Please merge strongswan 5.3.5-1 (main) from Debian unstable (main)
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
strongswan (Ubuntu) |
Fix Released
|
High
|
Ryan Harper |
Changed in strongswan (Ubuntu): | |
assignee: | nobody → Ryan Harper (raharper) |
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Launchpad Janitor (janitor) wrote : | #1 |
Changed in strongswan (Ubuntu): | |
status: | New → Confirmed |
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Simon Déziel (sdeziel) wrote : | #2 |
The attached logcheck rules should cover all the normal logs generated by Strongswan using the stock default config. If Debian integrates this ruleset, bug https:/
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Simon Déziel (sdeziel) wrote : | #4 |
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
mrq1 (kubuntu-bugreporter) wrote : | #5 |
is there any progress on this issue?
FeatureFreeze & DebianImportFreeze are getting close :-/
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Gianfranco Costamagna (costamagnagianfranco) wrote : | #6 |
There is a thread on Ubuntu-devel
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Ryan Harper (raharper) wrote : | #7 |
Yes, quite close. I'll handle the FFE if needed but I feel on-track. I'm preparing the merge debdiff for review.
Threads:
https:/
https:/
Please give the test-package a go if you're a strongswan user.
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
mrq1 (kubuntu-bugreporter) wrote : | #8 |
hi
i used your ppa .. looks great with the default plugin package
but with the extra plugins:
Feb 13 17:22:28 kvm-xenial charon: 00[CFG] mediation client database URI not defined, skipped
Feb 13 17:22:28 kvm-xenial charon: 00[CFG] no threshold configured for systime-fix, disabled
Feb 13 17:22:28 kvm-xenial charon: 00[CFG] coupling file path unspecified
Feb 13 17:22:28 kvm-xenial charon: 00[LIB] loaded plugins: charon test-vectors unbound ldap pkcs11 aes rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints acert pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey dnscert ipseckey pem openssl gcrypt af-alg fips-prf gmp xcbc cmac hmac ctr ccm gcm ntru curl soup mysql sqlite attr kernel-netlink resolve socket-default connmark farp stroke updown eap-identity eap-sim eap-sim-pcsc eap-aka eap-aka-3gpp2 eap-simaka-
Feb 13 17:22:28 kvm-xenial charon: 00[LIB] dropped capabilities, running as uid 0, gid 0
Feb 13 17:22:28 kvm-xenial charon: 00[JOB] spawning 16 worker threads
Feb 13 17:22:28 kvm-xenial charon: 04[DMN] thread 4 received 11
Feb 13 17:22:28 kvm-xenial charon: 04[LIB] dumping 7 stack frame addresses:
Feb 13 17:22:28 kvm-xenial charon: 04[LIB] /lib/x86_
Feb 13 17:22:28 kvm-xenial charon: 09[DMN] thread 9 received 11
Feb 13 17:22:28 kvm-xenial charon: 09[LIB] dumping 7 stack frame addresses:
Feb 13 17:22:28 kvm-xenial charon: 09[LIB] /lib/x86_
Feb 13 17:22:28 kvm-xenial charon: 10[DMN] thread 10 received 11
Feb 13 17:22:28 kvm-xenial charon: 10[LIB] dumping 7 stack frame addresses:
Feb 13 17:22:28 kvm-xenial charon: 10[LIB] /lib/x86_
Feb 13 17:22:28 kvm-xenial charon: 04[LIB] ->
Feb 13 17:22:28 kvm-xenial charon: 04[LIB] /usr/lib/
Feb 13 17:22:28 kvm-xenial charon: 09[LIB] ->
Feb 13 17:22:28 kvm-xenial charon: 09[LIB] /usr/lib/
Feb 13 17:22:28 kvm-xenial charon: 10[LIB] ->
Feb 13 17:22:28 kvm-xenial charon: 10[LIB] /usr/lib/
Feb 13 17:22:28 kvm-xenial charon: 04[LIB] ->
Feb 13 17:22:28 kvm-xenial charon: 04[LIB] /usr/lib/
Feb 13 17:22:28 kvm-xenial charon: 09[LIB] ->
Feb 13 17:22:28 kvm-xenial charon: 09[LIB] /usr/lib/
Feb 13 17:22:28 kvm-xenial charon: 10[LIB] ->
Feb 13 17:22:28 kvm-xenial charon: 10[LIB] /usr/lib/
Feb 13 17:22:28 kvm-xenial charon: 09[LIB] ->
Feb 13 17:22:28 kvm-xenial charon: 09[LIB] /usr/lib/
Feb 13 17:22:28 kvm-xenial charon: 04[LIB] ...
