Libreswan Documentation

Logo

Libreswan's Online Documentation

View the Project on GitHub libreswan/libreswan.github.io

Support
FAQ Common Error Messages
History
Implemented Standards
Kernel Support
HOWTO Additional ipsec.conf documentation
AWS Mesh
brendans Road Warrior Setup at Home
Configuration examples
Confuse !?@: github wiki
Enterprise cloud encryption
Entropy matters
EoIP shared ethernet LAN using IPsec
High Availability Fallover VPN in AWS
Host to host VPN
Host to host VPN with PSK
Libreswan as client to a Cisco ASA or VPN3000 server
Microsoft Azure configuration
Migrate from IKEv1 DPD to IKEv2 LIVENESS
Opportunistic IPsec
Opportunistic IPsec using LetsEncrypt
Pluto and DNSSEC
Read status output
Route based VPN
SElinux and Labeled IPsec VPN
Subnet extrusion
Subnet to subnet using NAT
Subnet to subnet VPN
Subnet to subnet VPN with PSK
Unauthenticated Opportunistic IPsec
Using Apache to serve PKCS
Using NSS Hardware Tokens
Using NSS with libreswan
VPN server for remote clients using IKEv2
VPN server for remote clients using IKEv2 split VPN
GSoC 2027 Code Project Ideas DRAFT
Contributor Guidance DRAFT
Completed Projects 2026 RFC 9593 Announcing Supported Authentication Methods in IKEv2
2026 Improve the ACQUIRE to IKE policy lookup
2026 Add HOST TO HOST Support on BSD
2021 RFC 8420 Add EdDSA Signature Authentication Support to IKEv2
2020 Session Resumption
2020 IKEv2 Interop testing with OpenBSD
2020 IKE Intermediate Exchange
2019 Libreswan Opportunistic IPsec using LetsEncrypt
2018 RSA PSS Support in compliance with RFC 7427 and RFC 8247
2018 RFC 7427 Add ECDSA Signature Authentication Support to IKEv2
2018 RFC 5685 Redirect Mechanism
2018 Managing Interface
2017 TCP encapsulation of IKE and IPsec
2017 RFC 7427 Add Signature Authentication Support to IKEv2
2017 Postquantum Preshared Keys
Presentations
IRC
Hacking Documentation
Git, GitHub, and Pull Requests
Merging GitHub Pull Requests
Programming Conventions
Testing Docker
KVM 1. Setup The Host
2. Configure Testing
3. Compile Libreswan
4. Test Libreswan
5. Accessing The Console
6. Maintenance and Internals
Bisecting
Debugging Pluto
Logging In Using SSH
Performance
Running A Custom Kernel
Running A Single Test
Running In The Background
Setup a Web Server
Testing Old Branches
Updating Test Results
Namespace Magic
Namespaces
Topology
Internals 3.14 X509
Benchmarking and Performance testing
Cipher suites and algorithm support
Cloud OE ideas
Compiling with AddressSanitizer
Compliance of RFC 7427 Signature Authentication in IKEv2
Coverity
Cryptographic Acceleration
Developer links strongswan android
Discouraged or forbidden C functions
IKEv2 Child SA
IKEv2 CP and EAP support
Introduction
Libreswan xfrm kernel support
Logging cleanup
New OE
Pluto
Pluto packet processing
Proposed ipsec ca command
Retransmit timings
Road Map
SAref code
Setting up system for debug logging
stf status
Testing 2017 Next Generation
Unbound
Uncrustify
Use Cases and Requirements document for ECC ECDSA support
Use Cases and Requirements document
XFRM Interface Development Notes
XFRM pCPU
XFRM pCPU RSS
Security Crypto boundary and certification
Libreswan and Heartbleed
Libreswan and TunnelCrack
Reporting a Vulnerability
Vulnerabilities
Meetups 2013 Helsinki
2014 San Francisco
2014 Toronto
2018 Toronto
Obsolete HOWTOs IKEv1 XAUTH with FreeOTP and FreeIPA
IKEv1 XAUTH with Google Authenticator One Time Passwords
Route based VPN using VTI
Testing Namespace
VPN server for remote clients using IKEv1 with L2TP
VPN server for remote clients using IKEv1 XAUTH with Certificates
VPN server for remote clients using IKEv1 XAUTH with PSK

Tracking down regressions (using git bisect)

The easy way

This workflow works best when the regression is recent. I.e., the last few commits where nothing significant has happened (for instance, os upgrade, test rename, …).

The command ./kvm install check diff exits with a git bisect friendly status code which means it can be combined with git bisect run to automate regression testing.

For instance, lets say unpushed commits have caused a regression in basic-pluto-01. First set up git bisect:

git bisect start
git bisect bad # tip is bad

Since there are unpushed changes, @{u} or upstream mainline, is a good first guess at a good commit:

git checkout @{u}
./kvm install check diff testing/pluto/basic-pluto-01

Assuming it passes (if it doesn’t time to go further back), mark it good and then let git bisect loose:

git bisect good
git bisect run ./kvm install check diff testing/pluto/basic-pluto-01

git bisect visualize is a good way to monitor progress. Finally, cleanup:

git bisect reset

The hard way

This workflow works best when trying to track down a regression in an older version of libreswan.

Two repo directories are used:

  1. rutdir aka repo-under-test this contains the sources that will be built and installed into the test domains and is what git bisect will manipulate

  2. benchdir aka testbench this contains the test scripts used to drive rutdir

(testing uses this)

Start by checking out the two repositories (existing repositories can also be used, carefully):

git clone https://github.com/libreswan/libreswan.git rutdir
git clone https://github.com/libreswan/libreswan.git benchdir

and then cd to rutdir directory:

cd rutdir

Next, configure benchdir so that it compiles and installs libreswan from rutdir but runs tests from benchdir. Do this by pointing the benchdir KVM_SOURCEDIR (/source) at rutdir vis:

# remember $PWD is rutdir`
echo KVM_SOURCEDIR=$(realpath ../rutdir)            >>../benchdir/Makefile.inc.local
echo KVM_TESTINGDIR=$(realpath ../benchdir/testing) >>../benchdir/Makefile.inc.local

Now, (re-)transmogrify benchdir so that, within the domains, /source points at repo-under-test:

../benchdir/kvm transmogrify

in the command building the Linux domain look for output like:

--filesystem=target=bench,type=mount,accessmode=squash,source=/.../benchdir \
--filesystem=target=source,type=mount,accessmode=squash,source=/.../rutdir \
--filesystem=target=testing,type=mount,accessmode=squash,source=/.../benchdir/testing \

Finally run the tests (remember testing/pluto/basic-pluto-01 is the test that started failing):

# start with the bad commit
git bisect start
git bisect bad
# next checkout and confirm the good commit
# NOTE: run benchdir/kvm from rutdir directory
git checkout <good-commit>
../benchdir/kvm install check diff testing/pluto/basic-pluto-01
git bisect good

if you’re lucky, the test requires no manual intervention and:

git bisect run ../benchdir/kvm install check diff testing/pluto/basic-pluto-01

also works. Finally, cleanup with:

git bisect reset

TODO: figure out how to get ../benchdir/kvm diff to honour $(KVM_TESTINGDIR) so that it can handle a test somewhere other than in the benchdir.