Issues with IPSEC and Diffie Hellman Groups on 19.1

[dasaint]

Hey All,

Testing out 19.1 and came across IPSEC Issues it doesnt seem that any of the DH codes are working when i  started to look deeper i found that its only supporting curve25519 which isnt even an option in the UI but also that there was an issue with OpenSSL failing to load which looks very similar to a freebsd issue from a while back (https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=212149)

root@ragnarok:/ # swanctl -g
plugin 'openssl' failed to load: /usr/local/lib/ipsec/plugins/libstrongswan-openssl.so: Undefined symbol "RSA_set0_factors"
encryption:
  AES_CBC[aes]
  3DES_CBC[des]
  DES_CBC[des]
  DES_ECB[des]
  BLOWFISH_CBC[blowfish]
  RC2_CBC[rc2]
integrity:
  AES_XCBC_96[xcbc]
  AES_CMAC_96[cmac]
  HMAC_SHA1_96[hmac]
  HMAC_SHA1_128[hmac]
  HMAC_SHA1_160[hmac]
  HMAC_MD5_96[hmac]
  HMAC_MD5_128[hmac]
  HMAC_SHA2_256_128[hmac]
  HMAC_SHA2_256_256[hmac]
  HMAC_SHA2_384_192[hmac]
  HMAC_SHA2_384_384[hmac]
  HMAC_SHA2_512_256[hmac]
  HMAC_SHA2_512_512[hmac]
aead:
  AES_GCM_8[gcm]
  AES_GCM_12[gcm]
  AES_GCM_16[gcm]
hasher:
  HASH_SHA1[sha1]
  HASH_SHA2_224[sha2]
  HASH_SHA2_256[sha2]
  HASH_SHA2_384[sha2]
  HASH_SHA2_512[sha2]
  HASH_MD4[md4]
  HASH_MD5[md5]
  HASH_IDENTITY[curve25519]
prf:
  PRF_KEYED_SHA1[sha1]
  PRF_FIPS_SHA1_160[fips-prf]
  PRF_AES128_XCBC[xcbc]
  PRF_AES128_CMAC[cmac]
  PRF_HMAC_SHA1[hmac]
  PRF_HMAC_MD5[hmac]
  PRF_HMAC_SHA2_256[hmac]
  PRF_HMAC_SHA2_384[hmac]
  PRF_HMAC_SHA2_512[hmac]
xof:
dh:
  CURVE_25519[curve25519]
rng:
  RNG_STRONG[random]
  RNG_TRUE[random]
nonce-gen:
  NONCE_GEN[nonce]

[dasaint]

Another piece of line with IPs XXX'ed Out

Dec 19 14:52:50 ragnarok charon: 15[KNL] creating acquire job for policy xxx.xxx.xxx.xxx/32 === xxx.xxx.xxx.xxx/32 with reqid {1}
Dec 19 14:52:50 ragnarok charon: 13[IKE] <con1|3> initiating IKE_SA con1[3] to xxx.xxx.xxx.xxx
Dec 19 14:52:50 ragnarok charon: 13[IKE] <con1|3> configured DH group MODP_2048 not supported
Dec 19 14:52:50 ragnarok charon: 13[MGR] <con1|3> tried to checkin and delete nonexisting IKE_SA

[dasaint]

more info,

this is what i would have expected to see but because of the openssl error i am betting that is root cause, had to boot up an older pfsense box that i had to pull it but i would have expected to see the below and it confirms my suspicions  (PFSense 2.4.4 P1 is using strongSwan 5.7.1 (OpenSSL 1.0.2o-freebsd) and this OPNSense Build 19.1b is using strongSwan 5.6.3 (OpenSSL 1.0.2o-freebsd)) could be a bug from previous strongSwan version that could be affecting Openssl?

Hope this helps more.

DH Groups from PFsense 2.4.4 VM
dh:
  ECP_256[openssl]
  ECP_384[openssl]
  ECP_521[openssl]
  ECP_224[openssl]
  ECP_192[openssl]
  ECP_256_BP[openssl]
  ECP_384_BP[openssl]
  ECP_512_BP[openssl]
  ECP_224_BP[openssl]
  MODP_3072[openssl]
  MODP_4096[openssl]
  MODP_6144[openssl]
  MODP_8192[openssl]
  MODP_2048[openssl]
  MODP_2048_224[openssl]
  MODP_2048_256[openssl]
  MODP_1536[openssl]
  MODP_1024[openssl]
  MODP_1024_160[openssl]
  MODP_768[openssl]
  MODP_CUSTOM[openssl]
  CURVE_25519[curve25519]

[nullinger]

I have a similar issue with the same possible cause. After importing configuration from 18.7 to 19.1 my IKEv2 VPNs are broken, the clients can't connect due to some errors with the DH Group

Code Select Expand


Dec 29 02:04:39 opnsense charon: 12[IKE] <40> XYZ is initiating an IKE_SA
Dec 29 02:04:39 opnsense charon: 12[IKE] <40> remote host is behind NAT
Dec 29 02:04:39 opnsense charon: 12[IKE] <40> DH group MODP_2048 inacceptable, requesting MODP_2048
Dec 29 02:04:39 opnsense charon: 12[ENC] <40> generating IKE_SA_INIT response 0 [ N(INVAL_KE) ]


DH Groups:

Code Select Expand


root@opnsense191:~ # ipsec listall | grep DH
    DH:CURVE_25519

root@opnsense187:~ # ipsec listall | grep DH
    DH:ECP_256
    DH:ECP_384
    DH:ECP_521
    DH:ECP_224
    DH:ECP_192
    DH:ECP_256_BP
    DH:ECP_384_BP
    DH:ECP_512_BP
    DH:ECP_224_BP
    DH:MODP_3072
    DH:MODP_4096
    DH:MODP_6144
    DH:MODP_8192
    DH:MODP_2048
    DH:MODP_2048_224
    DH:MODP_2048_256
    DH:MODP_1536
    DH:MODP_1024
    DH:MODP_1024_160
    DH:MODP_768
    DH:MODP_CUSTOM
    DH:CURVE_25519


[mimugmail]

Did you install 19.1 image or just install 19.1 kernel?
For me it looks good ...

[mimugmail]

OK, was able to reproduce. Installed a fresh 19.1 ISO and got the same behavior.
After updating to latest version and reboot it's gone ..

[franco]

Sounds strange, but should be reevaluated on 19.1-RC1 for safety.


Cheers,
Franco

[dasaint]

i hadnt updated the image as i went on vaca but that would prob be the next step i do believe that the issue is related to the strongswan version being older and that its causing an incompatibility with openssl that triggered the issue.

My tests were New installs via the ISO with 0 updates IIR it said it was 19.1 Version D that i had issues with

[franco]

Oh right, there was a transient issues with OpenSSL on StrongSwan 5.6.3 for us, but it was fixed when StrongSwan 5.7.1 was added in 18.7.7 and the 19.1-BETA images had the faulty one from 18.7.6.

FWIW, LibreSSL was not affected by this as far as I can tell.

Case closed. :)


Cheers,
Franco