Merge pull request #924 from sarthurdev/ipsec_l2tp_pki

pki: ipsec: l2tp: T2816: T3642: Move IPSec/L2TP code into vpn_ipsec.py and update to use PKI.

5 files changed, 50 insertions, 44 deletions

diff --git a/data/templates/ipsec/ipsec.conf.tmpl b/data/templates/ipsec/ipsec.conf.tmpl
index a9ea1aac7..1cb531e76 100644
--- a/data/templates/ipsec/ipsec.conf.tmpl
+++ b/data/templates/ipsec/ipsec.conf.tmpl
@@ -16,9 +16,3 @@ config setup
 {%  if include_ipsec_conf is defined %}
 include {{ include_ipsec_conf }}
 {%  endif %}
-
-{%  if delim_ipsec_l2tp_begin is defined %}
-{{delim_ipsec_l2tp_begin}}
-include {{ipsec_ra_conn_file}}
-{{delim_ipsec_l2tp_end}}
-{%  endif %}
diff --git a/data/templates/ipsec/ipsec.secrets.tmpl b/data/templates/ipsec/ipsec.secrets.tmpl
index 43b5fe0d2..057e291ed 100644
--- a/data/templates/ipsec/ipsec.secrets.tmpl
+++ b/data/templates/ipsec/ipsec.secrets.tmpl
@@ -3,13 +3,3 @@
 {%  if include_ipsec_secrets is defined %}
 include {{ include_ipsec_secrets }}
 {%  endif %}
-
-{%  if delim_ipsec_l2tp_begin is defined %}
-{{delim_ipsec_l2tp_begin}}
-{%      if ipsec_l2tp_auth_mode == 'pre-shared-secret' %}
-{{outside_addr}} %any : PSK "{{ipsec_l2tp_secret}}"
-{%      elif ipsec_l2tp_auth_mode == 'x509' %}
-: RSA {{server_key_file_copied}}
-{%      endif %}
-{{delim_ipsec_l2tp_end}}
-{%  endif %}
diff --git a/data/templates/ipsec/remote-access.tmpl b/data/templates/ipsec/remote-access.tmpl
deleted file mode 100644
index fae48232f..000000000
--- a/data/templates/ipsec/remote-access.tmpl
+++ /dev/null
@@ -1,28 +0,0 @@
-{{delim_ipsec_l2tp_begin}}
-conn {{ra_conn_name}}
-  type=transport
-  left={{outside_addr}}
-  leftsubnet=%dynamic[/1701]
-  rightsubnet=%dynamic
-  mark_in=%unique
-  auto=add
-  ike=aes256-sha1-modp1024,3des-sha1-modp1024,3des-sha1-modp1024!
-  dpddelay=15
-  dpdtimeout=45
-  dpdaction=clear
-  esp=aes256-sha1,3des-sha1!
-  rekey=no
-{% if ipsec_l2tp_auth_mode == 'pre-shared-secret' %}
-  authby=secret
-  leftauth=psk
-  rightauth=psk
-{% elif ipsec_l2tp_auth_mode == 'x509' %}
-  authby=rsasig
-  leftrsasigkey=%cert
-  rightrsasigkey=%cert
-  rightca=%same
-  leftcert={{server_cert_file_copied}}
-{% endif %}
-  ikelifetime={{ipsec_l2tp_ike_lifetime}}
-  keylife={{ipsec_l2tp_lifetime}}
-{{delim_ipsec_l2tp_end}}
diff --git a/data/templates/ipsec/swanctl.conf.tmpl b/data/templates/ipsec/swanctl.conf.tmpl
index a6ab73cc2..102d7583f 100644
--- a/data/templates/ipsec/swanctl.conf.tmpl
+++ b/data/templates/ipsec/swanctl.conf.tmpl
@@ -1,4 +1,5 @@
 ### Autogenerated by vpn_ipsec.py ###
+{% import 'ipsec/swanctl/l2tp.tmpl' as l2tp_tmpl %}
 {% import 'ipsec/swanctl/profile.tmpl' as profile_tmpl %}
 {% import 'ipsec/swanctl/peer.tmpl' as peer_tmpl %}
 {% import 'ipsec/swanctl/remote_access.tmpl' as remote_access_tmpl %}
@@ -19,6 +20,9 @@ connections {
 {{ remote_access_tmpl.conn(rw, rw_conf, ike_group, esp_group) }}
 {%   endfor %}
 {% endif %}
+{% if l2tp %}
+{{ l2tp_tmpl.conn(l2tp, l2tp_outside_address, l2tp_ike_default, l2tp_esp_default, ike_group, esp_group) }}
+{% endif %}
 }
 
 pools {
@@ -103,5 +107,21 @@ secrets {
 {%      endif %}
 {%    endfor %}
 {%  endif %}
+{%  if l2tp %}
+{%    if l2tp.authentication.mode == 'pre-shared-secret' %}
+    ike_l2tp_remote_access {
+        id = "{{ l2tp_outside_address }}"
+        secret = "{{ l2tp.authentication.pre_shared_secret }}"
+    }
+{%    elif l2tp.authentication.mode == 'x509' %}
+    private_l2tp_remote_access {
+        id = "{{ l2tp_outside_address }}"
+        file = {{ l2tp.authentication.x509.certificate }}.pem
+{%      if l2tp.authentication.x509.passphrase is defined %}
+        secret = "{{ l2tp.authentication.x509.passphrase }}"
+{%      endif %}
+    }
+{%    endif %}
+{%  endif %}
 }
 
diff --git a/data/templates/ipsec/swanctl/l2tp.tmpl b/data/templates/ipsec/swanctl/l2tp.tmpl
new file mode 100644
index 000000000..2df5c2a4d
--- /dev/null
+++ b/data/templates/ipsec/swanctl/l2tp.tmpl
@@ -0,0 +1,30 @@
+{% macro conn(l2tp, l2tp_outside_address, l2tp_ike_default, l2tp_esp_default, ike_group, esp_group) %}
+{%   set l2tp_ike = ike_group[l2tp.ike_group] if l2tp.ike_group is defined else None %}
+{%   set l2tp_esp = esp_group[l2tp.esp_group] if l2tp.esp_group is defined else None %}
+    l2tp_remote_access {
+        proposals = {{ l2tp_ike | get_esp_ike_cipher | join(',') if l2tp_ike else l2tp_ike_default }}
+        local_addrs = {{ l2tp_outside_address }}
+        dpd_delay = 15s
+        dpd_timeout = 45s
+        rekey_time = {{ l2tp_ike.lifetime if l2tp_ike else l2tp.ike_lifetime }}s
+        reauth_time = 0
+        local {
+            auth = {{ 'psk' if l2tp.authentication.mode == 'pre-shared-secret' else 'pubkey' }}
+{%   if l2tp.authentication.mode == 'x509' %}
+            certs = {{ l2tp.authentication.x509.certificate }}.pem
+{%   endif %}
+        }
+        remote {
+            auth = {{ 'psk' if l2tp.authentication.mode == 'pre-shared-secret' else 'pubkey' }}
+        }
+        children {
+            l2tp_remote_access_esp {
+                mode = transport
+                esp_proposals = {{ l2tp_esp | get_esp_ike_cipher | join(',') if l2tp_esp else l2tp_esp_default }}
+                life_time = {{ l2tp_esp.lifetime if l2tp_esp else l2tp.lifetime }}s
+                local_ts = dynamic[/1701]
+                remote_ts = dynamic
+            }
+        }
+    }
+{% endmacro %}