[Openswan Users] duplicate key error when ipsec auto --add connection

[Liviu Nicoara]

Hi guys,

I am trying for a couple of days now to set up a connection to my
office using OpenSWAN 2.5.16, with little success.

I am running Slackware on x86_64:

# uname -a
Linux yomama 2.6.25.4 #7 SMP Wed May 21 19:21:26 EDT 2008 x86_64
x86_64 x86_64 GNU/Linux

and AFAIK I am trying to establish a RoadWarrior type of connection. I
built and installed 2.5.16 (after 2.5.17 gave me a hard time) and the
installation went smoothly. I then installed the files provided by my
sysadmin (certificates and the sort).

The first roadblock is here:

tmp# ipsec setup start
duplicate key '' in conn theoffice while processing def theoffice
while loading 'theoffice': duplicate key '' in conn theoffice while
processing def theoffice
ipsec_setup: Starting Openswan IPsec 2.5.16...
ipsec_setup: FATAL ERROR: Both KLIPS and NETKEY IPsec code is present
in kernel
ipsec_setup: OOPS, should have aborted! Broken shell!

I do not understand the duplicate key error. Here is the content of my
config file for the connection:

tmp# cat /etc/ipsec.d/theoffice.conf
conn theoffice
authby=rsasig
pfs=no
rekey=yes
keyingtries=4
type=transport
leftupdown=/etc/ipsec.d/theoffice-updown
left=192.168.1.66
left=%defaultroute
leftcert=/etc/ipsec.d/certs/***@theoffice.com.pem
leftrsasigkey=%cert
leftprotoport=17/1701
right=nnn.nnn.nnn.nnn
rightid="C=US, ST=Colorado, L=Boulder, O=TheOffice, OU=IT,
CN=zephyrus.theoffice.com"
rightrsasigkey=%cert
rightca=%same
rightprotoport=17/1701
auto=add

Does anybody have any idea where that duplicate key error is coming
from? (There is a final newline after `add')

Then, the script code which emits that "FATAL ERROR" is in
/usr/local/lib/ipsec/_startklips:
if test ! -f $ipsecversion && test ! -f $netkey; then
# both KLIPS and NETKEY code detected, bail out
echo "FATAL ERROR: Both KLIPS and NETKEY IPsec code is present in
kernel"
exit
fi

I see the variables defined at the beginning:

netkey=/proc/net/pfkey
ipsecversion=/proc/net/ipsec/version

but I don't understand what's being tested here. I am not sure what is
configured wrong in the kernel either. IMHO, the kernel is configured
just fine.

Ok. Onward:

tmp# ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan U2.5.16/K(no kernel code presently loaded)
Checking for IPsec support in kernel [FAILED]
Checking for RSA private key (/etc/ipsec.secrets) [OK]
Checking that pluto is running [FAILED]
whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
Checking for 'ip' command [OK]
Checking for 'iptables' command [OK]
Checking for 'curl' command for CRL fetching [OK]
Opportunistic Encryption Support [DISABLED]


But then:

tmp# ipsec pluto && ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan U2.5.16/K2.6.25.4 (netkey)
Checking for IPsec support in kernel [OK]
NETKEY detected, testing for disabled ICMP send_redirects [OK]
NETKEY detected, testing for disabled ICMP accept_redirects [OK]
Checking for RSA private key (/etc/ipsec.secrets) [OK]
Checking that pluto is running [OK]
Pluto not listening on port udp 500. Check interfaces defintion in
ipsec.conf.Checking for 'ip' command
[OK]
Checking for 'iptables' command [OK]
Checking for 'curl' command for CRL fetching [OK]
Opportunistic Encryption Support [DISABLED]

Is it on or not? Well, apparently not:

tmp# ipsec auto --up theoffice
024 need --listen before --initiate


And here is the output of ipsec barf:

tmp# ipsec barf
yomama
Wed Jun 4 00:05:59 EDT 2008
+ _________________________ version
+ ipsec --version
Linux Openswan U2.5.16/K2.6.25.4 (netkey)
See `ipsec --copyright' for copyright information.
+ _________________________ /proc/version
+ cat /proc/version
Linux version 2.6.25.4 (***@yomama) (gcc version 4.1.2) #7 SMP Wed
May 21 19:21:26 EDT 2008
+ _________________________ /proc/net/ipsec_eroute
+ test -r /proc/net/ipsec_eroute
+ _________________________ netstat-rn
+ netstat -nr
+ head -n 100
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window
irtt Iface
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0
0 eth0
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0
0 lo
0.0.0.0 192.168.1.254 0.0.0.0 UG 0 0
0 eth0
+ _________________________ /proc/net/ipsec_spi
+ test -r /proc/net/ipsec_spi
+ _________________________ /proc/net/ipsec_spigrp
+ test -r /proc/net/ipsec_spigrp
+ _________________________ /proc/net/ipsec_tncfg
+ test -r /proc/net/ipsec_tncfg
+ _________________________ /proc/net/pfkey
+ test -r /proc/net/pfkey
+ cat /proc/net/pfkey
sk RefCnt Rmem Wmem User Inode
ffff81013a4e2000 2 0 0 0 73131
+ _________________________ ip-xfrm-state
+ ip xfrm state
+ _________________________ ip-xfrm-policy
+ ip xfrm policy
+ _________________________ /proc/crypto
/usr/local/libexec/ipsec/barf: line 382: syntax error: unexpected end
of file

(indeed, barf ends abruptly at line 382 and this error is present in
both 2.5.16 and 2.5.17).

