请社区持续维护更新本项目

highland0971 commented 3 years ago

各位朋友，基于zhangke5959及大家的无私奉献，我们现在有一个能够编译运行的开源国密strongswan（我这边正在等待华为交换机等商用交换机进行验证）。

目前这个分支的源头版本有一些早，没有办法与strongswan社区最新版本进行同步更新，后续维护起来担心可能会有问题。我这边基于zhangke5959的代码仓库以及在Issues中提到的若干修正，尝试将所有国密代码与最新的strongswan做了合并（合并期间亦做了部分错误修正），已经本地编译且运行通过。

但由于个人的能力有限，没有能力进一步维护代码更新或对国密算法做进一步的维护更新，为了让zhangke及大家的努力拥有持续的生命力，希望各位大神能够将我这边合并结果拿走做进一步的维护并开源给社区，如有可能推送到strongswan的官方社区，将国密算法实现作为strongswan的标准配置。

以上，仓库在strongswan-gmalg-merge，请大家拿走，并作持续更新维护回馈给社区，让项目能够持续。

cmdedds commented 3 years ago

想请教一个问题： prf.c中是否不应该将 PRF_AES128_CMAC 修改为9。根据iana的规范 http://www.iana.org/assignments/ikev2-parameters/ikev2-parameters.xhtml ，修改 PRF_AES128_CMAC 的值，应该不符合规范。我觉得应该修改 PRF_HMAC_SM3 为 10 及其以后的值。不知是否有问题，请指教。。。谢谢

wangyongzx commented 3 years ago

你和华为网关联调通了吗？我最近也在做这个版本的国密和华为商用网关的联调？微信：18355153875/QQ：939866911能交流一下吗？

highland0971 commented 3 years ago

目前还没有，在对加密协议的配对上，和华为的设备对不上。

highland0971 commented 3 years ago

这块我也有疑惑，在 @zhangke5959 的这个版本实现中对很多默认的协议的代码都做了调整，软件自身对接没有问题，但预计在跟其他ipsec实现对接时会有问题。

我记得github上有一个朋友的ipsec国密实现，也是基于zhangke这个版本，但在协议ID上对zhangke的修改做了回退。

cmdedds commented 3 years ago

是的，在 @zhangke5959 的这个版本实现中国密算法的值（不只这一点）不符合《GM/T 0022-2014 IPSec VPN》的规范。所以无法与其他设备对接。

wangyongzx commented 3 years ago

wangyongzx commented 3 years ago

对做对接这个有什么思路吗？

cmdedds commented 3 years ago

就我所知，没有开源版本实现了《GM/T 0022-2014 IPSec VPN》这个规范。

wangyongzx commented 3 years ago

你和华为网关对接了吗？可以交流下，有偿请教

cmdedds commented 3 years ago

我没有和华为设备对接...

wangyongzx commented 3 years ago

您这边了解应该改哪些代码吗

cmdedds commented 3 years ago

看规范，改动量应该挺大的；具体的还没开始改。。。

lijh8 commented 2 years ago

感谢！ Readme里的这个单词可以改一下：Claim -> Acknowledgement

highland0971 commented 2 years ago

好的，谢谢

hcjjmt commented 2 years ago

can't install route for 192.168.11.133/32 === 192.168.11.132/32 out, conflicts with IKE traffic 13[IKE] unable to install IPsec policies (SPD) in kernel 我按照作者的readme配置的，但是报了一个奇怪的错误。

hcjjmt commented 2 years ago

期待作者的回复，万分感谢

leonshaw commented 2 years ago

上面不推挺难的，不进 IANA 很难合到上游。这个商用标准的支持的值不全，也不能保证以后不冲突，而且以后万一注册了又得改。现阶段自己的设备建议挪到私有段，第三方对接的建议按他们的文档来。

happyfir commented 1 year ago

请问你解决了吗怎么解决的我也遇到同样的问题了

bin-wang1 commented 1 year ago

请问解决了吗？遇到同样的错误解决不了。

bin-wang1 commented 1 year ago

请问解决了吗？遇到同样的问题！！！

bin-wang1 commented 1 year ago

帅哥！安装你的仓库，进行配置，没法正常进行运行！显示unable to install IPsec policies in kernel

zhangke5959 commented 1 year ago

您好！你的问题解决了吗，当时就是就是随意上传了代码，没有测试过功能，这几年也没更新，如果你你那边有测试环境，我可以抽点时间协助处理问题，尽量整理一版可用的，我也是边学边改代码，如果不能给大家解决问题，也请见谅。

