Project

General

Profile

Issue #3371

Site-to-Site Strongswan as Client behind NAT

Added by Leon Brans 8 months ago. Updated about 1 month ago.

Status:
Closed
Priority:
Normal
Category:
configuration
Affected version:
5.6.3
Resolution:
No change required

Description

Hi @ll,
i'm new to this community because i have some problems with my TP-Link AC1750 OpenWRT 18.06 Setup with strongswan-full.

I have a Sophos Headquarter with IKEv2 and a static PublicIP IPv4.
In the Homeoffice I'm using a FritzBox for personal Homeuse with a dynamic IPv4 --> Behind the FritzBox i have the OpenWRT Router (all traffic is routed from FritzBox to it).

I think i have some config issue in ipsec.conf

/etc/ipsec.conf

# Add connections here.
conn sophos
        ikelifetime=36000s
        keylife=8h
        rekeymargin=3m
        keyingtries=5
        mobike=no

  # This server
  left=0.0.0.0/0
  leftid=fritzbox.dyndns.org
  # The network behind this server
  leftsourceip=10.0.2.1
  leftsubnet=10.0.2.0/24
  # The remote Sophos
  right=sophosip
  rightid=sophosip
  #The network behind remote Sophos
  rightsubnet=172.28.0.0/16
  #Connection parameters
  keyexchange=ikev2
  authby=secret
  ike=aes256-sha1-modp1024,aes128-sha1-modp1024,3des-sha1-modp1024! 
  esp=aes256-sha256,aes256-sha1,3des-sha1!
  dpddelay=30
  dpdtimeout=120
  dpdaction=restart
  auto=start

/etc/ipsec.secret

sophospublicip : PSK "myPSK" 

/etc/strongswan.conf
# strongswan.conf - strongSwan configuration file
#
# Refer to the strongswan.conf(5) manpage for details
#
# Configuration changes should be made in the included files

charon {
    load = random nonce aes gmp sha1 sha2 curve25519 hmac stroke kernel-netlink socket-default updown
        install_routes = 0
    load_modular = yes
    plugins {
        include strongswan.d/charon/*.conf
    }
}

include strongswan.d/*.conf

Now this is the log of the openwrt

Fri Mar 13 22:31:45 2020 daemon.info : 06[CFG] received stroke: add connection 'sophos'
Fri Mar 13 22:31:45 2020 daemon.info : 06[CFG] left nor right host is our side, assuming left=local
Fri Mar 13 22:31:45 2020 daemon.info : 06[CFG] added configuration 'sophos'
Fri Mar 13 22:31:45 2020 daemon.info : 08[CFG] received stroke: initiate 'sophos'
Fri Mar 13 22:31:45 2020 daemon.info : 08[IKE] initiating IKE_SA sophos[1] to sophosip
Fri Mar 13 22:31:45 2020 authpriv.info : 08[IKE] initiating IKE_SA sophos[1] to sophosip
Fri Mar 13 22:31:45 2020 daemon.info : 08[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Fri Mar 13 22:31:45 2020 daemon.info : 08[NET] sending packet: from 172.17.4.59[500] to sophosip[500] (420 bytes)
Fri Mar 13 22:31:45 2020 daemon.info : 10[NET] received packet: from sophosip[500] to 172.17.4.59[500] (36 bytes)
Fri Mar 13 22:31:45 2020 daemon.info : 10[ENC] parsed IKE_SA_INIT response 0 [ N(NO_PROP) ]
Fri Mar 13 22:31:45 2020 daemon.info : 10[IKE] received NO_PROPOSAL_CHOSEN notify error

And this is the log of Sophos:

2020-03-13 23:31:45 11[NET] <68> received packet: from 91.17.YYY.XXX[500] to SophosIP[500] (420 bytes)                                                    
2020-03-13 23:31:45 11[ENC] <68> parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP)N(HASH_ALG) N(REDIR_SUP) ]                       
2020-03-13 23:31:45 11[IKE] <68> no IKE config found for SophosIP...91.17.YYY.XXX, sending NO_PROPOSAL_CHOSEN                                             
2020-03-13 23:31:45 11[ENC] <68> generating IKE_SA_INIT response 0 [ N(NO_PROP)]                                                                               
2020-03-13 23:31:45 11[NET] <68> sending packet: from SophosIP[500] to 91.17.YYY.XXX[500] (36 bytes)

