[strongSwan] can not establish MSCHAPv2 tunnel using ipsec.conf/ipsec.secrets in strongswan 4.6.1 release on Android Gingerbread
Nitin Verma
nitin.jndm at gmail.com
Mon Nov 21 10:56:15 CET 2011
Hi,
I have been able to successfully establish IPSec IKEv2 tunnel between Nexus
S (running 2.3.5_r1) and a ubuntu server. However, the latest 4.6.1 release
supports starter and stroke executables at Android and I am trying to
establish the same connection using ipsec.conf and ipsec.secrets.
My server side configuration is:
======================
server IP: *192.168.1.154*
ipsec.conf:
config setup
crlcheckinterval=180
strictcrlpolicy=no
plutostart=no
charondebug="knl 3, cfg 2, ike 2, chd 2, mgr 2, dmn 2"
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
# leftcert=moonCert.pem
# Add connections here.
conn android
left=192.168.1.154
leftid=192.168.1.154
leftcert=moonCert.pem
leftauth=pubkey
right=%any
rightsourceip=10.0.5.0/24
rightauth=eap-mschapv2
rightsendcert=never
eap_identity=deepika
auto=add
ipsec.secrets:
: RSA moonKey.pem
deepika : EAP "deepika"
Configuration at Nexus S (Android 2.3.5_r1):
================================
I manually created "ipsec.d" directory in /system/etc/ and put my ca
certificate in cacerts there, and then created ipsec.conf and ipsec.secrets
in /system/etc/
/system/etc/ipsec.conf
config setup
plutostart=no
charondebug="knl 3, cfg 2, ike 2, chd 2, mgr 2, dmn 2"
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
# Add connections here.
# Sample VPN connections
conn android
left=192.168.1.2
leftauth=eap
eap_identity=deepika
right=192.168.1.154
rightid=192.168.1.154
rightauth=pubkey
auto=add
/system/etc/ipsec.secrets
deepika : EAP "deepika"
But when I start the connection I am getting the following error:
# ipsec stroke up android
uname: not found
uname: not found
[: not found
initiating IKE_SA android[2] to 192.168.1.154
generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]
sending packet: from 192.168.1.2[500] to 192.168.1.154[500]
received packet: from 192.168.1.154[500] to 192.168.1.2[500]
parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP)
N(MULT_AUTH) ]
sending cert request for "C=UK, CN=nits"
establishing CHILD_SA android
generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ IDr CP(DNS) SA
TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) ]
sending packet: from 192.168.1.2[4500] to 192.168.1.154[4500]
received packet: from 192.168.1.154[4500] to 192.168.1.2[4500]
parsed IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/MSCHAPV2 ]
received end entity cert "C=UK, CN=nits"
using certificate "C=UK, CN=nits"
using trusted ca certificate "C=UK, CN=nits"
reached self-signed root ca with a path length of 0
authentication of '192.168.1.154' with RSA signature successful
server requested EAP_MSCHAPV2 authentication (id 0x75)
no EAP key found for hosts '192.168.1.154' - '192.168.1.2'
EAP_MSCHAPV2 method failed
Output of logcat:
I/charon ( 469): 00[CFG] loading ca certificates from
'/system/etc/ipsec.d/cacerts'
I/charon ( 469): 00[CFG] loaded ca certificate "C=UK, CN=nits" from
'/system/etc/ipsec.d/cacerts/strongswanCert.pem'
I/charon ( 469): 00[CFG] loading aa certificates from
'/system/etc/ipsec.d/aacerts'
I/charon ( 469): 00[LIB] opening directory '/system/etc/ipsec.d/aacerts'
failed: No such file or directory
I/charon ( 469): 00[CFG] reading directory failed
I/charon ( 469): 00[CFG] loading ocsp signer certificates from
'/system/etc/ipsec.d/ocspcerts'
I/charon ( 469): 00[LIB] opening directory
'/system/etc/ipsec.d/ocspcerts' failed: No such file or directory
I/charon ( 469): 00[CFG] reading directory failed
I/charon ( 469): 00[CFG] loading attribute certificates from
'/system/etc/ipsec.d/acerts'
I/charon ( 469): 00[LIB] opening directory '/system/etc/ipsec.d/acerts'
failed: No such file or directory
I/charon ( 469): 00[CFG] reading directory failed
I/charon ( 469): 00[CFG] loading crls from '/system/etc/ipsec.d/crls'
I/charon ( 469): 00[LIB] opening directory '/system/etc/ipsec.d/crls'
failed: No such file or directory
I/charon ( 469): 00[CFG] reading directory failed
I/charon ( 469): 00[CFG] loading secrets from '/system/etc/ipsec.secrets'
I/charon ( 469): 00[CFG] loaded EAP secret for deepika
I/charon ( 469): 00[DMN] loaded plugins: openssl fips-prf random pubkey
pkcs1 pem xcbc hmac kernel-netlink socket-default android stroke
eap-identity eap-mschapv2 eap-md5
