Problemas com o StrongSwan no FreeBSD 10.0. Charon se recusa a começar

Question

O charon.log com níveis de depuração completos (4) é o seguinte:

Jan 21 16:09:47 00[DMN] Starting IKE charon daemon (strongSwan 5.0.4, FreeBSD 10.0-RELEASE, amd64)
Jan 21 16:09:47 00[LIB] plugin 'aes': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'des': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'blowfish': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'sha1': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'sha2': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'md4': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'md5': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'random': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'nonce': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'x509': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'revocation': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'constraints': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'pubkey': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'pkcs1': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'pkcs8': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'pgp': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'dnskey': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'pem': loaded successfully
Jan 21 16:09:47 00[LIB] openssl FIPS mode(0) unavailable
Jan 21 16:09:47 00[LIB] plugin 'openssl': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'fips-prf': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'xcbc': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'cmac': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'hmac': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'attr': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'kernel-pfkey': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'kernel-pfroute': loaded successfully
Jan 21 16:09:47 00[KNL] known interfaces and IP addresses:
Jan 21 16:09:47 00[KNL]   bce0
Jan 21 16:09:47 00[KNL]     -snip-
Jan 21 16:09:47 00[KNL]     -snip-
Jan 21 16:09:47 00[KNL]   lo0
Jan 21 16:09:47 00[KNL]     ::1
Jan 21 16:09:47 00[KNL]     fe80::1
Jan 21 16:09:47 00[KNL]     127.0.0.1
Jan 21 16:09:47 00[LIB] plugin 'resolve': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'socket-default': loaded successfully
Jan 21 16:09:47 00[KNL] unable to set UDP_ENCAP: Invalid argument
Jan 21 16:09:47 00[NET] enabling UDP decapsulation for IPv6 on port 4500 failed
Jan 21 16:09:47 00[KNL] unable to set UDP_ENCAP: Invalid argument
Jan 21 16:09:47 00[NET] enabling UDP decapsulation for IPv4 on port 4500 failed
Jan 21 16:09:47 00[LIB] plugin 'stroke': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'updown': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'eap-identity': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'eap-md5': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'eap-mschapv2': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'eap-tls': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'eap-ttls': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'eap-peap': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'whitelist': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'addrblock': loaded successfully
Jan 21 16:09:47 00[CFG] loading ca certificates from '/usr/local/etc/ipsec.d/cacerts'
Jan 21 16:09:47 00[CFG] loading aa certificates from '/usr/local/etc/ipsec.d/aacerts'
Jan 21 16:09:47 00[CFG] loading ocsp signer certificates from '/usr/local/etc/ipsec.d/ocspcerts'
Jan 21 16:09:47 00[CFG] loading attribute certificates from '/usr/local/etc/ipsec.d/acerts'
Jan 21 16:09:47 00[CFG] loading crls from '/usr/local/etc/ipsec.d/crls'
Jan 21 16:09:47 00[CFG] loading secrets from '/usr/local/etc/ipsec.secrets'
Jan 21 16:09:47 00[CFG]   loaded IKE secret for %any
Jan 21 16:09:47 00[CFG]   secret: -snip-
Jan 21 16:09:47 00[LIB] feature CUSTOM:libcharon in 'charon' plugin has unsatisfied dependency: CUSTOM:libcharon-receiver
Jan 21 16:09:47 00[LIB] feature CUSTOM:libcharon-receiver in 'charon' plugin has unsatisfied dependency: HASHER:HASH_SHA1
Jan 21 16:09:47 00[LIB] feature PRIVKEY:DSA in 'pem' plugin has unsatisfied dependency: PRIVKEY:DSA
Jan 21 16:09:47 00[LIB] feature PUBKEY:DSA in 'pem' plugin has unsatisfied dependency: PUBKEY:DSA
Jan 21 16:09:47 00[LIB] feature CERT_DECODE:X509_OCSP_REQUEST in 'pem' plugin has unsatisfied dependency: CERT_DECODE:X509_OCSP_REQUEST
Jan 21 16:09:47 00[LIB]   failed to load CUSTOM:libcharon in critical plugin 'charon'
Jan 21 16:09:47 00[LIB]   failed to load CUSTOM:libcharon-receiver in critical plugin 'charon'
Jan 21 16:09:47 00[LIB] failed to load 2 features in critical plugin 'charon'
Jan 21 16:09:47 00[DMN] initialization failed - aborting charon

A mesma configuração funcionou bem em 9.2, mas agora após a atualização para o 10.0 não funciona mais. O resto do sistema funciona como esperado.

uname -a é o seguinte (como você pode ver, um kernel personalizado para suporte a IPSec)

FreeBSD icefox 10.0-RELEASE FreeBSD 10.0-RELEASE #3: Tue Jan 21 15:49:28 CET 2014     doridian@icefox:/usr/obj/usr/src/sys/IPSEC  amd64

    

Answer 1

Eu me lembro de ter um problema com o strongSwan 5.0.4 e acho que estava no FreeBSD 10 rc3 na época. Eu sei que a versão mais recente da porta foi atualizada durante fevereiro e agora está na versão 5.1.1 e funciona no ambiente de teste.