I'm pretty much at a dead end on how to proceed further. Does anyone have ideas or suggestions to debug the charon daemon when it is in a restart loop when using ECDSA public and private keys?
Thanks in advance for any help and/or suggestions to proceed, Bill ________________________________ From: William Greene <wgreene9...@yahoo.com> To: Andreas Steffen <andreas.stef...@strongswan.org> Cc: users@lists.strongswan.org Sent: Wed, December 1, 2010 9:44:59 AM Subject: Re: [strongSwan] Fail on loading secrets (ECDSA) Here are snippets from the logs for each type of encoding. They just repeat. Using DER encoded certificates, from the charon.log: Dec 1 09:36:54 00[DMN] Starting IKEv2 charon daemon (strongSwan 4.5.0) Dec 1 09:36:54 00[LIB] plugin 'aes': loaded successfully Dec 1 09:36:54 00[LIB] plugin 'des': loaded successfully Dec 1 09:36:54 00[LIB] plugin 'sha1': loaded successfully Dec 1 09:36:54 00[LIB] plugin 'sha2': loaded successfully Dec 1 09:36:54 00[LIB] plugin 'md5': loaded successfully Dec 1 09:36:54 00[LIB] plugin 'random': loaded successfully Dec 1 09:36:54 00[LIB] plugin 'x509': loaded successfully Dec 1 09:36:54 00[LIB] plugin 'revocation': loaded successfully Dec 1 09:36:54 00[LIB] plugin 'pubkey': loaded successfully Dec 1 09:36:54 00[LIB] plugin 'pkcs1': loaded successfully Dec 1 09:36:54 00[LIB] plugin 'pgp': loaded successfully Dec 1 09:36:54 00[LIB] plugin 'pem': loaded successfully Dec 1 09:36:54 00[LIB] plugin 'openssl': loaded successfully Dec 1 09:36:54 00[LIB] plugin 'gcrypt': loaded successfully Dec 1 09:36:54 00[LIB] plugin 'fips-prf': loaded successfully Dec 1 09:36:54 00[LIB] plugin 'gmp': loaded successfully Dec 1 09:36:54 00[LIB] plugin 'xcbc': loaded successfully Dec 1 09:36:54 00[LIB] plugin 'hmac': loaded successfully Dec 1 09:36:54 00[LIB] plugin 'gcm': loaded successfully Dec 1 09:36:54 00[LIB] plugin 'attr': loaded successfully Dec 1 09:36:54 00[KNL] listening on interfaces: Dec 1 09:36:54 00[KNL] eth0 Dec 1 09:36:54 00[KNL] 10.168.80.8 Dec 1 09:36:54 00[KNL] 2005:a8::21e:c9ff:feff:124 Dec 1 09:36:54 00[KNL] 2004:a8::21e:c9ff:feff:124 Dec 1 09:36:54 00[KNL] fe80::21e:c9ff:feff:124 Dec 1 09:36:54 00[KNL] received netlink error: Address family not supported by protocol (97) Dec 1 09:36:54 00[KNL] unable to create IPv6 routing table rule Dec 1 09:36:54 00[LIB] plugin 'kernel-netlink': loaded successfully Dec 1 09:36:54 00[LIB] plugin 'resolve': loaded successfully Dec 1 09:36:54 00[LIB] plugin 'socket-default': loaded successfully Dec 1 09:36:54 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts' Dec 1 09:36:54 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts' Dec 1 09:36:54 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts' Dec 1 09:36:54 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts' Dec 1 09:36:54 00[CFG] loading crls from '/etc/ipsec.d/crls' Dec 1 09:36:54 00[CFG] loading secrets from '/etc/ipsec.secrets' Dec 1 09:36:59 00[DMN] Starting IKEv2 charon daemon (strongSwan 4.5.0) Dec 1 09:36:59 00[LIB] plugin 'aes': loaded successfully Dec 1 09:36:59 00[LIB] plugin 'des': loaded successfully Dec 1 09:36:59 00[LIB] plugin 'sha1': loaded successfully Dec 1 09:36:59 00[LIB] plugin 'sha2': loaded successfully Dec 1 09:36:59 00[LIB] plugin 