strongSwan - Issue #352
unable to allocate SPIs from kernel when running 32 bit binaries on 64 bit Linux
21.06.2013 12:25 - Daniel Albers

ステータス:

Closed

優先度:

Normal担当者:
カテゴリ:

kernelAffected version:

5.0.4

Resolution:

Fixed

説明
When using a 32 bit build on a 64 bit Linux kernel, the charon netlink communication seems to fail.
charon:charon:charon:charon:charon:charon:charon:charon:charon:charon:charon:charon:charon:charon:charon:charon:charon:charon:charon:charon:charon:charon:14[IKE] establishing CHILD̲SA peer-c14[KNL] getting SPI for reqid {1}14[KNL] sending XFRM̲MSG̲ALLOCSPI: => 244 bytes @ 0xf03edb9c
14[KNL]
0: F4 00 00 00 16 00 01 00 C9 00 00 00 DD 44 00 00
14[KNL]
16: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
14[KNL]
32: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
14[KNL]
48: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
14[KNL]
64: 00 00 00 00 00 00 00 00 5C CD 17 E4 00 00 00 00
14[KNL]80: 00 00 00 00 00 00 00 00 00 00 00 00 32 00 00 00
14[KNL]
96: 9E FF D5 12 00 00 00 00 00 00 00 00 00 00 00 00
14[KNL]112: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
14[KNL]
128: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
14[KNL]
144: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
14[KNL]
160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
14[KNL]
176: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
14[KNL]
192: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
14[KNL]
208: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
14[KNL]
224: 01 00 00 00 02 00 01 00 00 00 00 00 00 00 00 C0
14[KNL]240: FF FF FF CF
14[KNL] allocating SPI failed: Invalid argument (22)14[KNL] unable to get SPI for reqid {1}14[IKE] unable to allocate SPIs from kernel.............D..
................
................
................
........\.......
............2...
................
................
................
................
................
................
................
................
................
....

Booting a 32 bit kernel, everything works just fine.
This output is from strongSwan 5.0.4 in Linux 3.9 (Debian stock packages), but the same behavior could be observed with e. g.
strongSwan 4.5.2 and Linux 3.2.0.
履歴#1 - 21.06.2013 13:01 - Martin Willi
Hi Daniel,Yes, this is an known issue, resulting from different alignments of a struct from xfrm.h (xfrm̲selector, if I remember correctly).
I think it's a design flaw of the XFRM interface, and is actually hard to fix. We could try to detect a 64-bit kernel when running with 32-bit, and thenuse a specially prepared struct instead of that of xfrm.h.
Regards
Martin#2 - 21.06.2013 13:15 - Daniel Albers
Thanks Martin,
Maybe at least print a hint (on debug level) about this when detecting a 32/64 bit environment to save people troubleshooting this some time?
Cheers,Daniel#3 - 24.06.2013 06:07 - Andreas Steffen

11.10.2024

1/2

- ステータス を New から Feedback に変更- 担当者 を Martin Willi にセット
#4 - 15.10.2014 20:40 - Oguz Yilmaz
Dear Martin and Andreas,
Are there any update on this issue?
#5 - 24.07.2017 10:06 - John Comeau
just a note for those who found this via Google search and want a resolution, having found ̀sudo apt-get install strongswan:amd64̀ has noinstallation candidate:instead, ̀sudo apt-get install libstrongswan:amd64 libssl1.1:amd64 libstrongswan-standard-plugins:amd64 strongswan-charon:amd64̀
it replaced the 32-bit versions and now the ipsec tunnel works on my 64-bit kernel.
#6 - 17.04.2018 14:59 - Tobias Brunner- 担当者 を削除 (Martin Willi)
Before the 4.1 kernel (more specifically before 74005991b7), it was possible to modify some structs in the xfrm.h header file to make 32-bit
strongSwan work on 64-bit kernels. However, since then this doesn't work anymore without reverting that change in the kernel.
This problem was discussed at the 2018 Linux IPsec workshop and there might actually be a compatibility layer for XFRM in the future as thisapparently is an issue on some Android platforms.
#7 - 25.05.2023 12:41 - Tobias Brunner- ステータス を Feedback から Closed に変更- Resolution を Fixed にセット
The 5.10 kernel added a 32-bit compat layer for XFRM.

11.10.2024

2/2