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
mrq1 (kubuntu-bugreporter) wrote : | #9 |
the startup segfault disappears if a purge the extra-plugin package but NOT if i only remove it :-O
maybe the bug comes with one of the dependency packages?
Feb 13 17:31:24 kvm-xenial charon: 00[LIB] loaded plugins: charon test-vectors aes rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp xcbc hmac ccm gcm attr kernel-netlink resolve socket-default connmark farp stroke updown eap-identity eap-sim eap-sim-pcsc eap-aka eap-aka-3gpp2 eap-simaka-
Feb 13 17:31:24 kvm-xenial charon: 00[LIB] dropped capabilities, running as uid 0, gid 0
Feb 13 17:31:24 kvm-xenial charon: 00[JOB] spawning 16 worker threads
Feb 13 17:31:24 kvm-xenial charon: 02[DMN] thread 2 received 11
Feb 13 17:31:24 kvm-xenial charon: 02[LIB] dumping 7 stack frame addresses:
Feb 13 17:31:24 kvm-xenial charon: 02[LIB] /lib/x86_
Feb 13 17:31:24 kvm-xenial charon: 08[DMN] thread 8 received 11
Feb 13 17:31:24 kvm-xenial charon: 08[LIB] dumping 7 stack frame addresses:
Feb 13 17:31:24 kvm-xenial charon: 08[LIB] /lib/x86_
Feb 13 17:31:24 kvm-xenial charon: 07[DMN] thread 7 received 11
Feb 13 17:31:24 kvm-xenial charon: 07[LIB] dumping 7 stack frame addresses:
Feb 13 17:31:24 kvm-xenial charon: 07[LIB] /lib/x86_
Feb 13 17:31:24 kvm-xenial charon: 08[LIB] ->
Feb 13 17:31:24 kvm-xenial charon: 08[LIB] /usr/lib/
Feb 13 17:31:24 kvm-xenial charon: 02[LIB] ->
Feb 13 17:31:24 kvm-xenial charon: 02[LIB] /usr/lib/
Feb 13 17:31:24 kvm-xenial charon: 07[LIB] ->
Feb 13 17:31:24 kvm-xenial charon: 07[LIB] /usr/lib/
Feb 13 17:31:24 kvm-xenial charon: 02[LIB] ->
Feb 13 17:31:24 kvm-xenial charon: 02[LIB] /usr/lib/
Feb 13 17:31:24 kvm-xenial charon: 08[LIB] ->
Feb 13 17:31:24 kvm-xenial charon: 08[LIB] /usr/lib/
Feb 13 17:31:24 kvm-xenial charon: 07[LIB] ->
Feb 13 17:31:24 kvm-xenial charon: 07[LIB] /usr/lib/
Feb 13 17:31:24 kvm-xenial charon: 02[LIB] ->
Feb 13 17:31:24 kvm-xenial charon: 02[LIB] /usr/lib/
Feb 13 17:31:24 kvm-xenial charon: 08[LIB] ->
Feb 13 17:31:24 kvm-xenial charon: 08[LIB] /usr/lib/
Feb 13 17:31:24 kvm-xenial charon: 07[LIB] ->
Feb 13 17:31:24 kvm-xenial charon: 07[LIB] /usr/lib/
Feb 13 17:31:24 kvm-xenial cha...
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Ryan Harper (raharper) wrote : Re: [Bug 1535951] Re: Please merge strongswan 5.3.5-1 (main) from Debian unstable (main) | #10 |
Ah, yes. I've a fix for that; I hadn't pushed my latest update in to the
ppa. The extra-plugins package need some more privs for the charon binary
in the apparmor profile.
Look for 1ubuntu5 in the ppa in just a bit and see if that fixes up the
issue with the extras plugins.
On Sat, Feb 13, 2016 at 10:39 AM, mrq1 <email address hidden> wrote:
> the startup segfault disappears if a purge the extra-plugin package but
> NOT if i only remove it :-O
>
> maybe the bug comes with one of the dependency packages?
