[strongSwan-dev] 5.6.3 regression: dhcp integration appears to be broken

[Harald Dunkel]

Looks like the plugin is not loaded, check the log when the daemon starts.

According to the logfile its not loaded, but lsof shows it is:


***@hippogate:/etc/strongswan.d# lsof -p 5483
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
charon 5483 root cwd DIR 8,1 4096 525831 /etc/strongswan.d
charon 5483 root rtd DIR 8,1 4096 2 /
charon 5483 root txt REG 8,1 18424 132861 /usr/lib/ipsec/charon
charon 5483 root mem REG 8,1 47632 135359 /lib/x86_64-linux-gnu/libnss_files-2.24.so
charon 5483 root mem REG 8,1 10152 144259 /usr/lib/ipsec/plugins/libstrongswan-counters.so
charon 5483 root mem REG 8,1 18344 140717 /usr/lib/ipsec/plugins/libstrongswan-unity.so
charon 5483 root mem REG 8,1 10176 133263 /usr/lib/ipsec/plugins/libstrongswan-addrblock.so
charon 5483 root mem REG 8,1 10152 140709 /usr/lib/ipsec/plugins/libstrongswan-led.so
charon 5483 root mem REG 8,1 18344 133264 /usr/lib/ipsec/plugins/libstrongswan-certexpire.so
charon 5483 root mem REG 8,1 14248 140701 /usr/lib/ipsec/plugins/libstrongswan-error-notify.so
charon 5483 root mem REG 8,1 14248 140711 /usr/lib/ipsec/plugins/libstrongswan-lookip.so
charon 5483 root mem REG 8,1 59464 140706 /usr/lib/ipsec/plugins/libstrongswan-ha.so
charon 5483 root mem REG 8,1 22464 133265 /usr/lib/ipsec/plugins/libstrongswan-dhcp.so <<<
charon 5483 root mem REG 8,1 19512 140716 /usr/lib/ipsec/plugins/libstrongswan-tnc-tnccs.so
charon 5483 root mem REG 8,1 22944 135371 /lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
charon 5483 root mem REG 8,1 120752 135366 /lib/x86_64-linux-gnu/libaudit.so.1.0.0
charon 5483 root mem REG 8,1 56016 135413 /lib/x86_64-linux-gnu/libpam.so.0.83.1
charon 5483 root mem REG 8,1 14296 140742 /usr/lib/ipsec/plugins/libstrongswan-xauth-pam.so
charon 5483 root mem REG 8,1 10152 140740 /usr/lib/ipsec/plugins/libstrongswan-xauth-eap.so
charon 5483 root mem REG 8,1 10200 140741 /usr/lib/ipsec/plugins/libstrongswan-xauth-generic.so
charon 5483 root mem REG 8,1 15480 133179 /usr/lib/ipsec/libtnccs.so.0.0.0
charon 5483 root mem REG 8,1 10488 136827 /usr/lib/ipsec/plugins/libstrongswan-eap-tnc.so
charon 5483 root mem REG 8,1 18608 140699 /usr/lib/ipsec/plugins/libstrongswan-eap-ttls.so
charon 5483 root mem REG 8,1 97040 133048 /usr/lib/ipsec/libtls.so.0.0.0
charon 5483 root mem REG 8,1 10368 136823 /usr/lib/ipsec/plugins/libstrongswan-eap-tls.so
charon 5483 root mem REG 8,1 27728 133046 /usr/lib/ipsec/libradius.so.0.0.0
charon 5483 root mem REG 8,1 51328 135399 /usr/lib/ipsec/plugins/libstrongswan-eap-radius.so
charon 5483 root mem REG 8,1 22904 135380 /usr/lib/ipsec/plugins/libstrongswan-eap-mschapv2.so
charon 5483 root mem REG 8,1 10200 135305 /usr/lib/ipsec/plugins/libstrongswan-eap-gtc.so
charon 5483 root mem REG 8,1 10296 135370 /usr/lib/ipsec/plugins/libstrongswan-eap-md5.so
charon 5483 root mem REG 8,1 31216 133047 /usr/lib/ipsec/libsimaka.so.0.0.0
charon 5483 root mem REG 8,1 18656 135221 /usr/lib/ipsec/plugins/libstrongswan-eap-aka.so
charon 5483 root mem REG 8,1 10200 135367 /usr/lib/ipsec/plugins/libstrongswan-eap-identity.so
charon 5483 root mem REG 8,1 14248 144268 /usr/lib/ipsec/plugins/libstrongswan-updown.so
