OPNsense
  • Home
  • Help
  • Search
  • Login
  • Register

  • OPNsense Forum »
  • Archive »
  • 19.1 Legacy Series »
  • Issues with IPSEC and Diffie Hellman Groups on 19.1
« previous next »
  • Print
Pages: [1]

Author Topic: Issues with IPSEC and Diffie Hellman Groups on 19.1  (Read 2499 times)

dasaint

  • Newbie
  • *
  • Posts: 5
  • Karma: 1
    • View Profile
Issues with IPSEC and Diffie Hellman Groups on 19.1
« on: December 19, 2018, 11:39:31 pm »
Hey All,

Testing out 19.1 and came across IPSEC Issues it doesnt seem that any of the DH codes are working when i  started to look deeper i found that its only supporting curve25519 which isnt even an option in the UI but also that there was an issue with OpenSSL failing to load which looks very similar to a freebsd issue from a while back (https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=212149)

root@ragnarok:/ # swanctl -g
plugin 'openssl' failed to load: /usr/local/lib/ipsec/plugins/libstrongswan-openssl.so: Undefined symbol "RSA_set0_factors"
encryption:
  AES_CBC[aes]
  3DES_CBC[des]
  DES_CBC[des]
  DES_ECB[des]
  BLOWFISH_CBC[blowfish]
  RC2_CBC[rc2]
integrity:
  AES_XCBC_96[xcbc]
  AES_CMAC_96[cmac]
  HMAC_SHA1_96[hmac]
  HMAC_SHA1_128[hmac]
  HMAC_SHA1_160[hmac]
  HMAC_MD5_96[hmac]
  HMAC_MD5_128[hmac]
  HMAC_SHA2_256_128[hmac]
  HMAC_SHA2_256_256[hmac]
  HMAC_SHA2_384_192[hmac]
  HMAC_SHA2_384_384[hmac]
  HMAC_SHA2_512_256[hmac]
  HMAC_SHA2_512_512[hmac]
aead:
  AES_GCM_8[gcm]
  AES_GCM_12[gcm]
  AES_GCM_16[gcm]
hasher:
  HASH_SHA1[sha1]
  HASH_SHA2_224[sha2]
  HASH_SHA2_256[sha2]
  HASH_SHA2_384[sha2]
  HASH_SHA2_512[sha2]
  HASH_MD4[md4]
  HASH_MD5[md5]
  HASH_IDENTITY[curve25519]
prf:
  PRF_KEYED_SHA1[sha1]
  PRF_FIPS_SHA1_160[fips-prf]
  PRF_AES128_XCBC[xcbc]
  PRF_AES128_CMAC[cmac]
  PRF_HMAC_SHA1[hmac]
  PRF_HMAC_MD5[hmac]
  PRF_HMAC_SHA2_256[hmac]
  PRF_HMAC_SHA2_384[hmac]
  PRF_HMAC_SHA2_512[hmac]
xof:
dh:
  CURVE_25519[curve25519]
rng:
  RNG_STRONG[random]
  RNG_TRUE[random]
nonce-gen:
  NONCE_GEN[nonce]
Logged
Hardware ---
A2SDi-4C-HLN4 (8GB Ram, 32GB SATADOM) - Testing 19.1

dasaint

  • Newbie
  • *
  • Posts: 5
  • Karma: 1
    • View Profile
Re: Issues with IPSEC and Diffie Hellman Groups on 19.1
« Reply #1 on: December 19, 2018, 11:42:24 pm »
Another piece of line with IPs XXX'ed Out

Dec 19 14:52:50 ragnarok charon: 15[KNL] creating acquire job for policy xxx.xxx.xxx.xxx/32 === xxx.xxx.xxx.xxx/32 with reqid {1}
Dec 19 14:52:50 ragnarok charon: 13[IKE] <con1|3> initiating IKE_SA con1[3] to xxx.xxx.xxx.xxx
Dec 19 14:52:50 ragnarok charon: 13[IKE] <con1|3> configured DH group MODP_2048 not supported
Dec 19 14:52:50 ragnarok charon: 13[MGR] <con1|3> tried to checkin and delete nonexisting IKE_SA
Logged
Hardware ---
A2SDi-4C-HLN4 (8GB Ram, 32GB SATADOM) - Testing 19.1

dasaint

  • Newbie
  • *
  • Posts: 5
  • Karma: 1
    • View Profile
Re: Issues with IPSEC and Diffie Hellman Groups on 19.1
« Reply #2 on: December 20, 2018, 06:01:55 am »
more info,

this is what i would have expected to see but because of the openssl error i am betting that is root cause, had to boot up an older pfsense box that i had to pull it but i would have expected to see the below and it confirms my suspicions  (PFSense 2.4.4 P1 is using strongSwan 5.7.1 (OpenSSL 1.0.2o-freebsd) and this OPNSense Build 19.1b is using strongSwan 5.6.3 (OpenSSL 1.0.2o-freebsd)) could be a bug from previous strongSwan version that could be affecting Openssl?

Hope this helps more.