>
> Feb 13 17:31:24 kvm-xenial charon: 00[LIB] loaded plugins: charon
> test-vectors aes rc2 sha1 sha2 md4 md5 random nonce x509 revocation
> constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl
> fips-prf gmp xcbc hmac ccm gcm attr kernel-netlink resolve socket-default
> connmark farp stroke updown eap-identity eap-sim eap-sim-pcsc eap-aka
> eap-aka-3gpp2 eap-simaka-
> eap-mschapv2 eap-dynamic eap-radius eap-tls eap-ttls eap-peap eap-tnc
> xauth-generic xauth-eap xauth-noauth tnc-tnccs tnccs-20 tnccs-11
> tnccs-dynamic dhcp lookip error-notify certexpire led addrblock unity
> Feb 13 17:31:24 kvm-xenial charon: 00[LIB] dropped capabilities, running
> as uid 0, gid 0
> Feb 13 17:31:24 kvm-xenial charon: 00[JOB] spawning 16 worker threads
> Feb 13 17:31:24 kvm-xenial charon: 02[DMN] thread 2 received 11
> Feb 13 17:31:24 kvm-xenial charon: 02[LIB] dumping 7 stack frame
> addresses:
> Feb 13 17:31:24 kvm-xenial charon: 02[LIB]
> /lib/x86_
> Feb 13 17:31:24 kvm-xenial charon: 08[DMN] thread 8 received 11
> Feb 13 17:31:24 kvm-xenial charon: 08[LIB] dumping 7 stack frame
> addresses:
> Feb 13 17:31:24 kvm-xenial charon: 08[LIB]
> /lib/x86_
> Feb 13 17:31:24 kvm-xenial charon: 07[DMN] thread 7 received 11
> Feb 13 17:31:24 kvm-xenial charon: 07[LIB] dumping 7 stack frame
> addresses:
> Feb 13 17:31:24 kvm-xenial charon: 07[LIB]
> /lib/x86_
> Feb 13 17:31:24 kvm-xenial charon: 08[LIB] ->
> Feb 13 17:31:24 kvm-xenial charon: 08[LIB] /usr/lib/
> @ 0x7f770176d000 [0x7f7701770f4b]
> Feb 13 17:31:24 kvm-xenial charon: 02[LIB] ->
> Feb 13 17:31:24 kvm-xenial charon: 02[LIB] /usr/lib/
> @ 0x7f770176d000 [0x7f770176ffdc]
> Feb 13 17:31:24 kvm-xenial charon: 07[LIB] ->
> Feb 13 17:31:24 kvm-xenial charon: 07[LIB] /usr/lib/
> @ 0x7f770176d000 [0x7f7701770b5b]
> Feb 13 17:31:24 kvm-xenial charon: 02[LIB] ->
> Feb 13 17:31:24 kvm-xenial charon: 02[LIB]
> /usr/lib/
> Feb 13 17:31:24 kvm-xenial charon: 08[LIB] ->
> Feb 13 17:31:24 kvm-xenial charon: 08[LIB]
> /usr/lib/
> Feb 13 17:31:24 kvm-xenial charon: 07[LIB] ->
> Feb 13 17:31:24 kvm-xenial charon: 07[LIB]
> /usr/lib/
> Feb 13 17:31:24 kvm-xenial charon: 02[LIB] ->
> Feb 13 17:31:24 kv...
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
mrq1 (kubuntu-bugreporter) wrote : | #11 |
great! starts now :-)
what about the chapoly plugin? can you enable it in the extra package?
it would be very important for me!
btw: the output of service looks strange to me
# service strongswan status
● strongswan.service - strongSwan IPsec services
Loaded: loaded (/lib/systemd/
Active: inactive (dead) since Sat 2016-02-13 19:22:46 CET; 42s ago
Process: 25807 ExecStopPost=
Process: 25789 ExecStop=
Main PID: 25643 (code=exited, status=0/SUCCESS)
looks like the service is not running anymore but via
# ipsec statusall
everything looks ok
is the some systemd-
thanks!
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Ryan Harper (raharper) wrote : | #12 |
On Sat, Feb 13, 2016 at 12:27 PM, mrq1 <email address hidden> wrote:
> great! starts now :-)
>
> what about the chapoly plugin? can you enable it in the extra package?
> it would be very important for me!
>
I can look at enabling it. It's new in 5.3.5. If enabled, can you test
and confirm it works?
Looks like something quite interesting.
https:/
Comments here in the Debian bug indicate that this requires at least 4.2
kernel.
