luci-app-libreswan: Add LuCI for Libreswan #5932

jempatel · 2022-08-14T08:57:24Z

A new app for Libreswan IPSec with LuCI Support.

We also need openwrt/packages#19079
We also need openwrt/packages#19233

Screenshots from the new Luci App Libreswan:

Overview:

Globals:

Proposals:

Proposals Edit:

Tunnels:

Tunnels (General):

Tunnels (Authentication):

Tunnels (Interface):

Tunnels (Advanced):

systemcrash · 2022-09-01T13:20:39Z

Looks good, logical. Problems with 0.0.0.0/0 masks - IPv4 only. The GUI assumes that the necessary kernel modules are installed (and loaded). Have you tested in the absence of a (configured for use) crypto module?

It's a start. Handling certs would be a good improvement, but increases complexity, ofc.

jempatel · 2022-09-03T09:54:46Z

Looks good, logical. Problems with 0.0.0.0/0 masks - IPv4 only. The GUI assumes that the necessary kernel modules are installed (and loaded). Have you tested in the absence of a (configured for use) crypto module?

It's a start. Handling certs would be a good improvement, but increases complexity, ofc.

Did not get you with "Problems with 0.0.0.0/0 masks - IPv4 only",

Remote/Local Subnets are allowed with datatype ipaddr, so it should allow ipv4 and ipv6 both.

The GUI assumes that the necessary kernel modules are installed (and loaded).

App is installed with LUCI_DEPENDS libreswan and libreswan has all module dependencies handled, I also have checked other apps, but could not find any app that might be checking for the module is loaded or not, Can you pls point me any reference of what you meant here?

systemcrash · 2022-11-23T00:54:18Z

Just a thought, but given that libreswan and strongswan are virtually identical, can this GUI be dual purpose and used for both? I actually don't know what needs to be done in the package descriptions and/or permissions files, but maybe @jow has a tip here.

lucize · 2022-12-25T21:43:20Z

wanted to test with latest, does it need some updates ?

jempatel · 2023-01-25T10:51:58Z

wanted to test with latest, does it need some updates ?

I have rebased the current branch with the latest master and Its working fine at my end. Can you pls check again?

lucize · 2023-01-27T14:14:24Z

so I used the today master and still the same error on this page, I also cleared the config file and it's the same for me

jempatel · 2023-01-28T17:31:16Z

so I used the today master and still the same error on this page, I also cleared the config file and it's the same for me

I got it, there was actually a syntax error, and the fix is pushed. Weird, It was not reporting in private/incognito mode at my end.

lucize · 2023-01-29T14:14:09Z

great stuff, it works

Sun Jan 29 16:08:44 2023 authpriv.warn pluto[8684]: "forti/1x1" #2: initiator established Child SA using #1; IPsec tunnel [0.0.0.0-255.255.255.255:0-65535 0] -> [0.0.0.0-255.255.255.255:0-65535 0] {ESPinUDP=>0x6b4ab02b <0xf4081b5d xfrm=AES_CBC_256-HMAC_SHA2_256_128 NATD=x.x.x.x:4500 DPD=active}

lucize · 2023-01-29T14:14:33Z

Tested-by: Lucian [email protected]

systemcrash · 2023-02-01T01:30:37Z

applications/luci-app-libreswan/htdocs/luci-static/resources/view/libreswan/tunnels.js

+		o.optional = false;
+
+		o = s.taboption('authentication', form.Value, 'psk', _('Preshare Key'));
+		o.datatype = 'and(string, minlenght(8))'


minlength(8)

systemcrash · 2023-02-01T01:31:02Z

applications/luci-app-libreswan/htdocs/luci-static/resources/view/libreswan/tunnels.js

+
+		o = s.taboption('authentication', form.ListValue, 'authby', _('Auth Method'));
+		o.default = 'secret'
+		o.value('secret', 'Preshare Key');


Preshared Key

Also, please add never and null types. Useful to some.

systemcrash · 2023-02-01T01:32:55Z

applications/luci-app-libreswan/htdocs/luci-static/resources/view/libreswan/proposals.js

+		o.value('sha512', _('SHA512'));
+
+		o = s.taboption('general', form.MultiValue, 'encryption_algorithm', _('Encryption Method'));
+		o.default = '3des';


Please change this default, and mark 3des with a *, and a GUI note explaining it as unsafe.

systemcrash · 2023-02-01T01:33:05Z

applications/luci-app-libreswan/htdocs/luci-static/resources/view/libreswan/proposals.js

