StrongSwan支持libgcrypt。对于StrongSwan官网上的例子No.3需要安装libcurl、libgcrypt和libgmp。
- LIBGCRYPT安装
libgcrypt依赖于libgpg-error。首先下载libgpg-error和libgcrypt。
ftp> open ftp.gnupg.org Connected to ftp.gnupg.org. 220-Welcome hacker! 220-. 220-This is the FTP server of the GnuPG project. Please send problem reports 220-to ftpmaster@gnupg.org after having checked the gnupg-users mailing list 220-archive at http://lists.gnupg.org/pipermail/gnupg-users/ for known problems. 220-. 220-Housing and traffic is sponsored by OpenIT GmbH. 220-. 220-The server contains cryptographic software and its use might be illegal in 220-your country. However, as far as we know, only a very few countries have 220-restrictions on the use of cryptographic software. 220-. 220 Service ready for new user. Name (ftp.gnupg.org:***): anonymous（匿名登录） 331 Send e-mail address as password. Password: 230 User logged in, proceed. Remote system type is UNIX. ftp> cd gcrypt/libgpg-error 250-The package libgpg-error contains common error codes and error handling 250-functions used by GnuPG, Libgcrypt, GPGME and more packages. 250 Directory change successful. ftp> passive（被动模式） Passive mode on. ftp> binary（BINARY mode） 200 Command okay. ftp> get libgpg-error-1.12.tar.bz2 local: libgpg-error-1.12.tar.bz2 remote: libgpg-error-1.12.tar.bz2 227 Entering Passive Mode (217,69,76,55,156,84). 150 About to open data connection. 226 File transfer complete. 489266 bytes received in 9.86 secs (48.5 kB/s) ftp> cd .. 250-This directory is used as FTP site for GNU crypto software and 250-related stuff. 250-. 250-US laws place restrictions on the export of defense articles, which 250-includes some types of cryptographic software; this is the reason 250-that such software is not available from ftp.gnu.org 250-. 250-It is legal however, to export such software into the US. 250-. 250-Please contact <ftpmaster@gnupg.org> it you have any problems with 250-this site. 250-. 250-Software available here: 250-. 250- gnupg/ The GNU Privacy Guard 250- libgpg-error/ Common error codes for GnuPG, Libgcrypt etc. 250- gpgme/ GnuPG Made Easy library 250- pinentry/ Tool to enter a passphrase securely 250- libgcrypt/ General purpose low-level crypto library 250- libassuan/ The IPC library used by GnuPG 250- npth/ The New GNU Portable Threads Library 250- dirmngr/ A daemon to manage CRLs and LDAP queries for GnuPG. 250- gnu-crypt/ GNU Crypto for the classpathx Java libraries 250- egd/ Entropy Gathering Daemon 250- lsh/ A Secure Shell v2 implementation (work in progress) 250- 250- alpha/ Current development versions 250- binary/ Compiled versions for MS Windows. 250- contrib/ Other software and more translation files. 250- historic/ Historic versions. Also includes the content of 250- the old devel/ and pgpgpg/ directories. 250-. 250-See http://www.gnupg.org for further information. 250-. 250-The programs GnuPG and Libgcrypt hosted here are Free Software packages of 250-the GNU Project. We call them Free Software because you are free to copy 250-and redistribute them, following the rules stated in the license of each 250-package. For more information, see 250-http://www.gnu.org/philosophy/free-sw.html. 250-. 250-If you are looking for service or support for this software, see 250-http://www.gnupg.org/service.html . 250-. 