History

#1 Updated by Leon Brans 8 months ago

Hi @ll,
at this moment i got my configuration running, but without the correct routing. I think theres now a missconfiguration in right&leftsourceip

# Add connections here.
conn sophos
        ikelifetime=36000s
        keylife=8h
        rekeymargin=3m
        keyingtries=5
        mobike=no
        keyexchange=ikev2

  # This server 
  left=0.0.0.0/0
  leftid=openwrt
  leftsourceip=10.0.2.1
  leftsubnet=10.0.2.0/24

  # The remote Sophos
  #rightauth=psk
  right=sophospublicip
  rightid=sophospublicip
  rightsubnet=172.28.0.0/16
  rightsourceip=172.28.0.254

  #Connection parameters
  authby=secret
  #eap_identity=
  ike=aes256-sha256-modp2048 
  esp=aes256-sha256-modp2048
  dpddelay=30
  dpdtimeout=120
  dpdaction=restart
  auto=start

openwrt log

Sun Mar 15 09:25:27 2020 authpriv.info ipsec_starter[8784]: Starting strongSwan 5.6.3 IPsec [starter]...
Sun Mar 15 09:25:27 2020 authpriv.info ipsec_starter[8784]: !! Your strongswan.conf contains manual plugin load options for charon.
Sun Mar 15 09:25:27 2020 authpriv.info ipsec_starter[8784]: !! This is recommended for experts only, see
Sun Mar 15 09:25:27 2020 authpriv.info ipsec_starter[8784]: !! http://wiki.strongswan.org/projects/strongswan/wiki/PluginLoad
Sun Mar 15 09:25:27 2020 daemon.err modprobe: ah4 is already loaded
Sun Mar 15 09:25:27 2020 daemon.err modprobe: esp4 is already loaded
Sun Mar 15 09:25:27 2020 daemon.err modprobe: ipcomp is already loaded
Sun Mar 15 09:25:27 2020 daemon.err modprobe: xfrm4_tunnel is already loaded
Sun Mar 15 09:25:27 2020 daemon.err modprobe: xfrm_user is already loaded
Sun Mar 15 09:25:27 2020 daemon.info : 00[DMN] Starting IKE charon daemon (strongSwan 5.6.3, Linux 4.9.152, mips)
Sun Mar 15 09:25:31 2020 daemon.info : 00[LIB] curl SSL backend 'mbedTLS/2.16.3' not supported, https:// disabled
Sun Mar 15 09:25:31 2020 daemon.info : 00[CFG] disabling load-tester plugin, not configured
Sun Mar 15 09:25:31 2020 daemon.info : 00[LIB] plugin 'load-tester': failed to load - load_tester_plugin_create returned NULL
Sun Mar 15 09:25:31 2020 daemon.info : 00[CFG] PKCS11 module '<name>' lacks library path
Sun Mar 15 09:25:31 2020 daemon.info : 00[LIB] plugin 'uci' failed to load: Error relocating /usr/lib/ipsec/plugins/libstrongswan-uci.so: uci_lookup: symbol not found
Sun Mar 15 09:25:31 2020 daemon.info : 00[CFG] attr-sql plugin: database URI not set
Sun Mar 15 09:25:31 2020 daemon.info : 00[CFG] coupling file path unspecified
Sun Mar 15 09:25:31 2020 daemon.info : 00[CFG] loaded 0 RADIUS server configurations
Sun Mar 15 09:25:31 2020 daemon.info : 00[NET] using forecast interface br-lan
Sun Mar 15 09:25:31 2020 daemon.info : 00[CFG] joining forecast multicast groups: 224.0.0.1,224.0.0.22,224.0.0.251,224.0.0.252,239.255.255.250
Sun Mar 15 09:25:31 2020 daemon.info : 00[CFG] HA config misses local/remote address
Sun Mar 15 09:25:31 2020 daemon.info : 00[CFG] sql plugin: database URI not set
Sun Mar 15 09:25:31 2020 daemon.info : 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'
Sun Mar 15 09:25:31 2020 daemon.info : 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'
Sun Mar 15 09:25:31 2020 daemon.info : 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'
Sun Mar 15 09:25:31 2020 daemon.info : 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'
Sun Mar 15 09:25:31 2020 daemon.info : 00[CFG] loading crls from '/etc/ipsec.d/crls'
Sun Mar 15 09:25:31 2020 daemon.info : 00[CFG] loading secrets from '/etc/ipsec.secrets'
