Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The charon.log with full debug levels (4) is as follows:

Jan 21 16:09:47 00[DMN] Starting IKE charon daemon (strongSwan 5.0.4, FreeBSD 10.0-RELEASE, amd64)
Jan 21 16:09:47 00[LIB] plugin 'aes': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'des': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'blowfish': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'sha1': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'sha2': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'md4': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'md5': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'random': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'nonce': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'x509': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'revocation': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'constraints': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'pubkey': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'pkcs1': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'pkcs8': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'pgp': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'dnskey': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'pem': loaded successfully
Jan 21 16:09:47 00[LIB] openssl FIPS mode(0) unavailable
Jan 21 16:09:47 00[LIB] plugin 'openssl': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'fips-prf': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'xcbc': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'cmac': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'hmac': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'attr': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'kernel-pfkey': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'kernel-pfroute': loaded successfully
Jan 21 16:09:47 00[KNL] known interfaces and IP addresses:
Jan 21 16:09:47 00[KNL]   bce0
Jan 21 16:09:47 00[KNL]     -snip-
Jan 21 16:09:47 00[KNL]     -snip-
Jan 21 16:09:47 00[KNL]   lo0
Jan 21 16:09:47 00[KNL]     ::1
Jan 21 16:09:47 00[KNL]     fe80::1
Jan 21 16:09:47 00[KNL]     127.0.0.1
Jan 21 16:09:47 00[LIB] plugin 'resolve': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'socket-default': loaded successfully
Jan 21 16:09:47 00[KNL] unable to set UDP_ENCAP: Invalid argument
Jan 21 16:09:47 00[NET] enabling UDP decapsulation for IPv6 on port 4500 failed
Jan 21 16:09:47 00[KNL] unable to set UDP_ENCAP: Invalid argument
Jan 21 16:09:47 00[NET] enabling UDP decapsulation for IPv4 on port 4500 failed
Jan 21 16:09:47 00[LIB] plugin 'stroke': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'updown': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'eap-identity': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'eap-md5': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'eap-mschapv2': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'eap-tls': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'eap-ttls': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'eap-peap': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'whitelist': loaded successfully
Jan 21 16:09:47 00[LIB] plugin 'addrblock': loaded successfully
Jan 21 16:09:47 00[CFG] loading ca certificates from '/usr/local/etc/ipsec.d/cacerts'
Jan 21 16:09:47 00[CFG] loading aa certificates from '/usr/local/etc/ipsec.d/aacerts'
Jan 21 16:09:47 00[CFG] loading ocsp signer certificates from '/usr/local/etc/ipsec.d/ocspcerts'
Jan 21 16:09:47 00[CFG] loading attribute certificates from '/usr/local/etc/ipsec.d/acerts'
Jan 21 16:09:47 00[CFG] loading crls from '/usr/local/etc/ipsec.d/crls'
Jan 21 16:09:47 00[CFG] loading secrets from '/usr/local/etc/ipsec.secrets'
Jan 21 16:09:47 00[CFG]   loaded IKE secret for %any
Jan 21 16:09:47 00[CFG]   secret: -snip-
Jan 21 16:09:47 00[LIB] feature CUSTOM:libcharon in 'charon' plugin has unsatisfied dependency: CUSTOM:libcharon-receiver
Jan 21 16:09:47 00[LIB] feature CUSTOM:libcharon-receiver in 'charon' plugin has unsatisfied dependency: HASHER:HASH_SHA1
Jan 21 16:09:47 00[LIB] feature PRIVKEY:DSA in 'pem' plugin has unsatisfied dependency: PRIVKEY:DSA
Jan 21 16:09:47 00[LIB] feature PUBKEY:DSA in 'pem' plugin has unsatisfied dependency: PUBKEY:DSA
Jan 21 16:09:47 00[LIB] feature CERT_DECODE:X509_OCSP_REQUEST in 'pem' plugin has unsatisfied dependency: CERT_DECODE:X509_OCSP_REQUEST
Jan 21 16:09:47 00[LIB]   failed to load CUSTOM:libcharon in critical plugin 'charon'
Jan 21 16:09:47 00[LIB]   failed to load CUSTOM:libcharon-receiver in critical plugin 'charon'
Jan 21 16:09:47 00[LIB] failed to load 2 features in critical plugin 'charon'
Jan 21 16:09:47 00[DMN] initialization failed - aborting charon

The same config worked fine on 9.2, but now after the upgrade to 10.0 does not work anymore. The rest of the system works as expected.

uname -a is as follows (as you can see, a custom kernel for IPSec support)

FreeBSD icefox 10.0-RELEASE FreeBSD 10.0-RELEASE #3: Tue Jan 21 15:49:28 CET 2014     doridian@icefox:/usr/obj/usr/src/sys/IPSEC  amd64
share|improve this question
    
How did you "upgrade"? Have you rebuilt or updated the port/package? –  Chris S Jan 21 at 15:34
    
freebsd-update -r 10.0-RELEASE fetch, then install, then recompile my kernel. –  Doridian Jan 21 at 17:57
    
It's a strange error because the sha1 and the openssl plugins are loaded successfully, which both provide the HASHER:HASH_SHA1 feature. Do you have charon.load configured in strongswan.conf? If so, remove it please. –  ecdsa Jan 22 at 8:46
    
strongswan.conf only specifies charon.filelog, charon.plugins.sql, charon.threads (default strongswan.conf as it was delivered plus filelog) –  Doridian Jan 22 at 10:10
add comment

1 Answer 1

I remember having an issue with strongSwan 5.0.4 and I think it was on FreeBSD 10 rc3 at the time. I know the latest version of the port was updated during February it is now on 5.1.1 and it does work in the testing environment.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.