For Xenial, this will be sufficient I suppose.
https:/
>
> btw: the output of service looks strange to me
>
> # service strongswan status
> ● strongswan.service - strongSwan IPsec services
> Loaded: loaded (/lib/systemd/
> preset: enabled)
> Active: inactive (dead) since Sat 2016-02-13 19:22:46 CET; 42s ago
> Process: 25807 ExecStopPost=
> /var/run/
> Process: 25789 ExecStop=
> status=0/SUCCESS)
> Main PID: 25643 (code=exited, status=0/SUCCESS)
>
That looks like from the initial install; You may need to reload the new
apparmor policy
apparmor_parser -r /etc/apparmor.
And then you can restart it with:
systemctl restart strongswan
and check status
systemctl status strongswan
>
> looks like the service is not running anymore but via
> # ipsec statusall
> everything looks ok
>
> is the some systemd-
>
I'm not sure what ipsec statusall invokes to check status.
In an up-to-date Xenial VM, installing the current packages in the PPA, I
get the following:
# systemctl status strongswan
● strongswan.service - strongSwan IPsec services
Loaded: loaded (/lib/systemd/
preset: enabled)
Active: active (running) since Sat 2016-02-13 21:50:59 UTC; 18s ago
Main PID: 2798 (starter)
CGroup: /system.
├─2798 /usr/lib/
└─2799 /usr/lib/
Feb 13 21:50:59 sw1 charon[2799]: 00[CFG] loading ocsp signer certificates
from '/...ts'
Feb 13 21:50:59 sw1 charon[2799]: 00[CFG] loading attribute certificates
from '/et...ts'
Feb 13 21:50:59 sw1 charon[2799]: 00[CFG] loading crls from
'/etc/ipsec.d/crls'
Feb 13 21:50:59 sw1 charon[2799]: 00[CFG] loading secrets from
'/etc/ipsec.
Feb 13 21:50:59 sw1 charon[2799]: 00[LIB] loaded plugins: charon
test-vectors aes ...own
Feb 13 21:50:59 sw1 charon[2799]: 00[LIB] dropped capabilities, running as
uid 0, gid 0
Feb 13 21:50:59 sw1 charon[2799]: 00[JOB] spawning 16 worker threads
Feb 13 21:50:59 sw1 ipsec_starter[
Feb 13 21:50:59 sw1 systemd[1]: Started strongSwan IPsec services.
Feb 13 21:51:00 sw1 systemd[1]: Started strongSwan IPsec services.
Hint: Some lines were ellipsized, use -l to show in full.
root@sw1:~#
root@sw1:~# ipsec statusall
Status of IKE charon daemon (strongSwan 5.3.5, Linux 4.4.0-4-generic,
x86_64):
uptime: 30 seconds, since Feb 13 21:51:00 2016
malloc: sbrk 946176, mmap 0, used 229008,...
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Simon Déziel (sdeziel) wrote : | #13 |
On 2016-02-13 12:39 PM, Ryan Harper wrote:
> The extra-plugins package need some more privs for the charon binary
> in the apparmor profile.
Ryan, please take a look at [1] for refreshed AA profiles that could
address many more LP bugs (all mentioned in debian/changelog). Thanks.
Regards,
Simon
1:
https:/
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Ryan Harper (raharper) wrote : | #14 |
Excellent! I had forgotten about that. I'll update.
On Sat, Feb 13, 2016 at 7:00 PM, Simon Déziel <email address hidden>
wrote:
> On 2016-02-13 12:39 PM, Ryan Harper wrote:
> > The extra-plugins package need some more privs for the charon binary
> > in the apparmor profile.
>
> Ryan, please take a look at [1] for refreshed AA profiles that could
> address many more LP bugs (all mentioned in debian/changelog). Thanks.
>
> Regards,
> Simon
>
> 1:
>
> https:/
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https:/
>
> Title:
> Please merge strongswan 5.3.5-1 (main) from Debian unstable (main)
>
> To manage notifications about this bug go to:
>
> https:/
>
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Simon Déziel (sdeziel) wrote : | #15 |
On 2016-02-13 05:09 PM, Ryan Harper wrote:
> On Sat, Feb 13, 2016 at 12:27 PM, mrq1 <email address hidden> wrote:
>
>> great! starts now :-)
>>
>> what about the chapoly plugin? can you enable it in the extra package?
>> it would be very important for me!
>>
>
> I can look at enabling it. It's new in 5.3.5.
+1
ChaCha20/Poly1305 actually made it in 5.3.3 [1] and I haven't heard of
any problem on the mailing list.
> If enabled, can you test and confirm it works?
I too would be glad to give it a spin and report about it.
> Looks like something quite interesting.