It is possible that my machine is seriously screwed up so that this
installation process, which apparently works so fine for so many, it
fails for me.

Any suggestions are GREATLY appreciated!

Thanks,
Liviu

[Paul Wouters]

Post by Liviu Nicoara
I am trying for a couple of days now to set up a connection to my
office using OpenSWAN 2.5.16, with little success.
ipsec_setup: Starting Openswan IPsec 2.5.16...
ipsec_setup: FATAL ERROR: Both KLIPS and NETKEY IPsec code is present
in kernel
ipsec_setup: OOPS, should have aborted! Broken shell!

This was fixed later on:

If using NETKEY, you can also put "protostack=netkey" in the "config setup"
section of ipsec.conf to bypass starting klips.

Post by Liviu Nicoara
Then, the script code which emits that "FATAL ERROR" is in
if test ! -f $ipsecversion && test ! -f $netkey; then

That line should be:

if test -f $ipsecversion && test -f $netkey

Post by Liviu Nicoara
Linux Openswan U2.5.16/K(no kernel code presently loaded)
Checking for IPsec support in kernel [FAILED]

That will get fixed by the above.

Post by Liviu Nicoara
Linux Openswan U2.5.16/K2.6.25.4 (netkey)
Checking for IPsec support in kernel [OK]

It found netkey anyway.

Post by Liviu Nicoara
tmp# ipsec auto --up theoffice
024 need --listen before --initiate

That is because you starten it differently. Do the one line fix
above and run the init script to start or run "ipsec setup start"

Paul

[Liviu Nicoara]

Post by Paul Wouters

Post by Liviu Nicoara
I am trying for a couple of days now to set up a connection to my
office using OpenSWAN 2.5.16, with little success.

[...]
if test -f $ipsecversion && test -f $netkey
[...]
That is because you started it differently. Do the one line fix
above and run the init script to start or run "ipsec setup start"

Paul, thank for the prompt reply. The situation is much better now:

~# ipsec setup start
duplicate key '' in conn theoffice while processing def theoffice
while loading 'theoffice': duplicate key '' in conn theoffice while
processing def theoffice
ipsec_setup: Starting Openswan IPsec 2.5.16...
ipsec_setup: WARNING: interfaces= is ignored when using the NETKEY stack
ipsec_setup: Trying hardware random, this may fail, which is okay.
ipsec_setup: Trying to load all NETKEY modules:xfrm6_tunnel
xfrm6_mode_tunnel xfrm6_mode_beet xfrm6_mode_ro xfrm6_mode_transport
xfrm4_mode_transport xfrm4_mode_tunnel xfrm4_tunnel xfrm4_mode_beet
esp4 esp6 ah4 ah6 ipcomp ipcomp6 af_key
ipsec_setup: Trying VIA padlock driver, this may fail, which is okay.
ipsec_setup: Trying to load Crypto API modules, some may fail, which
is okay.
ipsec_setup: aes-x86_64 aes des sha512 sha256 md5 cbc xcbc ecb twofish
blowfish serpent

ipsec_setup: duplicate key '' in conn theoffice while processing def
theoffice
ipsec_setup: while loading 'theoffice': duplicate key '' in conn
theoffice while processing def theoffice

~# ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan U2.5.16/K2.6.25.4 (netkey)
Checking for IPsec support in kernel [OK]
NETKEY detected, testing for disabled ICMP send_redirects [OK]
NETKEY detected, testing for disabled ICMP accept_redirects [OK]
Checking for RSA private key (/etc/ipsec.secrets) [OK]
Checking that pluto is running [OK]
Checking for 'ip' command [OK]
Checking for 'iptables' command [OK]
Checking for 'curl' command for CRL fetching [OK]
Opportunistic Encryption Support [DISABLED]

As you can see above, the only remaining issue is the duplicate key in
my connection definition. I am re-attaching it here hoping that you,
or anybody else, might spot the issue (I couldn't). In the meantime, I
will try to debug it myself (have already spotted the parser code).

Thanks again!

Liviu

[Liviu Nicoara]

Post by Liviu Nicoara
[...]
As you can see above, the only remaining issue is the duplicate key in
my connection definition.

Scratch that, I see it now.

Thanks,
Liviu