Gage has submitted this change and it was merged. Change subject: IPsec: improved cipher selection ......................................................................
IPsec: improved cipher selection * For clarity, specify GCM in bytes instead of bits to match proposal output * Do not include null cipher, per Tobias @ Strongswan * Select pseudorandom function (PRF): SHA2_384 * ECDH: select Brainpool curve with 384-bit key * ESP: Disable 64-bit extended sequence numbers (ESN) due to kernel crash documented in T94820 * https://wikitech.wikimedia.org/wiki/IPsec#Cipher_selection * https://wikitech.wikimedia.org/wiki/IPsec#Cipher_proposals Change-Id: If2ac2b1def677dbcbf8cc95c849c4b6283e3c2dc --- M modules/strongswan/templates/ipsec.conf.erb 1 file changed, 4 insertions(+), 5 deletions(-) Approvals: Gage: Looks good to me, approved BBlack: Looks good to me, but someone else must approve jenkins-bot: Verified diff --git a/modules/strongswan/templates/ipsec.conf.erb b/modules/strongswan/templates/ipsec.conf.erb index f7c857a..fc4bcc4 100644 --- a/modules/strongswan/templates/ipsec.conf.erb +++ b/modules/strongswan/templates/ipsec.conf.erb @@ -38,11 +38,10 @@ conn %default # https://wiki.strongswan.org/projects/strongswan/wiki/IKEv2CipherSuites - # https://wiki.strongswan.org/projects/strongswan/wiki/CipherSuiteExamples - # http://www.strongswan.org/uml/testresults/ikev2/alg-aes-gcm/ - # modp2048 = DH group 14 - ike=aes128gcm128-aesxcbc-modp2048! - esp=aes128gcm128-modp2048! + # https://wikitech.wikimedia.org/wiki/IPsec#Cipher_selection + # https://wikitech.wikimedia.org/wiki/IPsec#Cipher_proposals + ike=aes128gcm16-prfsha384-ecp384bp! + esp=aes128gcm16-ecp384bp-noesn! type=transport auto=start -- To view, visit https://gerrit.wikimedia.org/r/201135 To unsubscribe, visit https://gerrit.wikimedia.org/r/settings Gerrit-MessageType: merged Gerrit-Change-Id: If2ac2b1def677dbcbf8cc95c849c4b6283e3c2dc Gerrit-PatchSet: 3 Gerrit-Project: operations/puppet Gerrit-Branch: production Gerrit-Owner: Gage <[email protected]> Gerrit-Reviewer: BBlack <[email protected]> Gerrit-Reviewer: Ecdsa <[email protected]> Gerrit-Reviewer: Faidon Liambotis <[email protected]> Gerrit-Reviewer: Gage <[email protected]> Gerrit-Reviewer: Mark Bergsma <[email protected]> Gerrit-Reviewer: jenkins-bot <> _______________________________________________ MediaWiki-commits mailing list [email protected] https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