> https:/
Indeed! Chacha20 and Poly1305 are cool and getting quite some traction
these days [2].
> Comments here in the Debian bug indicate that this requires at least 4.2
> kernel.
For the IKE part, the kernel version shouldn't matter. For the ESP part,
you indeed need a recent kernel or you can always use the userspace
implementation (libipsec).
libipsec support is very cool (thanks for enabling it!) as it should
allow running a IPsec in containers.
> For Xenial, this will be sufficient I suppose.
>
> https:/
The reporter was looking for NTRU (enabled in your PPA build IIRC) and
BLISS. That said, I'm sure the reporter would welcome having another
AEAD cipher available because they are well regarded [3] in terms of
security.
Thanks,
Simon
1: https:/
2:
https:/
3: https:/
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Ryan Harper (raharper) wrote : | #16 |
On Sat, Feb 13, 2016 at 7:51 PM, Simon Déziel <email address hidden>
wrote:
> On 2016-02-13 05:09 PM, Ryan Harper wrote:
> > On Sat, Feb 13, 2016 at 12:27 PM, mrq1 <email address hidden> wrote:
> >
> >> great! starts now :-)
> >>
> >> what about the chapoly plugin? can you enable it in the extra package?
> >> it would be very important for me!
> >>
> >
> > I can look at enabling it. It's new in 5.3.5.
>
> +1
>
> ChaCha20/Poly1305 actually made it in 5.3.3 [1] and I haven't heard of
> any problem on the mailing list.
>
> > If enabled, can you test and confirm it works?
>
> I too would be glad to give it a spin and report about it.
>
> > Looks like something quite interesting.
> > https:/
>
> Indeed! Chacha20 and Poly1305 are cool and getting quite some traction
> these days [2].
>
Excellent! I've just uploaded a new version to the PPA; should be ready in
a bit with the new plugin
and updated apparmor profiles from your repo.
One question, the profile included /dev/tun, and in my Xenial setups, I
need
/dev/net/tun so I've both allowed in the profile. Not clear to me if it's
useful/needed
to have both, or if only one is sufficient.
> > Comments here in the Debian bug indicate that this requires at least 4.2
> > kernel.
>
> For the IKE part, the kernel version shouldn't matter. For the ESP part,
> you indeed need a recent kernel or you can always use the userspace
> implementation (libipsec).
>
>
OK
> libipsec support is very cool (thanks for enabling it!) as it should
> allow running a IPsec in containers.
>
>
Please do confirm if that's working. I suspect they'll need to be
privileged containers
or will need some additional permissions/configs for unprivileged since
it'll want access to
/dev/net/tun which won't be present by default.
I'd like to capture how to run strongswan in containers like LXD so if
you've any experience
with getting that working it'd be very helpful for us to document.
> > For Xenial, this will be sufficient I suppose.
> >
> > https:/
>
> The reporter was looking for NTRU (enabled in your PPA build IIRC) and
>
Yes
> BLISS. That said, I'm sure the reporter would welcome having another
> AEAD cipher available because they are well regarded [3] in terms of
> security.
>
> Thanks,
> Simon
>
> 1: https:/
> 2:
>
> https:/
> 3: https:/
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https:/
>
> Title:
> Please merge strongswan 5.3.5-1 (main) from Debian unstable (main)
>
> To manage notifications about this bug go to:
>
> https:/
>
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
mrq1 (kubuntu-bugreporter) wrote : | #17 |
thanks for the fast pace!
> should be ready in a bit with the new plugin
NOPE. still no chapoly & ntru plugin included
# ipsec statusall
Status of IKE charon daemon (strongSwan 5.3.5, Linux 4.4.0-4-generic, x86_64):
uptime: 10 minutes, since Feb 14 08:59:01 2016
malloc: sbrk 1650688, mmap 0, used 547408, free 1103280
worker threads: 7 of 16 idle, 5/0/4/0 working, job queue: 0/0/0/0, scheduled: 0
loaded plugins: charon test-vectors aes rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-libipsec kernel-netlink resolve socket-default connmark farp stroke updown eap-identity eap-sim eap-sim-pcsc eap-aka eap-aka-3gpp2 eap-simaka-
i installed a new virtual machine and installed the ppa-strongswan
looks like it is not enough to
# apt install libcharon-
this package does not depend on
# apt install strongswan
which it should!
