[strongSwan] Yet another: charon[1749]: 14[KNL] received netlink error: Protocol not supported (93)
Rodrigo Stuffs
rbs at brasilia.br
Tue Apr 25 21:30:52 CEST 2017
Ok, I found out and everything is working flawlessly.
The WD's GPL toolchain for the MyCloud device fooled me.
While the .config had CONFIG_INET_ESP=m, after LOTS of tinkering, I've
found that in the source code it has:
[rfreire at rf ipv4]$ grep esp Makefile
#obj-$(CONFIG_INET_ESP) += esp4.o
YES: The GPL source had it disabled in the Makefile level.
After uncommenting it (and from ipv6 too) and recompiling, everything
just.works(TM).
A hint for someone else hitting the very same problem:
1. Try to add a test connection using ip xfrm, like:
xfrm state add src 172.16.8.3 dst 172.16.8.158 proto esp spi 1234 reqid
16380 mode transport auth sha1 0x27b12f61fdc46b0f545256a405ac29fc8c137514
enc aes 0x5f5fb739d41eee7a5fe793917d18cadd
If it fails at this stage, it means that the kernel backend is flawed.
2. A working (considering that most of your ipsec stack is modular) lsmod
output:
root at MyCloud:~# lsmod
Module Size Used by
xfrm4_mode_tunnel 1586 4
xfrm4_mode_transport 1136 0
pfe 428717 0
xfrm_user 24068 2
xfrm4_tunnel 1443 0
tunnel4 2043 1 xfrm4_tunnel
ipcomp 1770 0
xfrm_ipcomp 4059 1 ipcomp
esp4 6415 2
ah4 4666 0
af_key 30346 0
cryptosoft 13291 0
cryptodev 11075 0
ocf 23776 2 cryptodev,cryptosoft
Hope that helps other users.
On Sun, Apr 23, 2017 at 8:38 PM, Rodrigo Stuffs <rbs at brasilia.br> wrote:
> Hi there list,
>
> Yes, you have saw $SUBJECT. But I promise, no need to roll eyes: I *think*
> I did my homework properly.
>
> Here's the scenario; I have rebuilt a kernel of a WD My Cloud box in order
> to extend it.
>
> The Kernel config is available at https://pastebin.com/mYGiK3eN
>
> Prior to posting here I really tried to do my homework, doing extensive
> mailing list research. But it seems that the kernel build side is
> apparently OK.
>
> The Strongswan output is the following:
> ---
> Apr 23 23:28:36 MyCloud systemd[1]: Starting Cleanup of Temporary
> Directories...
> Apr 23 23:28:36 MyCloud systemd[1]: Starting strongSwan IPsec IKEv1/IKEv2
> daemon using ipsec.conf...
> Apr 23 23:28:36 MyCloud systemd[1]: Started strongSwan IPsec IKEv1/IKEv2
> daemon using ipsec.conf.
> Apr 23 23:28:36 MyCloud ipsec[1734]: Starting strongSwan 5.2.1 IPsec
> [starter]...
> Apr 23 23:28:36 MyCloud ipsec_starter[1734]: Starting strongSwan 5.2.1
> IPsec [starter]...
> Apr 23 23:28:36 MyCloud systemd[1]: Started Cleanup of Temporary
> Directories.
