0

I try to create a simple Strongswan connection between a server and an Android phone, using Strongswan Android application.

My Android phone informations : Android 8.0.0 with Samsung Experience 9.0 It's a Galaxy A5 (2017) model

I tried using both 4G and Wifi My Strongswan app is on version 2.3.0, updated on june 2020

My server informations : It's an Ubuntu 18.04 VPS up-to-date

My Strongswan server configuration is as follow I downloaded manually Strongswan 5.9.0 and then configured it using

./configure --prefix=/custompath/strongroot --disable-stroke --with-piddir=/custompath/strongroot/var/run --enable-eap-dynamic --enable-eap-mschapv2 --enable-eap-aka --enable-eap-identity --enable-md4
make
make install

My strongswan.conf is as follow

charon {
        load_modular = yes

        plugins {

                include strongswan.d/charon/*.conf
        }
}

include strongswan.d/*.conf

My server-side swanctl.conf is as follow

connections {
       server {
                pools = primary-pool-ipv4, primary-pool-ipv6
                local {
                        auth = pubkey
                        certs = <server_crt>
                        id = <server_id>
                }
                remote {
                        auth = eap-dynamic
                        id = %any
                }
                children {
                        client {
                                start_action = trap
                                local_ts = 0.0.0.0/0,::/0
                        }
                }
        }
}


secrets {
        eap-test {
                id = <user_id>
                secret = <user_password>
        }
}


pools {
    primary-pool-ipv4 {
        addrs = 127.0.0.0/8
        dns = 8.8.8.8 
    }
    primary-pool-ipv6 {
        addrs = ::/24

    }
}

Server is launched with following command as root with those results

/custompath/strongroot/libexec/ipsec/charon &
/custompath/strongroot/sbin/swanctl -q


loaded certificate from '/custompath/strongroot/etc/swanctl/x509/<server_crt'
loaded certificate from '/custompath/strongroot/etc/swanctl/x509ca/<CA_crt>'
loaded rsa key from '/custompath/strongroot/etc/swanctl/private/<server_key>'
loaded eap secret 'eap-test'
no authorities found, 0 unloaded
loaded pool 'primary-pool-ipv4'
loaded pool 'primary-pool-ipv6'
successfully loaded 2 pools, 0 unloaded
loaded connection 'server'
successfully loaded 1 connections, 0 unloaded

On my android phone, I used following parameters on my Strongswan App

Server : <server ipv4>
VPN Type : IKEv2 EAP (Username/Password)
Username : <user_id>
Password <user_password>

CA certificate : <CA_crt>

Server identity : <server_id>
Client identity : <user_id>

Every other fields were left at default/blank value (except the OCSP to check certificate that I disabled because it's a locally generated CA certificate, not sure it will have any effect here anyway)

On my server-side, everything is correctly set (especially CA and server crt)

But when I try to establish a connection, I got those logs on client-side (truncated as there are