在 2023-04-11 15:34:48，"bin-wang1" @.***> 写道：

各位朋友，基于zhangke5959及大家的无私奉献，我们现在有一个能够编译运行的开源国密strongswan（我这边正在等待华为交换机等商用交换机进行验证）。

目前这个分支的源头版本有一些早，没有办法与strongswan社区最新版本进行同步更新，后续维护起来担心可能会有问题。我这边基于zhangke5959的代码仓库以及在Issues中提到的若干修正，尝试将所有国密代码与最新的strongswan做了合并（合并期间亦做了部分错误修正），已经本地编译且运行通过。

但由于个人的能力有限，没有能力进一步维护代码更新或对国密算法做进一步的维护更新，为了让zhangke及大家的努力拥有持续的生命力，希望各位大神能够将我这边合并结果拿走做进一步的维护并开源给社区，如有可能推送到strongswan的官方社区，将国密算法实现作为strongswan的标准配置。

以上，仓库在strongswan-gmalg-merge，请大家拿走，并作持续更新维护回馈给社区，让项目能够持续。

帅哥！安装你的仓库，进行配置，没法正常进行运行！显示unable to install IPsec policies in kernel

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: @.***>

hcjjmt commented 1 year ago

您好作者，当初你的那个版本我是没解决。我应该是换了另一个版本，那个人是在您的版本上进行了小的修改，但是也有一些小问题，主要就是隧道不稳定，以及在某些网络情况下，即使建立了链接，抓包发现也是不加密的。如果有机会，非常希望能和您一起做这方面的工作，进行学习。

------------------ 原始邮件 ------------------ 发件人: "zhangke5959/strongswan" @.>; 发送时间: 2023年4月17日(星期一) 中午1:49 @.>; @.**@.>; 主题: Re: [zhangke5959/strongswan] 请社区持续维护更新本项目 (#17)

您好！你的问题解决了吗，当时就是就是随意上传了代码，没有测试过功能，这几年也没更新，如果你你那边有测试环境，我可以抽点时间协助处理问题，尽量整理一版可用的，我也是边学边改代码，如果不能给大家解决问题，也请见谅。

在 2023-04-11 15:34:48，"bin-wang1" @.***> 写道：

各位朋友，基于zhangke5959及大家的无私奉献，我们现在有一个能够编译运行的开源国密strongswan（我这边正在等待华为交换机等商用交换机进行验证）。

目前这个分支的源头版本有一些早，没有办法与strongswan社区最新版本进行同步更新，后续维护起来担心可能会有问题。我这边基于zhangke5959的代码仓库以及在Issues中提到的若干修正，尝试将所有国密代码与最新的strongswan做了合并（合并期间亦做了部分错误修正），已经本地编译且运行通过。

但由于个人的能力有限，没有能力进一步维护代码更新或对国密算法做进一步的维护更新，为了让zhangke及大家的努力拥有持续的生命力，希望各位大神能够将我这边合并结果拿走做进一步的维护并开源给社区，如有可能推送到strongswan的官方社区，将国密算法实现作为strongswan的标准配置。

以上，仓库在strongswan-gmalg-merge，请大家拿走，并作持续更新维护回馈给社区，让项目能够持续。

帅哥！安装你的仓库，进行配置，没法正常进行运行！显示unable to install IPsec policies in kernel

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: @.> — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you commented.Message ID: @.>

bin-wang1 commented 1 year ago

你好！正在调试中！非常感谢你的回信。非常感谢你的热心帮助！我还在调试中，后面有问题的话，可能还要麻烦你！

---原始邮件--- 发件人: @.> 发送时间: 2023年4月17日(周一) 中午1:49 收件人: @.>; 抄送: @.**@.>; 主题: Re: [zhangke5959/strongswan] 请社区持续维护更新本项目 (#17)

您好！你的问题解决了吗，当时就是就是随意上传了代码，没有测试过功能，这几年也没更新，如果你你那边有测试环境，我可以抽点时间协助处理问题，尽量整理一版可用的，我也是边学边改代码，如果不能给大家解决问题，也请见谅。

在 2023-04-11 15:34:48，"bin-wang1" @.***> 写道：

各位朋友，基于zhangke5959及大家的无私奉献，我们现在有一个能够编译运行的开源国密strongswan（我这边正在等待华为交换机等商用交换机进行验证）。

目前这个分支的源头版本有一些早，没有办法与strongswan社区最新版本进行同步更新，后续维护起来担心可能会有问题。我这边基于zhangke5959的代码仓库以及在Issues中提到的若干修正，尝试将所有国密代码与最新的strongswan做了合并（合并期间亦做了部分错误修正），已经本地编译且运行通过。

但由于个人的能力有限，没有能力进一步维护代码更新或对国密算法做进一步的维护更新，为了让zhangke及大家的努力拥有持续的生命力，希望各位大神能够将我这边合并结果拿走做进一步的维护并开源给社区，如有可能推送到strongswan的官方社区，将国密算法实现作为strongswan的标准配置。