> Apr 23 23:28:36 MyCloud charon[1749]: 00[DMN] Starting IKE charon daemon
> (strongSwan 5.2.1, Linux 3.2.26, armv7l)
> Apr 23 23:28:36 MyCloud charon[1749]: 00[CFG] loading ca certificates from
> '/etc/ipsec.d/cacerts'
> Apr 23 23:28:36 MyCloud charon[1749]: 00[CFG] loading aa certificates from
> '/etc/ipsec.d/aacerts'
> Apr 23 23:28:36 MyCloud charon[1749]: 00[CFG] loading ocsp signer
> certificates from '/etc/ipsec.d/ocspcerts'
> Apr 23 23:28:36 MyCloud charon[1749]: 00[CFG] loading attribute
> certificates from '/etc/ipsec.d/acerts'
> Apr 23 23:28:36 MyCloud charon[1749]: 00[CFG] loading crls from
> '/etc/ipsec.d/crls'
> Apr 23 23:28:36 MyCloud charon[1749]: 00[CFG] loading secrets from
> '/etc/ipsec.secrets'
> Apr 23 23:28:36 MyCloud charon[1749]: 00[CFG] loading secrets from
> '/etc/ipsec.d/mfrf.secrets'
> Apr 23 23:28:36 MyCloud charon[1749]: 00[CFG] loaded IKE secret for
> 172.16.8.3
> Apr 23 23:28:36 MyCloud charon[1749]: 00[LIB] loaded plugins: charon aes
> rc2 sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1
> pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc
> hmac gcm attr kernel-netlink resolve socket-default stroke updown
> Apr 23 23:28:36 MyCloud charon[1749]: 00[LIB] unable to load 3 plugin
> features (3 due to unmet dependencies)
> Apr 23 23:28:36 MyCloud charon[1749]: 00[LIB] dropped capabilities,
> running as uid 0, gid 0
> Apr 23 23:28:36 MyCloud charon[1749]: 00[JOB] spawning 16 worker threads
> Apr 23 23:28:36 MyCloud ipsec_starter[1734]: charon (1749) started after
> 80 ms
> Apr 23 23:28:36 MyCloud charon[1749]: 15[CFG] received stroke: add
> connection 'teste'
> Apr 23 23:28:36 MyCloud charon[1749]: 15[CFG] added configuration 'teste'
> Apr 23 23:28:36 MyCloud charon[1749]: 09[CFG] received stroke: initiate
> 'teste'
> Apr 23 23:28:36 MyCloud charon[1749]: 09[IKE] initiating IKE_SA teste[1]
> to 172.16.8.3
> Apr 23 23:28:36 MyCloud charon[1749]: 09[IKE] initiating IKE_SA teste[1]
> to 172.16.8.3
> Apr 23 23:28:36 MyCloud ipsec[1734]: charon (1749) started after 80 ms
> Apr 23 23:28:37 MyCloud charon[1749]: 09[ENC] generating IKE_SA_INIT
> request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]
> Apr 23 23:28:37 MyCloud charon[1749]: 09[NET] sending packet: from
> 172.16.8.158[500] to 172.16.8.3[500] (1108 bytes)
> Apr 23 23:28:37 MyCloud charon[1749]: 16[NET] received packet: from
> 172.16.8.3[500] to 172.16.8.158[500] (376 bytes)
> Apr 23 23:28:37 MyCloud charon[1749]: 16[ENC] parsed IKE_SA_INIT response
> 0 [ SA KE No V ]
> Apr 23 23:28:37 MyCloud charon[1749]: 16[ENC] received unknown vendor ID:
> 4f:45:75:5c:64:5c:6a:79:5c:5c:61:70
> Apr 23 23:28:37 MyCloud charon[1749]: 16[IKE] authentication of
> '172.16.8.158' (myself) with pre-shared key