now starts the testing ;-)
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
mrq1 (kubuntu-bugreporter) wrote : | #18 |
looks good so far :-)
i think the kernel-libipsec plugin should not be loaded by default
the plugin works only with UDP encapsulated packets
(look here: https:/
and this will break most of the "normal"/LAN setups
i would build and include the plugin but disable the loading with
/etc/strongswan
> load = no
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Simon Déziel (sdeziel) wrote : | #19 |
On 2016-02-13 10:03 PM, Ryan Harper wrote:
> On Sat, Feb 13, 2016 at 7:51 PM, Simon Déziel <email address hidden>
> wrote:
>
>> On 2016-02-13 05:09 PM, Ryan Harper wrote:
>>> On Sat, Feb 13, 2016 at 12:27 PM, mrq1 <email address hidden> wrote:
>>>
>>>> great! starts now :-)
>>>>
>>>> what about the chapoly plugin? can you enable it in the extra package?
>>>> it would be very important for me!
>>>>
>>>
>>> I can look at enabling it. It's new in 5.3.5.
>>
>> +1
>>
>> ChaCha20/Poly1305 actually made it in 5.3.3 [1] and I haven't heard of
>> any problem on the mailing list.
>>
>>> If enabled, can you test and confirm it works?
>>
>> I too would be glad to give it a spin and report about it.
>>
>>> Looks like something quite interesting.
>>> https:/
>>
>> Indeed! Chacha20 and Poly1305 are cool and getting quite some traction
>> these days [2].
>>
>
> Excellent! I've just uploaded a new version to the PPA; should be ready in
> a bit with the new plugin
> and updated apparmor profiles from your repo.
Thanks, will try it out.
> One question, the profile included /dev/tun, and in my Xenial setups, I
> need
> /dev/net/tun so I've both allowed in the profile. Not clear to me if it's
> useful/needed
> to have both, or if only one is sufficient.
Good catch. The path always have been /dev/net/tun even in previous
releases so please drop the erroneous /dev/tun rule I added.
>>> Comments here in the Debian bug indicate that this requires at least 4.2
>>> kernel.
>>
>> For the IKE part, the kernel version shouldn't matter. For the ESP part,
>> you indeed need a recent kernel or you can always use the userspace
>> implementation (libipsec).
>>
>>
> OK
>
>
>> libipsec support is very cool (thanks for enabling it!) as it should
>> allow running a IPsec in containers.
>>
>>
> Please do confirm if that's working. I suspect they'll need to be
> privileged containers
> or will need some additional permissions/configs for unprivileged since
> it'll want access to
> /dev/net/tun which won't be present by default.
>
> I'd like to capture how to run strongswan in containers like LXD so if
> you've any experience
I'd expect it to be pretty close to running OpenVPN in a container. I'll
check that out on LXD and let you know.
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Ryan Harper (raharper) wrote : | #20 |
On Sun, Feb 14, 2016 at 2:12 AM, mrq1 <email address hidden> wrote:
> thanks for the fast pace!
>
> > should be ready in a bit with the new plugin
>
> NOPE. still no chapoly & ntru plugin included
>
chapoly and ntru are part of libstrongswan-
>
> # ipsec statusall
> Status of IKE charon daemon (strongSwan 5.3.5, Linux 4.4.0-4-generic,
> x86_64):
> uptime: 10 minutes, since Feb 14 08:59:01 2016
> malloc: sbrk 1650688, mmap 0, used 547408, free 1103280
> worker threads: 7 of 16 idle, 5/0/4/0 working, job queue: 0/0/0/0,
> scheduled: 0
> loaded plugins: charon test-vectors aes rc2 sha1 sha2 md4 md5 random
> nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp
> dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr
> kernel-libipsec kernel-netlink resolve socket-default connmark farp stroke
> updown eap-identity eap-sim eap-sim-pcsc eap-aka eap-aka-3gpp2
> eap-simaka-
> eap-dynamic eap-radius eap-tls eap-ttls eap-peap eap-tnc xauth-generic
> xauth-eap xauth-pam xauth-noauth tnc-tnccs tnccs-20 tnccs-11 tnccs-dynamic
> dhcp lookip error-notify certexpire led addrblock unity
>
You might need to restart after upgrade: systemctl restart strongswan
# ipsec statusall
Status of IKE charon daemon (strongSwan 5.3.5, Linux 4.4.0-4-generic,
x86_64):
uptime: 99 seconds, since Feb 14 14:40:22 2016
malloc: sbrk 2834432, mmap 532480, used 1004336, free 1830096
worker threads: 7 of 16 idle, 5/0/4/0 working, job queue: 0/0/0/0,
scheduled: 0
