make dh group 31 default, support 22-24+31 by DaanHoogland · Pull Request #12764 · apache/cloudstack

DaanHoogland · 2026-03-09T08:56:48Z

Description

This PR...

Fixes: #12505

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
Build/CI
Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

codecov · 2026-03-09T09:05:31Z

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 17.61%. Comparing base (5caf6cd) to head (0ba157c).
⚠️ Report is 17 commits behind head on 4.22.

Files with missing lines	Patch %	Lines
...ls/src/main/java/com/cloud/utils/net/NetUtils.java	0.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff            @@
##               4.22   #12764   +/-   ##
=========================================
  Coverage     17.60%   17.61%           
- Complexity    15659    15663    +4     
=========================================
  Files          5917     5917           
  Lines        531394   531402    +8     
  Branches      64970    64971    +1     
=========================================
+ Hits          93575    93593   +18     
+ Misses       427269   427255   -14     
- Partials      10550    10554    +4

Flag	Coverage Δ
uitests	`3.70% <ø> (-0.01%)`	⬇️
unittests	`18.68% <0.00%> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copilot

Pull request overview

This PR updates Site-to-Site VPN Customer Gateway defaults/options to support additional IKE DH groups (including group 31) and validates them server-side, aligning with newer strongSwan capabilities.

Changes:

Expands server-side IKE/ESP policy DH-group validation to include groups 22–24 and 31.
Extends the UI DH group dropdown to include groups 22–24 and 31, and changes the default DH group to 31.
Updates UI default IKE/ESP algorithm selections (aes256/sha256 defaults).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
utils/src/main/java/com/cloud/utils/net/NetUtils.java	Extends DH-group allowlist for S2S VPN policy validation.
ui/src/views/network/CreateVpnCustomerGateway.vue	Adds DH groups 22–24 and 31 to the dropdown and changes default selections.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

utils/src/main/java/com/cloud/utils/net/NetUtils.java

ui/src/views/network/CreateVpnCustomerGateway.vue

Copilot · 2026-03-09T11:58:45Z

ui/src/views/network/CreateVpnCustomerGateway.vue

+        ikeDh: 'Group 31(curve 25519)',
+        espEncryption: 'aes256',


The default ikeDh is set to a label-like string (Group 31(...) / curve 25519), but the select stores the raw DH token (e.g., curve25519). Initialize form.ikeDh to the raw value and adjust the submit logic accordingly (it currently assumes parentheses parsing for the default), otherwise the default won’t be selected and ikepolicy may be built with an invalid DH group.

ui/src/views/network/CreateVpnCustomerGateway.vue

utils/src/main/java/com/cloud/utils/net/NetUtils.java

NuxRo · 2026-03-09T12:41:09Z

Strongswan 5.9.8 in ACS 4.22 (Debian Bookworm) does seem to support GROUP 31, so I guess it's ok to make it so and also add more options in the Customer Gateway for this and other versions.

This is what I am seeing in the shell, so groups 1, 2, 5 , 14, 15, 16, 17, 18, 22, 23, 24, 31 can be the options, also keeping PR #12193 in mind:

NuxRo

lgtm

DaanHoogland · 2026-03-10T09:49:04Z

@blueorangutan package

blueorangutan · 2026-03-10T09:50:04Z

@DaanHoogland a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

utils/src/test/java/com/cloud/utils/net/NetUtilsTest.java

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-10T10:27:35Z

ui/src/views/network/CreateVpnCustomerGateway.vue

+        'Group 31': 'curve25519'
      },
-      ikeDhGroupInitialValue: 'Group 5(modp1536)',
+      ikeDhGroupInitialValue: 'Group 31(curve25519)',


ikeDhGroupInitialValue is set to a label-like string (Group 31(curve25519)), but the <a-select> for IKE DH uses :value="DHGroups[group]" (e.g. curve25519). This mismatch makes the initial-value comparison in handleSubmit unreliable and contributes to generating invalid ikepolicy values. Set ikeDhGroupInitialValue to the actual option value (e.g. curve25519) or remove the special-casing logic entirely and always append values.ikeDh.

Suggested change

ikeDhGroupInitialValue: 'Group 31(curve25519)',

ikeDhGroupInitialValue: 'curve25519',

blueorangutan · 2026-03-10T11:00:36Z

Packaging result [SF]: ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 17067

abh1sar · 2026-03-10T11:38:49Z

@blueorangutan package

blueorangutan · 2026-03-10T11:38:51Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 17069

abh1sar

Code Looks good.
New algorithms need to be tested that they are working correctly.

make dh group 19 default, support 19-21

598a0c0

boring-cyborg bot added the component:UI label Mar 9, 2026

DaanHoogland requested a review from abh1sar March 9, 2026 08:58

make group 31 default and update group mnenomics

fd9b82a

DaanHoogland linked an issue Mar 9, 2026 that may be closed by this pull request

Increase DH Groups for VR from DH 18 to DH 21 or higher #12505

Open

DaanHoogland changed the title ~~make dh group 19 default, support 19-21~~ make dh group 31 default, support 22-24+31 Mar 9, 2026

DaanHoogland requested a review from Copilot March 9, 2026 11:54

Copilot started reviewing on behalf of DaanHoogland March 9, 2026 11:54 View session

DaanHoogland requested a review from NuxRo March 9, 2026 11:56

Copilot AI reviewed Mar 9, 2026

View reviewed changes

NuxRo approved these changes Mar 9, 2026

View reviewed changes

simple extra test

d83413a

DaanHoogland requested a review from Copilot March 10, 2026 09:47

Copilot AI reviewed Mar 10, 2026

View reviewed changes

utils/src/test/java/com/cloud/utils/net/NetUtilsTest.java Outdated Show resolved Hide resolved

Copilot started reviewing on behalf of DaanHoogland March 10, 2026 09:53 View session

policy update and test

0ba157c

DaanHoogland requested a review from Copilot March 10, 2026 10:23

Copilot started reviewing on behalf of DaanHoogland March 10, 2026 10:23 View session

Copilot AI reviewed Mar 10, 2026

View reviewed changes

abh1sar approved these changes Mar 10, 2026

View reviewed changes

	ikeDhGroupInitialValue: 'Group 31(curve25519)',
	ikeDhGroupInitialValue: 'curve25519',

Conversation

DaanHoogland commented Mar 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Uh oh!

codecov bot commented Mar 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

NuxRo commented Mar 9, 2026 • edited by DaanHoogland Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

NuxRo left a comment

Choose a reason for hiding this comment

Uh oh!

DaanHoogland commented Mar 10, 2026

Uh oh!

blueorangutan commented Mar 10, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

blueorangutan commented Mar 10, 2026

Uh oh!

abh1sar commented Mar 10, 2026

Uh oh!

blueorangutan commented Mar 10, 2026

Uh oh!

abh1sar left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

DaanHoogland commented Mar 9, 2026 •

edited

Loading

codecov bot commented Mar 9, 2026 •

edited

Loading

NuxRo commented Mar 9, 2026 •

edited by DaanHoogland

Loading