以上，仓库在strongswan-gmalg-merge，请大家拿走，并作持续更新维护回馈给社区，让项目能够持续。

帅哥！安装你的仓库，进行配置，没法正常进行运行！显示unable to install IPsec policies in kernel

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: @.> — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you commented.Message ID: @.>

bin-wang1 commented 1 year ago

大佬！您好！打扰了代码还是没跑通，麻烦您抽时间帮我分析分析。万分感谢！已经做的工作： 1、重编译内核：更改了xfrm_alg.c的代码，重新编译了内核。内核版本是5.15.1 2、编译了soft_alg.ko,使用insmod进行了加载，dmesg|tail提示 loading out-of-tree module taints kernel module verification failed: signature and/or required key missing - tainting kernel 以及function: sm3_init , line= 354 sm4_init 但是lsmod可看到已加载了soft_alg.ko，makefile里也有CONFIG_MODULE_SIG=n（好像没起作用） 3、在conf.d进行了配置：内容如下 server: connections { vpn { proposals = sm4cbc-sm3-sm2dh local_addrs=172.22.16.2 remote_addrs=172.22.16.3 local { auth = pubkey id = "172.22.16.2" certs = server.cert.pem } remote { auth = pubkey id = "172.22.16.3" } children { vpn_child { esp_proposals = sm4cbc-sm3-sm2dh updown = /opt/ss-gmalg/libexec/ipsec/_updown iptables } } } }

client： connections { vpn { proposals = sm4cbc-sm3-sm2dh local_addrs=172.22.16.3 remote_addrs=172.22.16.2 local { auth = pubkey id = "172.22.16.3" certs = client.cert.pem } remote { auth = pubkey id = "172.22.16.2" } children { vpn_child { esp_proposals = sm4cbc-sm3-sm2dh updown = /opt/ss-gmalg/libexec/ipsec/_updown iptables } } } }

进行联通的结果如下： server: @.***:/opt/ss-gmalg# /opt/ss-gmalg/sbin/swanctl -T 11[NET] received packet: from 172.22.16.3[500] to 172.22.16.2[500] (274 bytes) 11[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ] 11[IKE] 172.22.16.3 is initiating an IKE_SA 11[CFG] selected proposal: IKE:SM4_CBC_128/HMAC_SM3/PRF_HMAC_SM3/CURVE_SM2 11[IKE] remote host is behind NAT 11[IKE] sending cert request for "C=Country, O=Company, CN=root_CA" 11[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(HASH_ALG) N(CHDLESS_SUP) N(MULT_AUTH) ] 11[NET] sending packet: from 172.22.16.2[500] to 172.22.16.3[500] (307 bytes) 09[NET] received packet: from 172.22.16.3[4500] to 172.22.16.2[4500] (768 bytes) 09[ENC] parsed IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ] 09[IKE] received cert request for "C=Country, O=Company, CN=root_CA" 09[IKE] received end entity cert "C=Country, O=Company, CN=client" 09[CFG] looking for peer configs matching 172.22.16.2[172.22.16.2]...172.22.16.3[172.22.16.3] 09[CFG] selected peer config 'vpn' 09[CFG] using certificate "C=Country, O=Company, CN=client" 09[CFG] using trusted ca certificate "C=Country, O=Company, CN=root_CA" 09[CFG] checking certificate status of "C=Country, O=Company, CN=client" 09[CFG] certificate status is not available 09[CFG] reached self-signed root ca with a path length of 0 09[IKE] authentication of '172.22.16.3' with SM2_WITH_SM3 successful 09[IKE] peer supports MOBIKE 09[IKE] authentication of '172.22.16.2' (myself) with SM2_WITH_SM3 successful 09[IKE] IKE_SA vpn[1] established between 172.22.16.2[172.22.16.2]...172.22.16.3[172.22.16.3] 09[IKE] scheduling rekeying in 13463s 09[IKE] maximum IKE_SA lifetime 14903s 09[IKE] sending end entity cert "C=Country, O=Company, CN=172.22.16.2" 09[CFG] selected proposal: ESP:SM4_CBC_128/HMAC_SM3/NO_EXT_SEQ 09[KNL] can't install route for 172.22.16.2/32 === 172.22.16.3/32 out, conflicts with IKE traffic 09[IKE] unable to install IPsec policies (SPD) in kernel 09[IKE] failed to establish CHILD_SA, keeping IKE_SA 09[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH N(MOBIKE_SUP) N(NO_ADD_ADDR) N(TS_UNACCEPT) ] 09[NET] sending packet: from 172.22.16.2[4500] to 172.22.16.3[4500] (656 bytes) ^Cdisconnecting...

