jshotnik opened a new issue, #14427:
URL: https://github.com/apache/cloudstack/issues/14427
### problem
The system VM template build script
tools/appliance/systemvmtemplate/scripts/install_systemvm_packages.sh (line 78
on main) installs "strongswan libcharon-extra-plugins
libstrongswan-extra-plugins strongswan-charon strongswan-starter" with
--no-install-recommends. That leaves out libstrongswan-standard-plugins, which
holds the gcm, openssl and aesni plugins. charon on the router then has no
AES-GCM for IKE.
With an IKE policy such as aes256gcm16-sha256;modp2048 and IKEv2, charon
logs:
ENCRYPTION_ALGORITHM AES_GCM_16 (key size 256) not supported!
key derivation failed
ESP with AES-GCM works, because the kernel does ESP.
### versions
CloudStack 4.22.0.0, 4.23.0.0 and main. System VM template 4.22.0
(strongSwan 5.9.8, Debian 12). KVM.
### The steps to reproduce the bug
1. Allow GCM in NetUtils.isValidS2SVpnPolicy (the stock API refuses GCM
ciphers), or use a build that allows it.
2. Create a site-to-site VPN customer gateway with ikeversion=ikev2,
ikepolicy=aes256gcm16-sha256;modp2048, esppolicy=aes256gcm16;modp2048.
3. Create the VPN connection and reset it.
4. Read /var/log/daemon.log on the VPC router.
### What to do about it?
Add libstrongswan-standard-plugins to the package list in
install_systemvm_packages.sh. We run a template with this package added
(strongSwan 5.9.8-5+deb12u5) in production. charon then selects
IKE:AES_GCM_16_256/PRF_HMAC_SHA2_256/MODP_2048 and ESP:AES_GCM_16_256, with no
other change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