> Apr 23 23:28:37 MyCloud charon[1749]: 16[IKE] establishing CHILD_SA teste
> Apr 23 23:28:37 MyCloud charon[1749]: 16[IKE] establishing CHILD_SA teste
> Apr 23 23:28:37 MyCloud charon[1749]: 16[ENC] generating IKE_AUTH request
> 1 [ IDi N(INIT_CONTACT) IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR)
> N(EAP_ONLY) ]
> Apr 23 23:28:37 MyCloud charon[1749]: 16[NET] sending packet: from
> 172.16.8.158[500] to 172.16.8.3[500] (380 bytes)
> Apr 23 23:28:37 MyCloud charon[1749]: 14[NET] received packet: from
> 172.16.8.3[500] to 172.16.8.158[500] (204 bytes)
> Apr 23 23:28:37 MyCloud charon[1749]: 14[ENC] parsed IKE_AUTH response 1 [
> IDr AUTH SA TSi TSr ]
> Apr 23 23:28:37 MyCloud charon[1749]: 14[IKE] authentication of
> '172.16.8.3' with pre-shared key successful
> Apr 23 23:28:37 MyCloud charon[1749]: 14[IKE] IKE_SA teste[1] established
> between 172.16.8.158[172.16.8.158]...172.16.8.3[172.16.8.3]
> Apr 23 23:28:37 MyCloud charon[1749]: 14[IKE] IKE_SA teste[1] established
> between 172.16.8.158[172.16.8.158]...172.16.8.3[172.16.8.3]
> Apr 23 23:28:37 MyCloud charon[1749]: 14[IKE] scheduling reauthentication
> in 3305s
> Apr 23 23:28:37 MyCloud charon[1749]: 14[IKE] maximum IKE_SA lifetime 3485s
> Apr 23 23:28:37 MyCloud charon[1749]: 14[KNL] received netlink error:
> Protocol not supported (93)
> Apr 23 23:28:37 MyCloud charon[1749]: 14[KNL] unable to add SAD entry with
> SPI c6781a65
> Apr 23 23:28:37 MyCloud charon[1749]: 14[KNL] received netlink error:
> Protocol not supported (93)
> Apr 23 23:28:37 MyCloud charon[1749]: 14[KNL] unable to add SAD entry with
> SPI a6ac1542
> Apr 23 23:28:37 MyCloud charon[1749]: 14[IKE] unable to install inbound
> and outbound IPsec SA (SAD) in kernel
> Apr 23 23:28:37 MyCloud charon[1749]: 14[IKE] failed to establish
> CHILD_SA, keeping IKE_SA
> Apr 23 23:28:37 MyCloud charon[1749]: 14[IKE] sending DELETE for ESP
> CHILD_SA with SPI c6781a65
> Apr 23 23:28:37 MyCloud charon[1749]: 14[ENC] generating INFORMATIONAL
> request 2 [ D ]
> Apr 23 23:28:37 MyCloud charon[1749]: 14[NET] sending packet: from
> 172.16.8.158[500] to 172.16.8.3[500] (76 bytes)
> Apr 23 23:28:41 MyCloud charon[1749]: 06[IKE] retransmit 1 of request with
> message ID 2
> Apr 23 23:28:41 MyCloud charon[1749]: 06[NET] sending packet: from
> 172.16.8.158[500] to 172.16.8.3[500] (76 bytes)
> Apr 23 23:28:48 MyCloud charon[1749]: 08[IKE] retransmit 2 of request with
> message ID 2
> Apr 23 23:28:48 MyCloud charon[1749]: 08[NET] sending packet: from
> 172.16.8.158[500] to 172.16.8.3[500] (76 bytes)
> ---
>
> It is a real simple ipsec setup, between two systems in the local network:
> 172.16.8.158 (the Strongswan box) and 172.16.8.3 (a openswan 2.6.37 box).
> The ipsec endpoints should use a PSK key.
