Bugzilla – Bug 1219037
StrongSwan update breaks modern Vici interface
Last modified: 2024-02-22 11:39:32 UTC
Hello, https://bugzilla.opensuse.org/show_bug.cgi?id=1184144 introduced a change in `strongswan` which masks `strongswan.service`: ``` * Fri Mar 31 2023 - Allow to use stroke aka ipsec interface by default instead of vici aka swanctl interface which is current upstream's default. strongswan.service which enables swanctl interface is masked to stop interfering with the ipsec interface (bsc#1184144) ``` This breaks all existing deployments of StrongSwan using the modern Vici plugin (swanctl.conf)! The Stroke plugin (ipsec.conf) is DEPRECATED. New users should not be forced to use a legacy implementation of the software, and existing users should not be forced to migrate their modern configuration to a legacy one! Please revert this change - please do not ship a masked `strongswan.service`, please do not link the legacy ipsec binary to swanctl, and please generally do not break existing deployments. If I understand the referenced bug report correctly, this was done due to a FIPS concern. If the change is really needed for FIPS compliance, it should only be introduced on FIPS enabled systems. Georg
Hi Georg, I am aware of this vici vs stroke issue with strongswan. When strongswan switched from stroke to vici, updating the strongswan broke the existing deployements as systemd units were renamed etc etc. and I had many many bug reports stating that their systems are not working after strongswan update. Moreover, these issues were propagated to SLE products and yast-vpn module and because of FIPS and other concerns I had to make this change so migration could be smooth. Nevertheless, I understand that for opensuse distributions things should be different as stroke is deprecated now for the latest versions of strongswan. Having said that, strongswan 6.0 is near and it will disable the stroke interface unless explicitly enabled. Currently 6.0 version is in beta stage and it was supposed to be released by the end of 2023, but did't happen. So at this time I'm just waiting for it to get released and then I'll make the required changes. Also, last I checked there were issues with using vici interface on tumbleweed directly (not sure if that's still the case), and thus before enabling it I've to make sure things work correctly.
For now, I'm closing this as wontfix. Thank you!!