loaded plugins: charon test-vectors unbound ldap pkcs11 aes rc2 sha1 sha2
md4 md5 random nonce x509 revocation constraints acert pubkey pkcs1 pkcs7
pkcs8 pkcs12 pgp dnskey sshkey dnscert ipseckey pem openssl gcrypt af-alg
fips-prf gmp agent chapoly xcbc cmac hmac ctr ccm gcm ntru curl soup mysql
sqlite attr kernel-libipsec kernel-netlink resolve socket-default connmark
farp stroke updown eap-identity eap-sim eap-sim-pcsc eap-aka eap-aka-3gpp2
eap-simaka-
eap-dynamic eap-radius eap-tls eap-ttls eap-peap eap-tnc xauth-generic
xauth-eap xauth-pam xauth-noauth tnc-tnccs tnccs-20 tnccs-11 tnccs-dynamic
dhcp whitelist lookip error-notify certexpire led radattr addrblock unity
Listening IP addresses:
192.168.122.147
10.0.3.1
Connections:
Security Associations (0 up, 0 connecting):
none
> i installed a new virtual machine and installed the ppa-strongswan
>
> looks like it is not enough to
> # apt install libcharon-
> this package does not depend on
> # apt install strongswan
> which it should!
>
if you apt-get install libstrongswan-
strongswan package.
>
> now starts the testing ;-)
>
Excellent!
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https:/
>
> Title:
> Please merge strongswan 5.3.5-1 (main) from Debian unstable (main)
>
> To manage notifications about this bug go to:
>
> https:/
>
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
mrq1 (kubuntu-bugreporter) wrote : | #21 |
> chapoly and ntru are part of libstrongswan-
you are right!
i mixed up libcharon-
(had only the first one)
my tests are looking good so far.
chapoly & ntru are working as expected, great work!
the MOBIKE handling has much improved since 5.1.2 :-)
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Simon Déziel (sdeziel) wrote : | #22 |
On 2016-02-14 09:00 AM, Simon Deziel wrote:
> On 2016-02-13 10:03 PM, Ryan Harper wrote:
>> On Sat, Feb 13, 2016 at 7:51 PM, Simon Déziel <email address hidden>
>>> libipsec support is very cool (thanks for enabling it!) as it should
>>> allow running a IPsec in containers.
>>>
>>>
>> Please do confirm if that's working. I suspect they'll need to be
>> privileged containers
>> or will need some additional permissions/configs for unprivileged since
>> it'll want access to
>> /dev/net/tun which won't be present by default.
Correct, for unprivileged containers, one has to make the tun device
available using:
lxc config device add $CTNAME tun unix-char path=/dev/net/tun
Then it works.
Thanks,
Simon
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Ryan Harper (raharper) wrote : | #23 |
On Sun, Feb 14, 2016 at 3:36 AM, mrq1 <email address hidden> wrote:
> looks good so far :-)
>
> i think the kernel-libipsec plugin should not be loaded by default
>
> the plugin works only with UDP encapsulated packets
>
> (look here: https:/
> libipsec)
>
> and this will break most of the "normal"/LAN setups
>
The kernel-libipsec plugin is optional; a user must apt-get install
libstrongswan-
I've installed the extra plugins in a VM which uses NAT configuration and
none of the
networking was broken if the kernel-libipsec module was loaded (but
unconfigured).
However, I'm interested if you can expand on what setup would break? We
certainly don't want
break or surprise users so I'd like understand what "breaks" if the module
is loaded by default.
>
> i would build and include the plugin but disable the loading with
>
> /etc/strongswan
> > load = no
>
This would be a change compared to all other plugins so I'd like to
understand why
this plugin in the default configuration breaks any normal/LAN setups.
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https:/
>
> Title:
> Please merge strongswan 5.3.5-1 (main) from Debian unstable (main)
>
> To manage notifications about this bug go to:
>
> https:/
>
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Tobias Brunner (tobias-strongswan) wrote : | #24 |
>> i think the kernel-libipsec plugin should not be loaded by default
>>
>> the plugin works only with UDP encapsulated packets
>>
>> (look here: https:/
>> libipsec)
>>
>> and this will break most of the "normal"/LAN setups
>>
>
> The kernel-libipsec plugin is optional; a user must apt-get install
> libstrongswan-
> I've installed the extra plugins in a VM which uses NAT configuration and
> none of the
> networking was broken if the kernel-libipsec module was loaded (but
> unconfigured).
