<div dir="ltr"><font size="1">I am using Strongswan-5.5.2 with 4.4 Linux Kernel on two Debian systems. ESP tunnel establishment works as expected between two IPv4 endpoints. But ESP tunnel establishment between two IPv6 endpoints and observed following errors in strongswan logs during Quick Mode:</font><div><font size="1"><br></font></div><div><font size="1">--------------------------------------<br></font></div><div>
<p class="gmail-p1"><span class="gmail-s1"><font size="1">charon:<span class="gmail-Apple-converted-space"> </span>[<a href="http://authpriv.info">authpriv.info</a>] 14[NET] <2020::10_4.4.4.0/24-2020::20_3.3.3.0/24|1> received packet: from 2020::20[500] to 2020::10[500] (444 bytes)</font></span></p><p class="gmail-p1"><font size="1">charon:<span class="gmail-Apple-converted-space"> </span>[<a href="http://authpriv.info">authpriv.info</a>] 14[ENC] <2020::10_4.4.4.0/24-2020::20_3.3.3.0/24|1> parsed QUICK_MODE response 1674824392 [ HASH SA No KE ID ID ]</font></p>
<p class="gmail-p1"><span class="gmail-s1"><font size="1">charon:<span class="gmail-Apple-converted-space"> </span>[<a href="http://authpriv.info">authpriv.info</a>] 14[KNL] <2020::10_4.4.4.0/24-2020::20_3.3.3.0/24|1> received netlink error: Protocol not supported (93)</font></span></p>
<p class="gmail-p1"><span class="gmail-s1"><font size="1">charon:<span class="gmail-Apple-converted-space"> </span>[<a href="http://authpriv.info">authpriv.info</a>] 14[KNL] <2020::10_4.4.4.0/24-2020::20_3.3.3.0/24|1> unable to add SAD entry with SPI cb0cdfda</font></span></p>
<p class="gmail-p1"><span class="gmail-s1"><font size="1">charon:<span class="gmail-Apple-converted-space"> </span>[<a href="http://authpriv.info">authpriv.info</a>] 14[KNL] <2020::10_4.4.4.0/24-2020::20_3.3.3.0/24|1> received netlink error: Protocol not supported (93)</font></span></p>
<p class="gmail-p1"><span class="gmail-s1"><font size="1">charon:<span class="gmail-Apple-converted-space"> </span>[<a href="http://authpriv.info">authpriv.info</a>] 14[KNL] <2020::10_4.4.4.0/24-2020::20_3.3.3.0/24|1> unable to add SAD entry with SPI c1205b7d</font></span></p>
<p class="gmail-p1"><span class="gmail-s1"><font size="1">charon:<span class="gmail-Apple-converted-space"> </span>[<a href="http://authpriv.info">authpriv.info</a>] 14[IKE] <2020::10_4.4.4.0/24-2020::20_3.3.3.0/24|1> unable to install inbound and outbound IPsec SA (SAD) in kernel</font></span></p></div><div><font size="1">--------------------------------------</font></div><div><font size="1"><br></font></div><div><font size="1">here is the output of ipsec statusall:</font></div><div><p class="gmail-p1"><span class="gmail-s1"><font size="1">Status of IKE charon daemon (strongSwan 5.5.2, Linux 4.4.57, x86_64):</font></span></p><p class="gmail-p1"><span class="gmail-s1"><font size="1"><span class="gmail-Apple-converted-space"> </span>uptime: 20 minutes, since Aug 10 12:01:39 2017</font></span></p><p class="gmail-p1"><span class="gmail-s1"><font size="1"><span class="gmail-Apple-converted-space"> </span>malloc: sbrk 1480032, mmap 0, used 345280, free 1134752</font></span></p><p class="gmail-p1"><span class="gmail-s1"><font size="1"><span class="gmail-Apple-converted-space"> </span>worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 3</font></span></p><p class="gmail-p1"><span class="gmail-s1"><font size="1"><span class="gmail-Apple-converted-space"> </span>loaded plugins: charon aes des rc2 sha2 sha1 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf xcbc cmac hmac attr kernel-netlink resolve socket-default stroke vici updown xauth-generic</font></span></p><p class="gmail-p1"><span class="gmail-s1"><font size="1">Listening IP addresses:</font></span></p><p class="gmail-p1"><span class="gmail-s1"><font size="1"><span class="gmail-Apple-converted-space"> </span>2020::10</font></span></p><p class="gmail-p1"><span class="gmail-s1"><font size="1">Connections:</font></span></p><p class="gmail-p1"><span class="gmail-s1"><font size="1">2020::10_4.4.4.0/24-2020::20_3.3.3.0/24:<span class="gmail-Apple-converted-space"> </span>2020::10...2020::20<span class="gmail-Apple-converted-space"> </span>IKEv1, dpddelay=30s</font></span></p><p class="gmail-p1"><span class="gmail-s1"><font size="1">2020::10_4.4.4.0/24-2020::20_3.3.3.0/24: <span class="gmail-Apple-converted-space"> </span>local:<span class="gmail-Apple-converted-space"> </span>[2020::10] uses pre-shared key authentication</font></span></p><p class="gmail-p1"><span class="gmail-s1"><font size="1">2020::10_4.4.4.0/24-2020::20_3.3.3.0/24: <span class="gmail-Apple-converted-space"> </span>remote: [2020::20] uses pre-shared key authentication</font></span></p><p class="gmail-p1"><span class="gmail-s1"><font size="1">2020::10_4.4.4.0/24-2020::20_3.3.3.0/24: <span class="gmail-Apple-converted-space"> </span>child:<span class="gmail-Apple-converted-space"> </span><a href="http://4.4.4.0/24">4.4.4.0/24</a> === <a