IPSec bug with PFS Key group?

[taenzerme]

Hello guys,

we ran into problems with the latest 2.2/2.2.1 releases not beeing able to connect to a remote side where the phase 2 pfs key group was set.
Checking /var/etc/ipsec.conf revealed that the esp setting in the config was not beeing written correctly. The pfs/modp part was missing completely.

I checked /etc/inc/vpn.inc and found line 850:

if (isset($a_client['pfs_group']))
    $ph2ent['pfsgroup'] = $a_client['pfs_group'];

The form post value is actually pfsgroup, not pfs_group.
Changing it to:

if (isset($a_client['pfsgroup']))
    $ph2ent['pfsgroup'] = $a_client['pfsgroup'];

wrote the correct ipsec.conf and the connection worked after that.

Is that a bug? Should and can I submit this somewhere?

Sebastian

[rbgarga]

It's confusing but parameter is called pfs_group on <client>and pfsgroup on <phase2>. Can you share a sanitized version of your config.xml?</phase2></client>

[eri--]

Can you clairfy this a bit since i do not see any issue there!
The code is correct there from what i can tell but what does work for you after changing it.

[taenzerme]

Sorry for late reply. Was out of town for two days. Thanks for your quick replies!

ipsec.conf before fix:

# This file is automatically generated. Do not edit
config setup
    uniqueids = yes
    charondebug="dmn 2,mgr 2,ike 2,chd 2,job 2,net 2,esp 2,lib 2"

conn con1000
    reqid = 1
    fragmentation = yes
    keyexchange = ikev1
    reauth = yes
    forceencaps = no
    mobike = no
    rekey = yes
    installpolicy = yes
    type = tunnel
    dpdaction = restart
    dpddelay = 10s
    dpdtimeout = 60s
    auto = route
    left = xxx.xxx.xxx.xxx
    right = xxx.xxx.xxx.xxx
    leftid = xxx.xxx.xxx.xxx
    ikelifetime = 28800s
    lifetime = 3600s
    ike = 3des-sha1-modp1024!
    esp = aes256-md5
    leftauth = psk
    rightauth = psk
    rightid = xxx.xxx.xxx.xxx
    aggressive = no
    rightsubnet = 100.64.13.160/29
    leftsubnet = 100.72.13.160/29

After fix:

# This file is automatically generated. Do not edit
config setup
    uniqueids = yes
    charondebug="dmn 2,mgr 2,ike 2,chd 2,job 2,net 2,esp 2,lib 2"

conn con1000
    reqid = 1
    fragmentation = yes
    keyexchange = ikev1
    reauth = yes
    forceencaps = no
    mobike = no
    rekey = yes
    installpolicy = yes
    type = tunnel
    dpdaction = restart
    dpddelay = 10s
    dpdtimeout = 60s
    auto = route
    left = xxx.xxx.xxx.xxx
    right = xxx.xxx.xxx.xxx
    leftid = xxx.xxx.xxx.xxx
    ikelifetime = 28800s
    lifetime = 3600s
    ike = 3des-sha1-modp1024!
    esp = aes256-md5-modp1024!
    leftauth = psk
    rightauth = psk
    rightid = xxx.xxx.xxx.xxx
    aggressive = no
    rightsubnet = 100.64.13.160/29
    leftsubnet = 100.72.13.160/29

please note the esp = line.  Maybe it's a configuration thing but after changing the post name in the source the file was beeing generated correctly. Before it was not.

Sanitized config attached.

config.txt

[stegbth]

Hi taenzerme,

i have a fresh installed 2.2
There are some IPsec issues, but my ipsec.conf has at esp the appropriate modp setting.
esp = 3des-sha1-modp1536!

Does this only assing to modp1024?

best regards
thomas

[taenzerme]

Thomas,

ours are 2.1 upgraded to 2.2 and it happens with alle modp settings - they're missing completely.
Changing the form name value for the field works at least for us.

I did not have the time to test with a fresh install but will do later.

[cmb]

The root cause of that issue is https://redmine.pfsense.org/issues/4538 which is fixed for 2.2.2.