>
> The configuration is pretty much standard and untouched. I have only added
> a include clause, see below:
> ---
> root at MyCloud:/dev/shm# grep -v \# /etc/ipsec.conf
> config setup
> include /etc/ipsec.d/*.conf
> ---
> root at MyCloud:/dev/shm# grep -v \# /etc/ipsec.secrets
> include /etc/ipsec.d/*.secrets
> ---
>
> And here are the relevant config files:
>
> root at MyCloud:/dev/shm# cat /etc/ipsec.d/mfrf.conf (the only .conf file
> over there)
> conn teste
> left=172.16.8.158
> right=172.16.8.3
> ikelifetime=60m
> keylife=20m
> rekeymargin=3m
> keyingtries=1
> authby=secret
> auto=start
> ---
> root at MyCloud:/dev/shm# cat /etc/ipsec.d/mfrf.secrets (the only .secrets
> file over here too)
> 172.16.8.3 : PSK "zomgsecretkeyhere"
> ---
>
> The Strongswan version:
> ---
> root at MyCloud:/dev/shm# dpkg -l | grep strongsw
> ii libstrongswan 5.2.1-6+deb8u2
> armhf strongSwan utility and crypto library
> ii libstrongswan-standard-plugins 5.2.1-6+deb8u2
> armhf strongSwan utility and crypto library (standard plugins)
> ii strongswan 5.2.1-6+deb8u2
> all IPsec VPN solution metapackage
> ii strongswan-charon 5.2.1-6+deb8u2
> armhf strongSwan Internet Key Exchange daemon
> ii strongswan-libcharon 5.2.1-6+deb8u2
> armhf strongSwan charon library
> ii strongswan-starter 5.2.1-6+deb8u2
> armhf strongSwan daemon starter and configuration file parser
>
>
> The loaded modules output:
>
> ---
> root at MyCloud:~# bash teste.sh
> CONFIG_XFRM_USER=m
> CONFIG_NET_KEY=m
> CONFIG_INET=y
> CONFIG_IP_ADVANCED_ROUTER=y
> CONFIG_IP_MULTIPLE_TABLES=y
> CONFIG_INET_AH=m
> CONFIG_INET_ESP=m
> CONFIG_INET_IPCOMP=m
> CONFIG_INET_XFRM_MODE_TRANSPORT=m
> CONFIG_INET_XFRM_MODE_TUNNEL=m
> CONFIG_INET_XFRM_MODE_BEET=m
> CONFIG_IPV6=m
> CONFIG_INET6_AH=m
> CONFIG_INET6_ESP=m
> CONFIG_INET6_IPCOMP=m
> CONFIG_INET6_XFRM_MODE_TRANSPORT=m
> CONFIG_INET6_XFRM_MODE_TUNNEL=m
> CONFIG_INET6_XFRM_MODE_BEET=m
> CONFIG_IPV6_MULTIPLE_TABLES=y
> CONFIG_NETFILTER=y
> CONFIG_NETFILTER_XTABLES=m
> CONFIG_NETFILTER_XT_MATCH_POLICY=m
> ---
> root at MyCloud:/dev/shm# grep -e XFRM -e IPCOMP -e DEFLATE
> /boot/config-3.2.26
> CONFIG_XFRM=y
> CONFIG_XFRM_USER=m
> CONFIG_XFRM_SUB_POLICY=y
> CONFIG_XFRM_MIGRATE=y
> CONFIG_XFRM_STATISTICS=y
> CONFIG_XFRM_IPCOMP=m
> CONFIG_INET_IPCOMP=m
> CONFIG_INET_XFRM_TUNNEL=m
> CONFIG_INET_XFRM_MODE_TRANSPORT=m
> CONFIG_INET_XFRM_MODE_TUNNEL=m
> CONFIG_INET_XFRM_MODE_BEET=m
> CONFIG_INET6_IPCOMP=m
> CONFIG_INET6_XFRM_TUNNEL=m
> CONFIG_INET6_XFRM_MODE_TRANSPORT=m
> CONFIG_INET6_XFRM_MODE_TUNNEL=m
> CONFIG_INET6_XFRM_MODE_BEET=m
> CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION=m
> CONFIG_CRYPTO_DEFLATE=y
> CONFIG_ZLIB_DEFLATE=y
> ---
> lsmod output:
> root at MyCloud:/dev/shm# lsmod
> Module Size Used by
> xfrm6_mode_tunnel 1514 0
> xfrm4_mode_tunnel 1586 0
> xfrm_user 24068 2
> xfrm4_tunnel 1443 0
> tunnel4 2043 1 xfrm4_tunnel
> pfe 428717 0
> ipcomp 1770 0
> xfrm_ipcomp 4059 1 ipcomp
> ah4 4666 0
> af_key 30346 0
> cryptosoft 13291 0
> cryptodev 11075 0
> ocf 23776 2 cryptodev,cryptosoft
> ipv6 262883 20 xfrm6_mode_tunnel
> ---
>
> Any hints? /o\
>
> Thanks for stopping by! \o
>
> - Rodrigo.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20170425/9741897b/attachment-0001.html>
More information about the Users
mailing list