu charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.1.2, Linux 3.16.0-36-generic, x86_64)</div><div>May 2 16:20:03 ubuntu charon: 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'</div><div>May 2 16:20:03 ubuntu charon: 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'</div><div>May 2 16:20:03 ubuntu charon: 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'</div><div>May 2 16:20:03 ubuntu charon: 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'</div><div>May 2 16:20:03 ubuntu charon: 00[CFG] loading crls from '/etc/ipsec.d/crls'</div><div>May 2 16:20:03 ubuntu charon: 00[CFG] loading secrets from '/etc/ipsec.secrets'</div><div>May 2 16:20:03 ubuntu charon: 00[CFG] loaded RSA private key from '/etc/ipsec.d/private/ubuntu_prv.key'</div><div>May 2 16:20:03 ubuntu charon: 00[LIB] loaded plugins: charon addrblock attr ccm cmac constraints ctr eap-identity gcm md4 openssl pkcs12 pkcs7 pkcs8 rc2 resolve sha1 test-vectors xcbc sha2 md5 aes hmac pem pkcs1 x509 revocation random nonce kernel-netlink socket-default updown stroke</div><div>May 2 16:20:03 ubuntu charon: 00[LIB] unable to load 5 plugin features (5 due to unmet dependencies)</div><div>May 2 16:20:03 ubuntu charon: 00[LIB] dropped capabilities, running as uid 0, gid 0</div><div>May 2 16:20:03 ubuntu charon: 00[JOB] spawning 16 worker threads</div><div>May 2 16:20:03 ubuntu charon: 11[CFG] received stroke: add connection 'gre-ipsec'</div><div>May 2 16:20:03 ubuntu charon: 11[LIB] building CRED_CERTIFICATE - TRUSTED_PUBKEY failed, tried 0 builders</div><div>May 2 16:20:03 ubuntu charon: 11[CFG] loading public key for "192.168.72.144" from '/etc/ipsec.d/R14_pub.key' failed</div><div>May 2 16:20:03 ubuntu charon: 11[CFG] added configuration 'gre-ipsec'</div></div><div><br></div><div>I didn't see pubkey loaded. And it was not installed either (Ubuntu 14.04.2 LTS)</div><div><br></div><div><div>p strongswan-plugin-pubkey - strongSwan plugin for raw public keys</div></div><div><br></div><div>After installing it, everything went OK<br><br><div>May 2 16:23:55 ubuntu charon: 11[CFG] loaded RSA public key for "192.168.72.144" from '/etc/ipsec.d/R14_pub.key'</div></div><div><br></div><div>FYI when the plugin was mentioned in strongswan.conf** but not installed I saw this in the syslog</div><div><br></div><div><div>May 2 16:12:33 ubuntu charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.1.2, Linux 3.16.0-36-generic, x86_64)</div><div>May 2 16:12:33 ubuntu kernel: [88688.272922] charon[15413]: segfault at 0 ip 00007f49ba144aea sp 00007ffc51d184a8 error 4 in <a href="http://libc-2.19.so">libc-2.19.so</a>[7f49ba0bc000+1bb000]</div></div><div><br></div><div><br></div><div>**<br></div><div><div>charon {</div><div> load_modular = yes</div><div> plugins {</div><div> pubkey<br></div><div> include strongswan.d/charon/*.conf</div><div> }</div><div>}</div></div><div><br></div></div></div></div>