Feature #4688
open
Missing TFC Traffic Flow Confidentiality support
Added by Lars Pedersen almost 11 years ago.
Updated over 4 years ago.
Description
Got a IPSEC IKEv2 Tunnel up and running where a linux client connects to the pfsense 2.2.2 server. When connecting i got the following message:
received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
From the following RFC of an IPsec implementation, TFC should be implemented.
https://tools.ietf.org/html/rfc4303#page-17
From strongswan doc (ipsec.conf) TFC is defined by:
tfc = <value>
number of bytes to pad ESP payload data to. Traffic Flow Confidentiality is currently supported in IKEv2 and applies to outgoing packets only. The special value %mtu fills up ESP packets with padding to have the size of the MTU.
By looking in freebsd release 10.1 (which is the one pfSense is running) it also looks like TFC should be supported.
https://www.freebsd.org/cgi/man.cgi?query=ipsec.conf&apropos=0&sektion=5&manpath=FreeBSD+Ports+10.1-RELEASE&arch=default&format=html
So it looks like TFC isn't supported in pfSense or the option is just missing in the webConfigurator even though it should be supported.
- Category set to IPsec
- Assignee set to Chris Buechler
- Priority changed from High to Normal
- Target version set to 2.3
this should be a quick add and would be good to support, I'll take it.
- Status changed from New to Feedback
committed, needs testing beyond verifying the ipsec.conf is correct.
- Status changed from Feedback to New
- Assignee deleted (
Chris Buechler)
- Target version deleted (
2.3)
I should have checked if FreeBSD actually had TFC support first. It doesn't, so I commented it out.
The GUI and backend works fine, just a matter of un-commenting it when FreeBSD has support.
Did FreeBSD get TFC support in the last 2 years?
The IPsec stack in FreeBSD was overhauled between FreeBSD 10.x and FreeBSD 11.1, so it's possible that the behavior is different now. Needs someone to try it out and see if it works as expected when configured.
Jim Pingle wrote:
The IPsec stack in FreeBSD was overhauled between FreeBSD 10.x and FreeBSD 11.1, so it's possible that the behavior is different now. Needs someone to try it out and see if it works as expected when configured.
Im still receiving an "received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding" to pfsense 2.4.3 with a linux client using strongswan 5.6.1
Also available in: Atom
PDF
Updated by 
Updated by 
Updated by 
Updated by 
Updated by