From 5fbfd47c8a43d1836d064226f0ffb8ec91406cce Mon Sep 17 00:00:00 2001 From: Nataliia Solomko Date: Thu, 17 Sep 2026 16:25:14 +0300 Subject: ipsec: T9320: Add deprecation warning for IKEv1 key-exchange --- src/conf_mode/vpn_ipsec.py | 43 ++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 42 insertions(+), 1 deletion(-) (limited to 'src') diff --git a/src/conf_mode/vpn_ipsec.py b/src/conf_mode/vpn_ipsec.py index be8eeca13..24220c435 100755 --- a/src/conf_mode/vpn_ipsec.py +++ b/src/conf_mode/vpn_ipsec.py @@ -25,6 +25,7 @@ from ipaddress import ip_address from netaddr import IPNetwork from netaddr import IPRange +from vyos.base import DeprecationWarning from vyos.config import Config from vyos.config import config_dict_merge from vyos.configdep import set_dependents @@ -298,7 +299,47 @@ def verify(ipsec): # need to use a pseudo-random function (PRF) with an authenticated encryption algorithm. # If a hash algorithm is defined then it will be mapped to an equivalent PRF if 'ike_group' in ipsec: - for _, ike_config in ipsec['ike_group'].items(): + # T9320: IKEv1 is deprecated and will be removed in a future StrongSwan + # release. Collect the IKE groups actually bound to a connection so we + # can also warn about groups without an explicit key-exchange: those + # propose IKEv2 when initiating but still accept IKEv1 when acting as a + # responder. + used_ike_groups = set() + + l2tp_ike_group = dict_search('l2tp.ike_group', ipsec) + if l2tp_ike_group: + used_ike_groups.add(l2tp_ike_group) + + for profile_conf in (ipsec.get('profile') or {}).values(): + if 'ike_group' in profile_conf: + used_ike_groups.add(profile_conf['ike_group']) + + for ra_conf in (dict_search('remote_access.connection', ipsec) or {}).values(): + if 'ike_group' in ra_conf: + used_ike_groups.add(ra_conf['ike_group']) + + for peer_conf in (dict_search('site_to_site.peer', ipsec) or {}).values(): + if 'ike_group' in peer_conf: + used_ike_groups.add(peer_conf['ike_group']) + + for ike_name, ike_config in ipsec['ike_group'].items(): + # T9320: warn about the upcoming IKEv1 removal in StrongSwan. + key_exchange = ike_config.get('key_exchange') + if key_exchange == 'ikev1': + # Explicit IKEv1: the connection will stop working once + # StrongSwan removes IKEv1 support. + DeprecationWarning( + f'IKE group "{ike_name}" uses deprecated IKEv1, which will be ' + 'removed in the future. Please migrate this configuration to IKEv2.' + ) + elif key_exchange is None and ike_name in used_ike_groups: + # T9320: without an explicit key-exchange the group still + # accepts incoming IKEv1 connections when acting as a responder. + DeprecationWarning( + f'IKE group "{ike_name}" has no key-exchange set and will still ' + 'accept incoming deprecated IKEv1 connections. IKEv1 will be ' + 'removed in the future; please set key-exchange to IKEv2.' + ) for proposal, proposal_config in ike_config.get('proposal', {}).items(): if 'encryption' in proposal_config and 'prf' not in proposal_config: # list of hash algorithms that cannot be mapped to an equivalent PRF -- cgit v1.2.3