Sun Mar 15 09:25:31 2020 daemon.info : 00[CFG]   loaded IKE secret for SOP.HOS.IPX.XXX
Sun Mar 15 09:25:31 2020 daemon.info : 00[LIB] loaded plugins: charon addrblock af-alg agent attr blowfish ccm cmac connmark constraints ctr curl des dhcp dnskey duplicheck eap-identity eap-md5 eap-mschapv2 eap-radius eap-tls farp fips-prf forecast gcm gcrypt ldap led md4 md5 mysql openssl pem pgp pkcs1 pkcs11 pkcs12 pkcs7 pkcs8 pubkey random rc2 resolve revocation smp sqlite sshkey test-vectors unity vici whitelist x509 xauth-eap xauth-generic xcbc nonce aes gmp sha1 sha2 curve25519 hmac stroke kernel-netlink socket-default updown
Sun Mar 15 09:25:31 2020 daemon.info : 00[JOB] spawning 16 worker threads
Sun Mar 15 09:25:31 2020 authpriv.info ipsec_starter[8792]: charon (8793) started after 4320 ms
Sun Mar 15 09:25:31 2020 daemon.info : 06[CFG] received stroke: add connection 'sophos'
Sun Mar 15 09:25:31 2020 daemon.info : 06[CFG] left nor right host is our side, assuming left=local
Sun Mar 15 09:25:31 2020 daemon.info : 06[CFG] 'sophos' has both left- and rightsourceip, but IKE can negotiate one virtual IP only, ignoring local virtual IP
Sun Mar 15 09:25:31 2020 daemon.info : 06[CFG] added configuration 'sophos'
Sun Mar 15 09:25:31 2020 daemon.info : 08[CFG] received stroke: initiate 'sophos'
Sun Mar 15 09:25:31 2020 daemon.info : 08[IKE] initiating IKE_SA sophos[1] to SOP.HOS.IPX.XXX
Sun Mar 15 09:25:31 2020 authpriv.info : 08[IKE] initiating IKE_SA sophos[1] to SOP.HOS.IPX.XXX
Sun Mar 15 09:25:32 2020 daemon.info : 08[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Sun Mar 15 09:25:32 2020 daemon.info : 08[NET] sending packet: from 172.17.10.230[500] to SOP.HOS.IPX.XXX[500] (464 bytes)
Sun Mar 15 09:25:32 2020 daemon.info : 12[NET] received packet: from SOP.HOS.IPX.XXX[500] to 172.17.10.230[500] (466 bytes)
Sun Mar 15 09:25:32 2020 daemon.info : 12[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(MULT_AUTH) ]
Sun Mar 15 09:25:33 2020 daemon.info : 12[IKE] local host is behind NAT, sending keep alives
Sun Mar 15 09:25:33 2020 daemon.info : 12[IKE] authentication of 'openwrt' (myself) with pre-shared key
Sun Mar 15 09:25:33 2020 daemon.info : 12[IKE] establishing CHILD_SA sophos{1}
Sun Mar 15 09:25:33 2020 authpriv.info : 12[IKE] establishing CHILD_SA sophos{1}
Sun Mar 15 09:25:33 2020 daemon.info : 12[ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
Sun Mar 15 09:25:33 2020 daemon.info : 12[NET] sending packet: from 172.17.10.230[4500] to SOP.HOS.IPX.XXX[4500] (256 bytes)
Sun Mar 15 09:25:33 2020 daemon.info : 14[NET] received packet: from SOP.HOS.IPX.XXX[4500] to 172.17.10.230[4500] (224 bytes)
Sun Mar 15 09:25:33 2020 daemon.info : 14[ENC] parsed IKE_AUTH response 1 [ IDr AUTH SA TSi TSr ]
Sun Mar 15 09:25:33 2020 daemon.info : 14[IKE] authentication of 'SOP.HOS.IPX.XXX' with pre-shared key successful
Sun Mar 15 09:25:33 2020 daemon.info : 14[IKE] IKE_SA sophos[1] established between 172.17.10.230[openwrt]...SOP.HOS.IPX.XXX[SOP.HOS.IPX.XXX]
Sun Mar 15 09:25:33 2020 authpriv.info : 14[IKE] IKE_SA sophos[1] established between 172.17.10.230[openwrt]...SOP.HOS.IPX.XXX[SOP.HOS.IPX.XXX]
Sun Mar 15 09:25:33 2020 daemon.info : 14[IKE] scheduling reauthentication in 35712s
Sun Mar 15 09:25:33 2020 daemon.info : 14[IKE] maximum IKE_SA lifetime 35892s
Sun Mar 15 09:25:33 2020 daemon.info : 14[IKE] CHILD_SA sophos{1} established with SPIs c6484b3a_i c9c31789_o and TS 10.0.2.0/24 === 172.28.0.0/16
Sun Mar 15 09:25:33 2020 authpriv.info : 14[IKE] CHILD_SA sophos{1} established with SPIs c6484b3a_i c9c31789_o and TS 10.0.2.0/24 === 172.28.0.0/16

