4

I'm trying to connect to my university's VPN using strongSwan on Arch Linux. They have given example ipsec.conf and ipsec.secrets files and I've installed strongSwan from the AUR.

As far as I'm aware, I just need to run ipsec up UNI, where "UNI" is the name of the connection. But before that, when I run ipsec start I get the following output:

Starting strongSwan 5.5.0 IPsec [starter]...
no netkey IPsec stack detected
no KLIPS IPsec stack detected
no known IPsec stack detected, ignoring!

If I search for this error message online all I can find are answers on FreeBSD mailing lists/forums saying don't worry, it's a Linux specific error, we FreeBSDers don't need to worry about it.

There doesn't seem to be a way of running ipsec with a more verbose output so I have no idea how to resolve the error. Any help would be much appreciated.

thosphor
  • 153
  • 1
  • 5
  • Sometimes you will get a false-positive on this, when it previously worked and suddenly stops working, in which case one may have upgraded the kernel and modules mismatch (i.e. you modprobe tunnel and it it fails to load possibly because your distro wipes out your modules path - i.e. alpine linux), in which case, reboot would be first thing to try and see if 'ipsec restart' reports the same issue... – HidekiAI Nov 23 '18 at 16:54

1 Answers1

8

That legacy check looks for /proc/net/pfkey. If not found, the code tries to load the af_key module via modprobe and then checks again. However, the PF_KEYv2 interface provided by the af_key module is not used on Linux, by default. Instead, the Netlink/XFRM interface provided by the xfrm_user module is used. The starter process has no explicit check for that, though.

So if your kernel provides all required modules for IPsec and XFRM but just not the af_key module that's not a problem and you should be able to establish the connection just fine. As the message suggests, ignore these warnings and simply try to initiate the connection with ipsec up.

Update: These checks were removed with strongSwan 5.8.0.

ecdsa
  • 809
  • 4
  • 7