+		o = s.taboption('general', form.MultiValue, 'encryption_algorithm', _('Encryption Method'));
+		o.default = '3des';
+		o.value('3des', _('3DES'))
+		o.value('aes', _('AES'))


Mark AES as default.

systemcrash · 2023-02-01T01:33:48Z

applications/luci-app-libreswan/htdocs/luci-static/resources/view/libreswan/proposals.js

+
+		o = s.taboption('general', form.MultiValue, 'hash_algorithm', _('Hash Algorithm'));
+		o.default = 'md5';
+		o.value('md5', _('MD5'));


Mark this hash with a *:
o.value('md5', _('MD5*'));

systemcrash · 2023-02-01T01:34:51Z

applications/luci-app-libreswan/htdocs/luci-static/resources/view/libreswan/proposals.js

+		o = s.taboption('general', form.MultiValue, 'hash_algorithm', _('Hash Algorithm'));
+		o.default = 'md5';
+		o.value('md5', _('MD5'));
+		o.value('sha1', _('SHA1'));


Mark this hash with a *:
o.value('sha1', _('SHA1*'));

Move to a better, more collision resistant hash.

systemcrash · 2023-02-01T01:49:27Z

applications/luci-app-libreswan/htdocs/luci-static/resources/view/libreswan/tunnels.js

+
+		o = s.taboption('advanced', form.Value, 'ikelifetime', _('IKE Life Time'));
+		o.datatype = 'uinteger';
+		o.default = 10800;


Please add multiple values to choose from (and hint in readable text the amount of hours it represents), and permit the user to enter their own values.

If the current libreswan version is >=4.2, then the default is 8h.

I do not think that this should be an unsigned integer...

Suggestions: 1h, 2h, 4h, 8h, 12h, 16, 24h, custom...

systemcrash · 2023-02-01T01:53:00Z

applications/luci-app-libreswan/htdocs/luci-static/resources/view/libreswan/tunnels.js

+		o.modalonly = true;
+		o.optional = false;
+
+		o = s.taboption('authentication', form.Value, 'psk', _('Preshare Key'));


This needs a depends where authentication = secret - future iterations may add other auth methods.

systemcrash · 2023-02-01T01:55:36Z

applications/luci-app-libreswan/htdocs/luci-static/resources/view/libreswan/tunnels.js

+		for (var i = 0; i < netDevs.length; i++) {
+			var addrs = netDevs[i].getIPAddrs();
+			for (var j = 0; j < addrs.length; j++) {
+				var subnet = calculateNetwork(addrs[j].split('/')[0], addrs[j].split('/')[1]);


Have you tested what happens here with an IPv6?

This app version does not support IPv6, getIPAddrs only returns IPv4 addresses.

/** * Query all IPv4 addresses of the logical interface. * * @returns {string[]} * Returns an array of IPv4 addresses in CIDR notation which have been * registered by the protocol handler. The order of the resulting array * follows the order of the addresses in `ubus` runtime information. */ getIPAddrs: function() {

zcracker · 2023-06-05T06:18:38Z

Why can't it be merged, this app is very much needed

sjkhsl · 2023-06-13T06:41:01Z

Error after latest main build

RPCError
RPC call to uci/get failed with ubus code 4: Resource not found
  at ClassConstructor.handleCallReply (https://192.168.79.128/luci-static/resources/rpc.js?v=git-23.156.69953-fa775ee:15:3)

lucize · 2023-10-02T17:18:19Z

tested it today on master and I don't have that issue, all seems to work

systemcrash · 2023-10-20T17:44:52Z

@jempatel can you address my comments, and let me know when you're done.

jempatel · 2023-10-20T17:46:55Z

@jempatel can you address my comments, and let me know when you're done?

Sure, Let me address the comments and test changes.

systemcrash · 2023-10-23T23:50:24Z

Sure, Let me address the comments and test changes.

If you did something, nothing has changed here...

jempatel · 2023-10-24T04:33:08Z

Sure, Let me address the comments and test changes.

If you did something, nothing has changed here...

I've recently rebased the master branches of both luci and packages feeds in order to synchronize all the latest changes. Now I am testing my local changes with fresh firmware build and separate package installation on installed firmware. Once the testing confirms that everything is functioning correctly, I will re-request for review.

jempatel · 2023-10-29T11:12:20Z

This PR depends on
openwrt/packages#19233

jempatel · 2023-10-31T19:20:54Z

Sure, Let me address the comments and test changes.

If you did something, nothing has changed here...

