Bug 1136124

Paul, I am currently facing two issues brought by 3.12-4. 

First, it is RSA peer authentication. Suppose I have all credentials in NSS DB and private key is secured by password. Previously (3.10-1) RSA auth worked fine with NSS password stored in /etc/ipsec.d/nsspassword and the following ipsec.secrets:

: RSA toe

With 3.12-4 this suddenly stopped working with the following messages in the pluto log:

...
loading secrets from "/etc/ipsec.secrets"
loaded private key for keyid: PPK_RSA:AwEAAeZDV
...
"test" #1: I am sending my cert
"test" #1: I am sending a certificate request
"test" #1: Can't find the private key from the NSS CERT (err -8177)
"test" #1: unable to locate my private key for RSA Signature
"test" #1: sending notification AUTHENTICATION_FAILED to 10.0.0.1:500

So the private was loaded but it cannot be found afterwards? I am a bit confused by the comment #5, the part of it mentioning RSA, do I need to have private key password in secrets file or not? As you mentioned it was there before and then it was removed, is the back now? Libreswan docs still says it should be there and 3.12-4 indicates that it did not changed:

# cat /etc/ipsec.secrets
: RSA "toe" "secret"

# ipsec secrets
002 forgetting secrets
002 loading secrets from "/etc/ipsec.secrets"
003 "/etc/ipsec.secrets" line 1: RSA private key file -- unexpected token after friendly_name

Mysteriously, ipsec auto --listall shows correct results for both 3.10 and 3.12:

000 List of RSA Public Keys:
000                                                                             
000 Jan 15 10:19:09 2015, 1024 RSA Key AwEAAb98E (no private key), until Jan 15 10:00:56 2025 ok
000        ID_IPV4_ADDR '10.0.0.1'
000        Issuer 'CN=CA'
000 Jan 15 10:19:09 2015, 1024 RSA Key AwEAAb98E (no private key), until Jan 15 10:00:56 2025 ok
000        ID_DER_ASN1_DN 'CN=ns'
000        Issuer 'CN=CA'
000 Jan 15 10:19:09 2015, 1024 RSA Key AwEAAeZDV (has private key), until Jan 15 10:00:56 2025 ok
000        ID_IPV4_ADDR '10.0.0.2'
000        Issuer 'CN=CA'
000 Jan 15 10:19:09 2015, 1024 RSA Key AwEAAeZDV (has private key), until Jan 15 10:00:56 2025 ok
000        ID_DER_ASN1_DN 'CN=toe'
000        Issuer 'CN=CA'
000                                                                             
000 List of Pre-shared secrets (from /etc/ipsec.secrets)
000               
000     1: RSA (none) (none)
000

(In reply to Ondrej Moriš from comment #14)
> Paul, I am currently facing two issues brought by 3.12-4. 
> 
> First, it is RSA peer authentication...

I dug deeper into this issue and found out that my nsspassword was actually using incorrect format (just "secret" instead of "token:secret"). It worked before, because previously (<=3.10) libreswan was somehow able to read even such incorrectly formatted password. In 3.12, NSS password parser (getNSSPassword in lswconf.c) changed so that only a correctly written nsspassword is used. 

All in all, RSA peer authentication works fine. I am sorry for false alarming :).

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-0431.html