I/charon ( 469): 00[JOB] spawning 16 worker threads
I/charon ( 469): 11[CFG] received stroke: add connection 'android'
I/charon ( 469): 11[CFG] added configuration 'android'
I/charon ( 469): 12[CFG] received stroke: initiate 'android'
I/charon ( 469): 14[IKE] initiating IKE_SA android[1] to 192.168.1.154
I/charon ( 469): 14[ENC] generating IKE_SA_INIT request 0 [ SA KE No
N(NATD_S_IP) N(NATD_D_IP) ]
I/charon ( 469): 14[NET] sending packet: from 192.168.1.2[500] to
192.168.1.154[500]
D/GpsLocationProvider( 107): NTP server returned: 1321866231250 (Mon Nov
21 09:03:51 GMT+00:00 2011) reference: 318100 certainty: 337 system time
offset: -20070741
I/charon ( 469): 15[IKE] retransmit 1 of request with message ID 0
I/charon ( 469): 15[NET] sending packet: from 192.168.1.2[500] to
192.168.1.154[500]
I/charon ( 469): 03[IKE] retransmit 2 of request with message ID 0
I/charon ( 469): 03[NET] sending packet: from 192.168.1.2[500] to
192.168.1.154[500]
I/charon ( 469): 16[IKE] retransmit 3 of request with message ID 0
I/charon ( 469): 16[NET] sending packet: from 192.168.1.2[500] to
192.168.1.154[500]
I/charon ( 469): 02[NET] received packet: from 192.168.1.154[500] to
192.168.1.2[500]
I/charon ( 469): 02[ENC] parsed IKE_SA_INIT response 0 [ SA KE No
N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]
I/charon ( 469): 02[IKE] sending cert request for "C=UK, CN=nits"
I/charon ( 469): 02[IKE] establishing CHILD_SA android
I/charon ( 469): 02[ENC] generating IKE_AUTH request 1 [ IDi
N(INIT_CONTACT) CERTREQ IDr CP(DNS) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR)
N(MULT_AUTH) N(EAP_ONLY) ]
I/charon ( 469): 02[NET] sending packet: from 192.168.1.2[4500] to
192.168.1.154[4500]
I/charon ( 469): 01[NET] received packet: from 192.168.1.154[4500] to
192.168.1.2[4500]
I/charon ( 469): 01[ENC] parsed IKE_AUTH response 1 [ IDr CERT AUTH
EAP/REQ/MSCHAPV2 ]
I/charon ( 469): 01[IKE] received end entity cert "C=UK, CN=nits"
I/charon ( 469): 01[CFG] using certificate "C=UK, CN=nits"
I/charon ( 469): 01[CFG] using trusted ca certificate "C=UK, CN=nits"
I/charon ( 469): 01[CFG] reached self-signed root ca with a path length
of 0
I/charon ( 469): 01[IKE] authentication of '192.168.1.154' with RSA
signature successful
I/charon ( 469): 01[IKE] server requested EAP_MSCHAPV2 authentication (id
0xFD)
I/charon ( 469): 01[IKE] no EAP key found for hosts '192.168.1.154' -
'192.168.1.2'
I/charon ( 469): 01[IKE] EAP_MSCHAPV2 method failed
I/dalvikvm( 164): Total arena pages for JIT: 11
I/charon ( 469): 11[CFG] received stroke: initiate 'android'
I/charon ( 469): 14[IKE] initiating IKE_SA android[2] to 192.168.1.154
I/charon ( 469): 14[ENC] generating IKE_SA_INIT request 0 [ SA KE No
N(NATD_S_IP) N(NATD_D_IP) ]
I/charon ( 469): 14[NET] sending packet: from 192.168.1.2[500] to
192.168.1.154[500]
I/charon ( 469): 15[NET] received packet: from 192.168.1.154[500] to
192.168.1.2[500]
I/charon ( 469): 15[ENC] parsed IKE_SA_INIT response 0 [ SA KE No
N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]
I/charon ( 469): 15[IKE] sending cert request for "C=UK, CN=nits"
I/charon ( 469): 15[IKE] establishing CHILD_SA android
I/charon ( 469): 15[ENC] generating IKE_AUTH request 1 [ IDi
N(INIT_CONTACT) CERTREQ IDr CP(DNS) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR)
N(MULT_AUTH) N(EAP_ONLY) ]
I/charon ( 469): 15[NET] sending packet: from 192.168.1.2[4500] to
192.168.1.154[4500]
I/charon ( 469): 03[NET] received packet: from 192.168.1.154[4500] to
192.168.1.2[4500]
I/charon ( 469): 03[ENC] parsed IKE_AUTH response 1 [ IDr CERT AUTH
EAP/REQ/MSCHAPV2 ]
I/charon ( 469): 03[IKE] received end entity cert "C=UK, CN=nits"
I/charon ( 469): 03[CFG] using certificate "C=UK, CN=nits"
I/charon ( 469): 03[CFG] using trusted ca certificate "C=UK, CN=nits"
I/charon ( 469): 03[CFG] reached self-signed root ca with a path length
of 0
I/charon ( 469): 03[IKE] authentication of '192.168.1.154' with RSA
signature successful
I/charon ( 469): 03[IKE] server requested EAP_MSCHAPV2 authentication (id
0x75)
I/charon ( 469): 03[IKE] no EAP key found for hosts '192.168.1.154' -
'192.168.1.2'
I/charon ( 469): 03[IKE] EAP_MSCHAPV2 method failed
Am I missing something or there are some issues with the release?
Thanks in advance.
Regards,
Nitin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20111121/65f3556f/attachment.html>
More information about the Users
mailing list