client: @.***:/opt/ss-gmalg# /opt/ss-gmalg/sbin/swanctl -i --child vpn_child [IKE] initiating IKE_SA vpn[2] to 172.22.16.2 [ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ] [NET] sending packet: from 172.22.16.3[500] to 172.22.16.2[500] (274 bytes) [NET] received packet: from 172.22.16.2[500] to 172.22.16.3[500] (307 bytes) [ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(HASH_ALG) N(CHDLESS_SUP) N(MULT_AUTH) ] [CFG] selected proposal: IKE:SM4_CBC_128/HMAC_SM3/PRF_HMAC_SM3/CURVE_SM2 [IKE] remote host is behind NAT [IKE] received cert request for "C=Country, O=Company, CN=root_CA" [IKE] sending cert request for "C=Country, O=Company, CN=root_CA" [IKE] authentication of '172.22.16.3' (myself) with SM2_WITH_SM3 successful [IKE] sending end entity cert "C=Country, O=Company, CN=client" [IKE] establishing CHILD_SA vpn_child{1} [ENC] generating IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ] [NET] sending packet: from 172.22.16.3[4500] to 172.22.16.2[4500] (768 bytes) [NET] received packet: from 172.22.16.2[4500] to 172.22.16.3[4500] (656 bytes) [ENC] parsed IKE_AUTH response 1 [ IDr CERT AUTH N(MOBIKE_SUP) N(NO_ADD_ADDR) N(TS_UNACCEPT) ] [IKE] received end entity cert "C=Country, O=Company, CN=172.22.16.2" [CFG] using certificate "C=Country, O=Company, CN=172.22.16.2" [CFG] using trusted ca certificate "C=Country, O=Company, CN=root_CA" [CFG] checking certificate status of "C=Country, O=Company, CN=172.22.16.2" [CFG] certificate status is not available [CFG] reached self-signed root ca with a path length of 0 [IKE] authentication of '172.22.16.2' with SM2_WITH_SM3 successful [IKE] IKE_SA vpn[2] established between 172.22.16.3[172.22.16.3]...172.22.16.2[172.22.16.2] [IKE] scheduling rekeying in 13237s [IKE] maximum IKE_SA lifetime 14677s [IKE] received TS_UNACCEPTABLE notify, no CHILD_SA built [IKE] failed to establish CHILD_SA, keeping IKE_SA initiate failed: establishing CHILD_SA 'vpn_child' failed

麻烦您帮我看看！谢谢大佬！

王斌 @.***

------------------ 原始邮件 ------------------ 发件人: "zhangke5959/strongswan" @.>; 发送时间: 2023年4月17日(星期一) 中午1:49 @.>; @.**@.>; 主题: Re: [zhangke5959/strongswan] 请社区持续维护更新本项目 (#17)

您好！你的问题解决了吗，当时就是就是随意上传了代码，没有测试过功能，这几年也没更新，如果你你那边有测试环境，我可以抽点时间协助处理问题，尽量整理一版可用的，我也是边学边改代码，如果不能给大家解决问题，也请见谅。

在 2023-04-11 15:34:48，"bin-wang1" @.***> 写道：

各位朋友，基于zhangke5959及大家的无私奉献，我们现在有一个能够编译运行的开源国密strongswan（我这边正在等待华为交换机等商用交换机进行验证）。

目前这个分支的源头版本有一些早，没有办法与strongswan社区最新版本进行同步更新，后续维护起来担心可能会有问题。我这边基于zhangke5959的代码仓库以及在Issues中提到的若干修正，尝试将所有国密代码与最新的strongswan做了合并（合并期间亦做了部分错误修正），已经本地编译且运行通过。

但由于个人的能力有限，没有能力进一步维护代码更新或对国密算法做进一步的维护更新，为了让zhangke及大家的努力拥有持续的生命力，希望各位大神能够将我这边合并结果拿走做进一步的维护并开源给社区，如有可能推送到strongswan的官方社区，将国密算法实现作为strongswan的标准配置。

以上，仓库在strongswan-gmalg-merge，请大家拿走，并作持续更新维护回馈给社区，让项目能够持续。

帅哥！安装你的仓库，进行配置，没法正常进行运行！显示unable to install IPsec policies in kernel

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: @.> — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you commented.Message ID: @.>

zhangke5959 commented 1 year ago

你好！我微信号 z17625995959 , 明天加个好友，我远程看看你内核模块。

在 2023-04-19 14:38:38，"bin-wang1" @.***> 写道：

大佬！您好！打扰了代码还是没跑通，麻烦您抽时间帮我分析分析。万分感谢！已经做的工作： 1、重编译内核：更改了xfrm_alg.c的代码，重新编译了内核。内核版本是5.15.1 2、编译了soft_alg.ko,使用insmod进行了加载，dmesg|tail提示 loading out-of-tree module taints kernel module verification failed: signature and/or required key missing - tainting kernel 以及function: sm3_init , line= 354 sm4_init 但是lsmod可看到已加载了soft_alg.ko，makefile里也有CONFIG_MODULE_SIG=n（好像没起作用） 3、在conf.d进行了配置：内容如下 server: connections { vpn { proposals = sm4cbc-sm3-sm2dh local_addrs=172.22.16.2 remote_addrs=172.22.16.3 local { auth = pubkey id = "172.22.16.2" certs = server.cert.pem } remote { auth = pubkey id = "172.22.16.3" } children { vpn_child { esp_proposals = sm4cbc-sm3-sm2dh updown = /opt/ss-gmalg/libexec/ipsec/_updown iptables } } } }

