No route on Ubuntu 18.04 LTS (NVidia Nano U5.6.2/K4.9.337-tegra )

[ksaye]

I have been successful using strongSwan on a Raspberry Pi connecting to a MikroTik device.

I am attempting to move the connection to an Nvidia Nano device and it is not setting up the route and no packets are going across the connection. With this device I think I am limited to strongSwan U5.6.2

OS Info:

root@nano:~# uname -a
Linux nano 4.9.337-tegra #1 SMP PREEMPT Thu Jun 8 21:19:14 PDT 2023 aarch64 aarch64 aarch64 GNU/Linux

root@nano:~# cat /etc/issue
Ubuntu 18.04.6 LTS \n \l

Config file:

root@nano:~# cat /etc/ipsec.conf
# ipsec.conf - strongSwan IPsec configuration file

# basic configuration

config setup
        strictcrlpolicy=no

# Add connections here.

conn "homemicrotik"
        forceencaps=yes
       authby=secret
        keyexchange=ikev2
        ike=aes128-sha1-modp2048
        ikelifetime=720h
        esp=aes128-sha1
        leftid=%any
        leftsubnet=192.168.15.0/24
        left={removed}
        right=192.168.1.33
        rightsubnet=192.168.1.0/24
        auto=start
        type=tunnel

output of the up command:

root@nano:~# ipsec up homemicrotik
initiating IKE_SA homemicrotik[2] to 47.184.184.200
generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
sending packet: from 192.168.1.33[500] to 47.184.184.200[500] (962 bytes)
received packet: from 47.184.184.200[500] to 192.168.1.33[500] (437 bytes)
parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) CERTREQ ]
local host is behind NAT, sending keep alives
authentication of '192.168.1.33' (myself) with pre-shared key
establishing CHILD_SA homemicrotik{4}
generating IKE_AUTH request 1 [ IDi AUTH SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_6_ADDR) N(ADD_6_ADDR) N(ADD_6_ADDR) N(ADD_6_ADDR) N(ADD_6_ADDR) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
sending packet: from 192.168.1.33[4500] to 47.184.184.200[4500] (460 bytes)
received packet: from 47.184.184.200[4500] to 192.168.1.33[4500] (284 bytes)
parsed IKE_AUTH response 1 [ IDr AUTH N(INIT_CONTACT) TSi TSr SA ]
authentication of '47.184.184.200' with pre-shared key successful
IKE_SA homemicrotik[2] established between 192.168.1.33[192.168.1.33]...47.184.184.200[47.184.184.200]
scheduling reauthentication in 2591076s
maximum IKE_SA lifetime 2591616s
received netlink error: Function not implemented (38)
unable to add SAD entry with SPI c123de9c (FAILED)
received netlink error: Function not implemented (38)
unable to add SAD entry with SPI 0b78e74a (FAILED)
unable to install inbound and outbound IPsec SA (SAD) in kernel
failed to establish CHILD_SA, keeping IKE_SA
sending DELETE for ESP CHILD_SA with SPI c123de9c
generating INFORMATIONAL request 2 [ D ]
sending packet: from 192.168.1.33[4500] to 47.184.184.200[4500] (76 bytes)
received packet: from 47.184.184.200[4500] to 192.168.1.33[4500] (92 bytes)
parsed INFORMATIONAL response 2 [ ]
deleting policy 192.168.15.0/24 === 192.168.1.0/24 in failed, not found
deleting policy 192.168.15.0/24 === 192.168.1.0/24 fwd failed, not found
establishing connection 'homemicrotik' failed

root@nano:~# ip route list table 220
root@nano:~#

Yet MikroTik says connected:

more info:

root@nano:~# ipsec --version
Linux strongSwan U5.6.2/K4.9.337-tegra
Institute for Internet Technologies and Applications
University of Applied Sciences Rapperswil, Switzerland
See 'ipsec --copyright' for copyright information.

root@nano:~# iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
DOCKER-USER  all  --  anywhere             anywhere
DOCKER-ISOLATION-STAGE-1  all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain DOCKER (1 references)
target     prot opt source               destination

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere

Chain DOCKER-ISOLATION-STAGE-2 (1 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere

Chain DOCKER-USER (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere


tail -3 /etc/sysctl.conf
net.ipv4.ip_forward = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

[tobiasbrunner]

With this device I think I am limited to strongSwan U5.6.2

Why is that? Nothing newer available than Ubuntu 18.04 (whose standard support ended over a year ago)?

received netlink error: Function not implemented (38)
unable to add SAD entry with SPI c123de9c (FAILED)

Apparently, your Linux kernel has an issue with the installed SA. Maybe it doesn't support the negotiated algorithms.

