kernel-libipsec not loading

Forwarded upstream: http://wiki.strongswan.org/issues/575

Personally, I doubt if it is an upstream problem, since I previously compiled the source code from strongswan.org and that can load kernel-libipsec properly...

AFAICS, kernel-libipsec is not part of the Ubuntu strongSwan package, hence it can't be enabled.

Not sure if there are that many uses cases for kernel-libipsec on a standard Linux distribution to justify its inclusion; kernel-netlink is preferable on >95% of use cases.

Regards
Martin

While debian/strongswan-plugin-kernel-libipsec.install lists usr/lib/ipsec/plugins/libstrongswan-kernel-libipsec.so the strongswan-plugin-kernel-libipsec package does not actually include that file.

The reason for this is how dh_install is called in debian/rules, due to the -Xlibstrongswan-kernel option all kernel plugins are excluded from the packages. The kernel-netlink/pfroute/pfkey plugins are added manually to the libstrongswan package depending on the target platform (i.e. FreeBSD vs. Linux). I suppose something similar could be done to add the kernel-libipsec plugin to the plugin-kernel-libipsec package.

Hi Martin,

strongswan-plugin-kernel-libipsec does provide the plugin (or supposedly) in Ubuntu 14.04.

There are two reasons (or at least mine) to use kernel-libipsec, one is that kernel-libipsec provides a separate interface so that filtering/inspecting the packets would be easier with iptables, and second is that for OpenVZ-based platforms, kernel-libipsec is necessary to make both L2TP/IPSec and IKEv1 to work properly simultaneously (although for L2TP case tunnel mode must be used). I have tested that kernel-netlink alone will fail to forward the packets between the gateway and IKEv1 clients.

Best,
TZ

@ttzforj, I understand the need for a userspace implementation when using OpenVZ (LXC too?) but for iptables, are you aware of the policy module? I find it very useful and relatively easy to use:

  # Allow only SSH when over IPsec
  iptables -A INPUT -p tcp --dport 22 -m policy --dir in --pol ipsec -j ACCEPT
  iptables -A INPUT -p tcp --dport 22 -j REJECT

Regards,
Simon

Hello Simon,

Yes I know the policy module. However I think on OpenVZ, strongswan is unable to forward ipsec traffic to proper interface, which I believe it is an upstream problem: https://wiki.strongswan.org/issues/592

Thanks,
TZ

Hi Tony

On 09/18/2014 11:28 AM, Tony Zhou wrote:
> However I think on OpenVZ, strongswan is unable to forward ipsec
> traffic to proper interface, which I believe it is an upstream
> problem: https://wiki.strongswan.org/issues/592

This is getting off-topic but I only ever tried to run IPsec in the HW
node context and protect traffic for the VEs. This required disabling
this in the *VE*: sysctl net.ipv4.conf.venet0.disable_policy=1

HTH,
Simon

The attachment "A patch to fix the kernel-libipsec plugin packaging." seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

I wonder why this is not fixed in official Ubuntu repos yet.

This bug was fixed in the package strongswan - 5.3.5-1ubuntu1

---------------
strongswan (5.3.5-1ubuntu1) xenial; urgency=medium

  * debian/{rules,control,libstrongswan-extra-plugins.install}
    Enable bliss plugin
  * debian/{rules,control,libstrongswan-extra-plugins.install}
    Enable chapoly plugin
  * debian/patches/dont-load-kernel-libipsec-plugin-by-default.patch
    Upstream suggests to not load this plugin by default as it has
    some limitations.
    https://wiki.strongswan.org/projects/strongswan/wiki/Kernel-libipsec
  * debian/patches/increase-bliss-test-timeout.patch
    Under QEMU/KVM for autopkgtest bliss test takes a bit longer then default
  * Update Apparmor profiles
    - usr.lib.ipsec.charon
      - add capability audit_write for xauth-pam (LP: #1470277)
      - add capability dac_override (needed by agent plugin)
      - allow priv dropping (LP: #1333655)
      - allow caching CRLs (LP: #1505222)
      - allow rw access to /dev/net/tun for kernel-libipsec (LP: #1309594)
    - usr.lib.ipsec.stroke
      - allow priv dropping (LP: #1333655)
      - add local include
    - usr.lib.ipsec.lookip
      - add local include
  * Merge from Debian, which includes fixes for all previous CVEs
    Fixes (LP: #1330504, #1451091, #1448870, #1470277)
    Remaining changes:
      * debian/control
        - Lower dpkg-dev to 1.16.1 from 1.16.2 to enable backporting to Precise
        - Update Maintainer for Ubuntu
        - Add build-deps
          - dh-apparmor
          - iptables-dev
          - libjson0-dev
          - libldns-dev
          - libmysqlclient-dev
          - libpcsclite-dev
          - libsoup2.4-dev
          - libtspi-dev
          - libunbound-dev
        - Drop build-deps
          - libfcgi-dev
          - clearsilver-dev
        - Create virtual packages for all strongswan-plugin-* for dist-upgrade
        - Set XS-Testsuite: autopkgtest
      * debian/rules:
        - Enforcing DEB_BUILD_OPTIONS=nostrip for library integrity checking.
        - Set TESTS_REDUCED_KEYLENGTHS to one generate smallest key-lengths in
          tests.
        - Change init/systemd program name to strongswan
        - Install AppArmor profiles
        - Removed pieces on 'patching ipsec.conf' on build.
        - Enablement of features per Ubuntu current config suggested from
          upstream recommendation
        - Unpack and sort enabled features to one-per-line
        - Disable duplicheck as per
          https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718291#10
        - Disable libfast (--disable-fast):
          Requires dropping medsrv, medcli plugins which depend on libfast
        - Add configure options
          --with-tss=trousers
        - Remove configure options:
          --enable-ha (requires special kernel)
          --enable-unit-test (unit tests run by default)
        - Drop logcheck install
      * debian/tests/*
        - Add DEP8 test for strongswan service and plugins
      * debian/strongswan-starter.strongswan.service
        - Add new systemd file instead of patching upstream
      * debian/strongswan-starter.links
        - removed, use Ubuntu systemd file instead of linking to upstream
      * debia...

Not fixed in Ubuntu 14.04, still need to compile from strongswan source package with the patch from comment #9.

This seems unlikely to be fixed in Trusty now. If someone wants to drive this (prepare a minimal backport, etc), then please comment and reopen.