'md5': loaded successfully Dec 1 09:36:59 00[LIB] plugin 'random': loaded successfully Dec 1 09:36:59 00[LIB] plugin 'x509': loaded successfully Dec 1 09:36:59 00[LIB] plugin 'revocation': loaded successfully Dec 1 09:36:59 00[LIB] plugin 'pubkey': loaded successfully Dec 1 09:36:59 00[LIB] plugin 'pkcs1': loaded successfully Dec 1 09:36:59 00[LIB] plugin 'pgp': loaded successfully Dec 1 09:36:59 00[LIB] plugin 'pem': loaded successfully Dec 1 09:36:59 00[LIB] plugin 'openssl': loaded successfully Dec 1 09:36:59 00[LIB] plugin 'gcrypt': loaded successfully Dec 1 09:36:59 00[LIB] plugin 'fips-prf': loaded successfully Dec 1 09:36:59 00[LIB] plugin 'gmp': loaded successfully Dec 1 09:36:59 00[LIB] plugin 'xcbc': loaded successfully Dec 1 09:36:59 00[LIB] plugin 'hmac': loaded successfully Dec 1 09:36:59 00[LIB] plugin 'gcm': loaded successfully Dec 1 09:36:59 00[LIB] plugin 'attr': loaded successfully Dec 1 09:36:59 00[KNL] listening on interfaces: Dec 1 09:36:59 00[KNL] eth0 Dec 1 09:36:59 00[KNL] 10.168.80.8 Dec 1 09:36:59 00[KNL] 2005:a8::21e:c9ff:feff:124 Dec 1 09:36:59 00[KNL] 2004:a8::21e:c9ff:feff:124 Dec 1 09:36:59 00[KNL] fe80::21e:c9ff:feff:124 Dec 1 09:36:59 00[KNL] received netlink error: Address family not supported by protocol (97) Dec 1 09:36:59 00[KNL] unable to create IPv6 routing table rule Dec 1 09:36:59 00[LIB] plugin 'kernel-netlink': loaded successfully Dec 1 09:36:59 00[LIB] plugin 'resolve': loaded successfully Dec 1 09:36:59 00[LIB] plugin 'socket-default': loaded successfully Dec 1 09:36:59 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts' Dec 1 09:36:59 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts' Dec 1 09:36:59 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts' Dec 1 09:36:59 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts' Dec 1 09:36:59 00[CFG] loading crls from '/etc/ipsec.d/crls' Dec 1 09:36:59 00[CFG] loading secrets from '/etc/ipsec.secrets' Using PEM encoded certificates, the charon.log: Dec 1 09:41:19 00[DMN] Starting IKEv2 charon daemon (strongSwan 4.5.0) Dec 1 09:41:19 00[LIB] plugin 'aes': loaded successfully Dec 1 09:41:19 00[LIB] plugin 'des': loaded successfully Dec 1 09:41:19 00[LIB] plugin 'sha1': loaded successfully Dec 1 09:41:19 00[LIB] plugin 'sha2': loaded successfully Dec 1 09:41:19 00[LIB] plugin 'md5': loaded successfully Dec 1 09:41:19 00[LIB] plugin 'random': loaded successfully Dec 1 09:41:19 00[LIB] plugin 'x509': loaded successfully Dec 1 09:41:19 00[LIB] plugin 'revocation': loaded successfully Dec 1 09:41:19 00[LIB] plugin 'pubkey': loaded successfully Dec 1 09:41:19 00[LIB] plugin 'pkcs1': loaded successfully Dec 1 09:41:19 00[LIB] plugin 'pgp': loaded successfully Dec 1 09:41:19 00[LIB] plugin 'pem': loaded successfully Dec 1 09:41:19 00[LIB] plugin 'openssl': loaded successfully Dec 1 09:41:19 00[LIB] plugin 'gcrypt': loaded successfully Dec 1 09:41:19 00[LIB] plugin 'fips-prf': loaded successfully Dec 1 09:41:19 00[LIB] plugin 'gmp': loaded successfully Dec 1 09:41:19 00[LIB] plugin 'xcbc': loaded successfully Dec 1 09:41:19 00[LIB] plugin 'hmac': loaded successfully Dec 1 09:41:19 00[LIB] plugin 'gcm': loaded successfully Dec 1 09:41:19 00[LIB] plugin 'attr': loaded successfully Dec 1 09:41:19 