charon 5483 root mem REG 8,1 125384 136868 /usr/lib/ipsec/plugins/libstrongswan-vici.so
charon 5483 root mem REG 8,1 96656 140723 /usr/lib/ipsec/plugins/libstrongswan-stroke.so
charon 5483 root mem REG 8,1 10152 140702 /usr/lib/ipsec/plugins/libstrongswan-farp.so
charon 5483 root mem REG 8,1 31184 1639 /usr/lib/x86_64-linux-gnu/libip6tc.so.0.1.0
charon 5483 root mem REG 8,1 27088 1638 /usr/lib/x86_64-linux-gnu/libip4tc.so.0.1.0
charon 5483 root mem REG 8,1 14248 133003 /usr/lib/ipsec/plugins/libstrongswan-connmark.so
charon 5483 root mem REG 8,1 14272 144267 /usr/lib/ipsec/plugins/libstrongswan-socket-default.so
charon 5483 root mem REG 8,1 14248 144292 /usr/lib/ipsec/plugins/libstrongswan-resolve.so
charon 5483 root mem REG 8,1 85096 135438 /usr/lib/ipsec/plugins/libstrongswan-kernel-netlink.so
charon 5483 root mem REG 8,1 14504 132845 /usr/lib/ipsec/plugins/libstrongswan-attr.so
charon 5483 root mem REG 8,1 14256 135394 /lib/x86_64-linux-gnu/libkeyutils.so.1.5
charon 5483 root mem REG 8,1 48152 1645 /usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1
charon 5483 root mem REG 8,1 1138648 1690 /usr/lib/x86_64-linux-gnu/libunistring.so.0.1.2
charon 5483 root mem REG 8,1 14248 135374 /lib/x86_64-linux-gnu/libcom_err.so.2.1
charon 5483 root mem REG 8,1 203656 1643 /usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1
charon 5483 root mem REG 8,1 892616 1644 /usr/lib/x86_64-linux-gnu/libkrb5.so.3.3
charon 5483 root mem REG 8,1 305688 1634 /usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2
charon 5483 root mem REG 8,1 2492224 347 /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.2
charon 5483 root mem REG 8,1 431232 1837 /usr/lib/x86_64-linux-gnu/libssl.so.1.0.2
charon 5483 root mem REG 8,1 55136 1675 /usr/lib/x86_64-linux-gnu/libpsl.so.5.1.1
charon 5483 root mem REG 8,1 179480 1682 /usr/lib/x86_64-linux-gnu/libssh2.so.1.0.1
charon 5483 root mem REG 8,1 118256 1677 /usr/lib/x86_64-linux-gnu/librtmp.so.1
charon 5483 root mem REG 8,1 137208 1637 /usr/lib/x86_64-linux-gnu/libidn2.so.0.1.4
charon 5483 root mem REG 8,1 153640 1664 /usr/lib/x86_64-linux-gnu/libnghttp2.so.14.12.3
charon 5483 root mem REG 8,1 522656 1808 /usr/lib/x86_64-linux-gnu/libcurl.so.4.4.0
charon 5483 root mem REG 8,1 14176 136882 /usr/lib/ipsec/plugins/libstrongswan-curl.so
charon 5483 root mem REG 8,1 10560 133004 /usr/lib/ipsec/plugins/libstrongswan-gcm.so
charon 5483 root mem REG 8,1 10992 135375 /usr/lib/ipsec/plugins/libstrongswan-ccm.so
charon 5483 root mem REG 8,1 10416 136881 /usr/lib/ipsec/plugins/libstrongswan-ctr.so
charon 5483 root mem REG 8,1 10920 135434 /usr/lib/ipsec/plugins/libstrongswan-hmac.so
charon 5483 root mem REG 8,1 10248 136826 /usr/lib/ipsec/plugins/libstrongswan-cmac.so
charon 5483 root mem REG 8,1 10344 144301 /usr/lib/ipsec/plugins/libstrongswan-xcbc.so
charon 5483 root mem REG 8,1 10200 133002 /usr/lib/ipsec/plugins/libstrongswan-agent.so
charon 5483 root mem REG 8,1 96600 136884 /usr/lib/ipsec/plugins/libstrongswan-curve25519.so
charon 5483 root mem REG 8,1 36984 132961 /usr/lib/ipsec/plugins/libstrongswan-gmp.so
charon 5483 root mem REG 8,1 10176 132960 /usr/lib/ipsec/plugins/libstrongswan-fips-prf.so
