OPNsense Forum

Archive => 23.7 Legacy Series => Topic started by: olest on October 26, 2023, 12:15:48 PM

Title: aes128gcm16-aesxcbc-modp2048 missing after 23.7.7 update
Post by: olest on October 26, 2023, 12:15:48 PM
Hi,

After updating to 23.7.7 I can no longer choose aes128gcm16-aesxcbc-modp2048 in new IPSEC Connections Proposals.
Title: Re: aes128gcm16-aesxcbc-modp2048 missing after 23.7.7 update
Post by: MoonbeamFrame on October 26, 2023, 01:49:05 PM
And I have some existing OPNsense to OPNsense tunnels where the Proposals now say Nothing selected.

Though the tunnels are up-and-running OK.
Title: Re: aes128gcm16-aesxcbc-modp2048 missing after 23.7.7 update
Post by: franco on October 26, 2023, 01:55:58 PM
Investigating this now.


Cheers,
Franco
Title: Re: aes128gcm16-aesxcbc-modp2048 missing after 23.7.7 update
Post by: mimugmail on October 26, 2023, 02:52:38 PM
aes128gcm16-aesxcbc-modp2048

Cyphers with GCM already include a auth mech like md5, sha, aesxcbc, those values are useless.


Title: Re: aes128gcm16-aesxcbc-modp2048 missing after 23.7.7 update
Post by: franco on October 26, 2023, 03:06:26 PM
According to strongswan "it depends":

https://users.strongswan.narkive.com/0YfEZ2CS/question-about-ike-aes256gcm16-aesxcbc-modp2048-in-ipsec-conf

I think we'd rather put back what we had offered before quickly and reassess this later in a proper data migration. PRF prefix-or-not and ESP/IKE modularity is a bit difficult to unwind on short notice.


Cheers,
Franco
Title: Re: aes128gcm16-aesxcbc-modp2048 missing after 23.7.7 update
Post by: franco on October 26, 2023, 03:23:31 PM
This should bring the selected item back? https://github.com/opnsense/core/commit/cde83b0a0c

# opnsense-patch cde83b0a0c


Cheers,
Franco
Title: Re: aes128gcm16-aesxcbc-modp2048 missing after 23.7.7 update
Post by: olest on October 26, 2023, 04:15:11 PM
Thank you.
Title: Re: aes128gcm16-aesxcbc-modp2048 missing after 23.7.7 update
Post by: franco on October 26, 2023, 05:07:08 PM
Counting that as a "yes it does"? :)
Title: Re: aes128gcm16-aesxcbc-modp2048 missing after 23.7.7 update
Post by: olest on October 26, 2023, 06:02:07 PM
It does work now :)
Title: Re: aes128gcm16-aesxcbc-modp2048 missing after 23.7.7 update
Post by: franco on October 26, 2023, 07:33:24 PM
Ok, I'll proceed to hotfix this tomorrow just to avoid further irritation about it.


Cheers,
Franco
Title: Re: aes128gcm16-aesxcbc-modp2048 missing after 23.7.7 update
Post by: olest on October 26, 2023, 09:10:18 PM
ok,

Is aes256-sha256-modp1024[DH2] / AES (256 bits) + SHA256 + DH Group 2 not an option with the new connection proposals. I'm having one IPSEC IKEv1 using it.
Title: Re: aes128gcm16-aesxcbc-modp2048 missing after 23.7.7 update
Post by: franco on October 26, 2023, 09:20:08 PM
I think modp1024 is considered deprecated. Wasn't in 23.7.6 either, right?


Cheers,
Franco
Title: Re: aes128gcm16-aesxcbc-modp2048 missing after 23.7.7 update
Post by: olest on October 26, 2023, 09:26:00 PM
ok, I have not tried to find it in IPSEC new connections before now. Only in legacy IPSEC. I'll update to DH14 I think.