Bug 260713 - net/pipsecd: Deprecate and set expiration date to 2022-01-15
Summary: net/pipsecd: Deprecate and set expiration date to 2022-01-15
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Many People
Assignee: Daniel Engberg
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-12-27 04:48 UTC by Daniel Engberg
Modified: 2022-01-02 22:30 UTC (History)
0 users

See Also:
cy: maintainer-feedback+

Attachments
Patch for pipesecd (442 bytes, patch)
2021-12-27 04:48 UTC, Daniel Engberg 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Daniel Engberg freebsd_committer freebsd_triage 2021-12-27 04:48:43 UTC 
Created attachment 230443 [details]
Patch for pipesecd

Abandonware, current release is from 1999 and uses insecure encryption algorithms

Retire this port as we have better and secure options these days such as n2n, openvpn and wireguard in ports
Comment 1 Cy Schubert freebsd_committer freebsd_triage 2021-12-27 06:54:04 UTC 
None of the listed packages truly support IPsec. OpenVPN, n2n and wireguard do not support IPsec. n2n uses IKE (the authentication part of IPsec only),

FreeBSD base does support IPsec however it is interface agnostic making it more challenging and difficult to configure firewalls with that in mind.
Comment 2 Daniel Engberg freebsd_committer freebsd_triage 2021-12-27 09:48:02 UTC 
True, I was mainly looking for alternatives in terms of VPN/link connectivity.

We do have https://www.freshports.org/security/libreswan/ and https://www.freshports.org/security/strongswan/ if you're looking for IPSec alternatives that are actively maintained and supports secure algorithms.

From what I can tell des/des3 and blowfish are the only ones supported which all are vulnerable to sweet32 ( https://sweet32.info/ ).
Comment 3 Cy Schubert freebsd_committer freebsd_triage 2021-12-28 02:08:22 UTC 
Approved for EXPIRY date 2022-01-15.
Comment 4 commit-hook freebsd_committer freebsd_triage 2022-01-02 22:29:30 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=2f3dbd76967475390c79408ddcdfd0d9a4f688f9

commit 2f3dbd76967475390c79408ddcdfd0d9a4f688f9
Author:     Daniel Engberg <diizzy@FreeBSD.org>
AuthorDate: 2022-01-02 22:25:41 +0000
Commit:     Daniel Engberg <diizzy@FreeBSD.org>
CommitDate: 2022-01-02 22:28:32 +0000

    net/pipsecd: Deprecate and set expiration date to 2022-01-15

    Abandonware, current release is from 1999 and uses insecure encryption
    algorithms.

    PR:             260713
    Approved by:    cy (maintainer)

 net/pipsecd/Makefile | 3 +++
 1 file changed, 3 insertions(+)