please evaluate enabling more plugins to make strongswan more useful

[Christian Ehrhardt ]

Based on a discussion I had related to the zesty merge of latest Strongswan I got this info:

The only (small) problem I have with Strongswan in Xenial is that what's
installed by default doesn't provide enough features to make a good
roadwarrior client compatible with VPN targeting OSX/iOS, Windows and
Android clients.

2 plugins are missing from the default install:

1) eap-mschapv2 is required on the client side to connect to VPN
concentrators configured for Windows 7+ and modern OSX/iOS using IKEv2.
In such scenario, the VPN concentrator identifies itself with a public
key and asks the client to authenticate with MSCHAPv2.

2) xauth-generic is required on the client side to connect to VPN
concentrators configured for Android and older OSX/iOS using IKEv1 and
XAUTH. In such scenario, the VPN concentrator identifies itself with a
public key or a shared secret and asks the client to authenticate with a
XAUTH password.

Currently in Xenial, installing Strongswan only suggests
libcharon-extra-plugins. That seems reasonable since
libcharon-extra-plugins is pretty big on it's own and pulls in
strongswan-tnc-base. Maybe the TNC stuff could be made completely
independent and then making libcharon-extra-plugins a recommends would
be doable?

Definitely worth to look into it, so I opened this bug to track it.

[Christian Ehrhardt  (paelzer)]

Thanks to Simon for bringing that up!

Stored on my personal "I should do" list

[Simon Déziel (sdeziel)]

The eap-mschapv2 and xauth-generic plugins are both provided by libcharon-extra-plugins which is in main.

It seems that you already split the TNC stuff off of libcharon-extra-plugins in https://git.launchpad.net/~paelzer/ubuntu/+source/strongswan/commit/?h=merge-zesty&id=4e1bbd943cb61de280ac9891896b79a549bd910b. So that's a very good start.

[Christian Ehrhardt  (paelzer)]

So to clarify what you'd recommend I try to rephrase:
Since those two plugins are needed for the most common cases they should/could be part of the libstrongswan-standard-plugins which are a recommends.

I'm not sure if that would work dependency wise - but if it works would that meet the need that you are reporting?

[Simon Déziel (sdeziel)]

What I'd like is for someone to install the strongswan package and have
both plugins installed as "recommends" but without the TNC stuff.
Debian/you took care of splitting out the TNC part so that's done
already, thanks.

The 2 plugins are currently in libcharon-extra-plugins [*] so I'd keep
them there but make strongswan-libcharon recommend the package instead
of suggesting it.

If pulling libcharon-extra-plugins is deemed too big I think a new
package named libcharon-standard-plugins would be a good place to ship a
minimal set of plugins.

*: libstrongswan-standard-plugins wouldn't be a good place as the 2
plugins are under the libcharon if you look here:
https://wiki.strongswan.org/projects/strongswan/wiki/PluginList

[Christian Ehrhardt  (paelzer)]

FYI (status update) - I Got to that on merging latest Strongswan, I think it is working pretty well.
The only dependencies left from that are to base charon which makes sense - no cross refs to other plugins. Given that my reviewer agrees that this is a sane change I hope to put it in the zesty release.

[Launchpad Janitor (janitor)]

This bug was fixed in the package strongswan - 5.5.1-1ubuntu2

---------------
strongswan (5.5.1-1ubuntu2) zesty; urgency=medium

  * Update Maintainers which was missed while merging 5.5.1-1.

 -- Christian Ehrhardt <email address hidden> Mon, 19 Dec 2016 16:02:40 +0100