<html><head><meta http-equiv="content-type" content="text/html; charset=GB2312"><style>body { line-height: 1.5; }body { font-size: 10.5pt; font-family: 'Microsoft YaHei UI'; color: rgb(0, 0, 0); line-height: 1.5; }</style></head><body>
<div><span></span><br></div>
<div><div>Hello. I want to use strongswan to call my own implementation of the af_alg algorithm.</div><div>Use of test scenario is af-alg/rw-cert: https://strongswan.org/testresults.html</div><div>But every time the client connects, the moon gateway always prompts:</div><div><br></div><div>```</div><div>09[NET] received packet: from 192.168.0.100[4500] to 192.168.0.1[4500] (588 bytes)</div><div>09[ENC] parsed CREATE_CHILD_SA request 2 [ SA No KE TSi TSr ]</div><div>09[CFG] selected proposal: ESP:TSR_ECB_128/HMAC_SHA2_256_128/MODP_3072/NO_EXT_SEQ</div><div>09[CHD] using TSR_ECB for encryption</div><div>09[CHD] in file sa/ikev2/keymat_v2.c, alg_id = 29</div><div>09[KNL] switch (data->enc_alg) 1728 </div><div>09[KNL] my debug print enter lookup_algorithm</div><div>09[KNL] my debug print list[18].name = tsr_skcipher</div><div>09[KNL] using encryption algorithm TSR_ECB with key size 128</div><div>09[KNL] algorithm name = tsr_skcipher</div><div>09[KNL] my debug print enter lookup_algorithm</div><div>09[KNL] my debug print list[5].name = hmac(sha256)</div><div>09[KNL] 2008 before send_ack</div><div>09[KNL] received netlink error: Function not implemented (38)</div><div>09[KNL] unable to add SAD entry with SPI ca782fc3 (FAILED)</div><div>09[KNL] my debug print list[18].name = tsr_skcipher</div><div>09[KNL] using encryption algorithm TSR_ECB with key size 128</div><div>09[KNL] algorithm name = tsr(ecb(sm4))0000</div><div>09[KNL] my debug print enter lookup_algorithm</div><div>09[KNL] my debug print list[5].name = hmac(sha256)</div><div>09[KNL] line 2008 before send_ack</div><div>09[KNL] received netlink error: Function not implemented (38)</div><div>09[KNL] status = 1</div><div>09[KNL] unable to add SAD entry with SPI c377672a (FAILED)</div><div>09[IKE] unable to install inbound and outbound IPsec SA (SAD) in kernel</div><div>09[IKE] failed to establish CHILD_SA, keeping IKE_SA</div><div>09[KNL] deleting policy 192.168.0.100/32 === 10.1.0.0/16 in failed, not found</div><div>09[KNL] deleting policy 192.168.0.100/32 === 10.1.0.0/16 fwd failed, not found</div><div>09[ENC] generating CREATE_CHILD_SA response 2 [ N(NO_PROP) ]</div><div>09[NET] sending packet: from 192.168.0.1[4500] to 192.168.0.100[4500] (68 bytes)</div><div>```</div><div><br></div><div><br></div><div>The log on carol's end is:</div><div>```</div><div>#swanctl --initiate --child home 2> /dev/null</div><div><br></div><div>loaded connection 'home'</div><div>successfully loaded 1 connections, 0 unloaded</div><div>14[CFG] vici initiate CHILD_SA 'home'</div><div>12[IKE] establishing CHILD_SA home{3}</div><div>[IKE] establishing CHILD_SA home{3}</div><div>12[ENC] generating CREATE_CHILD_SA request 2 [ SA No KE TSi TSr ]</div><div>[ENC] generating CREATE_CHILD_SA request 2 [ SA No KE TSi TSr ]</div><div>12[NET] sending packet: from 192.168.0.100[4500] to 192.168.0.1[4500] (588 bytes)</div><div>[NET] sending packet: from 192.168.0.100[4500] to 192.168.0.1[4500] (588 bytes)</div><div>08[NET] received packet: from 192.168.0.1[4500] to 192.168.0.100[4500] (68 bytes)</div><div>08[ENC] parsed CREATE_CHILD_SA response 2 [ N(NO_PROP) ]</div><div>08[IKE] received NO_PROPOSAL_CHOSEN notify, no CHILD_SA built</div><div>08[IKE] failed to establish CHILD_SA, keeping IKE_SA</div><div>[NET] received packet: from 192.168.0.1[4500] to 192.168.0.100[4500] (68 bytes)</div><div>[ENC] parsed CREATE_CHILD_SA response 2 [ N(NO_PROP) ]</div><div>[IKE] received NO_PROPOSAL_CHOSEN notify, no CHILD_SA built</div><div>[IKE] failed to establish CHILD_SA, keeping IKE_SA</div><div>```</div><div><br></div><div><br></div><div><br></div><div><br></div><div>## My algorithm </div><div>The algorithm structure I defined is:</div><div>```c</div><div>struct skcipher_alg skcipher = {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>.base = {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>.cra_name = "tsr_skcipher",</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>.cra_driver_name = "tsr_skcipher",</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>.cra_blocksize = SM4_BLOCK_SIZE,</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>.cra_priority<span class="Apple-tab-span" style="white-space:pre"> </span>= 100,</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>.cra_flags<span class="Apple-tab-span" style="white-space:pre"> </span>= CRYPTO_ALG_TYPE_SKCIPHER,</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>.cra_ctxsize<span class="Apple-tab-span" style="white-space:pre"> </span>= sizeof(struct crypto_tsr_ctx),</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>.cra_module<span class="Apple-tab-span" style="white-space:pre"> </span>= THIS_MODULE,</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>},</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>.setkey = skcipher_setkey,</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>.encrypt = skcipher_encrypt,</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>.decrypt = skcipher_decrypt,</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>.min_keysize = SM4_KEY_LEN,</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>.max_keysize = SM4_KEY_LEN,</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>.ivsize = SM4_IV_LEN,</div><div>};</div><div>```</div><div><br></div><div>It can also be loaded successfully in strongswan, as shown below:</div><div>```</div><div>#swanctl --list-algs</div><div><br></div><div>encryption:</div><div> AES_CBC[aes]</div><div> AES_ECB[aes]</div><div> 3DES_CBC[des]</div><div> DES_CBC[des]</div><div> DES_ECB[des]</div><div> RC2_CBC[rc2]</div><div> AES_CTR[af-alg]</div><div> CAMELLIA_CBC[af-alg]</div><div> CAMELLIA_CTR[af-alg]</div><div> CAST_CBC[af-alg]</div><div> BLOWFISH_CBC[af-alg]</div><div> SERPENT_CBC[af-alg]</div><div> TWOFISH_CBC[af-alg]</div><div> TSR_ECB[af-alg] //here</div><div>```</div><div><br></div><div><br></div><div>I also modify code in </div><div>- esp proposal</div><div>- libstrongswan/crypter</div><div>- af_alg_plugin</div><div><br></div><div>to recognize the algorithm I defined.</div><div><br></div><div>## configure command</div><div>`./configure --prefix=/usr --sysconfdir=/etc --with-systemdsystemunitdir=/lib/systemd/system --enable-af-alg</div><div>`</div><div><br></div><div>## log and config in moon</div><div>When the moon end is initialized, the log is printed as:</div><div>```</div><div>#sudo /usr/libexec/ipsec/charon &</div><div><br></div><div><br></div><div>00[DMN] Starting IKE charon daemon (strongSwan 5.8.2, Linux 4.15.0-20-generic, x86_64)</div><div>00[KNL] unable to create IPv4 routing table rule</div><div>00[KNL] unable to create IPv6 routing table rule</div><div>00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'</div><div>00[CFG] loaded ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Root CA" from '/etc/ipsec.d/cacerts/strongswanCert.pem'</div><div>00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'</div><div>00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'</div><div>00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'</div><div>00[CFG] loading crls from '/etc/ipsec.d/crls'</div><div>00[CFG] loading secrets from '/etc/ipsec.secrets'</div><div>00[CFG] loaded RSA private key from '/etc/ipsec.d/private/moonKey.pem'</div><div>00[LIB] loaded plugins: charon aes des rc2 sha2 sha1 md5 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem af-alg fips-prf gmp curve25519 xcbc cmac hmac drbg attr kernel-netlink resolve socket-default stroke vici updown xauth-generic counters</div><div>```</div><div><br></div><div><br></div><div>The configuration code of the moon end is:</div><div>```</div><div>#/etc/strongswan.conf - strongSwan configuration file</div><div><br></div><div>swanctl {</div><div> load = pem pkcs1 x509 revocation constraints pubkey openssl random</div><div>}</div><div><br></div><div>charon-systemd {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>load = random nonce test-vectors pem pkcs1 af-alg gmp x509 revocation curl ctr ccm gcm kernel-netlink socket-default updown vici</div><div> integrity_test = yes</div><div> crypto_test {</div><div> on_add = yes</div><div> }</div><div><br></div><div> filelog {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>path = /var/log/charon.log</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>time_format = %b %e %T</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>ike_name = yes</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>append = no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>default = 5</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>flush_line = yes</div><div> }</div><div>}</div><div><br></div><div>#/etc/swanctl/swanctl.conf</div><div>connections {</div><div><br></div><div> rw {</div><div> local_addrs = 192.168.0.1</div><div><br></div><div> local {</div><div> auth = pubkey</div><div> certs = moonCert.pem</div><div> id = moon.strongswan.org</div><div> }</div><div> remote {</div><div> auth = pubkey</div><div> }</div><div> children {</div><div> net {</div><div> local_ts = 10.1.0.0/16 </div><div><br></div><div> updown = /usr/local/libexec/ipsec/_updown iptables</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>esp_proposals = tsr128ecb-sha256-modp3072</div><div><br></div><div> }</div><div> }</div><div> version = 2</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> proposals = aes128-sha256-modp3072,3des-sha1-modp1536 </div><div> }</div><div>}</div><div><br></div><div>```</div><div><br></div><div>## config in carol</div><div>The configuration code of carol end is:</div><div><br></div><div>```</div><div>connections {</div><div><br></div><div> home {</div><div> local_addrs = 192.168.0.100</div><div> remote_addrs = 192.168.0.1 </div><div><br></div><div> local {</div><div> auth = pubkey</div><div> certs = carolCert.pem</div><div> id = carol@strongswan.org</div><div> }</div><div> remote {</div><div> auth = pubkey</div><div> id = moon.strongswan.org </div><div> }</div><div> children {</div><div> home {</div><div> remote_ts = 10.1.0.0/16 </div><div><br></div><div> updown = /usr/local/libexec/ipsec/_updown iptables</div><div> esp_proposals = tsr128ecb-sha256-modp3072</div><div> }</div><div> }</div><div> version = 2</div><div> proposals = 3des-sha1-modp1536 </div><div> }</div><div>}</div><div><br></div><div>```</div><div><br></div></div><hr style="width: 210px; height: 1px;" color="#b5c4df" size="1" align="left">
<div><span><div style="margin: 10px;"><div style="font-family: verdana; font-size: 10pt;"><b style="font-family: DengXian; font-size: 14px; line-height: normal;"><span style="font-family: ΢ÈíÑźÚ, sans-serif; color: rgb(32, 56, 100);">»Æ¾²²¨<span lang="EN-US"> (</span>Èí¼þ¹¤³Ìʦ<span lang="EN-US">)</span></span></b><span lang="EN-US" style="line-height: normal; font-size: 10pt; font-family: ΢ÈíÑźÚ, sans-serif; color: rgb(31, 73, 125);"><br></span><span lang="EN-US" style="line-height: normal; font-size: 9pt; font-family: ΢ÈíÑźÚ, sans-serif; color: rgb(31, 73, 125);">Institute of Microelectronics Tsinghua University </span><span lang="EN-US" style="line-height: normal; font-size: 10pt; font-family: ΢ÈíÑźÚ, sans-serif; color: rgb(31, 73, 125);"><br></span><b style="font-family: DengXian; font-size: 14px; line-height: normal;"><span lang="EN-US" style="font-size: 9pt; font-family: ΢ÈíÑźÚ, sans-serif; color: rgb(31, 73, 125);">Mobile</span></b><b style="font-family: DengXian; font-size: 14px; line-height: normal;"><span style="font-size: 9pt; font-family: ΢ÈíÑźÚ, sans-serif; color: rgb(31, 73, 125);">£º<span lang="EN-US">18101359513</span></span></b></div><div style="font-family: verdana; font-size: 10pt;"><b style="font-family: DengXian; font-size: 14px; line-height: normal;"><span style="font-size: 9pt; font-family: ΢ÈíÑźÚ, sans-serif; color: rgb(31, 73, 125);"><span lang="EN-US"><br></span></span></b></div><div style="font-family: verdana;"><span style="line-height: 1.5; background-color: transparent; font-size: 12px;">huangjingbo@mail.tsinghua.edu.cn</span></div><div style="font-family: verdana; font-size: 10pt;"><b style="font-family: DengXian; font-size: 14px; line-height: normal;"><span style="font-size: 9pt; font-family: ΢ÈíÑźÚ, sans-serif; color: rgb(31, 73, 125);"><span lang="EN-US"><br></span></span></b></div><div style="font-family: verdana; font-size: 10pt;"><br></div></div></span></div>
</body></html>