<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">You want <span style="background-color: rgb(255, 255, 255);" class=""><font face="Courier New" class="">--disable-curve25519 to be --</font></span><span style="background-color: rgb(255, 255, 255);" class=""><font face="Courier New" class="">enable-curve25519</font></span><div class=""><font face="Courier New" class=""><span style="background-color: rgb(255, 255, 255);" class=""><br class=""></span></font></div><div class=""><font face="Courier New" class=""><span style="background-color: rgb(255, 255, 255);" class="">EKG</span></font></div><div class=""><font face="Courier New" class=""><span style="background-color: rgb(255, 255, 255);" class=""><br class=""></span></font><div><blockquote type="cite" class=""><div class="">On Aug 30, 2017, at 4:24 AM, Gyula Kovács <<a href="mailto:gyula.kovacs.kkb.tech@gmail.com" class="">gyula.kovacs.kkb.tech@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<meta http-equiv="content-type" content="text/html; charset=utf-8" class="">
<div text="#000000" bgcolor="#FFFFFF" class="">
<font face="Courier New" class="">Hi All,<br class="">
<br class="">
I've just updated strongSwan from 5.5.1 to 5.6.0.<br class="">
After the update, I got the "configured DH group CURVE_25519 not
supported" error message.<br class="">
The target was working fine before the update, the configuration
files were not changed during the update.<br class="">
I found some information on the internet, so I know that
Curve25519 support was introduced in 5.5.2.<br class="">
I checked the build configuration options, and disabled the
curve25519 support (--disable-curve25519), but it did not help.<br class="">
I have no idea what might cause the problem.<br class="">
Any help would be appreciated.<br class="">
<br class="">
Best regards,<br class="">
Gyula Kovacs<br class="">
<br class="">
I added the technical details here.<br class="">
<br class="">
Target system:<br class="">
- Linux 3.18.31 #1 PREEMPT Tue Aug 29 12:27:09 CEST 2017 armv7l
GNU/Linux<br class="">
- OpenSSL 1.0.2l 25 May 2017<br class="">
- strongSwan configuration options:<br class="">
--build=x86_64-linux --host=arm-oe-linux-gnueabi
--target=arm-oe-linux-gnueabi<br class="">
--prefix=/usr --exec_prefix=/usr --bindir=/usr/bin
--sbindir=/usr/sbin<br class="">
--libexecdir=/usr/lib/strongswan --datadir=/usr/share
--sysconfdir=/etc<br class="">
--sharedstatedir=/com --localstatedir=/var --libdir=/usr/lib
--includedir=/usr/include<br class="">
--oldincludedir=/usr/include --infodir=/usr/share/info
--mandir=/usr/share/man<br class="">
--disable-silent-rules --disable-dependency-tracking
--with-libtool-sysroot=/oe-core/build/tmp-glibc/sysroots/xxxxxxxx<br class="">
--without-lib-prefix --without-systemdsystemunitdir
--disable-aesni --enable-charon --enable-curl --disable-curve25519<br class="">
--enable-gmp --disable-ldap --disable-mysql --enable-openssl
--disable-scepclient --disable-soup --enable-sqlite<br class="">
--enable-stroke --disable-swanctl --disable-systemd<br class="">
<br class="">
Opponent:<br class="">
</font><font face="Courier New" class="">- Linux 3.16.0-4-586 #1 Debian
3.16.43-2 (2017-04-30) i686 GNU/Linux<br class="">
- OpenSSL 1.0.1t 3 May 2016<br class="">
</font><font face="Courier New" class=""><font face="Courier New" class=""><font face="Courier New" class="">- strongSwan configuration options:</font><br class="">
./configure --prefix=/usr --sysconfdir=/etc
--disable-curve25519<br class="">
</font><br class="">
Error message:<br class="">
root@mdm9640:~# ipsec up host-host-psk-lan<br class="">
initiating IKE_SA host-host-psk-lan[1] to 160.48.99.124<br class="">
configured DH group CURVE_25519 not supported<br class="">
tried to checkin and delete nonexisting IKE_SA<br class="">
establishing connection 'host-host-psk-lan' failed<br class="">
root@mdm9640:~#<br class="">
<br class="">
root@mdm9640:~# ipsec statusall<br class="">
Status of IKE charon daemon (strongSwan 5.6.0, Linux 3.18.31,
armv7l):<br class="">
uptime: 13 seconds, since Jan 01 00:01:30 1970<br class="">
malloc: sbrk 540672, mmap 0, used 229400, free 311272<br class="">
worker threads: 11 of 16 idle, 5/0/0/0 working, job queue:
0/0/0/0, scheduled: 0<br class="">
loaded plugins: charon aes des rc2 sha2 sha1 md5 random nonce
x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp
dnskey sshkey pem openssl gmp xcbc cmac hmac curl sqlite attr
kernel-netlink resolve socket-default stroke vici updown
