Gage has submitted this change and it was merged.

Change subject: IPsec: improved cipher selection
......................................................................


IPsec: improved cipher selection

* For clarity, specify GCM in bytes instead of bits to match proposal output
* Do not include null cipher, per Tobias @ Strongswan
* Select pseudorandom function (PRF): SHA2_384
* ECDH: select Brainpool curve with 384-bit key
* ESP: Disable 64-bit extended sequence numbers (ESN) due to kernel crash 
documented in T94820
* https://wikitech.wikimedia.org/wiki/IPsec#Cipher_selection
* https://wikitech.wikimedia.org/wiki/IPsec#Cipher_proposals

Change-Id: If2ac2b1def677dbcbf8cc95c849c4b6283e3c2dc
---
M modules/strongswan/templates/ipsec.conf.erb
1 file changed, 4 insertions(+), 5 deletions(-)

Approvals:
  Gage: Looks good to me, approved
  BBlack: Looks good to me, but someone else must approve
  jenkins-bot: Verified



diff --git a/modules/strongswan/templates/ipsec.conf.erb 
b/modules/strongswan/templates/ipsec.conf.erb
index f7c857a..fc4bcc4 100644
--- a/modules/strongswan/templates/ipsec.conf.erb
+++ b/modules/strongswan/templates/ipsec.conf.erb
@@ -38,11 +38,10 @@
 
 conn %default
        # https://wiki.strongswan.org/projects/strongswan/wiki/IKEv2CipherSuites
-       # 
https://wiki.strongswan.org/projects/strongswan/wiki/CipherSuiteExamples
-       # http://www.strongswan.org/uml/testresults/ikev2/alg-aes-gcm/
-       # modp2048 = DH group 14
-       ike=aes128gcm128-aesxcbc-modp2048!
-       esp=aes128gcm128-modp2048!
+       # https://wikitech.wikimedia.org/wiki/IPsec#Cipher_selection
+       # https://wikitech.wikimedia.org/wiki/IPsec#Cipher_proposals
+       ike=aes128gcm16-prfsha384-ecp384bp!
+       esp=aes128gcm16-ecp384bp-noesn!
        type=transport
        auto=start
 

-- 
To view, visit https://gerrit.wikimedia.org/r/201135
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings

Gerrit-MessageType: merged
Gerrit-Change-Id: If2ac2b1def677dbcbf8cc95c849c4b6283e3c2dc
Gerrit-PatchSet: 3
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Gage <[email protected]>
Gerrit-Reviewer: BBlack <[email protected]>
Gerrit-Reviewer: Ecdsa <[email protected]>
Gerrit-Reviewer: Faidon Liambotis <[email protected]>
Gerrit-Reviewer: Gage <[email protected]>
Gerrit-Reviewer: Mark Bergsma <[email protected]>
Gerrit-Reviewer: jenkins-bot <>

_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits

Reply via email to