Il 02/11/21 13:15, Petr Pisar ha scritto:
V Tue, Nov 02, 2021 at 09:46:28AM +0000, Mattia Verga via devel
napsal(a):
> I was trying to set up a VPN to my work company network. It seems I need
> to use IPSec XAuth PSK, so I found some guide in internet that says to
> set up a libreswan VPN.
> I'm facing several problems, first of all I'm using Plasma KDE which
> seems to not have a GUI for setup/editing libreswan VPNs. Plasma-nm only
> has support for openswan. I've reported that upstream and downstream. So
> I went setting up the VPN through nmcli: it doesn't work, but that's not
> my point here.
>
> I was wondering how both plasma-nm and nmcli allow to setup an openswan
> VPN since openswan has been retired in Fedora many years ago... it also
> seems to work (well, in some way, since the connection fails) even if
> there's no NM plugin or openswan package installed.
> How is it possible? Does NM bundles some openswan library itself? If so,
> is it updated (latest Fedora openswan build was 8 years ago) or there
> may be any security concern?
>
An explanation is that you mistaken IPsec as a protocol and Openswan as an
implementation of the protocol. There are multiple implementations of IPsec.
E.g. in Fedora we have Strongswan and Libreswan. And NetworkManager plugins
for both of them:
# dnf repoquery --qf '%{name} %{summary}' |grep IPsec
NetworkManager-l2tp NetworkManager VPN plugin for L2TP and L2TP/IPsec
NetworkManager-l2tp-gnome NetworkManager VPN plugin for L2TP and L2TP/IPsec - GNOME
files
NetworkManager-libreswan NetworkManager VPN plug-in for IPsec VPN
ike-scan IKE protocol tool to discover, fingerprint and test IPsec VPN servers
libreswan Internet Key Exchange (IKEv1 and IKEv2) implementation for IPsec
openvswitch-ipsec Open vSwitch IPsec tunneling support
strongswan An OpenSource IPsec-based VPN and TNC solution
So the answer is that nmcli in Fedora does use Openswan. It uses Strongswan or
Libreswan.
-- Petr
mmm, but if I:
$ nmcli conn add type vpn vpn-type openswan
it creates a vpn of vpn-type=org.freedesktop.NetworkManager.openswan,
while if I:
$ nmcli conn add type vpn vpn-type libreswan
it creates a vpn-type=org.freedesktop.NetworkManager.libreswan
Do you mean that both are using the same implementation even if they
seem to point to different plugins?
Mattia