xauth-generic<br class="">
Listening IP addresses:<br class="">
160.48.99.98<br class="">
160.48.199.98<br class="">
Connections:<br class="">
host-host-psk-lan: 160.48.99.98...160.48.99.124 IKEv2<br class="">
host-host-psk-lan: local: [160.48.99.98] uses pre-shared key
authentication<br class="">
host-host-psk-lan: remote: [160.48.99.124] uses pre-shared key
authentication<br class="">
host-host-psk-lan: child: dynamic === dynamic TRANSPORT<br class="">
Security Associations (0 up, 0 connecting):<br class="">
none<br class="">
root@mdm9640:~#<br class="">
<br class="">
Log files:<br class="">
root@mdm9640:~# cat /var/log/charon.log<br class="">
Jan 1 00:03:35 00[DMN] Starting IKE charon daemon (strongSwan
5.6.0, Linux 3.18.31, armv7l)<br class="">
Jan 1 00:03:35 00[CFG] loading ca certificates from
'/etc/ipsec.d/cacerts'<br class="">
Jan 1 00:03:35 00[CFG] loading aa certificates from
'/etc/ipsec.d/aacerts'<br class="">
Jan 1 00:03:35 00[CFG] loading ocsp signer certificates from
'/etc/ipsec.d/ocspcerts'<br class="">
Jan 1 00:03:35 00[CFG] loading attribute certificates from
'/etc/ipsec.d/acerts'<br class="">
Jan 1 00:03:35 00[CFG] loading crls from '/etc/ipsec.d/crls'<br class="">
Jan 1 00:03:35 00[CFG] loading secrets from '/etc/ipsec.secrets'<br class="">
Jan 1 00:03:35 00[CFG] loaded IKE secret for 160.48.99.124<br class="">
Jan 1 00:03:35 00[CFG] loaded IKE secret for 160.48.199.124<br class="">
Jan 1 00:03:35 00[CFG] loaded RSA private key from
'/etc/ipsec.d/private/ATM-02_IPsec-internal.key'<br class="">
Jan 1 00:03:35 00[CFG] loaded RSA private key from
'/etc/ipsec.d/private/ATM-02_IPsec-internal.key'<br class="">
Jan 1 00:03:35 00[LIB] loaded plugins: charon aes des rc2 sha2
sha1 md5 random nonce x509 revocation constraints pubkey pkcs1
pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl gmp xcbc cmac
hmac curl sqlite attr kernel-netlink resolve socket-default stroke
vici updown xauth-generic<br class="">
Jan 1 00:03:35 00[JOB] spawning 16 worker threads<br class="">
Jan 1 00:03:35 05[CFG] received stroke: add connection
'host-host-psk-lan'<br class="">
Jan 1 00:03:35 05[CFG] added configuration 'host-host-psk-lan'<br class="">
Jan 1 00:03:54 07[CFG] received stroke: initiate
'host-host-psk-lan'<br class="">
Jan 1 00:03:54 09[IKE] <host-host-psk-lan|1> initiating
IKE_SA host-host-psk-lan[1] to 160.48.99.124<br class="">
Jan 1 00:03:54 09[IKE] <host-host-psk-lan|1> configured DH
group CURVE_25519 not supported<br class="">
Jan 1 00:03:54 09[MGR] <host-host-psk-lan|1> tried to
checkin and delete nonexisting IKE_SA<br class="">
Jan 1 00:04:02 00[DMN] signal of type SIGINT received. Shutting
down<br class="">
root@mdm9640:~#<br class="">
<br class="">
Aug 30 10:12:51 mgu charon: 00[DMN] Starting IKE charon daemon
(strongSwan 5.6.0, Linux 3.16.0-4-586, i686)<br class="">
Aug 30 10:12:51 mgu charon: 00[CFG] loading ca certificates from
'/etc/ipsec.d/cacerts'<br class="">
Aug 30 10:12:51 mgu charon: 00[CFG] loading aa certificates from
'/etc/ipsec.d/aacerts'<br class="">
Aug 30 10:12:51 mgu charon: 00[CFG] loading ocsp signer
certificates from '/etc/ipsec.d/ocspcerts'<br class="">
Aug 30 10:12:51 mgu charon: 00[CFG] loading attribute certificates
from '/etc/ipsec.d/acerts'<br class="">
Aug 30 10:12:51 mgu charon: 00[CFG] loading crls from
'/etc/ipsec.d/crls'<br class="">
Aug 30 10:12:51 mgu charon: 00[CFG] loading secrets from
'/etc/ipsec.secrets'<br class="">
Aug 30 10:12:51 mgu charon: 00[CFG] loaded IKE secret for
160.48.99.98<br class="">
Aug 30 10:12:51 mgu charon: 00[CFG] loaded IKE secret for
160.48.199.98<br class="">
Aug 30 10:12:51 mgu charon: 00[CFG] loaded RSA private key from
'/etc/ipsec.d/private/MGU_01_IPsec-internal.key'<br class="">
Aug 30 10:12:51 mgu charon: 00[CFG] loaded RSA private key from
'/etc/ipsec.d/private/MGU_01_IPsec-internal.key'<br class="">
Aug 30 10:12:51 mgu charon: 00[LIB] loaded plugins: charon aes des
rc2 sha2 sha1 md5 random nonce x509 revocation constraints pubkey
pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem fips-prf gmp xcbc
cmac hmac attr kernel-netlink resolve socket-default stroke vici
updown xauth-generic<br class="">
Aug 30 10:12:51 mgu charon: 00[JOB] spawning 16 worker threads<br class="">
Aug 30 10:12:51 mgu charon: 05[CFG] received stroke: add
connection 'host-host-psk-lan'<br class="">
Aug 30 10:12:51 mgu charon: 05[CFG] added configuration
'host-host-psk-lan'<br class="">
<br class="">
</font>
</div>
</div></blockquote></div><br class=""></div></body></html>