@systemcrash all the comments are addressed and PR in packages is also merged now. If everything is fine, we can merge this as well

systemcrash · 2023-11-02T00:51:42Z

Almost, you have the right values there, but they should be made translation (i18n) friendly.

e.g.

o.value('secret', 'Shared Secret');

should be

o.value('secret', _('Shared Secret'));

systemcrash · 2023-11-02T00:53:59Z

applications/luci-app-libreswan/htdocs/luci-static/resources/view/libreswan/proposals.js

+		o.value('sha384', _('SHA384'));
+		o.value('sha512', _('SHA512'));
+
+		o = s.taboption('general', form.MultiValue, 'encryption_algorithm', _('Encryption Method'));


update to e.g.:

o = s.taboption('general', form.MultiValue, 'encryption_algorithm', _('Encryption Method'), _('* = unsafe'));

systemcrash · 2023-11-02T00:54:31Z

applications/luci-app-libreswan/htdocs/luci-static/resources/view/libreswan/proposals.js

+
+		o = s.taboption('general', form.MultiValue, 'encryption_algorithm', _('Encryption Method'));
+		o.default = 'aes';
+		o.value('3des', _('3DES* [Unsafe]'))


Just 3DES*

With ofc

o = s.taboption('general', form.MultiValue, 'encryption_algorithm', _('Encryption Method'), _('* = unsafe'));

systemcrash · 2023-11-02T01:03:04Z

applications/luci-app-libreswan/htdocs/luci-static/resources/view/libreswan/proposals.js

+		o.value('aes256', _('AES256'));
+		o.value('camellia_cbc', _('CAMELLIA_CBC'));
+
+		o = s.taboption('general', form.MultiValue, 'dh_group', _('DH Group'));


Add comment _('* = unsafe. See <a href="%s">RFC8247</a>.').format('https://www.rfc-editor.org/rfc/rfc8247#section-2.4')

systemcrash · 2023-11-02T01:03:06Z

applications/luci-app-libreswan/htdocs/luci-static/resources/view/libreswan/proposals.js

+		o.value('dh19', _('DH Group 19'));
+		o.value('dh20', _('DH Group 20'));
+		o.value('dh21', _('DH Group 21'));
+		o.value('dh22', _('DH Group 22'));


Mark dh22 as DH Group 22*

systemcrash · 2023-11-02T01:03:22Z

applications/luci-app-libreswan/htdocs/luci-static/resources/view/libreswan/proposals.js

+
+		o = s.taboption('general', form.MultiValue, 'dh_group', _('DH Group'));
+		o.default = 'modp1536';
+		o.value('modp1536', _('DH Group 5'));


Mark with *

with ofc

o = s.taboption('general', form.MultiValue, 'dh_group', _('DH Group'), _('* = unsafe'));

systemcrash · 2023-11-02T01:07:03Z

applications/luci-app-libreswan/htdocs/luci-static/resources/view/libreswan/tunnels.js

+		o.default = '9m';
+		o.value('5m', '5m');
+		o.value('9m', '9m');
+		o.value('15m', '15h');


systemcrash · 2023-11-09T00:24:03Z

@jempatel please fix these most recent additions

jempatel · 2023-11-09T06:41:32Z

@jempatel please fix these most recent additions

Done

systemcrash · 2023-11-09T12:08:22Z

applications/luci-app-libreswan/htdocs/luci-static/resources/view/libreswan/proposals.js

+		o.value('camellia_cbc', _('CAMELLIA_CBC'));
+
+		o = s.taboption('general', form.MultiValue, 'dh_group', _('DH Group'),
+			('* = %s, See <a href="%s">RFC8247</a>.').format(_('Unsafe'), 'https://www.rfc-editor.org/rfc/rfc8247#section-2.4'));


Be sure that translatable sections start with _.

Its already handled inside the format function except string "See"

Perhaps just put See also in with Unsafe, e.g. _('Unsafe, See')

LuCI Support for IPSec VPN (Libreswan) Signed-off-by: Jaymin Patel <[email protected]>

systemcrash · 2023-11-10T11:20:22Z

Ok good. @jow- @hnyman any other reviewers? I'm largely satisfied.

jow- · 2023-11-10T12:02:13Z

I held back merging this as the underlying packages PR were open for a long time, but it seems they finally got merged last week, so let's go ahead! We can still continue polishing this in subsequent PRs if the need arises.

@jempatel - thanks a lot for your effort and patience.

jow- · 2023-11-10T12:17:10Z

Merged via 9f65244

systemcrash · 2023-11-10T14:03:08Z

@jempatel looks like you missed the 15m -> 15h thing I flagged in the review.

jempatel · 2023-11-11T10:56:15Z

@jempatel looks like you missed the 15m -> 15h thing I flagged in the review.