charon 5483 root mem REG 8,1 18344 132968 /usr/lib/ipsec/plugins/libstrongswan-af-alg.so
charon 5483 root mem REG 8,1 36408 136885 /usr/lib/ipsec/plugins/libstrongswan-gcrypt.so
charon 5483 root mem REG 8,1 2686672 2041 /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1
charon 5483 root mem REG 8,1 91560 133005 /usr/lib/ipsec/plugins/libstrongswan-openssl.so
charon 5483 root mem REG 8,1 20000 144280 /usr/lib/ipsec/plugins/libstrongswan-pem.so
charon 5483 root mem REG 8,1 14296 144296 /usr/lib/ipsec/plugins/libstrongswan-sshkey.so
charon 5483 root mem REG 8,1 10200 132959 /usr/lib/ipsec/plugins/libstrongswan-dnskey.so
charon 5483 root mem REG 8,1 18960 144281 /usr/lib/ipsec/plugins/libstrongswan-pgp.so
charon 5483 root mem REG 8,1 14464 144283 /usr/lib/ipsec/plugins/libstrongswan-pkcs12.so
charon 5483 root mem REG 8,1 10320 144287 /usr/lib/ipsec/plugins/libstrongswan-pkcs8.so
charon 5483 root mem REG 8,1 30848 144284 /usr/lib/ipsec/plugins/libstrongswan-pkcs7.so
charon 5483 root mem REG 8,1 14656 144282 /usr/lib/ipsec/plugins/libstrongswan-pkcs1.so
charon 5483 root mem REG 8,1 10272 144288 /usr/lib/ipsec/plugins/libstrongswan-pubkey.so
charon 5483 root mem REG 8,1 14272 132868 /usr/lib/ipsec/plugins/libstrongswan-constraints.so
charon 5483 root mem REG 8,1 18464 144293 /usr/lib/ipsec/plugins/libstrongswan-revocation.so
charon 5483 root mem REG 8,1 92760 144299 /usr/lib/ipsec/plugins/libstrongswan-x509.so
charon 5483 root mem REG 8,1 6080 144278 /usr/lib/ipsec/plugins/libstrongswan-nonce.so
charon 5483 root mem REG 8,1 10176 144290 /usr/lib/ipsec/plugins/libstrongswan-random.so
charon 5483 root mem REG 8,1 10224 136895 /usr/lib/ipsec/plugins/libstrongswan-rdrand.so
charon 5483 root mem REG 8,1 10368 136883 /usr/lib/ipsec/plugins/libstrongswan-mgf1.so
charon 5483 root mem REG 8,1 10232 135439 /usr/lib/ipsec/plugins/libstrongswan-md5.so
charon 5483 root mem REG 8,1 14296 144294 /usr/lib/ipsec/plugins/libstrongswan-sha1.so
charon 5483 root mem REG 8,1 14320 144295 /usr/lib/ipsec/plugins/libstrongswan-sha2.so
charon 5483 root mem REG 8,1 10152 144291 /usr/lib/ipsec/plugins/libstrongswan-rc2.so
charon 5483 root mem REG 8,1 34776 132828 /usr/lib/ipsec/plugins/libstrongswan-aes.so
charon 5483 root mem REG 8,1 51928 132982 /usr/lib/ipsec/plugins/libstrongswan-aesni.so
charon 5483 root mem REG 8,1 10160 132844 /usr/lib/ipsec/libtpmtss.so.0.0.0
charon 5483 root mem REG 8,1 10344 136897 /usr/lib/ipsec/plugins/libstrongswan-tpm.so
charon 5483 root mem REG 8,1 74480 136889 /usr/lib/ipsec/plugins/libstrongswan-pkcs11.so
charon 5483 root mem REG 8,1 35296 1621 /usr/lib/x86_64-linux-gnu/libffi.so.6.0.4
charon 5483 root mem REG 8,1 537448 1629 /usr/lib/x86_64-linux-gnu/libgmp.so.10.3.2
charon 5483 root mem REG 8,1 216776 1636 /usr/lib/x86_64-linux-gnu/libhogweed.so.4.3
charon 5483 root mem REG 8,1 224504 1661 /usr/lib/x86_64-linux-gnu/libnettle.so.6.3
charon 5483 root mem REG 8,1 75776 5688 /usr/lib/x86_64-linux-gnu/libtasn1.so.6.5.3
charon 5483 root mem REG 8,1 210968 135392 /lib/x86_64-linux-gnu/libidn.so.11.6.16
charon 5483 root mem REG 8,1 411688 1669 /usr/lib/x86_64-linux-gnu/libp11-kit.so.0.2.0
charon 5483 root mem REG 8,1 105088 135441 /lib/x86_64-linux-gnu/libz.so.1.2.8
