IPSec issue since 22.1.3 upgrade

[RedVortex]

I upgraded from 21.1.2 to 22.1.3 last night.

Since then, on reboot and every time I save/apply my IPSec configs I get those errors

Code: [Select]

[18-Mar-2022 00:29:44 America/Toronto] PHP Warning:  openssl_x509_read(): supplied parameter cannot be coerced into an X509 certificate! in /usr/local/etc/inc/plugins.inc.d/ipsec.inc on line 1257

[39675810-00da-4d28-b42b-1befc06e7261] Script action stderr returned "b"no files found matching '/usr/local/etc/strongswan.opnsense.d/*.conf'""

/usr/local/sbin/pluginctl: Error: Invalid certificate hash info for

Anybody has an idea of what's up ? I think it may be related to this release note but I'm not sure how to fix it...

o ipsec: clean up stale CA certificates on reconfigure

Also, I checked under: /usr/local/etc/strongswan.opnsense.d/*.conf and there is nothing (Except a README file) in there but this configuration line

Code: [Select]

include strongswan.opnsense.d/*.conf

is included in the /usr/local/etc/strongswan.conf anyways, this could explain one of the errors above (maybe all 3 actually).

Checking the code of

Code: [Select]

        $strongswan = generate_strongswan_conf($strongswanTree);
        $strongswan .= "\ninclude strongswan.opnsense.d/*.conf\n";
        @file_put_contents("/usr/local/etc/strongswan.conf", $strongswan);

        /* generate CA certificates files */
        $cafiles = [];
        foreach (isset($config['ca']) ? $config['ca'] : [] as $ca) {
            $cert = base64_decode($ca['crt']);
            $x509cert = openssl_x509_parse(openssl_x509_read($cert));
            if (is_array($x509cert) && isset($x509cert['hash'])) {
                $fname = "{$capath}/{$x509cert['hash']}.0.crt";
                $cafiles[] = $fname;
                if (!@file_put_contents($fname, $cert)) {
                    log_error(sprintf('Error: Cannot write IPsec CA file for %s', $ca['descr']));
                }
            } else {
                log_error(sprintf('Error: Invalid certificate hash info for %s', $ca['descr']));
            }
        }
        foreach (glob("{$capath}/*.0.crt") as $fname) {
            if (!in_array($fname, $cafiles)) {
                unlink($fname);
            }
        }

I see it seems to do something against the ipsec certs... I see 2 certs generated there: /usr/local/etc/ipsec.d/cacerts/ so I'm not sure what going on...

[RedVortex]

It also seems I have a empty CA under System: Trust: Authorities, I don't think I saw an empty CA there before the upgrade...

[RedVortex]

ok, so deleting the empty self-signed CA seems to have fixed this issue

This is not happening anymore since I deleted the empty CA cert

Code: [Select]

[18-Mar-2022 11:15:55 America/Toronto] PHP Warning:  openssl_x509_read(): supplied parameter cannot be coerced into an X509 certificate! in /usr/local/etc/inc/plugins.inc.d/ipsec.inc on line 1257

And this one is gone too now

Code: [Select]

2022-03-18T11:15:55-04:00 Error opnsense /usr/local/sbin/pluginctl: Error: Invalid certificate hash info for
This self-sign CA seems like it was used for the web GUI and possibly other stuff for IPSec ? Could it be that it got wiped on the upgrade or not (re-)generated properly ?

However the following "errors" persists, which I guess is normal since there is no files under this folder. Not sure they should be logged at Error level though or even be logged as an error.

Code: [Select]

Date Severity Process Line
2022-03-18T11:39:05-04:00 Error configd.py [033c924d-1574-4bd8-ac18-241d0f3451d6] Script action stderr returned "b"no files found matching '/usr/local/etc/strongswan.opnsense.d/*.conf'""
2022-03-18T11:39:04-04:00 Error configd.py [6ebc7f84-633f-4128-ba8a-d0c7a1daed63] Script action stderr returned "b"no files found matching '/usr/local/etc/strongswan.opnsense.d/*.conf'""
2022-03-18T11:39:00-04:00 Error configd.py [ff5483fa-5c54-45ac-b74b-c6b8eb5de680] Script action stderr returned "b"no files found matching '/usr/local/etc/strongswan.opnsense.d/*.conf'""
2022-03-18T11:38:02-04:00 Error configd.py [5828834c-f694-474c-9a54-ac9208347813] Script action stderr returned "b"no files found matching '/usr/local/etc/strongswan.opnsense.d/*.conf'""
2022-03-18T11:38:00-04:00 Error configd.py [f26a48ad-5c5d-4452-bdf0-d79e4be1e386] Script action stderr returned "b"no files found matching '/usr/local/etc/strongswan.opnsense.d/*.conf'""
2022-03-18T11:37:58-04:00 Error configd.py [c1f4a1c2-9b18-4e8f-a1a5-b537e9bffd14] Script action stderr returned "b"no files found matching '/usr/local/etc/strongswan.opnsense.d/*.conf'""
2022-03-18T11:37:54-04:00 Error configd.py [da8d2b3a-d68e-43f2-8d7b-fd5e24d6dafc] Script action stderr returned "b"no files found matching '/usr/local/etc/strongswan.opnsense.d/*.conf'""
2022-03-18T11:15:55-04:00 Error configd.py [39675810-00da-4d28-b42b-1befc06e7261] Script action stderr returned "b"no files found matching '/usr/local/etc/strongswan.opnsense.d/*.conf'""
2022-03-18T11:15:53-04:00 Error configd.py [714f0020-e64e-4654-8f27-231d1e7c6c3d] Script action stderr returned "b"no files found matching '/usr/local/etc/strongswan.opnsense.d/*.conf'""
2022-03-18T11:15:49-04:00 Error configd.py [b16026ba-b84b-458a-a53a-269ccb139bc4] Script action stderr returned "b"no files found matching '/usr/local/etc/strongswan.opnsense.d/*.conf'""