Sophos log

2020-03-15 10:25:32 19[ENC] <97> parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]                       
2020-03-15 10:25:32 19[IKE] <97> FritzBoxPublicIP is initiating an IKE_SA          
2020-03-15 10:25:32 19[IKE] <97> remote host is behind NAT                      
2020-03-15 10:25:32 19[ENC] <97> generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(MULT_AUTH) ]                  
2020-03-15 10:25:32 19[NET] <97> sending packet: from SOP.HOS.IPX.XXX[500] to FritzBoxPublicIP[500] (466 bytes)                                                     
2020-03-15 10:25:33 18[NET] <97> received packet: from FritzBoxPublicIP[4500] to SOP.HOS.IPX.XXX[4500] (256 bytes)                                                  
2020-03-15 10:25:33 18[ENC] <97> parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT)              
2020-03-15 10:25:33 18[CFG] <97> looking for peer configs matching SOP.HOS.IPX.XXX[SOP.HOS.IPX.XXX]...FritzBoxPublicIP[openwrt]                                      
2020-03-15 10:25:33 18[CFG] <HO2-1|97> selected peer config 'HO2-1'             
2020-03-15 10:25:33 18[IKE] <HO2-1|97> authentication of 'openwrt' with pre-shared key successful                                                               
2020-03-15 10:25:33 18[IKE] <HO2-1|97> authentication of 'SOP.HOS.IPX.XXX' (myself) with pre-shared key                                                          
2020-03-15 10:25:33 18[IKE] <HO2-1|97> IKE_SA HO2-1[97] established between SOP.HOS.IPX.XXX[SOP.HOS.IPX.XXX]...FritzBoxPublicIP[openwrt]                             
2020-03-15 10:25:33 18[IKE] <HO2-1|97> scheduling rekeying in 28290s            
2020-03-15 10:25:33 18[IKE] <HO2-1|97> maximum IKE_SA lifetime 28650s           
2020-03-15 10:25:33 18[IKE] <HO2-1|97> CHILD_SA HO2-1{4} established with SPIs c9c31789_i c6484b3a_o and TS 172.28.0.0/16 === 10.0.2.0/24                       
2020-03-15 10:25:33 18[APP] <HO2-1|97> [SSO] (sso_invoke_once) SSO is disabled. 
2020-03-15 10:25:33 18[APP] <HO2-1|97> [COP-UPDOWN] (ref_counting) ref_count: 0 to 1 ++ up ++ (172.28.0.0/16#10.0.2.0/24)                                       
2020-03-15 10:25:33 18[APP] <HO2-1|97> [COP-UPDOWN] (ref_counting_remote) ref_count_remote: 0 to 1 ++ up ++ (SOP.HOS.IPX.XXX#FritzBoxPublicIP)                      
2020-03-15 10:25:33 18[APP] <HO2-1|97> [COP-UPDOWN] (cop_updown_invoke_once) UID: 97 Net: Local SOP.HOS.IPX.XXX Remote FritzBoxPublicIP Connection: HO2 Fullname: HO2-1                                                                             
2020-03-15 10:25:33 18[APP] <HO2-1|97> [COP-UPDOWN] (cop_updown_invoke_once) Tunnel: User '' Peer-IP '' my-IP '' up-client                                      
2020-03-15 10:25:33 18[ENC] <HO2-1|97> generating IKE_AUTH response 1 [ IDr AUTH SA TSi TSr ]                                                                   
2020-03-15 10:25:33 18[NET] <HO2-1|97> sending packet: from SOP.HOS.IPX.XXX[4500] to FritzBoxPublicIP[4500] (224 bytes)                                             
2020-03-15 10:25:33 21[APP] [COP-UPDOWN][DB] (db_conn_info) hostname: 'HO2' result --> id: '1', mode: 'ntn', tunnel_type: '0', subnet_family:'0'                
2020-03-15 10:25:33 21[APP] [COP-UPDOWN] (do_cop_updown_invoke_once) ---- exec remote updown ++ up ++                                                           
2020-03-15 10:25:33 21[APP] [COP-UPDOWN][SHELL] (run_shell) '/bin/service fwm:vpn_gateway_chains -t json -s nosync -b '{"local_server":"SOP.HOS.IPX.XXX","remote_server":"FritzBoxPublicIP","action":"enable","family":"0","conntype":"ntn","compress":"0"}'': success 0                                                            
2020-03-15 10:25:33 21[APP] [COP-UPDOWN] (do_cop_updown_invoke_once) ---- exec subnet updown ++ up ++                                                           