There is nothing to configure, as long as it gets loaded before any of
the other kernel-ipsec implementations (that's the default) it gets used
as IPsec backend (i.e. IPsec is then handled in userland, not the
kernel). As described on the wiki page, it is not generally recommended
to be used.
> However, I'm interested if you can expand on what setup would break? We
> certainly don't want
> break or surprise users so I'd like understand what "breaks" if the module
> is loaded by default.
Refer to the wiki page above. One example are host-to-host tunnels,
which require additional configuration, then there are the performance
limitations.
>> i would build and include the plugin but disable the loading with
>>
>> /etc/strongswan
>>> load = no
That would be an option, another is to put the plugin and config snippet
into a separate package.
Regards,
Tobias
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
mrq1 (kubuntu-bugreporter) wrote : | #25 |
it looks like strongswan is faking a nat situation if the kernel-libipsec
is used, so there are only problems with transport & beet mode ..
btw: did you get this audit entries too?
# grep audit /var/log/syslog
Feb 16 07:56:31 kvm-xenial kernel: [240771.376037] audit: type=1400 audit(145560579
Feb 16 08:20:30 kvm-xenial kernel: [242210.398331] audit: type=1400 audit(145560723
Feb 16 08:37:04 kvm-xenial kernel: [243204.311072] audit: type=1400 audit(145560822
Feb 16 08:41:09 kvm-xenial kernel: [243449.474502] audit: type=1400 audit(145560846
Feb 16 08:41:30 kvm-xenial kernel: [243470.304749] audit: type=1400 audit(145560849
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Ryan Harper (raharper) wrote : | #26 |
On Tue, Feb 16, 2016 at 8:46 AM, mrq1 <email address hidden> wrote:
> it looks like strongswan is faking a nat situation if the kernel-libipsec
> is used, so there are only problems with transport & beet mode ..
>
It sounds like it could be confusing. I'd prefer not to have a one-off for
just this
package but if it's disruptive then it's likely warranted.
> btw: did you get this audit entries too?
>
No. Are you running 1ubuntu6 and have you reloaded the apparmor profile
and restarted strongswan?
sudo apparmor_parser -r /etc/apparmor.
sudo systemctl restart strongswan
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Simon Déziel (sdeziel) wrote : | #27 |
On 2016-02-16 09:46 AM, mrq1 wrote:
> it looks like strongswan is faking a nat situation if the kernel-libipsec
> is used
This is by design as kernel-libipsec requires ESPinUDP.
As Tobias (Strongswan upstream) said, it's best to not have this on by
default.
> btw: did you get this audit entries too?
>
> # grep audit /var/log/syslog
> Feb 16 07:56:31 kvm-xenial kernel: [240771.376037] audit: type=1400 audit(145560579
> Feb 16 08:20:30 kvm-xenial kernel: [242210.398331] audit: type=1400 audit(145560723
> Feb 16 08:37:04 kvm-xenial kernel: [243204.311072] audit: type=1400 audit(145560822
> Feb 16 08:41:09 kvm-xenial kernel: [243449.474502] audit: type=1400 audit(145560846
> Feb 16 08:41:30 kvm-xenial kernel: [243470.304749] audit: type=1400 audit(145560849
I don't get those but I only tested libipsec in a container where there
is no Apparmor. Maybe it's libipsec specific?
Can you add this to the profile and see if it helps:
owner @{PROC}/@{pid}/fd/ r,
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Ryan Harper (raharper) wrote : | #28 |
I've pushed the latest revisions into the PPA:
strongswan (5.3.5-1ubuntu7) xenial; urgency=medium
* debian/
Enable bliss plugin
* debian/
Under QEMU/KVM for autopkgtest bliss test takes a bit longer
* debian/
Upstream suggests to not load this plugin by default as it has
some limitations.
https:/
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Ryan Harper (raharper) wrote : | #29 |
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Ryan Harper (raharper) wrote : | #30 |
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Ubuntu Foundations Team Bug Bot (crichton) wrote : | #31 |
The attachment "Ubuntu debdiff between 5.1.2-0ubuntu8 and 5.3.5-1ubuntu1" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.
[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]
tags: | added: patch |
Changed in strongswan (Ubuntu): | |
importance: | Undecided → High |
Changed in strongswan (Ubuntu): | |
status: | Confirmed → Fix Released |
Status changed to 'Confirmed' because the bug affects multiple users.