href="http://3.3.3.0/24">3.3.3.0/24</a> TUNNEL, dpdaction=restart</font></span></p><p class="gmail-p1"><span class="gmail-s1"><font size="1">Routed Connections:</font></span></p><p class="gmail-p1"><span class="gmail-s1"><font size="1">2020::10_4.4.4.0/24-2020::20_3.3.3.0/24{1}:<span class="gmail-Apple-converted-space"> </span>ROUTED, TUNNEL, reqid 1</font></span></p><p class="gmail-p1"><span class="gmail-s1"><font size="1">2020::10_4.4.4.0/24-2020::20_3.3.3.0/24{1}: <span class="gmail-Apple-converted-space"> </span><a href="http://4.4.4.0/24">4.4.4.0/24</a> === <a href="http://3.3.3.0/24">3.3.3.0/24</a></font></span></p><p class="gmail-p1"><span class="gmail-s1"><font size="1">Security Associations (1 up, 0 connecting):</font></span></p><p class="gmail-p1"><span class="gmail-s1"><font size="1">2020::10_4.4.4.0/24-2020::20_3.3.3.0/24[1]: ESTABLISHED 20 minutes ago, 2020::10[2020::10]...2020::20[2020::20]</font></span></p><p class="gmail-p1"><span class="gmail-s1"><font size="1">2020::10_4.4.4.0/24-2020::20_3.3.3.0/24[1]: IKEv1 SPIs: 23b31ae851f9bddb_i* bd1fcbc1681eb3ca_r, pre-shared key reauthentication in 7 hours</font></span></p><p class="gmail-p1">
</p><p class="gmail-p1"><span class="gmail-s1"><font size="1">2020::10_4.4.4.0/24-2020::20_3.3.3.0/24[1]: IKE proposal: AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048</font></span></p></div><div><font size="1">--------------------------------------<br></font></div><div><font size="1"><br></font></div><div><font size="1">ipsec.conf contents (peer contents are matching):</font></div><div><font size="1"><br></font></div><div><div><font size="1">conn %default</font></div><div><font size="1"> ikelifetime = 28800s</font></div><div><font size="1"> type = tunnel</font></div><div><font size="1"> lifetime = 3600s</font></div><div><font size="1"> dpddelay = 30</font></div><div><font size="1"> dpdaction = restart</font></div><div><font size="1"><br></font></div><div><font size="1">conn 2020::10_4.4.4.0/24-2020::20_3.3.3.0/24</font></div><div><font size="1"> left=2020::10</font></div><div><font size="1"> leftid=2020::10</font></div><div><font size="1"> rightid=2020::20</font></div><div><font size="1"> leftsubnet=<a href="http://4.4.4.0/24">4.4.4.0/24</a></font></div><div><font size="1"> right=2020::20</font></div><div><font size="1"> rightsubnet=<a href="http://3.3.3.0/24">3.3.3.0/24</a></font></div><div><font size="1"> authby=secret</font></div><div><font size="1"> keyexchange = ikev1</font></div><div><font size="1"> auto = start</font></div><div><font size="1"> fragmentation = yes</font></div><div><font size="1"> esp=aes128-sha1-modp2048</font></div><div><font size="1"> ike=aes128-sha1-modp2048!</font></div></div><div><font size="1"><br></font></div><div><font size="1">--------------------------------------<br></font></div><div><font size="1"><br></font></div><div><font size="1">From the logs it looks like the required XFRM modules related to IPv6 support are not pre-loaded by strongSwan.</font></div><div><font size="1">Therefore I manually loaded the missing kernel modules related to XFRM6 viz. ah6, esp6, ipcomp6, xfrm6_tunnel, xfrm6_mode_tunnel, xfrm6_mode_transport, ip6_tunnel. However it didn't result in success of IPv6 SA download.</font></div><div><font size="1"><br></font></div><div><font size="1">Finally I built all the features recommended at <a href="https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules">https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules</a> as statically-linked in kernel instead of as modules, and then the IPv6 SA download was successful with the new kernel.</font></div><div><font size="1"><br></font></div><div><font size="1">This makes me think auto-loading of Ipv6 related xfrm modules is missing in strongSwan. I found the following lines in it's source file src/starter/netkey.c</font></div><div><font size="1">...</font></div><div><font size="1"><br></font></div><div><font size="1"> /* make sure that all required IPsec modules are loaded */</font></div><div><font size="1"> if (stat(PROC_MODULES, &stb) == 0)</font></div><div><font size="1"> {</font></div><div><font size="1"> ignore_result(system("modprobe -qv ah4"));</font></div><div><font size="1"> ignore_result(system("modprobe -qv esp4"));</font></div><div><font size="1"> ignore_result(system("modprobe -qv ipcomp"));</font></div><div><font size="1"> ignore_result(system("modprobe -qv xfrm4_tunnel"));</font></div><div><font size="1"> ignore_result(system("modprobe -qv xfrm_user"));</font></div><div><font size="1"> } </font></div><div><font size="1">...</font></div><div><font size="1">Shouldn't it be doing modprobe for ipv6 related xfrm modules? </font></div><div><font size="1"><br></font></div><div><font size="1">Can someone point out the exact modules required to be loaded so that IPv6 SA download by charon succeeds. </font></div><div><font size="1"><br></font></div><div><font size="1">Thanks & regards,</font></div><div><font size="1">Sandesh Sawant</font></div></div>