charon 5483 root mem REG 8,1 1670752 1630 /usr/lib/x86_64-linux-gnu/libgnutls.so.30.13.1
charon 5483 root mem REG 8,1 109296 1678 /usr/lib/x86_64-linux-gnu/libsasl2.so.2.0.25
charon 5483 root mem REG 8,1 84848 138371 /lib/x86_64-linux-gnu/libresolv-2.24.so
charon 5483 root mem REG 8,1 59576 1647 /usr/lib/x86_64-linux-gnu/liblber-2.4.so.2.10.7
charon 5483 root mem REG 8,1 322896 1648 /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.10.7
charon 5483 root mem REG 8,1 10176 136886 /usr/lib/ipsec/plugins/libstrongswan-ldap.so
charon 5483 root mem REG 8,1 110080 136896 /usr/lib/ipsec/plugins/libstrongswan-test-vectors.so
charon 5483 root mem REG 8,1 79936 135389 /lib/x86_64-linux-gnu/libgpg-error.so.0.21.0
charon 5483 root mem REG 8,1 468920 135419 /lib/x86_64-linux-gnu/libpcre.so.3.13.3
charon 5483 root mem REG 8,1 1112184 135387 /lib/x86_64-linux-gnu/libgcrypt.so.20.1.6
charon 5483 root mem REG 8,1 72024 1652 /usr/lib/x86_64-linux-gnu/liblz4.so.1.7.1
charon 5483 root mem REG 8,1 154376 135398 /lib/x86_64-linux-gnu/liblzma.so.5.2.2
charon 5483 root mem REG 8,1 31744 138372 /lib/x86_64-linux-gnu/librt-2.24.so
charon 5483 root mem REG 8,1 155400 135427 /lib/x86_64-linux-gnu/libselinux.so.1
charon 5483 root mem REG 8,1 1063328 135232 /lib/x86_64-linux-gnu/libm-2.24.so
charon 5483 root mem REG 8,1 22768 135372 /lib/x86_64-linux-gnu/libcap.so.2.25
charon 5483 root mem REG 8,1 14640 135224 /lib/x86_64-linux-gnu/libdl-2.24.so
charon 5483 root mem REG 8,1 1689360 135219 /lib/x86_64-linux-gnu/libc-2.24.so
charon 5483 root mem REG 8,1 135440 138370 /lib/x86_64-linux-gnu/libpthread-2.24.so
charon 5483 root mem REG 8,1 629696 132764 /usr/lib/ipsec/libcharon.so.0.0.0
charon 5483 root mem REG 8,1 446032 132813 /usr/lib/ipsec/libstrongswan.so.0.0.0
charon 5483 root mem REG 8,1 153288 135171 /lib/x86_64-linux-gnu/ld-2.24.so
charon 5483 root mem REG 8,1 557552 135263 /lib/x86_64-linux-gnu/libsystemd.so.0.17.0
charon 5483 root 0u CHR 1,3 0t0 3075 /dev/null
charon 5483 root 1u CHR 1,3 0t0 3075 /dev/null
charon 5483 root 2u CHR 1,3 0t0 3075 /dev/null
charon 5483 root 3r FIFO 0,10 0t0 18172 pipe
charon 5483 root 4w FIFO 0,10 0t0 18172 pipe
charon 5483 root 5w REG 8,1 2468716 173 /var/log/charon.log
charon 5483 root 6r CHR 1,9 0t0 3080 /dev/urandom
charon 5483 root 7r CHR 1,8 0t0 3079 /dev/random
charon 5483 root 8r CHR 1,9 0t0 3080 /dev/urandom
charon 5483 root 9u pack 18228 0t0 ARP type=SOCK_DGRAM
charon 5483 root 10u unix 0xffff9801d5fafc00 0t0 18229 /var/run/charon.lkp type=STREAM
charon 5483 root 11u unix 0xffff9801d5faf800 0t0 18231 /var/run/charon.enfy type=STREAM
charon 5483 root 12u netlink 0t0 18233 XFRM
charon 5483 root 13u netlink 0t0 18234 XFRM
charon 5483 root 14u IPv6 18235 0t0 UDP *:isakmp
charon 5483 root 15u IPv6 18236 0t0 UDP *:ipsec-nat-t
charon 5483 root 16u IPv4 18237 0t0 UDP *:isakmp
charon 5483 root 17u IPv4 18238 0t0 UDP *:ipsec-nat-t
charon 5483 root 18u netlink 0t0 18239 ROUTE
charon 5483 root 19u netlink 0t0 18240 ROUTE
charon 5483 root 20u unix 0xffff9801d70ba400 0t0 18241 /var/run/charon.ctl type=STREAM
charon 5483 root 21u unix 0xffff9801d70ba000 0t0 18243 /var/run/charon.vici type=STREAM
charon 5483 root 22w REG 0,19 5 18246 /run/charon.pid