client： connections { vpn { proposals = sm4cbc-sm3-sm2dh local_addrs=172.22.16.3 remote_addrs=172.22.16.2 local { auth = pubkey id = "172.22.16.3" certs = client.cert.pem } remote { auth = pubkey id = "172.22.16.2" } children { vpn_child { esp_proposals = sm4cbc-sm3-sm2dh updown = /opt/ss-gmalg/libexec/ipsec/_updown iptables } } } }

进行联通的结果如下： server: @.***:/opt/ss-gmalg# /opt/ss-gmalg/sbin/swanctl -T 11[NET] received packet: from 172.22.16.3[500] to 172.22.16.2[500] (274 bytes) 11[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ] 11[IKE] 172.22.16.3 is initiating an IKE_SA 11[CFG] selected proposal: IKE:SM4_CBC_128/HMAC_SM3/PRF_HMAC_SM3/CURVE_SM2 11[IKE] remote host is behind NAT 11[IKE] sending cert request for "C=Country, O=Company, CN=root_CA" 11[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(HASH_ALG) N(CHDLESS_SUP) N(MULT_AUTH) ] 11[NET] sending packet: from 172.22.16.2[500] to 172.22.16.3[500] (307 bytes) 09[NET] received packet: from 172.22.16.3[4500] to 172.22.16.2[4500] (768 bytes) 09[ENC] parsed IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ] 09[IKE] received cert request for "C=Country, O=Company, CN=root_CA" 09[IKE] received end entity cert "C=Country, O=Company, CN=client" 09[CFG] looking for peer configs matching 172.22.16.2[172.22.16.2]...172.22.16.3[172.22.16.3] 09[CFG] selected peer config 'vpn' 09[CFG] using certificate "C=Country, O=Company, CN=client" 09[CFG] using trusted ca certificate "C=Country, O=Company, CN=root_CA" 09[CFG] checking certificate status of "C=Country, O=Company, CN=client" 09[CFG] certificate status is not available 09[CFG] reached self-signed root ca with a path length of 0 09[IKE] authentication of '172.22.16.3' with SM2_WITH_SM3 successful 09[IKE] peer supports MOBIKE 09[IKE] authentication of '172.22.16.2' (myself) with SM2_WITH_SM3 successful 09[IKE] IKE_SA vpn[1] established between 172.22.16.2[172.22.16.2]...172.22.16.3[172.22.16.3] 09[IKE] scheduling rekeying in 13463s 09[IKE] maximum IKE_SA lifetime 14903s 09[IKE] sending end entity cert "C=Country, O=Company, CN=172.22.16.2" 09[CFG] selected proposal: ESP:SM4_CBC_128/HMAC_SM3/NO_EXT_SEQ 09[KNL] can't install route for 172.22.16.2/32 === 172.22.16.3/32 out, conflicts with IKE traffic 09[IKE] unable to install IPsec policies (SPD) in kernel 09[IKE] failed to establish CHILD_SA, keeping IKE_SA 09[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH N(MOBIKE_SUP) N(NO_ADD_ADDR) N(TS_UNACCEPT) ] 09[NET] sending packet: from 172.22.16.2[4500] to 172.22.16.3[4500] (656 bytes) ^Cdisconnecting...

