Bug 11855 - IPsec: Cannot establish tunnel with ChaCha20-Poly1305 on ARM
Summary: IPsec: Cannot establish tunnel with ChaCha20-Poly1305 on ARM
Status: CLOSED FIXED
Alias: None
Product: IPFire
Classification: Unclassified
Component: --- (show other bugs)
Version: 2
Hardware: unspecified Unspecified
: Will affect an average number of users Crash
Assignee: Arne.F
QA Contact:
URL:
Keywords:
Depends on: 11549
Blocks:
  Show dependency tree / graph
 
Reported: 2018-09-10 09:58 UTC by Michael Tremer
Modified: 2018-10-15 13:47 UTC (History)
1 user (show)

See Also:

Attachments
Log excerpt (1.30 KB, text/plain)
2018-09-10 09:58 UTC, Michael Tremer 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Tremer 2018-09-10 09:58:03 UTC 
Created attachment 624 [details]
Log excerpt

Cannot establish IPsec VPN with ChaCha20-Poly1305 on ARM:

> received netlink error: Function not implemented (38)
> unable to add SAD entry with SPI c7e5aa6d (FAILED)

Full log is attached.

It looks like this is not enabled in the ARM kernel configs:

> config/kernel/kernel.config.aarch64-ipfire:# CONFIG_CRYPTO_CHACHA20POLY1305 is not set
> config/kernel/kernel.config.aarch64-ipfire:# CONFIG_CRYPTO_CHACHA20 is not set
> config/kernel/kernel.config.armv5tel-ipfire-kirkwood:# CONFIG_CRYPTO_CHACHA20POLY1305 is not set
> config/kernel/kernel.config.armv5tel-ipfire-kirkwood:# CONFIG_CRYPTO_CHACHA20 is not set
> config/kernel/kernel.config.armv5tel-ipfire-multi:# CONFIG_CRYPTO_CHACHA20POLY1305 is not set
> config/kernel/kernel.config.armv5tel-ipfire-multi:# CONFIG_CRYPTO_CHACHA20 is not set
> config/kernel/kernel.config.i586-ipfire:CONFIG_CRYPTO_CHACHA20POLY1305=m
> config/kernel/kernel.config.i586-ipfire:CONFIG_CRYPTO_CHACHA20=m
> config/kernel/kernel.config.i586-ipfire-pae:CONFIG_CRYPTO_CHACHA20POLY1305=m
> config/kernel/kernel.config.i586-ipfire-pae:CONFIG_CRYPTO_CHACHA20=m
> config/kernel/kernel.config.x86_64-ipfire:CONFIG_CRYPTO_CHACHA20POLY1305=m
> config/kernel/kernel.config.x86_64-ipfire:CONFIG_CRYPTO_CHACHA20=m
> config/kernel/kernel.config.x86_64-ipfire:CONFIG_CRYPTO_CHACHA20_X86_64=m

Please enable.

This is quite severe because ChaCha20-Poly1305 is chosen as default and tunnels with the default settings won't come up if one peer is ARM.