"cfg = 4" doesn't tell. ???


Regards
Harri

[Tobias Brunner]

Hi Harri,

Post by Harald Dunkel
According to the logfile its not loaded

What does it say exactly? Is an error logged when it tries to load it?

Post by Harald Dunkel
"cfg = 4" doesn't tell. ???

Parts of the plugin loading process is logged in "lib", and some errors
in the dhcp plugin in "net", others in "cfg".

Regards,
Tobias

[Tobias Brunner]

Hi Harald,

Perhaps you could also prevent DHCP packets from leaving the host via
iptables. Also, familiarize yourself with DHCP and then perhaps
consider not using it if you only do this locally anyway (why? - the
dhcp plugin is intended to reuse already existing infrastructure).

My IPsec gateway provides a separate subnet for the peers. dnsmasq is
the only dhcp/dns server on this subnet.

So you mainly use it as DNS server to map names of your clients to their
virtual IP?

Do you think it would be possible to add some "dyndns" feature to
strongswan's IP address pool? The dhcp discover takes about 3 seconds
(at least for dnsmasq). I would love to get rid of this.

I guess you could write a plugin (or script) that (un-)registers the
assigned virtual IP at a DNS server (if it provides an API for it, e.g.
RFC 2136).

Instead of catching port number conflicts (which implies knowledge about
the startup sequence, afaics) I would suggest to make this relay agent
feature configurable.

Yeah, that's true. In the dhcp-client-port branch I added an option to
force the use of the DHCP client port as source port even when acting as
relay agent.

Using your patch in the dhcp-client-port branch and "force_client_port = yes"
the dhcp support in 5.6.3 is working again (for me).

OK, great.

For backwards compatibility I would suggest to keep port 68/udp by default.
Its a serious cut dropping an old hard-wired port number in favor of a new
one, just because some dhcp servers might have a problem with the ICMP port
unreachable triggered on Linux. I think its pretty common to run both IPsec
and DHCP on the same gateway.

Let's see if there are others having issues with this first.

Regards,
Tobias

[Harald Dunkel]

Hi Tobias,
If I omit the server address in dhcp.conf, then I get
Jun  6 11:15:19 12[IKE] <IPSec-IKEv2|1> peer requested virtual IP %any
Jun  6 11:15:19 12[CFG] <IPSec-IKEv2|1> sending DHCP DISCOVER to 255.255.255.255
Jun  6 11:15:19 12[CFG] <IPSec-IKEv2|1> sending DHCP DISCOVER failed: Operation not permitted
Jun  6 11:15:19 12[CFG] <IPSec-IKEv2|1> DHCP DISCOVER timed out

PS: If I keep the server address in dhcp.conf and use

bind-interfaces
except-interface=eth0

in dnsmasq.conf, then the port number conflict is gone, but dhcp is
still broken. Now I get

Jun 6 12:01:13 23[IKE] <IPSec-IKEv2|1> peer requested virtual IP %any
Jun 6 12:01:13 23[CFG] <IPSec-IKEv2|1> sending DHCP DISCOVER to 172.19.122.9
Jun 6 12:01:14 23[CFG] <IPSec-IKEv2|1> sending DHCP DISCOVER to 172.19.122.9
Jun 6 12:01:16 23[CFG] <IPSec-IKEv2|1> sending DHCP DISCOVER to 172.19.122.9
Jun 6 12:01:19 23[CFG] <IPSec-IKEv2|1> sending DHCP DISCOVER to 172.19.122.9
Jun 6 12:01:23 23[CFG] <IPSec-IKEv2|1> sending DHCP DISCOVER to 172.19.122.9
Jun 6 12:01:28 23[CFG] <IPSec-IKEv2|1> DHCP DISCOVER timed out


Regards
Harri