TCP encapsulation fails with setsockopt(SOL_TCP, TCP_ULP) failed No such file or directory (errno 2)

[mbaudier]

On Debian 12 (both sides), when trying to use TCP encapsulation (over IPv4), I get the following errors:

• client:
  ERROR setsockopt(SOL_TCP, TCP_ULP) failed (connect_to_tcp_endpoint() +546 /programs/pluto/iface_tcp.c): No such file or directory (errno 2)
• server:
  IKETCP ACCEPTED: socket 14: accepted connection
  IKETCP ACCEPTED: socket 14: closing socket; setsockopt(14, SOL_TCP, TCP_ULP, "espintcp") failed: No such file or directory (errno 2)

The same connection is working if I disable TCP.
(But it hangs after a while, and since I am behind a NAT that I don't control, I thought that I would give TCP a try)

The Libreswan version is 4.10.

The Kernel version is:
Linux 6.1.0-20-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.85-1 (2024-04-11) x86_64 GNU/Linux

Any ideas on how I could analyse further? Thanks in advance!

[cagney]

It feels like iketcp isn't enabled in the kernel, which I struggle to believe.

The initiator does this:

| TCP: open TCP connection to TCP 2001:db8:1:2::23 with port 4500
| TCP: opening socket
| TCP: socket 15: connecting to other end
| TCP: socket 15: extracting local randomly assigned port
| TCP: socket 15: making things non-blocking
| TCP: socket 15: sending IKE-in-TCP prefix
| TCP: socket 15: enabling "espintcp"

and the responder:

| fdl: newref @0x7f644ff85f58(0->1) (attach_fd_read_listener() +820 programs/pluto/server.c)
| IKETCP ACCEPTED: socket 14: reading IKETCP prefix
| IKETCP ACCEPTED: socket 14: verifying IKETCP prefix
| IKETCP ACCEPTED: socket 14: enabling ESPINTCP
| spent 0.0736 (0.45) milliseconds in process_iface_packet() reading and processing packet
| IKETCP PREFIX_RECEIVED: socket 14: reading first packet
| IKETCP PREFIX_RECEIVED: socket 14: read 736 of 65536 byte first packet

[mbaudier]

It feels like iketcp isn't enabled in the kernel, which I struggle to believe.

How can I check whether this is the case?

[cagney]

according to https://wiki.debian.org/KernelFAQ it's in /boot/config-$(uname -r)
I guess your looking for:

CONFIG_XFRM_ESPINTCP=y
CONFIG_INET_ESPINTCP=y

[mbaudier]

Many thanks for your quick answers!

$ cat /boot/config-$(uname -r) | grep ESPINTCP
# CONFIG_INET_ESPINTCP is not set
# CONFIG_INET6_ESPINTCP is not set

I also checked the XFRM properties (cat /boot/config-$(uname -r) | grep XFRM) and there is not even a "is not set" for CONFIG_XFRM_ESPINTCP.

If I understand well, there is nothing I can do beside rebuilding a kernel?

Maybe I should rather raise this issue by Debian?

[cagney]

Yes. Kernel rebuild time :-(
Asking Debian sounds like a good idea; my hunch is that it's disabled as no one has asked. Ditto for Alpine.

[mbaudier]

I have raised the issue by Debian:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1069155

I also did a quick test with the same setup and network access between a RHEL 9 client and a RHEL 9 server, and it worked as expected.

Please feel free to close this issue, as the problem is not in libreswan.