2020-03-15 10:25:33 21[APP] [COP-UPDOWN] (do_cop_updown_invoke_once) [NTN] NTN get actual...                                                                   
2020-03-15 10:25:33 21[APP] [COP-UPDOWN][DB] (db_query) No data retrieved from query: 'SELECT ( nath.netid  || '/' || nath.netmask ) 
AS natedlan FROM   tblvpnconnhostrel AS rel JOIN tblhost AS h        
ON h.hostid = rel.hostid  JOIN tblhost AS nath ON rel.natedhost = nath.hostid WHERE  rel.connectionid = $1 AND rel.hostlocation = 'L'  
AND h.netid = $2        AND h.netmask = $3 LIMIT  1;' status: 2 rows:0                                                                              
2020-03-15 10:25:33 21[APP]                                                     
2020-03-15 10:25:33 21[APP] [COP-UPDOWN] (do_cop_updown_invoke_once) [IPSEC0] using ipsec dummy interface 'ipsec0'                                              
2020-03-15 10:25:33 21[APP] [COP-UPDOWN][NET] (get_src_ip) source address for 172.28.0.0 is IP: 172.28.0.254                                                    
2020-03-15 10:25:33 21[APP]                                                     
2020-03-15 10:25:33 21[APP] [COP-UPDOWN][SHELL] (run_shell) 'ip route add 10.0.2.0/24 dev ipsec0 src 172.28.0.254 table 220': success 0                         
2020-03-15 10:25:33 21[APP] [COP-UPDOWN] (add_routes) no routes to add for HO2 on interface ipsec0                                                              
2020-03-15 10:25:33 21[APP] [COP-UPDOWN][SHELL] (run_shell) 'ip route flush cache': success 0                                                                   
2020-03-15 10:25:33 21[APP] [COP-UPDOWN][SHELL] (run_shell) 'ip route flush cache': success 0                                                                   
2020-03-15 10:25:33 21[APP] [COP-UPDOWN][SHELL] (run_shell) '/bin/service fwm:vpn_connection_chains -t json -s nosync -b '{"me":"SOP.HOS.IPX.XXX","peer":"FritzBoxPublicIP",
"mynet":"172.28.0.0/16","peernet":"10.0.2.0/24","connop":"1","iface":"Port8_ppp","myproto":"0","myport":"0","peerproto":"0","peerport":"0","conntype":"ntn","actnet":"",
"compress":"0","conn_id":"1"}'': success 0                      
2020-03-15 10:25:33 21[APP] [COP-UPDOWN][SHELL] (run_shell) 'conntrack -D --not-protonum=6 --inzone-outzone=2': success 0                                       
2020-03-15 10:25:33 21[APP] [COP-UPDOWN][SHELL] (run_shell) 'conntrack -D --not-protonum=6 --inzone-outzone=5': error returned 1                                
2020-03-15 10:25:33 21[APP] [COP-UPDOWN][SHELL] (run_shell) 'conntrack -D --protonum=50': error returned 1                                                      
2020-03-15 10:26:03 07[IKE] <HO2-1|97> sending DPD request                      
2020-03-15 10:26:03 07[ENC] <HO2-1|97> generating INFORMATIONAL request 0 [ ]   
2020-03-15 10:26:03 07[NET] <HO2-1|97> sending packet: from SOP.HOS.IPX.XXX[4500] to FritzBoxPublicIP[4500] (80 bytes)                                              
2020-03-15 10:26:03 17[NET] <HO2-1|97> received packet: from FritzBoxPublicIP[4500] to SOP.HOS.IPX.XXX[4500] (80 bytes)                                             
2020-03-15 10:26:03 17[ENC] <HO2-1|97> parsed INFORMATIONAL request 2 [ ]       
2020-03-15 10:26:03 17[ENC] <HO2-1|97> generating INFORMATIONAL response 2 [ ]  
2020-03-15 10:26:03 17[NET] <HO2-1|97> sending packet: from SOP.HOS.IPX.XXX[4500] to FritzBoxPublicIP[4500] (80 bytes)                                              
2020-03-15 10:26:03 11[NET] <HO2-1|97> received packet: from FritzBoxPublicIP[4500] to SOP.HOS.IPX.XXX[4500] (80 bytes)                                             
2020-03-15 10:26:03 11[ENC] <HO2-1|97> parsed INFORMATIONAL response 0 [ ] 