client: @.***:/opt/ss-gmalg# /opt/ss-gmalg/sbin/swanctl -i --child vpn_child [IKE] initiating IKE_SA vpn[2] to 172.22.16.2 [ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ] [NET] sending packet: from 172.22.16.3[500] to 172.22.16.2[500] (274 bytes) [NET] received packet: from 172.22.16.2[500] to 172.22.16.3[500] (307 bytes) [ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(HASH_ALG) N(CHDLESS_SUP) N(MULT_AUTH) ] [CFG] selected proposal: IKE:SM4_CBC_128/HMAC_SM3/PRF_HMAC_SM3/CURVE_SM2 [IKE] remote host is behind NAT [IKE] received cert request for "C=Country, O=Company, CN=root_CA" [IKE] sending cert request for "C=Country, O=Company, CN=root_CA" [IKE] authentication of '172.22.16.3' (myself) with SM2_WITH_SM3 successful [IKE] sending end entity cert "C=Country, O=Company, CN=client" [IKE] establishing CHILD_SA vpn_child{1} [ENC] generating IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ] [NET] sending packet: from 172.22.16.3[4500] to 172.22.16.2[4500] (768 bytes) [NET] received packet: from 172.22.16.2[4500] to 172.22.16.3[4500] (656 bytes) [ENC] parsed IKE_AUTH response 1 [ IDr CERT AUTH N(MOBIKE_SUP) N(NO_ADD_ADDR) N(TS_UNACCEPT) ] [IKE] received end entity cert "C=Country, O=Company, CN=172.22.16.2" [CFG] using certificate "C=Country, O=Company, CN=172.22.16.2" [CFG] using trusted ca certificate "C=Country, O=Company, CN=root_CA" [CFG] checking certificate status of "C=Country, O=Company, CN=172.22.16.2" [CFG] certificate status is not available [CFG] reached self-signed root ca with a path length of 0 [IKE] authentication of '172.22.16.2' with SM2_WITH_SM3 successful [IKE] IKE_SA vpn[2] established between 172.22.16.3[172.22.16.3]...172.22.16.2[172.22.16.2] [IKE] scheduling rekeying in 13237s [IKE] maximum IKE_SA lifetime 14677s [IKE] received TS_UNACCEPTABLE notify, no CHILD_SA built [IKE] failed to establish CHILD_SA, keeping IKE_SA initiate failed: establishing CHILD_SA 'vpn_child' failed

麻烦您帮我看看！谢谢大佬！

王斌 @.***

------------------ 原始邮件 ------------------ 发件人: "zhangke5959/strongswan" @.>; 发送时间: 2023年4月17日(星期一) 中午1:49 @.>; @.**@.>; 主题: Re: [zhangke5959/strongswan] 请社区持续维护更新本项目 (#17)

您好！你的问题解决了吗，当时就是就是随意上传了代码，没有测试过功能，这几年也没更新，如果你你那边有测试环境，我可以抽点时间协助处理问题，尽量整理一版可用的，我也是边学边改代码，如果不能给大家解决问题，也请见谅。

在 2023-04-11 15:34:48，"bin-wang1" @.***> 写道：

各位朋友，基于zhangke5959及大家的无私奉献，我们现在有一个能够编译运行的开源国密strongswan（我这边正在等待华为交换机等商用交换机进行验证）。

目前这个分支的源头版本有一些早，没有办法与strongswan社区最新版本进行同步更新，后续维护起来担心可能会有问题。我这边基于zhangke5959的代码仓库以及在Issues中提到的若干修正，尝试将所有国密代码与最新的strongswan做了合并（合并期间亦做了部分错误修正），已经本地编译且运行通过。

但由于个人的能力有限，没有能力进一步维护代码更新或对国密算法做进一步的维护更新，为了让zhangke及大家的努力拥有持续的生命力，希望各位大神能够将我这边合并结果拿走做进一步的维护并开源给社区，如有可能推送到strongswan的官方社区，将国密算法实现作为strongswan的标准配置。

以上，仓库在strongswan-gmalg-merge，请大家拿走，并作持续更新维护回馈给社区，让项目能够持续。

帅哥！安装你的仓库，进行配置，没法正常进行运行！显示unable to install IPsec policies in kernel

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: @.> — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you commented.Message ID: @.>

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: @.***>

Ruifu-Su commented 1 year ago

大佬，您好。我也在调试这个问题，希望也可以添加您的微信向您咨询请教。

祝：一切都好！

苏瑞辅 +86.15151856782

On Wed, Apr 19, 2023 at 6:49 PM 张克 @.***> wrote:

apsara2825 commented 7 months ago

hancm commented 3 months ago

received TS_UNACCEPTABLE notify, no CHILD_SA built 请问下这个问题要怎么解决，使用的是kernel-libipsec，没有用内核模块。

whaosoft commented 2 months ago

===== 你好编译时报错呢这个版本

../../libtool: eval: line 7963: unexpected EOF while looking for matching `"' ../../libtool: eval: line 7964: syntax error: unexpected end of file Makefile:1744: recipe for target 'libstrongswan.la' failed make[5]: [libstrongswan.la] Error 2 make[5]: Leaving directory '/media/root/Disk21/strongswan-master/src/libstrongswan' Makefile:2057: recipe for target 'install-recursive' failed make[4]: [install-recursive] Error 1 make[4]: Leaving directory '/media/root/Disk21/strongswan-master/src/libstrongswan' Makefile:2214: recipe for target 'install' failed make[3]: [install] Error 2 make[3]: Leaving directory '/media/root/Disk21/strongswan-master/src/libstrongswan' Makefile:536: recipe for target 'install-recursive' failed make[2]: [install-recursive] Error 1 make[2]: Leaving directory '/media/root/Disk21/strongswan-master/src' Makefile:593: recipe for target 'install-recursive' failed make[1]: [install-recursive] Error 1 make[1]: Leaving directory '/media/root/Disk21/strongswan-master' Makefile:890: recipe for target 'install' failed make: [install] Error 2

whaosoft commented 2 months ago

hi大佬你这个号怎么从来不说话啊~

whaosoft commented 2 months ago

但是我好像 docker 18.04 到是过去了~~ 桌面版本报的这个错~~

happyfir commented 2 months ago

你好我最终没有用这个版本的代码你可以去这个库的issue里面去找有人照此编译了新版本可以使用这个东西是为了应付当时导师的任务我已经毕业了相关代码和操作已经不记得了

