Project

General

Profile

Actions

Bug #6263

closed

Encryption options for every P2 on a given P1 are written to each P2 individually inside ipsec.conf with multiple P2 entries + split conn entries

Added by Jim Pingle over 5 years ago. Updated almost 2 years ago.

Status:
Resolved
Priority:
Normal
Category:
IPsec
Target version:
Start date:
04/25/2016
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
All
Affected Architecture:

Description

When multiple Phase 2 entries exist, the encryption options for every P2 inside a given P1 are added to every split connection entries (IKEv1 or IKEv2 with split connections active)

For example, with three P2 entries all set for AES256-GCM-128, ipsec.conf has this in each conn entry:

    esp = aes256gcm128,aes256gcm128,aes256gcm128!

The same identical option is written on each connection.

If different options are used for P2s within the same tunnel, all of them are written to each P2. So each split conn entry contains all possible P2 algorithms for any P2 on the P1, not just the selected algorithm for that specific P2 entry.


Files

pfsense-bug-6263.diff (528 Bytes) pfsense-bug-6263.diff PJ Goodwin, 02/05/2018 05:41 PM
Actions

Also available in: Atom PDF