#2 Updated by Tobias Brunner 8 months ago

  • Category changed from network / firewall to configuration
  • Status changed from New to Feedback
leftsourceip=10.0.2.1
leftsubnet=10.0.2.0/24

No.

rightsubnet=172.28.0.0/16
rightsourceip=172.28.0.254

And no.

Please read VirtualIP and maybe ForwardingAndSplitTunneling and perhaps IntroductionTostrongSwan.

#3 Updated by Leon Brans 8 months ago

Tobias Brunner wrote:

[...]

No.

[...]

And no.

Please read VirtualIP and maybe ForwardingAndSplitTunneling and perhaps IntroductionTostrongSwan.

Hi Thanks for your answer,
i already read the article VirtualIP, Problem is that the Sophos doesnt create a virtual IP so requesting IP fails.

I wonder that the Tunnel comes up but no traffic is going through...

i also disabled firewall on Openwrt

#4 Updated by Tobias Brunner 8 months ago

i already read the article VirtualIP

Then you obviously didn't do that thoroughly, as what you configured goes against what's advised there.

Problem is that the Sophos doesnt create a virtual IP so requesting IP fails.

Then don't configure left|rightsourceip at all, as described on said wiki page.

#5 Updated by Tobias Brunner about 1 month ago

  • Status changed from Feedback to Closed
  • Assignee set to Tobias Brunner
  • Resolution set to No change required

Also available in: Atom PDF