Ahh, Yup I missed that. Looks like someone had already updated and merged that to master.

jempatel mentioned this pull request Aug 14, 2022

libreswan: uci configuration support openwrt/packages#19079

Merged

jempatel force-pushed the luci-app-libreswan branch 3 times, most recently from 1c0359e to 96d1dca Compare August 17, 2022 16:47

jempatel force-pushed the luci-app-libreswan branch 4 times, most recently from f51d3b1 to 4e851a5 Compare August 31, 2022 09:38

jempatel force-pushed the luci-app-libreswan branch from 4e851a5 to fd6c795 Compare October 18, 2022 20:13

jempatel force-pushed the luci-app-libreswan branch from fd6c795 to ade187c Compare November 20, 2022 10:23

jempatel force-pushed the luci-app-libreswan branch from ade187c to fa4f970 Compare January 25, 2023 10:41

jempatel force-pushed the luci-app-libreswan branch from fa4f970 to 064394e Compare January 28, 2023 17:29

jempatel force-pushed the luci-app-libreswan branch from 064394e to 39bee1d Compare January 31, 2023 09:16

systemcrash requested changes Feb 1, 2023

View reviewed changes

zcracker approved these changes May 12, 2023

View reviewed changes

systemcrash mentioned this pull request Sep 12, 2023

luci-app-strongswan-ipsec: add package #6566

Merged

jempatel force-pushed the luci-app-libreswan branch from 5e53eb1 to 64ae849 Compare October 22, 2023 06:40

jempatel force-pushed the luci-app-libreswan branch from 64ae849 to 2a260fa Compare October 29, 2023 10:48

jempatel requested a review from systemcrash October 29, 2023 11:09

systemcrash requested changes Nov 2, 2023

View reviewed changes

jempatel force-pushed the luci-app-libreswan branch from 2a260fa to ce11cc5 Compare November 9, 2023 06:38

jempatel requested a review from systemcrash November 9, 2023 06:41

systemcrash reviewed Nov 9, 2023

View reviewed changes

luci-app-libreswan: Add LuCI for Libreswan

068e9f0

LuCI Support for IPSec VPN (Libreswan) Signed-off-by: Jaymin Patel <[email protected]>

jempatel force-pushed the luci-app-libreswan branch from ce11cc5 to 068e9f0 Compare November 10, 2023 11:17

jempatel requested a review from systemcrash November 10, 2023 11:18

systemcrash approved these changes Nov 10, 2023

View reviewed changes

jow- closed this Nov 10, 2023

systemcrash mentioned this pull request Nov 15, 2023

luci-app-strongswan-swanctl: initial commit #6700

Merged

luci-app-libreswan: Add LuCI for Libreswan #5932

luci-app-libreswan: Add LuCI for Libreswan #5932

Conversation

jempatel commented Aug 14, 2022 • edited Loading

systemcrash commented Sep 1, 2022

jempatel commented Sep 3, 2022

systemcrash commented Nov 23, 2022

lucize commented Dec 25, 2022

jempatel commented Jan 25, 2023

lucize commented Jan 27, 2023

jempatel commented Jan 28, 2023 • edited Loading

lucize commented Jan 29, 2023

lucize commented Jan 29, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jempatel Oct 29, 2023 • edited Loading

Choose a reason for hiding this comment

zcracker commented Jun 5, 2023

sjkhsl commented Jun 13, 2023

lucize commented Oct 2, 2023

systemcrash commented Oct 20, 2023

jempatel commented Oct 20, 2023

systemcrash commented Oct 23, 2023

jempatel commented Oct 24, 2023

jempatel commented Oct 29, 2023

jempatel commented Oct 31, 2023

systemcrash commented Nov 2, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

systemcrash Nov 2, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

systemcrash commented Nov 9, 2023

jempatel commented Nov 9, 2023

Choose a reason for hiding this comment

jempatel Nov 9, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

systemcrash commented Nov 10, 2023

jow- commented Nov 10, 2023

jow- commented Nov 10, 2023

systemcrash commented Nov 10, 2023

jempatel commented Nov 11, 2023

jempatel commented Aug 14, 2022 •

edited

Loading

jempatel commented Jan 28, 2023 •

edited

Loading

jempatel Oct 29, 2023 •

edited

Loading

systemcrash Nov 2, 2023 •

edited

Loading

jempatel Nov 9, 2023 •

edited

Loading