DH Groups from PFsense 2.4.4 VM
dh:
  ECP_256[openssl]
  ECP_384[openssl]
  ECP_521[openssl]
  ECP_224[openssl]
  ECP_192[openssl]
  ECP_256_BP[openssl]
  ECP_384_BP[openssl]
  ECP_512_BP[openssl]
  ECP_224_BP[openssl]
  MODP_3072[openssl]
  MODP_4096[openssl]
  MODP_6144[openssl]
  MODP_8192[openssl]
  MODP_2048[openssl]
  MODP_2048_224[openssl]
  MODP_2048_256[openssl]
  MODP_1536[openssl]
  MODP_1024[openssl]
  MODP_1024_160[openssl]
  MODP_768[openssl]
  MODP_CUSTOM[openssl]
  CURVE_25519[curve25519]
Logged
Hardware ---
A2SDi-4C-HLN4 (8GB Ram, 32GB SATADOM) - Testing 19.1

nullinger

  • Newbie
  • *
  • Posts: 19
  • Karma: 0
    • View Profile
Re: Issues with IPSEC and Diffie Hellman Groups on 19.1
« Reply #3 on: December 29, 2018, 02:19:07 am »
I have a similar issue with the same possible cause. After importing configuration from 18.7 to 19.1 my IKEv2 VPNs are broken, the clients can't connect due to some errors with the DH Group

Code: [Select]
Dec 29 02:04:39 opnsense charon: 12[IKE] <40> XYZ is initiating an IKE_SA
Dec 29 02:04:39 opnsense charon: 12[IKE] <40> remote host is behind NAT
Dec 29 02:04:39 opnsense charon: 12[IKE] <40> DH group MODP_2048 inacceptable, requesting MODP_2048
Dec 29 02:04:39 opnsense charon: 12[ENC] <40> generating IKE_SA_INIT response 0 [ N(INVAL_KE) ]

DH Groups:

Code: [Select]
root@opnsense191:~ # ipsec listall | grep DH
    DH:CURVE_25519

root@opnsense187:~ # ipsec listall | grep DH
    DH:ECP_256
    DH:ECP_384
    DH:ECP_521
    DH:ECP_224
    DH:ECP_192
    DH:ECP_256_BP
    DH:ECP_384_BP
    DH:ECP_512_BP
    DH:ECP_224_BP
    DH:MODP_3072
    DH:MODP_4096
    DH:MODP_6144
    DH:MODP_8192
    DH:MODP_2048
    DH:MODP_2048_224
    DH:MODP_2048_256
    DH:MODP_1536
    DH:MODP_1024
    DH:MODP_1024_160
    DH:MODP_768
    DH:MODP_CUSTOM
    DH:CURVE_25519
Logged

mimugmail

  • Hero Member
  • *****
  • Posts: 5180
  • Karma: 362
    • View Profile
Re: Issues with IPSEC and Diffie Hellman Groups on 19.1
« Reply #4 on: December 29, 2018, 08:04:06 am »
Did you install 19.1 image or just install 19.1 kernel?
For me it looks good ...
Logged
IRC: mimugmail
Twitter: mimu_muc
WWW: www.routerperformance.net

mimugmail

  • Hero Member
  • *****
  • Posts: 5180
  • Karma: 362
    • View Profile
Re: Issues with IPSEC and Diffie Hellman Groups on 19.1
« Reply #5 on: December 29, 2018, 08:26:54 am »
OK, was able to reproduce. Installed a fresh 19.1 ISO and got the same behavior.
After updating to latest version and reboot it's gone ..
Logged
IRC: mimugmail
Twitter: mimu_muc
WWW: www.routerperformance.net

franco

  • Administrator
  • Hero Member
  • *****
  • Posts: 10328
  • Karma: 807
    • View Profile
Re: Issues with IPSEC and Diffie Hellman Groups on 19.1
« Reply #6 on: January 02, 2019, 05:36:54 pm »
Sounds strange, but should be reevaluated on 19.1-RC1 for safety.


Cheers,
Franco
Logged

dasaint

  • Newbie
  • *
  • Posts: 5
  • Karma: 1
    • View Profile
Re: Issues with IPSEC and Diffie Hellman Groups on 19.1
« Reply #7 on: January 03, 2019, 06:32:19 am »
i hadnt updated the image as i went on vaca but that would prob be the next step i do believe that the issue is related to the strongswan version being older and that its causing an incompatibility with openssl that triggered the issue.

My tests were New installs via the ISO with 0 updates IIR it said it was 19.1 Version D that i had issues with
Logged
Hardware ---
A2SDi-4C-HLN4 (8GB Ram, 32GB SATADOM) - Testing 19.1

franco

  • Administrator
  • Hero Member
  • *****
  • Posts: 10328
  • Karma: 807
    • View Profile
Re: Issues with IPSEC and Diffie Hellman Groups on 19.1
« Reply #8 on: January 03, 2019, 09:03:36 am »
Oh right, there was a transient issues with OpenSSL on StrongSwan 5.6.3 for us, but it was fixed when StrongSwan 5.7.1 was added in 18.7.7 and the 19.1-BETA images had the faulty one from 18.7.6.

FWIW, LibreSSL was not affected by this as far as I can tell.

Case closed. :)


Cheers,
Franco
Logged

  • Print
Pages: [1]
« previous next »
  • OPNsense Forum »
  • Archive »
  • 19.1 Legacy Series »
  • Issues with IPSEC and Diffie Hellman Groups on 19.1
 

OPNsense is an OSS project © Deciso B.V. 2015 - 2021 All rights reserved
  • SMF 2.0.17 | SMF © 2019, Simple Machines
    Privacy Policy
    | XHTML | RSS | WAP2