250-If you would like to contribute to the development of one of these 250-packages, contact the package maintainer or the bug-reporting address 250-of the package (which should be listed in the package itself), or look 250-on www.gnu.org for more information on how to contribute. 250-. 250 Directory change successful. ftp> cd libgcrypt 250-This is the stable version of Libgcrypt. 250-For devlopment versions see ../alpha/libgcrypt/. 250 Directory change successful. ftp> get libgcrypt-1.6.0.tar.bz2 local: libgcrypt-1.6.0.tar.bz2 remote: libgcrypt-1.6.0.tar.bz2 227 Entering Passive Mode (217,69,76,55,158,239). 150 About to open data connection. 226 File transfer complete. 2499149 bytes received in 51.68 secs (47.2 kB/s) ftp> close 221 Service closing control connection. ftp> bye
下载完成后，安装libgpg-error和libgcrypt。
******xxx.tar.bz2格式文件解压******
bzip2 -d xxx.tar.bz2
tar -xvf xxx.tar
或者
tar -xjvf xxx.tar.bz2
******************************************
bzip2 -d libgpg-error-1.12.tar.bz2 tar -xvf libgpg-error-1.12.tar bzip2 -d libgcrypt-1.6.0.tar.bz2 tar -xvf libgcrypt-1.6.0.tar
对libgpg-error和libgcrypt请参考——libgpg-error-1.12和libgcrypt-1.6.0：
libgpg-error-1.12安装：
Install libgpg-error by running the following commands: ./configure --prefix=/usr --disable-static && make To test the results, issue: make check. Now, as the root user: make install && install -v -m644 -D README /usr/share/doc/libgpg-error-1.12/README
libgcrypt-1.6.0安装（实验中执行了红字部分）：
Install libgcrypt by running the following commands: ./configure --prefix=/usr && make Only info documentation is shipped in the package tarball. If you wish to build alternate formats of the documentation, (you must have texlive-20130530 installed to build the PDF and PostScript documentation), then issue the following commands: make -C doc pdf ps html && makeinfo --html --no-split -o doc/gcrypt_nochunks.html doc/gcrypt.texi && makeinfo --plaintext -o doc/gcrypt.txt doc/gcrypt.texi To test the results, issue: make check. Now, as the root user: make install && install -v -dm755 /usr/share/doc/libgcrypt-1.6.0 && install -v -m644 README doc/{README.apichanges,fips*,libgcrypt*} /usr/share/doc/libgcrypt-1.6.0 If you built the additional documentation, install it by issuing the following commands as the root user: install -v -dm755 /usr/share/doc/libgcrypt-1.6.0/html && install -v -m644 doc/gcrypt.html/* /usr/share/doc/libgcrypt-1.6.0/html && install -v -m644 doc/gcrypt_nochunks.html /usr/share/doc/libgcrypt-1.6.0 && install -v -m644 doc/gcrypt.{pdf,ps,dvi,txt,texi} /usr/share/doc/libgcrypt-1.6.0
- LIBGMP安装
安装libgmp之前需要安装m4（a macro processing language）和build-essential（Informational list of build-essential packages）。
sudo apt-get install m4 apt-get install build-essential
在libgmp官网下载gmp-x.x.x.tar.bz2进行安装，实验中下载的是gmp-5.1.3.tar.bz2：
tar -xjvf gmp-5.1.3.tar.bz2 cd gmp-5.1.3 sudo ./configure --enable-cxx sudo make sudo make check sudo make install
- LIBCURL安装
wget http://curl.haxx.se/download/curl-7.22.0.tar.gz tar -zxvf curl-7.22.0.tar.gz cd curl-7.22.0 ./configure make make install
- StrongSwan安装
wget http://download.strongswan.org/strongswan-4.6.4.tar.bz2 tar xjvf strongswan-4.6.4.tar.bz2 cd strongswan-4.6.4 ./configure --prefix=/usr --sysconfdir=/etc --enable-gcrypt --enable-curl --disable-pluto make make install
- 实验
配置：
Ubuntu3（虚拟机）——Ubuntu12.04LTS（32位）——IP192.168.31.132
Ubuntu4（虚拟机）——Ubuntu12.04LTS（32位）——IP192.168.31.133
