Repository navigation
'keylen' in IPsec is not always an integer #880
Description
Describe the bug
When doing a GET on e.g. /api/v2/vpn/ipsec/phase2s it will throw an error 500:
{
"code": 500,
"status": "internal server error",
"response_id": "INTEGER_FIELD_WITH_NON_INTEGER_INTERNAL_VALUE",
"message": "Cannot parse IntegerField `keylen` from internal because its internal value is not a numeric value. Consider changing this field to a StringField.",
"data": []
}I'm pretty sure this happens when one of the phase2's has the key length set to "auto" :
<encryption-algorithm-option>
<name>aes256gcm</name>
<keylen>auto</keylen>
</encryption-algorithm-option>If I set these to 128 bits for example, the GET will work.
To Reproduce
Steps to reproduce the behavior:
- Configure a VPN with auto key length
- GET /api/v2/vpn/ipsec/phase2s
pfSense Version & Package Version:
- pfSense Version: 25.11.1
- Package Version: 2.7.6
Affected Endpoints:
- URL: /api/v2/vpn/ipsec/phase2s
I assume others that use 'keylen'
Activity
fix(IPsecPhase2Encryption): allow 'auto' keylen to be represented as 0 …
jaredhendrickson13 commentedon May 9, 2026
For the sake of not introducing a breaking change by making this a string field, I've made some changes to allow
0to be specified as thekeylento representauto. When this gets written to the config0will automatically be converted toautoand vice-versa. I'll have it in the next patch.