Missing Diffie-Hellman-Groups

[Maxim Korezkij]

The values for the pfs (perfect forward secrecy) when creating an ike or ipsec policy are limited to the Diffie-Hellman-Groups 2,5 and 14.

Strongswan as the default provider supports more than these 3 groups, e.g. group20(ecp384).

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/neutron-vpnaas/+/802714

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Maxim Korezkij <email address hidden>" on branch: master
Review: https://review.opendev.org/c/openstack/neutron-vpnaas/+/802714
Reason: Abandon because no time. Feel free to reopen.

[Enrico Kern (flyersa)]

Can we finally implement this patch? Those groups are outdated since years. Clients request to support higher DH groups. Patch is also there, why not implement it?

[Jeremy Stanley (fungi)]

Note that you've changed the information type of this bug to Public Security, indicating it represents a possible security vulnerability. Since the OpenStack Vulnerability Management Team (VMT) does not officially oversee[*] the neutron-vpnaas deliverable, I'm adding a security advisory task with a Won't Fix status to indicate we're not tracking this for any future advisory publication.

[*] https://security.openstack.org/repos-overseen.html

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/neutron-lib/+/898828

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/neutron-vpnaas/+/898830

[Bodo Petermann (bpetermann)]

The patches above add not only the DH groups 15 to 31 but also more choices for encryption algorithm (to support AES CCM and AES GCM modes) and auth algorithms (to support aes-xcbc and aes-cmac).

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/neutron-lib/+/898828
Committed: https://opendev.org/openstack/neutron-lib/commit/b7598dab47d3648bf1bb28eae8c8ed8006097f5a
Submitter: "Zuul (22348)"
Branch: master

commit b7598dab47d3648bf1bb28eae8c8ed8006097f5a
Author: Bodo Petermann <email address hidden>
Date: Wed Oct 18 13:50:58 2023 +0200

    vpnaas: add support for more ciphers (auth, encryption, pfs modes)

    Encryption algorithms: add AES CCM mode and AES GCM mode variants
    for 128/192/256 bit keys and 8/12/16 octet ICVs.
    Auth algorithms: add aes-xcbc and aes-cmac.
    PFS: add Diffie Hellman groups 15 to 31.

    Related-Bug: #1938284
    Change-Id: Iba86fe9a1bbf88223b57a45fb89349c6b1858015

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/2023.1
Review: https://review.opendev.org/c/openstack/neutron-lib/+/903551

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/2023.2
Review: https://review.opendev.org/c/openstack/neutron-lib/+/903552

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/neutron-lib/+/903971

[Bodo Petermann (bpetermann)]

The neutron-lib part for the API definition for most added choices has been merged already. But the neutron-vpnaas change that implements them has not. I also noticed that the neutron-lib part missed the definition for AES CTR mode, so there's a new commit to add that too.

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Rodolfo Alonso <email address hidden>" on branch: stable/2023.2
Review: https://review.opendev.org/c/openstack/neutron-lib/+/903552
Reason: As commented in https://review.opendev.org/c/openstack/neutron-lib/+/903552/comment/a4b99a01_466b834a/, an API change cannot be backported

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Rodolfo Alonso <email address hidden>" on branch: stable/2023.1
Review: https://review.opendev.org/c/openstack/neutron-lib/+/903551
Reason: As commented in https://review.opendev.org/c/openstack/neutron-lib/+/903551/comments/5c42cb15_a3ec30b5, an API change cannot be backported.