[ksaye]

Thanks for the comment. Let me see if I can upgrade the OS.

…

________________________________ From: Tobias Brunner ***@***.***> Sent: Tuesday, June 4, 2024 4:13:57 AM To: strongswan/strongswan ***@***.***> Cc: Kevin Saye ***@***.***>; Author ***@***.***> Subject: Re: [strongswan/strongswan] No route on Ubuntu 18.04 LTS (NVidia Nano U5.6.2/K4.9.337-tegra ) (Discussion #2275) With this device I think I am limited to strongSwan U5.6.2 Why is that? Nothing newer available than Ubuntu 18.04 (whose standard support ended over a year ago)? received netlink error: Function not implemented (38) unable to add SAD entry with SPI c123de9c (FAILED) Apparently, your Linux kernel has an issue with the installed SA. Maybe it doesn't support the negotiated algorithms. — Reply to this email directly, view it on GitHub<#2275 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ADY2O5HG3374LWFN62ZGG53ZFWANLAVCNFSM6AAAAABIXFWWDGVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4TMNRRG4ZDS>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[ksaye]

After an upgrade to Ubuntu 20.04, I am still on the same kernel:

cat /etc/issue
Ubuntu 20.04.6 LTS \n \l

uname -a
Linux nano 4.9.337-tegra #1 SMP PREEMPT Thu Jun 8 21:19:14 PDT 2023 aarch64 aarch64 aarch64 GNU/Linux

And still getting the same 'unable to add SAD entry':

root@nano:/home/ksaye# ipsec up homemicrotik
initiating IKE_SA homemicrotik[2] to 47.184.184.200
generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
sending packet: from 192.168.1.37[500] to 47.184.184.200[500] (1004 bytes)
received packet: from 47.184.184.200[500] to 192.168.1.37[500] (437 bytes)
parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) CERTREQ ]
selected proposal: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048
local host is behind NAT, sending keep alives
authentication of '192.168.1.37' (myself) with pre-shared key
establishing CHILD_SA homemicrotik{2}
generating IKE_AUTH request 1 [ IDi AUTH SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_6_ADDR) N(ADD_6_ADDR) N(ADD_6_ADDR) N(ADD_6_ADDR) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
sending packet: from 192.168.1.37[4500] to 47.184.184.200[4500] (428 bytes)
received packet: from 47.184.184.200[4500] to 192.168.1.37[4500] (204 bytes)
parsed IKE_AUTH response 1 [ IDr AUTH TSi TSr SA ]
authentication of '47.184.184.200' with pre-shared key successful
IKE_SA homemicrotik[2] established between 192.168.1.37[192.168.1.37]...47.184.184.200[47.184.184.200]
scheduling reauthentication in 2591158s
maximum IKE_SA lifetime 2591698s
selected proposal: ESP:AES_CBC_128/HMAC_SHA1_96/NO_EXT_SEQ
received netlink error: Function not implemented (38)
unable to add SAD entry with SPI cae7898a (FAILED)
received netlink error: Function not implemented (38)
unable to add SAD entry with SPI 01852beb (FAILED)
unable to install inbound and outbound IPsec SA (SAD) in kernel
failed to establish CHILD_SA, keeping IKE_SA
sending DELETE for ESP CHILD_SA with SPI cae7898a
generating INFORMATIONAL request 2 [ D ]
sending packet: from 192.168.1.37[4500] to 47.184.184.200[4500] (76 bytes)
received packet: from 47.184.184.200[4500] to 192.168.1.37[4500] (108 bytes)
parsed INFORMATIONAL response 2 [ ]
deleting policy 192.168.15.0/24 === 192.168.1.0/24 in failed, not found

This link suggest it is the kernel not supporting the algorithm: https://wiki.strongswan.org/issues/2121

I will keep digging for now

[ksaye]

After lots of research, it appears that the Jetson Nano only supports the 4.9 kernel so I will have to look elsewhere to run strongSwan.

[tobiasbrunner]

So? The kernel version doesn't really matter (as long it's not extremely old). It's about the enabled modules/features. Since the negotiated algorithms are aes128 and sha1 it's weird that the kernel would not support them. It's possible that it's some hardware acceleration issue (check dmesg for errors), or that e.g. SHA-1 is rejected due to some security setting (might also produce an error). There could also be other issues (e.g. the IPsec mode as those are handled by separate modules or the IV generators). But I guess this is not a standard Ubuntu kernel, so it's definitely possible that stuff like specific crypto algorithms are missing.