---原始郵件--- 寄件人： @.> 傳送時間： 2024年6月13日(週四) 上午10:36 收件人： @.>; 抄送： @.**@.>; 主旨： Re: [zhangke5959/strongswan] 请社区持续维护更新本项目 (#17)

你好！我微信号 z17625995959 , 明天加个好友，我远程看看你内核模块。在 2023-04-19 14:38:38，"bin-wang1" @.> 写道：大佬！您好！打扰了代码还是没跑通，麻烦您抽时间帮我分析分析。万分感谢！已经做的工作： 1、重编译内核：更改了xfrm_alg.c的代码，重新编译了内核。内核版本是5.15.1 2、编译了soft_alg.ko,使用insmod进行了加载，dmesg|tail提示 loading out-of-tree module taints kernel module verification failed: signature and/or required key missing - tainting kernel 以及function: sm3_init , line= 354 sm4_init 但是lsmod可看到已加载了soft_alg.ko，makefile里也有CONFIG_MODULE_SIG=n（好像没起作用） 3、在conf.d进行了配置：内容如下 server: connections { vpn { proposals = sm4cbc-sm3-sm2dh local_addrs=172.22.16.2 remote_addrs=172.22.16.3 local { auth = pubkey id = "172.22.16.2" certs = server.cert.pem } remote { auth = pubkey id = "172.22.16.3" } children { vpn_child { esp_proposals = sm4cbc-sm3-sm2dh updown = /opt/ss-gmalg/libexec/ipsec/_updown iptables } } } } client： connections { vpn { proposals = sm4cbc-sm3-sm2dh local_addrs=172.22.16.3 remote_addrs=172.22.16.2 local { auth = pubkey id = "172.22.16.3" certs = client.cert.pem } remote { auth = pubkey id = "172.22.16.2" } children { vpn_child { esp_proposals = sm4cbc-sm3-sm2dh updown = /opt/ss-gmalg/libexec/ipsec/_updown iptables } } } } 进行联通的结果如下： server: @.:/opt/ss-gmalg# /opt/ss-gmalg/sbin/swanctl -T 11[NET] received packet: from 172.22.16.3[500] to 172.22.16.2[500] (274 bytes) 11[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ] 11[IKE] 172.22.16.3 is initiating an IKE_SA 11[CFG] selected proposal: IKE:SM4_CBC_128/HMAC_SM3/PRF_HMAC_SM3/CURVE_SM2 11[IKE] remote host is behind NAT 11[IKE] sending cert request for "C=Country, O=Company, CN=root_CA" 11[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(HASH_ALG) N(CHDLESS_SUP) N(MULT_AUTH) ] 11[NET] sending packet: from 172.22.16.2[500] to 172.22.16.3[500] (307 bytes) 09[NET] received packet: from 172.22.16.3[4500] to 172.22.16.2[4500] (768 bytes) 09[ENC] parsed IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ] 09[IKE] received cert request for "C=Country, O=Company, CN=root_CA" 09[IKE] received end entity cert "C=Country, O=Company, CN=client" 09[CFG] looking for peer configs matching 172.22.16.2[172.22.16.2]...172.22.16.3[172.22.16.3] 09[CFG] selected peer config 'vpn' 09[CFG] using certificate "C=Country, O=Company, CN=client" 09[CFG] using trusted ca certificate "C=Country, O=Company, CN=root_CA" 09[CFG] checking certificate status of "C=Country, O=Company, CN=client" 09[CFG] certificate status is not available 09[CFG] reached self-signed root ca with a path length of 0 09[IKE] authentication of '172.22.16.3' with SM2_WITH_SM3 successful 09[IKE] peer supports MOBIKE 09[IKE] authentication of '172.22.16.2' (myself) with SM2_WITH_SM3 successful 09[IKE] IKE_SA vpn[1] established between 172.22.16.2[172.22.16.2]...172.22.16.3[172.22.16.3] 09[IKE] scheduling rekeying in 13463s 09[IKE] maximum IKE_SA lifetime 14903s 09[IKE] sending end entity cert "C=Country, O=Company, CN=172.22.16.2" 09[CFG] selected proposal: ESP:SM4_CBC_128/HMAC_SM3/NO_EXT_SEQ 09[KNL] can't install route for 172.22.16.2/32 === 172.22.16.3/32 out, conflicts with IKE traffic 09[IKE] unable to install IPsec policies (SPD) in kernel 09[IKE] failed to establish CHILD_SA, keeping IKE_SA 09[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH N(MOBIKE_SUP) N(NO_ADD_ADDR) N(TS_UNACCEPT) ] 09[NET] sending packet: from 172.22.16.2[4500] to 172.22.16.3[4500] (656 bytes) ^Cdisconnecting... client: @.:/opt/ss-gmalg# /opt/ss-gmalg/sbin/swanctl -i --child vpn_child [IKE] initiating IKE_SA vpn[2] to 172.22.16.2 [ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ] [NET] sending packet: from 172.22.16.3[500] to 172.22.16.2[500] (274 bytes) [NET] received packet: from 172.22.16.2[500] to 172.22.16.3[500] (307 bytes) [ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(HASH_ALG) N(CHDLESS_SUP) N(MULT_AUTH) ] [CFG] selected proposal: IKE:SM4_CBC_128/HMAC_SM3/PRF_HMAC_SM3/CURVE_SM2 [IKE] remote host is behind NAT [IKE] received cert request for "C=Country, O=Company, CN=root_CA" [IKE] sending cert request for "C=Country, O=Company, CN=root_CA" [IKE] authentication of '172.22.16.3' (myself) with SM2_WITH_SM3 successful [IKE] sending end entity cert "C=Country, O=Company, CN=client" [IKE] establishing CHILD_SA vpn_child{1} [ENC] generating IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ] [NET] sending packet: from 172.22.16.3[4500] to 172.22.16.2[4500] (768 bytes) [NET] received packet: from 172.22.16.2[4500] to 172.22.16.3[4500] (656 bytes) [ENC] parsed IKE_AUTH response 1 [ IDr CERT AUTH N(MOBIKE_SUP) N(NO_ADD_ADDR) N(TS_UNACCEPT) ] [IKE] received end entity cert "C=Country, O=Company, CN=172.22.16.2" [CFG] using certificate "C=Country, O=Company, CN=172.22.16.2" [CFG] using trusted ca certificate "C=Country, O=Company, CN=root_CA" [CFG] checking certificate status of "C=Country, O=Company, CN=172.22.16.2" [CFG] certificate status is not available [CFG] reached self-signed root ca with a path length of 0 [IKE] authentication of '172.22.16.2' with SM2_WITH_SM3 successful [IKE] IKE_SA vpn[2] established between 172.22.16.3[172.22.16.3]...172.22.16.2[172.22.16.2] [IKE] scheduling rekeying in 13237s [IKE] maximum IKE_SA lifetime 14677s [IKE] received TS_UNACCEPTABLE notify, no CHILD_SA built [IKE] failed to establish CHILD_SA, keeping IKE_SA initiate failed: establishing CHILD_SA 'vpn_child' failed 麻烦您帮我看看！谢谢大佬！王斌 @. … ------------------ 原始邮件 ------------------ 发件人: "zhangke5959/strongswan" @.>; 发送时间: 2023年4月17日(星期一) 中午1:49 @.>; @.@.>; 主题: Re: [zhangke5959/strongswan] 请社区持续维护更新本项目 (#17) 您好！你的问题解决了吗，当时就是就是随意上传了代码，没有测试过功能，这几年也没更新，如果你你那边有测试环境，我可以抽点时间协助处理问题，尽量整理一版可用的，我也是边学边改代码，如果不能给大家解决问题，也请见谅。在 2023-04-11 15:34:48，"bin-wang1" @.> 写道：各位朋友，基于zhangke5959及大家的无私奉献，我们现在有一个能够编译运行的开源国密strongswan（我这边正在等待华为交换机等商用交换机进行验证）。目前这个分支的源头版本有一些早，没有办法与strongswan社区最新版本进行同步更新，后续维护起来担心可能会有问题。我这边基于zhangke5959的代码仓库以及在Issues中提到的若干修正，尝试将所有国密代码与最新的strongswan做了合并（合并期间亦做了部分错误修正），已经本地编译且运行通过。但由于个人的能力有限，没有能力进一步维护代码更新或对国密算法做进一步的维护更新，为了让zhangke及大家的努力拥有持续的生命力，希望各位大神能够将我这边合并结果拿走做进一步的维护并开源给社区，如有可能推送到strongswan的官方社区，将国密算法实现作为strongswan的标准配置。以上，仓库在strongswan-gmalg-merge，请大家拿走，并作持续更新维护回馈给社区，让项目能够持续。帅哥！安装你的仓库，进行配置，没法正常进行运行！显示unable to install IPsec policies in kernel — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: @.> — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you commented.Message ID: @.> — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: @.>

hi大佬你这个号怎么从来不说话啊~

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you commented.Message ID: @.***>

zhangke5959 / strongswan

请社区持续维护更新本项目 #17

大佬，您好。我也在调试这个问题，希望也可以添加您的微信向您咨询请教。