strongswan config in 10.10 doesn't work

[Hasse Hagen Johansen]

Binary package hint: strongswan

I had problems after upgrading my server to ubuntu 10.10

No failures in the strongswan logs..only about one of the plugins..but no serious errors, but it doesn't log anything when you try to connect at client to it.

I stumbled upon a workaround about the order which the plugins for the charon daemon is loaded. It should work if the plugins is loaded in this order:

/etc/strongswan.conf:

        ...
        charon {
                       ...
                       load = curl ldap aes des sha1 sha2 md5 random x509 pubkey pkcs1 pgp dnskey pem openssl fips-prf xcbc hmac agent gmp attr kernel-netlink socket-default farp eap-identity eap-aka eap-md5 eap-gtc eap-mschapv2 nm dhcp resolve
                       ...

Originally found on: http://mopoinfo.vpn.uni-freiburg.de/node/99 (in german)

[Martin Willi (martinwilli)]

> It should work if the plugins is loaded in this order

The problem is not the order, but the compile time plugin configuration:

> --enable-socket-raw --enable-socket-dynamic

Only one socket is needed. The raw socket allows both the IKEv1 and IKEv2 daemons to run in parallel. I suggest to remove the --enable-socket-dynamic.

Patch attached.

[Bhavani Shankar (bhavi)]

Hello

I updated strongswan package in natty to the latest upstream version. If the problem persists then update the patch for natty and I ll be happy to upload

regards

[Hasse Hagen Johansen (hasse-launchpad)]

Hi Thanks Bhavani

Would it be possible to get an updated package in 10.10 also. I would believe this is critical software for some people?

[Bhavani Shankar (bhavi)]

Hello again!

Yes through SRU if the patch goes to natty ll prepare a SRU (Stable Release Update) for maverick

regards

[Stefano Rivera (stefanor)]

Unsubscribing sponsors, as this isn't currently ready for sponsorship.

[Laurent Bigonville (bigon)]

This bug is fixed in natty, closing