00[KNL] listening on interfaces: Dec 1 09:41:19 00[KNL] eth0 Dec 1 09:41:19 00[KNL] 10.168.80.8 Dec 1 09:41:19 00[KNL] 2005:a8::21e:c9ff:feff:124 Dec 1 09:41:19 00[KNL] 2004:a8::21e:c9ff:feff:124 Dec 1 09:41:19 00[KNL] fe80::21e:c9ff:feff:124 Dec 1 09:41:19 00[KNL] received netlink error: Address family not supported by protocol (97) Dec 1 09:41:19 00[KNL] unable to create IPv6 routing table rule Dec 1 09:41:19 00[LIB] plugin 'kernel-netlink': loaded successfully Dec 1 09:41:19 00[LIB] plugin 'resolve': loaded successfully Dec 1 09:41:19 00[LIB] plugin 'socket-default': loaded successfully Dec 1 09:41:19 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts' Dec 1 09:41:19 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts' Dec 1 09:41:19 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts' Dec 1 09:41:19 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts' Dec 1 09:41:19 00[CFG] loading crls from '/etc/ipsec.d/crls' Dec 1 09:41:19 00[CFG] loading secrets from '/etc/ipsec.secrets' Dec 1 09:41:19 00[LIB] file content is not binary ASN.1 Dec 1 09:41:19 00[LIB] -----BEGIN EC PRIVATE KEY----- Dec 1 09:41:19 00[LIB] -----END EC PRIVATE KEY----- Dec 1 09:41:24 00[DMN] Starting IKEv2 charon daemon (strongSwan 4.5.0) Dec 1 09:41:24 00[LIB] plugin 'aes': loaded successfully Dec 1 09:41:24 00[LIB] plugin 'des': loaded successfully Dec 1 09:41:24 00[LIB] plugin 'sha1': loaded successfully Dec 1 09:41:24 00[LIB] plugin 'sha2': loaded successfully Dec 1 09:41:24 00[LIB] plugin 'md5': loaded successfully Dec 1 09:41:24 00[LIB] plugin 'random': loaded successfully Dec 1 09:41:24 00[LIB] plugin 'x509': loaded successfully Dec 1 09:41:24 00[LIB] plugin 'revocation': loaded successfully Dec 1 09:41:24 00[LIB] plugin 'pubkey': loaded successfully Dec 1 09:41:24 00[LIB] plugin 'pkcs1': loaded successfully Dec 1 09:41:24 00[LIB] plugin 'pgp': loaded successfully Dec 1 09:41:24 00[LIB] plugin 'pem': loaded successfully Dec 1 09:41:24 00[LIB] plugin 'openssl': loaded successfully Dec 1 09:41:24 00[LIB] plugin 'gcrypt': loaded successfully Dec 1 09:41:24 00[LIB] plugin 'fips-prf': loaded successfully Dec 1 09:41:24 00[LIB] plugin 'gmp': loaded successfully Dec 1 09:41:24 00[LIB] plugin 'xcbc': loaded successfully Dec 1 09:41:24 00[LIB] plugin 'hmac': loaded successfully Dec 1 09:41:24 00[LIB] plugin 'gcm': loaded successfully Dec 1 09:41:24 00[LIB] plugin 'attr': loaded successfully Dec 1 09:41:24 00[KNL] listening on interfaces: Dec 1 09:41:24 00[KNL] eth0 Dec 1 09:41:24 00[KNL] 10.168.80.8 Dec 1 09:41:24 00[KNL] 2005:a8::21e:c9ff:feff:124 Dec 1 09:41:24 00[KNL] 2004:a8::21e:c9ff:feff:124 Dec 1 09:41:24 00[KNL] fe80::21e:c9ff:feff:124 Dec 1 09:41:24 00[KNL] received netlink error: Address family not supported by protocol (97) Dec 1 09:41:24 00[KNL] unable to create IPv6 routing table rule Dec 1 09:41:24 00[LIB] plugin 'kernel-netlink': loaded successfully Dec 1 09:41:24 00[LIB] plugin 'resolve': loaded successfully Dec 1 09:41:24 00[LIB] plugin 'socket-default': loaded successfully Dec 1 09:41:24 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts' Dec 1 09:41:24 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts' Dec 1 09:41:24 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts' Dec 1 09:41:24 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts' Dec 1 09:41:24 00[CFG] loading crls from '/etc/ipsec.d/crls' Dec 1 09:41:24 00[CFG] loading secrets from '/etc/ipsec.secrets' Dec 1 09:41:24 00[LIB] file content is not binary ASN.1 Dec 1 09:41:24 00[LIB] -----BEGIN EC PRIVATE KEY----- Dec 1 09:41:24 00[LIB] -----END EC PRIVATE KEY----- ________________________________ From: Andreas Steffen <andreas.stef...