[DMN] +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
[DMN] Starting IKE service (strongSwan 5.8.4, Android 8.0.0 - R16NW.A520FXXSFCTG8/2020-08-01, SM-A520F - samsung/a5y17ltexx/samsung, Linux 3.18.14-13712092-QB33307948, aarch64)
    Oct 23 16:11:53 00[LIB] loaded plugins: androidbridge charon android-log openssl fips-prf random nonce pubkey chapoly curve25519 pkcs1 pkcs8 pem xcbc hmac socket-default revocation eap-identity eap-mschapv2 eap-md5 eap-gtc eap-tls x509
[JOB] spawning 16 worker threads
[LIB] all OCSP validation disabled
[IKE] initiating IKE_SA android[15] to <server_ip>
[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
[NET] sending packet: from <client_ip>[33144] to <server_ip>[500] (716 bytes)
[NET] received packet: from <server_ip>[500] to <client_ip>[33144] (38 bytes)
[ENC] parsed IKE_SA_INIT response 0 [ N(INVAL_KE) ]
[IKE] peer didn't accept DH group ECP_256, it requested CURVE_25519
[IKE] initiating IKE_SA android[15] to <server_ip>
[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
[NET] sending packet: from <client_ip>[33144] to <server_ip>[500] (684 bytes)
[NET] received packet: from <server_ip>[500] to <client_ip>[33144] (273 bytes)
[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(HASH_ALG) N(CHDLESS_SUP) N(MULT_AUTH) ]
[CFG] selected proposal: IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_AES128_XCBC/CURVE_25519
[IKE] local host is behind NAT, sending keep alives
[IKE] received cert request for "C=FR, O=Test, CN=Test CA"
[IKE] sending cert request for "C=FR, O=Test, CN=Test CA"
[IKE] establishing CHILD_SA android{15}
[ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ IDr CPRQ(ADDR ADDR6 DNS DNS6) N(ESP_TFC_PAD_N) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
[NET] sending packet: from <client_ip>[56499] to <server_ip>[4500] (480 bytes)
[NET] received packet: from <server_ip>[4500] to <client_ip>[56499] (1184 bytes)
[ENC] parsed IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/AKA ]
[IKE] received end entity cert "C=FR, O=Test, CN=<server_id>"
[CFG]   using certificate "C=FR, O=Test, CN=<server_id>"
[CFG]   using trusted ca certificate "C=FR, O=Test, CN=Test CA"
[CFG] checking certificate status of "C=FR, O=Test, CN=<server_id>"
[CFG] certificate status is not available
[CFG]   reached self-signed root ca with a path length of 0
[IKE] authentication of 'serv' with RSA_EMSA_PKCS1_SHA2_256 successful
[IKE] server requested EAP_AKA authentication (id 0xCA)
[IKE] EAP method not supported, sending EAP_NAK
[ENC] generating IKE_AUTH request 2 [ EAP/RES/NAK ]
[NET] sending packet: from <client_ip>[56499] to <server_ip>[4500] (80 bytes)
[NET] received packet: from <server_ip>[4500] to <client_ip>[56499] (112 bytes)
[ENC] parsed IKE_AUTH response 2 [ EAP/REQ/MSCHAPV2 ]
[IKE] server requested EAP_MSCHAPV2 authentication (id 0x7A)
[ENC] generating IKE_AUTH request 3 [ EAP/RES/MSCHAPV2 ]
[NET] sending packet: from <client_ip>[56499] to <server_ip>[4500] (144 bytes)
[NET] received packet: from <server_ip>[4500] to <client_ip>[56499] (144 bytes)
[ENC] parsed IKE_AUTH response 3 [ EAP/REQ/MSCHAPV2 ]
[IKE] EAP-MS-CHAPv2 succeeded: 'Welcome2strongSwan'
[ENC] generating IKE_AUTH request 4 [ EAP/RES/MSCHAPV2 ]
[NET] sending packet: from <client_ip>[56499] to <server_ip>[4500] (80 bytes)
[NET] received packet: from <server_ip>[4500] to <client_ip>[56499] (80 bytes)
[ENC] parsed IKE_AUTH response 4 [ EAP/SUCC ]
[IKE] EAP method EAP_MSCHAPV2 succeeded, MSK established
[IKE] authentication of <user_id> (myself) with EAP
[ENC] generating IKE_AUTH request 5 [ AUTH ]
[NET] sending packet: from <client_ip>[56499] to <server_ip>[4500] (96 bytes)
[NET] received packet: from <server_ip>[4500] to <client_ip>[56499] (336 bytes)
[ENC] parsed IKE_AUTH response 5 [ AUTH CPRP(ADDR ADDR6 DNS) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) ]
[IKE] authentication of <server_id> with EAP successful
[IKE] IKE_SA android[15] established between <client_ip>[<user_id>]...<server_ip>[<server_id>]
[IKE] scheduling rekeying in 35468s
[IKE] maximum IKE_SA lifetime 37268s
[IKE] installing DNS server 8.8.8.8
[IKE] installing new virtual IP 127.0.0.1
[IKE] installing new virtual IP ::1
[CFG] selected proposal: ESP:AES_CBC_128/HMAC_SHA2_256_128/NO_EXT_SEQ
[IKE] CHILD_SA android{15} established with SPIs d1729f20_i cded7525_o and TS 127.0.0.1/32 ::1/128 === 0.0.0.0/0 ::/0
[DMN] setting up TUN device for CHILD_SA android{15}
[LIB] builder: failed to build TUN device
[DMN] failed to setup TUN device
[IKE] peer supports MOBIKE
[IKE] deleting IKE_SA android[15] between <client_ip>[<user_id>]...<server_ip>[<server_id>]
[IKE] sending DELETE for IKE_SA android[15]
[ENC] generating INFORMATIONAL request 6 [ D ]
[NET] sending packet: from <client_ip>[56499] to <server_ip>[4500] (80 bytes)

Here the important lines seems to be

[LIB] builder: failed to build TUN device
[DMN] failed to setup TUN device

I only found online resources about a bug with android 4.4, which is not the case here, any idea on how to solve it ?

I did not shown server-side logs, as they are ultra verbose, but no error is reported (I can still show you it if needed). It seems that server receive a DELETE from client and then procede to close the connection, going from ESTABLISHED to DELETING to DESTROYING as shown below

[IKE] <server|8> IKE_SA server[8] state change: ESTABLISHED => DELETING
[...]
[MGR] <server|8> checkin and destroy IKE_SA server[8]
[IKE] <server|8> IKE_SA server[8] state change: DELETING => DESTROYING
[CHD] <server|8> CHILD_SA client{4} state change: INSTALLED => DESTROYING
[KNL] <server|8> deleting policy 0.0.0.0/0 === 127.0.0.1/32 out
Improve this question
4
  • Those virtual IP addresses look strange and probably cause this error. Why are loopback addresses (127.0.0.1/32, ::1/128) assigned to the client? (I mean I see that you configured the IP pools like that, but why?)
    – ecdsa
    Oct 23, 2020 at 17:35
  • As I was fighting with Strongswan for a bit, maybe I chose the wrong ones. Changing it for 10.0.0.0/24 and 2620:0:2d0:200::7/97 (totally arbitrary random values), it now works, thanks ! But then there is something strange : When going on monip.org with my VPN connected, I see that my ip is still the client one, and not the VPN one as i thought it would be. There is something wrong with my config ? Or maybe I did not understood properly how it works ?
    – Dazounet
    Oct 24, 2020 at 10:21
  • Please update the config, logs etc. as it's difficult to say without seeing what's now configured and negotiated (or create a new question with that information).
    – ecdsa
    Oct 26, 2020 at 9:51
  • Yeah as it seems not related I'll create another question ! Thanks
    – Dazounet
    Oct 27, 2020 at 9:43

1 Answer 1

Reset to default
0

The answer here was my bad pool address allocated. Changing to

pools {
    primary-pool-ipv4 {
        addrs = 10.0.0.0/24
        dns = 8.8.8.8 
    }
    primary-pool-ipv6 {
        addrs = 2620:0:2d0:200::7/97

    }
}

works properly

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .