SIG-VPN

sig-vpn@lists.ipfire.org

27 discussions

charon: 03[NET] receive buffer too small, packet discarded
by Ian H 14 Jun '21

14 Jun '21

Hi, I've listed this "bug" and the resolution on bugzilla: https://bugzilla.ipfire.org/show_bug.cgi?id=12635 What are the thoughts on if this default value should be changed for IPFire or if it should be done case by case? Seems that the default value is too small nowadays anyway, however unsure if there is a downside to a larger buffer? Ian

2 1

[PATCH] ipsec: Allow selection of ESP group type
by Michael Tremer 13 Jun '15

13 Jun '15

If a connection is edited, the IKE group types will be used instead. Fixes #10860 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- doc/language_issues.de | 1 + doc/language_issues.es | 1 + doc/language_issues.fr | 1 + doc/language_issues.it | 1 + doc/language_issues.nl | 1 + doc/language_issues.pl | 1 + doc/language_issues.ru | 1 + doc/language_issues.tr | 1 + html/cgi-bin/vpnmain.cgi | 73 ++++++++++++++++++++++++++++++++++++++++++------ langs/en/cgi-bin/en.pl | 1 + 10 files changed, 74 insertions(+), 8 deletions(-) diff --git a/doc/language_issues.de b/doc/language_issues.de index 90accb3c006a..0d86987569b5 100644 --- a/doc/language_issues.de +++ b/doc/language_issues.de @@ -644,6 +644,7 @@ WARNING: untranslated string: fwhost cust geoipgrp WARNING: untranslated string: fwhost err hostip WARNING: untranslated string: ike lifetime should be between 1 and 8 hours WARNING: untranslated string: no data +WARNING: untranslated string: none WARNING: untranslated string: qos add subclass WARNING: untranslated string: route config changed WARNING: untranslated string: routing config added diff --git a/doc/language_issues.es b/doc/language_issues.es index fe8b726243ab..b0c066f644a3 100644 --- a/doc/language_issues.es +++ b/doc/language_issues.es @@ -917,6 +917,7 @@ WARNING: untranslated string: most preferred WARNING: untranslated string: nameserver WARNING: untranslated string: no data WARNING: untranslated string: no hardware random number generator +WARNING: untranslated string: none WARNING: untranslated string: not a valid dh key WARNING: untranslated string: notice WARNING: untranslated string: openvpn default diff --git a/doc/language_issues.fr b/doc/language_issues.fr index fee481d25bb0..b13969b01705 100644 --- a/doc/language_issues.fr +++ b/doc/language_issues.fr @@ -932,6 +932,7 @@ WARNING: untranslated string: most preferred WARNING: untranslated string: nameserver WARNING: untranslated string: no data WARNING: untranslated string: no hardware random number generator +WARNING: untranslated string: none WARNING: untranslated string: not a valid dh key WARNING: untranslated string: notice WARNING: untranslated string: ntp common settings diff --git a/doc/language_issues.it b/doc/language_issues.it index 2f61cb61b17c..c133fec1b84f 100644 --- a/doc/language_issues.it +++ b/doc/language_issues.it @@ -705,6 +705,7 @@ WARNING: untranslated string: masquerading disabled WARNING: untranslated string: masquerading enabled WARNING: untranslated string: messages WARNING: untranslated string: no data +WARNING: untranslated string: none WARNING: untranslated string: outgoing compression in bytes per second WARNING: untranslated string: outgoing overhead in bytes per second WARNING: untranslated string: ovpn add conf diff --git a/doc/language_issues.nl b/doc/language_issues.nl index fadc79272f9b..692420e6b30b 100644 --- a/doc/language_issues.nl +++ b/doc/language_issues.nl @@ -737,6 +737,7 @@ WARNING: untranslated string: modem status WARNING: untranslated string: monitor interface WARNING: untranslated string: nameserver WARNING: untranslated string: no data +WARNING: untranslated string: none WARNING: untranslated string: not a valid dh key WARNING: untranslated string: outgoing compression in bytes per second WARNING: untranslated string: outgoing overhead in bytes per second diff --git a/doc/language_issues.pl b/doc/language_issues.pl index fe8b726243ab..b0c066f644a3 100644 --- a/doc/language_issues.pl +++ b/doc/language_issues.pl @@ -917,6 +917,7 @@ WARNING: untranslated string: most preferred WARNING: untranslated string: nameserver WARNING: untranslated string: no data WARNING: untranslated string: no hardware random number generator +WARNING: untranslated string: none WARNING: untranslated string: not a valid dh key WARNING: untranslated string: notice WARNING: untranslated string: openvpn default diff --git a/doc/language_issues.ru b/doc/language_issues.ru index a9e900134b79..f23b103e1642 100644 --- a/doc/language_issues.ru +++ b/doc/language_issues.ru @@ -917,6 +917,7 @@ WARNING: untranslated string: most preferred WARNING: untranslated string: nameserver WARNING: untranslated string: no data WARNING: untranslated string: no hardware random number generator +WARNING: untranslated string: none WARNING: untranslated string: not a valid dh key WARNING: untranslated string: notice WARNING: untranslated string: openvpn default diff --git a/doc/language_issues.tr b/doc/language_issues.tr index d94953a84d93..8ec9e31295ec 100644 --- a/doc/language_issues.tr +++ b/doc/language_issues.tr @@ -684,6 +684,7 @@ WARNING: untranslated string: incoming compression in bytes per second WARNING: untranslated string: incoming overhead in bytes per second WARNING: untranslated string: invalid input for valid till days WARNING: untranslated string: no data +WARNING: untranslated string: none WARNING: untranslated string: outgoing compression in bytes per second WARNING: untranslated string: outgoing overhead in bytes per second WARNING: untranslated string: ovpn add conf diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi index 94900765f523..6458bf251920 100644 --- a/html/cgi-bin/vpnmain.cgi +++ b/html/cgi-bin/vpnmain.cgi @@ -327,7 +327,13 @@ sub writeipsecfiles { if ($lconfighash{$key}[21] && $lconfighash{$key}[22]) { my @encs = split('\|', $lconfighash{$key}[21]); my @ints = split('\|', $lconfighash{$key}[22]); - my @groups = split('\|', $lconfighash{$key}[20]); + my @groups = split('\|', $lconfighash{$key}[23]); + + # Use IKE grouptype if no ESP group type has been selected + # (for backwards compatibility) + if ($lconfighash{$key}[23] eq "") { + @groups = split('\|', $lconfighash{$key}[20]); + } my @algos = &make_algos("esp", \@encs, \@ints, \@groups, ($pfs eq "on")); print CONF "\tesp=" . join(",", @algos); @@ -1260,6 +1266,9 @@ END $cgiparams{'ESP_ENCRYPTION'} = $confighash{$cgiparams{'KEY'}}[21]; $cgiparams{'ESP_INTEGRITY'} = $confighash{$cgiparams{'KEY'}}[22]; $cgiparams{'ESP_GROUPTYPE'} = $confighash{$cgiparams{'KEY'}}[23]; + if ($cgiparams{'ESP_GROUPTYPE'} eq "") { + $cgiparams{'ESP_GROUPTYPE'} = $cgiparams{'IKE_GROUPTYPE'}; + } $cgiparams{'ESP_KEYLIFE'} = $confighash{$cgiparams{'KEY'}}[17]; $cgiparams{'COMPRESSION'} = $confighash{$cgiparams{'KEY'}}[13]; $cgiparams{'ONLY_PROPOSED'} = $confighash{$cgiparams{'KEY'}}[24]; @@ -1855,7 +1864,7 @@ END $cgiparams{'IKE_LIFETIME'} = '3'; #[16]; $cgiparams{'ESP_ENCRYPTION'} = 'aes256gcm128|aes256gcm96|aes256gcm64|aes256|aes192gcm128|aes192gcm96|aes192gcm64|aes192|aes128gcm128|aes128gcm96|aes128gcm64|aes128'; #[21]; $cgiparams{'ESP_INTEGRITY'} = 'sha2_512|sha2_256|sha1'; #[22]; - $cgiparams{'ESP_GROUPTYPE'} = ''; #[23]; + $cgiparams{'ESP_GROUPTYPE'} = '4096|3072|2048|1536|1024'; #[23]; $cgiparams{'ESP_KEYLIFE'} = '1'; #[17]; $cgiparams{'COMPRESSION'} = 'on'; #[13]; $cgiparams{'ONLY_PROPOSED'} = 'off'; #[24]; @@ -2165,13 +2174,17 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) || goto ADVANCED_ERROR; } } - if ($cgiparams{'ESP_GROUPTYPE'} ne '' && - $cgiparams{'ESP_GROUPTYPE'} !~ /^ecp(192|224|256|384|512)(bp)?$/ && - $cgiparams{'ESP_GROUPTYPE'} !~ /^modp(1024|1536|2048|2048s(256|224|160)|3072|4096|6144|8192)$/) { + @temp = split('\|', $cgiparams{'ESP_GROUPTYPE'}); + if ($#temp < 0) { $errormessage = $Lang::tr{'invalid input'}; goto ADVANCED_ERROR; } - + foreach my $val (@temp) { + if ($val !~ /^(e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|1024|1536|2048|2048s256|2048s224|2048s160|3072|4096|6144|8192|none)$/) { + $errormessage = $Lang::tr{'invalid input'}; + goto ADVANCED_ERROR; + } + } if ($cgiparams{'ESP_KEYLIFE'} !~ /^\d+$/) { $errormessage = $Lang::tr{'invalid input for esp keylife'}; goto ADVANCED_ERROR; @@ -2234,6 +2247,9 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) || $cgiparams{'ESP_ENCRYPTION'} = $confighash{$cgiparams{'KEY'}}[21]; $cgiparams{'ESP_INTEGRITY'} = $confighash{$cgiparams{'KEY'}}[22]; $cgiparams{'ESP_GROUPTYPE'} = $confighash{$cgiparams{'KEY'}}[23]; + if ($cgiparams{'ESP_GROUPTYPE'} eq "") { + $cgiparams{'ESP_GROUPTYPE'} = $cgiparams{'IKE_GROUPTYPE'}; + } $cgiparams{'ESP_KEYLIFE'} = $confighash{$cgiparams{'KEY'}}[17]; $cgiparams{'COMPRESSION'} = $confighash{$cgiparams{'KEY'}}[13]; $cgiparams{'ONLY_PROPOSED'} = $confighash{$cgiparams{'KEY'}}[24]; @@ -2323,7 +2339,17 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) || $checked{'ESP_INTEGRITY'}{'aesxcbc'} = ''; @temp = split('\|', $cgiparams{'ESP_INTEGRITY'}); foreach my $key (@temp) {$checked{'ESP_INTEGRITY'}{$key} = "selected='selected'"; } - $checked{'ESP_GROUPTYPE'}{$cgiparams{'ESP_GROUPTYPE'}} = "selected='selected'"; + $checked{'ESP_GROUPTYPE'}{'768'} = ''; + $checked{'ESP_GROUPTYPE'}{'1024'} = ''; + $checked{'ESP_GROUPTYPE'}{'1536'} = ''; + $checked{'ESP_GROUPTYPE'}{'2048'} = ''; + $checked{'ESP_GROUPTYPE'}{'3072'} = ''; + $checked{'ESP_GROUPTYPE'}{'4096'} = ''; + $checked{'ESP_GROUPTYPE'}{'6144'} = ''; + $checked{'ESP_GROUPTYPE'}{'8192'} = ''; + $checked{'ESP_GROUPTYPE'}{'none'} = ''; + @temp = split('\|', $cgiparams{'ESP_GROUPTYPE'}); + foreach my $key (@temp) {$checked{'ESP_GROUPTYPE'}{$key} = "selected='selected'"; } $checked{'COMPRESSION'} = $cgiparams{'COMPRESSION'} eq 'on' ? "checked='checked'" : '' ; $checked{'ONLY_PROPOSED'} = $cgiparams{'ONLY_PROPOSED'} eq 'on' ? "checked='checked'" : '' ; @@ -2484,7 +2510,30 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) || <option value='1024' $checked{'IKE_GROUPTYPE'}{'1024'}>MODP-1024</option> </select> </td> - <td></td> + <td class='boldbase'> + <select name='ESP_GROUPTYPE' multiple='multiple' size='6' style='width: 100%'> + <option value='e521' $checked{'ESP_GROUPTYPE'}{'e521'}>ECP-521 (NIST)</option> + <option value='e512bp' $checked{'ESP_GROUPTYPE'}{'e512bp'}>ECP-512 (Brainpool)</option> + <option value='e384' $checked{'ESP_GROUPTYPE'}{'e384'}>ECP-384 (NIST)</option> + <option value='e384bp' $checked{'ESP_GROUPTYPE'}{'e384bp'}>ECP-384 (Brainpool)</option> + <option value='e256' $checked{'ESP_GROUPTYPE'}{'e256'}>ECP-256 (NIST)</option> + <option value='e256bp' $checked{'ESP_GROUPTYPE'}{'e256bp'}>ECP-256 (Brainpool)</option> + <option value='e224' $checked{'ESP_GROUPTYPE'}{'e224'}>ECP-224 (NIST)</option> + <option value='e224bp' $checked{'ESP_GROUPTYPE'}{'e224bp'}>ECP-224 (Brainpool)</option> + <option value='e192' $checked{'ESP_GROUPTYPE'}{'e192'}>ECP-192 (NIST)</option> + <option value='8192' $checked{'ESP_GROUPTYPE'}{'8192'}>MODP-8192</option> + <option value='6144' $checked{'ESP_GROUPTYPE'}{'6144'}>MODP-6144</option> + <option value='4096' $checked{'ESP_GROUPTYPE'}{'4096'}>MODP-4096</option> + <option value='3072' $checked{'ESP_GROUPTYPE'}{'3072'}>MODP-3072</option> + <option value='2048s256' $checked{'ESP_GROUPTYPE'}{'2048s256'}>MODP-2048/256</option> + <option value='2048s224' $checked{'ESP_GROUPTYPE'}{'2048s224'}>MODP-2048/224</option> + <option value='2048s160' $checked{'ESP_GROUPTYPE'}{'2048s160'}>MODP-2048/160</option> + <option value='2048' $checked{'ESP_GROUPTYPE'}{'2048'}>MODP-2048</option> + <option value='1536' $checked{'ESP_GROUPTYPE'}{'1536'}>MODP-1536</option> + <option value='1024' $checked{'ESP_GROUPTYPE'}{'1024'}>MODP-1024</option> + <option value='none' $checked{'ESP_GROUPTYPE'}{'none'}>- $Lang::tr{'none'} -</option> + </select> + </td> </tr> </tbody> </table> @@ -3029,6 +3078,14 @@ sub make_algos($$$$$) { if (!$is_aead) { push(@algo, $int); } + + if ($grp eq "none") { + # noop + } elsif ($grp =~ m/^e(.*)$/) { + push(@algo, "ecp$1"); + } else { + push(@algo, "modp$grp"); + } } push(@algos, join("-", @algo)); diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 43601c86eb22..19f5fdd1be94 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -1645,6 +1645,7 @@ 'no modem selected' => 'No modem selected', 'no set selected' => 'No set was selected', 'no time limit' => 'unlimited time', +'none' => 'none', 'none found' => 'none found', 'nonetworkname' => 'No Network Name entered', 'noservicename' => 'No Service Name entered', -- 2.1.0

1 1

New OpenVPN feature for additional server and client config
by ummeegge 15 Nov '14

15 Nov '14

Hi all, i wanted to introduce a new OpenVPN feature which makes it possible to integrate some additional user configurations for server.conf but also for client.ovpn. The OpenVPN CGI script creates two new files under /var/ipfire/ovpn/scripts if the server was stopped and the save button was hit. These files can be processed like usual OpenVPN configuration files and will be printed to the configurations after the save button was used. Also, they won´t be changed by an IPFire side update of the ovpnmain.cgi, so the changes on the configurations are consistent and do not be made by modifications over the perl script or manually over the server.conf which disappears at this after changes over the WUI. If someone is interested in this feature, the code and an forum discussion in this topic can be found in here --> https://bugzilla.ipfire.org/show_bug.cgi?id=10577 . The Bugzilla entry contains also all other links. Feedback would be nice. Greetings to all, Erik

3 6

OpenVPN: Added 'valid til (days)' field for N2N.
by ue 14 Nov '14

14 Nov '14

Hi all, i wanted to introduce a possibility to give the N2N connections also the possibility to set an 'Valid til (days)' for the client certificates like it is also managed for Roadwarrior connections. So the WUI delivers now the possibility (under Authentication:) to configure the days of how long a N2N connection should be valid. I added also a check for this entry so it is possible to leave the fields blank (defines OpenSSLs maximum lenght) or to set a number of days. This check will now also be used for Roadwarrior connections. Have leave a note also in the forum --> https://forum.ipfire.org/index.php?topic=11666.0 for a deeper look. Patches are located in here --> http://git.ipfire.org/?p=people/ummeegge/ipfire-2.x.git;a=commit;h=f4fbb935… Greetings, Erik

2 1

Re: Automatic backup of IPFire on an external USB-harddisk
by ue 13 Nov '14

13 Nov '14

Hi all, nice idea Daniel :-) . Should it be outlined that the shell script needs to be made executable (chmod ...) ? May some comments in the shell script can help a little better to find sections where individual data are needed ? Read a little through and have fixed by the way some tags in the symlink section of rsync. Went through again if i can also test it ;-) . Greetings, Erik Am 13.11.2014 um 15:38 schrieb Daniel Weismüller: > Hi Rod > > It would be very cool if you "translate" it from "german english" to "american english". > > - > Daniel > > > Am 12.11.2014 um 23:39 schrieb R. W. Rodolico: >> Daniel, >> >> This looks like a very cool article. I will definitely be trying it in >> the future. >> >> I see a few things in the writing of the English part that would be said >> differently, at least in American English. For example, I would write >> >> "IPFire shall generate an automatic" >> as >> "IPFire can be set up to generate an automatic" >> >> It is just little stuff like that sound sounds a little different, at >> least to an American English speaker. Do you want those changes made? If >> so, I can either send you a list of my suggestions or go in and do it, >> then let you know when I'm done. >> >> NOTE: The article is great. I'm just talking about English grammar the >> way I use it. If you want it left alone, I'm fine with that. The article >> is clear as is. >> >> Rod >> >> On 11/12/2014 05:54 AM, Daniel Weismüller wrote: >>> Hi >>> I've overworked these parts of the wiki. >>> Could someone please review it? >>> >>> http://wiki.ipfire.org/en/optimization/usb-harddisk/start >>> >>> http://wiki.ipfire.org/de/optimization/usb-harddisk/start >>> >>> thx >>> Daniel >>> _______________________________________________ >>> Documentation mailing list >>> Documentation(a)lists.ipfire.org >>> http://lists.ipfire.org/mailman/listinfo/documentation > > _______________________________________________ > Documentation mailing list > Documentation(a)lists.ipfire.org > http://lists.ipfire.org/mailman/listinfo/documentation

1 0

Re: Little question regarding Patches in guzilla
by Michael Tremer 01 Oct '14

01 Oct '14

Hi, On Wed, 2014-10-01 at 16:57 +0200, Jochen Kauz wrote: > Hi Michael, > thanks for the answer. > I submitted the patches as git format-patch, so I think they should be > mergable. And they should not be in any conflict to the license and > coding styles. No, as far as I checked they are fine. > But one point of your list is an unsolvable problem for me: > "* You must use your real name and a valid email address as author." > If this is the requirement to submit a patch, then I will not be able > to submit one. > I always use only my pseudonym JochenKauz in community development, > never my real name. It's my way of privacy, and I try always to use > only this mail address I'm writing from, or the one that I have on our > crew domain. Approximately the same rules as the Linux kernel uses apply here. Check section 12) for some explanation why this is why it is. https://www.kernel.org/doc/Documentation/SubmittingPatches We are able to make exceptions for very trivial changes like spelling fixes as there is no copyright involved. > Best regards > Mario, aka JochenKauz > > 2014-10-01 15:09 GMT+02:00 Michael Tremer <michael.tremer(a)ipfire.org>: > Hi Mario, > > thanks for contributing to our little project :) > > Of course we are always interested in receiving patches and > encourage > people to send us patches that improve IPFire or enhance its > functionality. There are almost no limitations regarding those > patches, > except: > > * They must be sent in in a unified diff format or as a git > pull request > (preferably open a report on the bug tracker so that we can > assign > someone who will take care of merging the patches). > > * You must use your real name and a valid email address as > author. > > * If there is copyright-able code in it, you must specify the > license > under which the code is distributable. We can only accept > patches that > are free software which means that they are under one of the > licenses on > this list or compatible: > http://wiki.ipfire.org/en/legal/licenses > > * Of course they must be clean and respect the coding style. > > Apart from that there are only technical reasons why to accept > or refuse > a patch. Daniel held a nice talk about this topic on the > recent IPFire > Summit which will hopefully be up on YouTube soon. > > Best, > -Michael > > On Tue, 2014-09-30 at 23:17 +0200, Jochen Kauz wrote: > > Hi SIG-VPN, > > I have only a short question. > > I submitted two patches to the bugzilla, which deals with 2 > Problems I > > have seen in vpnmain.cgi. > > What is the chance that this changes can integrated into the > ipfire > > release in the next future? > > I only ask, cause I have to deal with it in the future and > patch again > > if a core release updates this file. So an information would > be good > > only to prepare for future core updates. > > > > > > Best regards > > JochenKauz > > > _______________________________________________ > > SIG-VPN mailing list > > SIG-VPN(a)lists.ipfire.org > > http://lists.ipfire.org/mailman/listinfo/sig-vpn > >

1 0

Little question regarding Patches in guzilla
by Jochen Kauz 01 Oct '14

01 Oct '14

Hi SIG-VPN, I have only a short question. I submitted two patches to the bugzilla, which deals with 2 Problems I have seen in vpnmain.cgi. What is the chance that this changes can integrated into the ipfire release in the next future? I only ask, cause I have to deal with it in the future and patch again if a core release updates this file. So an information would be good only to prepare for future core updates. Best regards JochenKauz

2 1

OpenVPN N2N Serverconfig Managementport
by Daniel Weismüller 09 Aug '12

09 Aug '12

Hi On the webui of the openvpn-n2n configuration is discribed that the server port wil be used as management port by default. But if you don't fill the field then the management don't work. - Daniel -- You need a firewall? Easy to use? Powerful? Modular? For free? www.ipfire.org An Open Source Firewall Solution

2 2

[SIG-VPN] Strongswan 5.0.0
by Michael Tremer 07 Aug '12

07 Aug '12

Hello, as Core Update 61 has now been released, it is time to go on with developments for the next one: I have updated strongswan to version 5.0.0 which finally removes the pluto daemon which was responsible for IKEv1 connections. However, pluto has gotten very old and was created in the beginnings of the IPsec for Linux developments back in freeswan times. charon was introduced by strongswan some time ago when IKEv2 connections got supported. It handles IKEv1 connections as well as IKEv2 connections since strongswan version 5.0.0. What are the benefits for IPFire? As mentioned earlier, pluto is very old and got very hard to maintain. There have been problems with VPNs that terminate at hosts with dynamic IP addresses, so we needed to restart the entire IPsec subsystem in intervals of 5 minutes. This caused some trouble in stability terms. charon handles those dynamic endpoints much better without the need to restart anything. Connections may now be added and removed smoothly and in total there should be much more connection stability. There is also some new code for hybrid IPsec VPNs which can be used with Android 4 and maybe Apple iOS. I have not done any investigation on this topic, because I am not interested, but hopefully somebody else gives it a shot. I have now packaged the changes into a small package which wants to be installed on your system. http://people.ipfire.org/~ms/unsupported/core-upgrade-2.11-strongswan.ipfire It should not require any manual interaction at all. Please install and give me feedback about the connection stability and the interoperability with other (proprietary) implementations. I am looking forward to it. Michael P.S. If you reply to this mail make sure to keep both mailing lists.

3 8

[Development] Strongswan 5.0.0
by Erik K. 07 Aug '12

07 Aug '12

> Hi all, > i have tried that and after a > > [root@ipfire-server ~]# /etc/init.d/ipsec start > Starting strongSwan 5.0.0 IPsec [starter]... > insmod /lib/modules/2.6.32.45-ipfire/kernel/net/key/af_key.ko > insmod /lib/modules/2.6.32.45-ipfire/kernel/net/ipv4/ah4.ko > insmod /lib/modules/2.6.32.45-ipfire/kernel/net/ipv4/esp4.ko > insmod /lib/modules/2.6.32.45-ipfire/kernel/net/xfrm/xfrm_ipcomp.ko > insmod /lib/modules/2.6.32.45-ipfire/kernel/net/ipv4/ipcomp.ko > insmod /lib/modules/2.6.32.45-ipfire/kernel/net/ipv4/tunnel4.ko > insmod /lib/modules/2.6.32.45-ipfire/kernel/net/ipv4/xfrm4_tunnel.ko > insmod /lib/modules/2.6.32.45-ipfire/kernel/net/xfrm/xfrm_user.ko > > there was no output on httpd/error_log > > but my log manager warned me per email with a: > > OSSEC HIDS Notification. > 2012 Aug 07 10:29:16 > > Received From: ipfire-server->/var/log/messages > Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system." > Portion of the log(s): > > Aug 7 10:29:16 ipfire-server charon: 00[LIB] plugin 'padlock': failed to load - padlock_plugin_create returned NULL > > > > --END OF NOTIFICATION > > and a look to /var/log/messages gives me the following back: > > > Aug 7 10:34:28 ipfire-server charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.0.0, Linux 2.6.32.45-ipfire, i686) > Aug 7 10:34:28 ipfire-server charon: 00[LIB] Padlock not found, CPU is GenuineIntel > Aug 7 10:34:28 ipfire-server charon: 00[LIB] plugin 'padlock': failed to load - padlock_plugin_create returned NULL > > Also is there a dev list with changes on this new version especially for the WUI so the documentation can start up more quickly ? > > Greetings > > Erik > > Am 06.08.2012 um 23:11 schrieb Michael Tremer: > >> Please try to manually stop strongswan with the helper tool: >> >> ipsecctrl D >> >> Try to start it again with: >> >> ipsecctrl S >> >> On Mon, 2012-08-06 at 21:48 +0200, Stefan Schantl wrote: >>> Hello Michael, >>> >>> I've tested to stop IPSec from shell which worked without problems. But >>> if I try to disable and stop it from the WUI, by >>> unsing the checkbox the service does a restart and no shutdown. >>> >>> I've looked inside the error_log from the httpd, and found the following >>> lines: >>> >>> [Mon Aug 06 21:42:08 2012] [error] [client 192.168.xxx.xxx] IPSec >>> enabled on orange but orange interface is invalid or not found, referer: >>> https://gate.xxx:444/cgi-bin/vpnmain.cgi >>> [Mon Aug 06 21:42:08 2012] [error] [client 192.168.xxx.xxx] IPSec >>> enabled on blue but blue interface is invalid or not found, referer: >>> https://gate.xxx:444/cgi-bin/vpnmain.cgi >>> [Mon Aug 06 21:42:08 2012] [error] [client 192.168.xxx.xxx] Stopping >>> strongSwan IPsec..., referer: https://gate.xxx:444/cgi-bin/vpnmain.cgi >>> [Mon Aug 06 21:42:12 2012] [error] [client 192.168.xxx.xxx] Starting >>> strongSwan 5.0.0 IPsec [starter]..., referer: >>> https://gate.xxx:444/cgi-bin/vpnmain.cgi >>> [Mon Aug 06 21:42:12 2012] [error] [client 192.168.xxx.xxx] , referer: >>> https://gate.xxx:444/cgi-bin/vpnmain.cgi >>> >>> Why are there entries about an orange and blue network, I don't have one >>> of them...... >>> >>> Do you have any idea about that ? >>> >>> Stefan >>> >>>> On Mon, 2012-08-06 at 17:21 +0200, Stefan Schantl wrote: >>>>> The only bad point, I've to report is, that after the update I can't >>>>> disable IPSec over the WUI anymore - may other testers will report the >>>>> same issue. >>>> What is the exact problem? Did you get an internal server error from the >>>> CGI script? Need a more precise error report. >>>> >>>> Michael >>>> >>>> >>> >>> _______________________________________________ >>> SIG-VPN mailing list >>> SIG-VPN(a)lists.ipfire.org >>> http://lists.ipfire.org/mailman/listinfo/sig-vpn >> >> _______________________________________________ >> Development mailing list >> Development(a)lists.ipfire.org >> http://lists.ipfire.org/mailman/listinfo/development >

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

SIG-VPN