@strongswan.org> To: William Greene <wgreene9...@yahoo.com> Cc: users@lists.strongswan.org Sent: Tue, November 30, 2010 5:35:04 PM Subject: Re: [strongSwan] Fail on loading secrets (ECDSA) Hello Bill, what does "restarting" mean? Does charon crash? (what it shouldn't) If you give the key in PEM format then it is normal that it is automatically converted to DER format first. Regards Andreas On 11/30/2010 09:55 PM, William Greene wrote: > Hello, > > The charon daemon keeps restarting after the "loading secrets from > '/etc/ipsec.secrets' log line when the private key is in der format. In > pem form, same thing but with: > > Nov 30 14:28:52 00[CFG] loading secrets from '/etc/ipsec.secrets' > Nov 30 14:28:52 00[LIB] file content is not binary ASN.1 > Nov 30 14:28:52 00[LIB] -----BEGIN EC PRIVATE KEY----- > Nov 30 14:28:52 00[LIB] -----END EC PRIVATE KEY----- > > So der form seems the way to go. It appears that I'm having the same > issue as this: > > https://lists.strongswan.org/pipermail/users/2008-December/003030.html > > I've regenerated these ECDSA keys several times and I'm at a loss right > now how to get going with SuiteB testing. I've attached the files that > I'm using, hoping that someone can tease a clue out from them. > > Thanks in advance for any help anyone can provided, > Bill > > > > Note: I was unable to use "ipsec pki" commands to create the keys so I > resolved myself to using openssl and I removed the passphase from the > private key file, so I know that can't be the issue. To do this I did > the following: > > > [r...@kap8 private]# openssl ecparam -genkey -name secp384r1 -out > testParam.pem > > [r...@kap8 private]# openssl req -x509 -newkey ec:testParam.pem -config > /root/openssl.cnf -out testPub.pem -outform PEM > Generating a 384 bit EC private key > writing new private key to 'privkey.pem' > Enter PEM pass phrase: > Verifying - Enter PEM pass phrase: > ----- > ... > > [r...@kap8 private]# ls > privkey.pem temp testParam.pem testPub.pem > > [r...@kap8 private]# openssl ec -in privkey.pem -out testKey.pem > read EC key > Enter PEM pass phrase: > writing EC key > > [r...@kap8 private]# ls > privkey.pem temp testKey.pem testParam.pem testPub.pem > > [r...@kap8 private]# openssl ec -outform DER -in testKey.pem -out > testKey.der > read EC key > writing EC key ====================================================================== Andreas Steffen andreas.stef...@strongswan.org strongSwan - the Linux VPN Solution! www.strongswan.org Institute for Internet Technologies and Applications University of Applied Sciences Rapperswil CH-8640 Rapperswil (Switzerland) ===========================================================[ITA-HSR]==
_______________________________________________ Users mailing list Users@lists.strongswan.org https://lists.strongswan.org/mailman/listinfo/users