对Ubuntu3进行配置：
配置/etc/ipsec.secrets
192.168.31.132 : PSK "chu"
配置/etc/ipsec.conf
# ipsec.conf - strongSwan IPsec configuration file # basic configuration config setup # plutodebug=all # crlcheckinterval=600 # strictcrlpolicy=yes # cachecrls=yes # nat_traversal=yes # charonstart=no # plutostart=no plutodebug=all charondebug="ike 4" charonstart=yes plutostart=yes # Add connections here. # Sample VPN connections #conn sample-self-signed # left=%defaultroute # leftsubnet=10.1.0.0/16 # leftcert=selfCert.der # leftsendcert=never # right=192.168.0.2 # rightsubnet=10.2.0.0/16 # rightcert=peerCert.der # auto=start #conn sample-with-ca-cert # left=%defaultroute # leftsubnet=10.1.0.0/16 # leftcert=myCert.pem # right=192.168.0.2 # rightsubnet=10.2.0.0/16 # rightid="C=CH, O=Linux strongSwan CN=peer name" # keyexchange=ikev2 # auto=start conn host-to-host left=192.168.31.133 right=192.168.31.132 type=transport authby=secret auto=start
配置/etc/strongswan.conf
# strongswan.conf - strongSwan configuration file charon { # number of worker threads in charon threads = 16 # send strongswan vendor ID? # send_vendor_id = yes load = curl pem pkcs1 gcrypt x509 revocation hmac xcbc stroke kernel-netlink socket-default updown plugins { sql { # loglevel to log into sql database loglevel = -1 # URI to the database # database = sqlite:///path/to/file.db # database = mysql://user:password@localhost/database } } filelog { /var/log/strongswan.log { time_format = %b %e %T append = no default = 4 flush_line = yes } } # ... } pluto { } libstrongswan { # set to no, the DH exponent size is optimized # dh_exponent_ansi_x9_42 = no }
类似的，对Ubuntu4进行配置。通过ipsec restart重启软件。查看日志文件（/var/log/strongswan.log）：
Jan 12 17:36:50 00[DMN] Starting IKEv2 charon daemon (strongSwan 4.6.4) Jan 12 17:36:50 00[LIB] plugin ‘curl‘: loaded successfully Jan 12 17:36:50 00[LIB] plugin ‘pem‘: loaded successfully Jan 12 17:36:50 00[LIB] plugin ‘pkcs1‘: loaded successfully Jan 12 17:36:50 00[LIB] plugin ‘gcrypt‘: loaded successfully Jan 12 17:36:50 00[LIB] plugin ‘x509‘: loaded successfully Jan 12 17:36:50 00[LIB] plugin ‘revocation‘: loaded successfully Jan 12 17:36:50 00[LIB] plugin ‘hmac‘: loaded successfully Jan 12 17:36:50 00[LIB] plugin ‘xcbc‘: loaded successfully Jan 12 17:36:50 00[CFG] loading ca certificates from ‘/etc/ipsec.d/cacerts‘ Jan 12 17:36:50 00[CFG] loading aa certificates from ‘/etc/ipsec.d/aacerts‘ Jan 12 17:36:50 00[CFG] loading ocsp signer certificates from ‘/etc/ipsec.d/ocspcerts‘ Jan 12 17:36:50 00[CFG] loading attribute certificates from ‘/etc/ipsec.d/acerts‘ Jan 12 17:36:50 00[CFG] loading crls from ‘/etc/ipsec.d/crls‘ Jan 12 17:36:50 00[CFG] loading secrets from ‘/etc/ipsec.secrets‘ Jan 12 17:36:50 00[CFG] loaded IKE secret for 192.168.31.133 Jan 12 17:36:50 00[CFG] secret: 63:68:75 Jan 12 17:36:50 00[LIB] plugin ‘stroke‘: loaded successfully Jan 12 17:36:50 00[LIB] plugin ‘kernel-netlink‘: loaded successfully Jan 12 17:36:50 00[KNL] listening on interfaces: Jan 12 17:36:50 00[KNL] eth0 Jan 12 17:36:50 00[KNL] 192.168.31.133 Jan 12 17:36:50 00[KNL] fe80::20c:29ff:feb9:b29c Jan 12 17:36:50 00[LIB] plugin ‘socket-default‘: loaded successfully Jan 12 17:36:50 00[LIB] plugin ‘updown‘: loaded successfully Jan 12 17:36:50 00[DMN] loaded plugins: curl pem pkcs1 gcrypt x509 revocation hmac xcbc stroke kernel-netlink socket-default updown