reyk / openiked

Internet Key Exchange version 2 (IKEv2) daemon - portable version of OpenBSD iked

OpenIKED

This is a development mirror of OpenBSD's iked.

iked is a lean Internet Key Exchange (IKEv2) daemon which performs mutual authentication and which establishes and maintains IPsec VPN flows and security associations (SAs) between the two peers. The IKEv2 protocol is defined in RFC 5996, which combines and updates the previous standards: ISAKMP/Oakley (RFC 2408), IKE (RFC 2409), and the Internet DOI (RFC 2407). iked only supports the IKEv2 protocol; support for ISAKMP/Oakley and IKEv1 is provided by OpenBSD's isakmpd(8) or other implementations on non-OpenBSD platforms.

iked supports mutual authentication using RSA public keys and X.509 certificates, it also support responder/server-side authentication of clients using the EAP-MSCHAPv2 protocol over IKEv2. It interconnects with other IKEv2 implementations like the native IKEv2 implementation of Windows 7 or newer (aka Agile VPN) or strongSwan.

The main development of iked is being done for OpenBSD and the source tree is found in OpenBSD's CVS repository. Like most of the projects from the OpenBSD repository, the original source code does not include any portability glue (#ifdefs) and is specifically developed for OpenBSD.

The main development tree is found in the src/sbin/iked and src/usr.sbin/ikectl directories of the OpenBSD CVS repository:

• http://www.openbsd.org/cgi-bin/cvsweb/src/sbin/iked/
• http://www.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/ikectl/
• See also: http://www.openiked.org/

Supported Platforms

Original version:

• OpenBSD 4.8 or newer

The portable version has been suspended and is not available at present. It previously supported the following platforms:

• Darwin (Apple OS X Mountain Lion 10.8) - DEPRECATED
• Linux (Ubuntu 12.10 GNU/Linux 3.5.0-19-generic) - DEPRECATED
• FreeBSD (FreeBSD 9.0-RELEASE with IPSEC kernel) - DEPRECATED
• NetBSD (NetBSD 6.0 with IPSEC kernel) - DEPRECATED

Authors

• Reyk Floeter [email protected]
• Mike Belopuhov [email protected]

See LICENSE.md for information about copyright and licensing.

Reyk

openiked's Issues

Documentation of config format

There is some parts of the config format that isn't documented, but is used in the examples. More specifically there is a config directive that seams to allow set DHCP/DNS/IP options, and I guess it's related to MODE_CFG.

It would be nice if it was properly documented, as well as additional examples.

user "test" "password123" 

ikev2 "win7" esp \ 
    from 0.0.0.0/0 to 172.16.2.0/24 \ 
    peer 10.0.0.0/8 local 192.168.56.0/24 \ 
    eap "mschap-v2" \ 
    config address 172.16.2.1 \ # This isn't documented
    tag "$name-$id"

the order of keywords matter, which is not documented

I had the ikesa and childsa at a different position, and the configuration file failed to parse. It was not obvious this was due to the order of the "sections".

This fails:

ikev2 test esp
from 10.0.1.0/24 to 10.0.2.0/24
local 1.2.3.4 peer 5.6.7.8
srcid foo dstid bar
ikesa enc aes-256 auth hmac-sha2-256 group esp256
childsa enc aes-128-gcm
psk test
tag FOO

but this works:

ikev2 test esp
from 10.0.1.0/24 to 10.0.2.0/24
local 1.2.3.4 peer 5.6.7.8
ikesa enc aes-256 auth hmac-sha2-256 group esp256
childsa enc aes-128-gcm
srcid foo dstid bar
psk test
tag FOO

The critical bit is the most-significant bit, not the least significant

OpenIKED treats the least significant bit of the reserved field of the generic payload header as the critical bit - this is incorrect according to the RFCs and according to a number of other implementations. Fix would involved defining the critical bit as 0x80 or 0x1 << 7.

aes-128-gcm not a valid transform

Hi there,

I got this strange error on a clean OpenBSD 6.3 GENERIC#490 i386 (iked,v 1.6 2018/01/11)

/etc/iked.conf

ikev2 test \
        esp     from 0.0.0.0/0 to 0.0.0.0/0 peer 172.16.0.1 \
        ikesa enc aes-128-gcm group ecp256 \
        srcid jack \
        dstid 172.16.0.1

/sbin/iked -dvv

/etc/iked.conf: 3: aes-128-gcm not a valid transform
ca exiting, pid 374
control exiting, pid 19575
ikev2 exiting, pid 6367
Segmentation fault (core dumped)

any suggestions?