From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4ZyjYW6gkFz33B8 for ; Thu, 15 May 2025 08:09:51 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) client-signature RSA-PSS (4096 bits)) (Client CN "mail01.haj.ipfire.org", Issuer "R10" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4ZyjYS3Xm0z2yTm for ; Thu, 15 May 2025 08:09:48 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4ZyjYR2MTLz16G for ; Thu, 15 May 2025 08:09:47 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1747296587; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=opcA0e8t0c/Ebwz8EFPQGlkmaOQ1/kNSzOp77kN+e54=; b=SooSoyDmHkQd50E5PM436ffDKyAKmpsRC/ThRR/0WuSgZgT9EHi5+Wn5Yyr2TbGmm7A+r4 hGSDTZe1JPqTnNDw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1747296587; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=opcA0e8t0c/Ebwz8EFPQGlkmaOQ1/kNSzOp77kN+e54=; b=QOKL0B2+jeZ08qI/+zGv7kS6TQYbxqNbDGCJOfk8B8mdfWobYfiJMnZZ0XRTkXxbDEmk7u 7mz7FMp/OtaWLy3dYqpBzhZCKK0FWBzkKlgXhNol0TAmWbK1epFCYzeFPHT9VTr3vEA3G3 8B74a7kHwsGQIbY3xWnhWICvNX73ytKB0E6+xvbxoJmoTnkDDceKXKFomBZBadvzclBCW+ gCIaycZWBMgrhuymFzRoF7havRStC7qd9IyMNkzNzggBTpvV9MtqYs7whTV+FRQ5Dtk2IG O+ZY1KtL9jXQs5QrWQIYetwdHnKTHWGEc34B/XIJZE7k5mp/FJy4ziOYZEqWkQ== Message-ID: Date: Thu, 15 May 2025 08:09:00 +0000 Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Subject: [PATCH 2/2] Core Update 196: Adjust existing IPsec connections using ML-KEM From: =?UTF-8?Q?Peter_M=C3=BCller?= To: "IPFire: Development" References: <8baae50f-cf7b-4af0-81ec-89d898966993@ipfire.org> In-Reply-To: <8baae50f-cf7b-4af0-81ec-89d898966993@ipfire.org> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This causes existing IPsec connections using ML-KEM to always use it in conjunction with Curve 25519, in line with the changes dfa7cd2bbac3c746569368d70fefaf1ff4e1fed2 implements for newly configured IPsec connections. Again, we can reasonably assume an IPsec peer supporting ML-KEM also supports Curve 25519. In case such a peer does not support RFC 9370, and the IPsec connection was created using our default ciphers, it will fall back to Curve 448, Curve 25519, or any other traditional algorithm. This patch will break existing IPsec connections only if they are exclusively using ML-KEM (which means the IPFire user reconfigured them manually using the "advanced connection settings" section in the WebUI), and the IPsec peer is configured in the same manner, and/or is an IPFire machine not yet updated to Core Update 196. Any other IPFire-to-IPFire IPsec connection will continue working, potentially falling back to Curve 448 or 25519 until both peers are updated to Core Update 196, after which ML-KEM in conjunction with Curve 25519 will be used again. Signed-off-by: Peter Müller --- config/rootfiles/core/196/update.sh | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/config/rootfiles/core/196/update.sh b/config/rootfiles/core/196/update.sh index 0138fabcf..4f92b998b 100644 --- a/config/rootfiles/core/196/update.sh +++ b/config/rootfiles/core/196/update.sh @@ -32,6 +32,7 @@ for (( i=1; i<=$core; i++ )); do done # Stop services +/etc/rc.d/init.d/ipsec stop # Remove files rm -rfv \ @@ -65,7 +66,14 @@ esac # Apply SSH configuration #/usr/local/bin/sshctrl +# Change IPsec configuration of existing connections using ML-KEM +# to always make use of hybrid key exchange in conjunction with Curve 25519. +sed -i -e "s@-mlkem@-x25519-ke1_mlkem@g" /etc/ipsec.conf + # Start services +if grep -q "ENABLED=on" /var/ipfire/vpn/settings; then + /etc/rc.d/init.d/ipsec start +fi # This update needs a reboot... #touch /var/run/need_reboot -- 2.43.0