Age | Commit message (Collapse) | Author | |
---|---|---|---|
2021-07-04 | Merge pull request #908 from c-po/ipsec-ikev2-remote-access | Christian Poessinger | |
ipsec: T1210: T1251: IKEv2 road-warrior support | |||
2021-07-04 | ipsec: T2816: add completion helper for tunnel interfaces | Christian Poessinger | |
2021-07-04 | T3663: prerequisites for inotify-based watching implementations. | Daniil Baturin | |
2021-07-04 | ipsec: T1210: T1251: add "local" traffic-selector include definition | Christian Poessinger | |
Used by both site2site and remote-access/road-warrior VPN connections. | |||
2021-07-04 | ipsec: T1210: T1251: add remote-access "name-server" definition to pool config | Christian Poessinger | |
2021-07-04 | ipsec: T2816: add completion helper for VTI interfaces | Christian Poessinger | |
2021-07-04 | ipsec: T2816: add include definition for ipsec local-address | Christian Poessinger | |
2021-07-04 | ipsec: T2816: use common building block/include for port definition | Christian Poessinger | |
2021-07-04 | ipsec: T1210: T1251: extend ra config with address pools/traffic selectors | sarthurdev | |
2021-07-04 | smoketest: pki: adjust to "type" node removal on CLI | Christian Poessinger | |
A certificate "type" can be auto derived from the certificate itself. | |||
2021-07-04 | ipsec: T1210: T1251: IKEv2 road-warrior support | Christian Poessinger | |
set vpn ipsec esp-group ESP-RW compression 'disable' set vpn ipsec esp-group ESP-RW lifetime '3600' set vpn ipsec esp-group ESP-RW pfs 'disable' set vpn ipsec esp-group ESP-RW proposal 10 encryption 'aes256' set vpn ipsec esp-group ESP-RW proposal 10 hash 'sha256' set vpn ipsec esp-group ESP-RW proposal 20 encryption 'aes256' set vpn ipsec esp-group ESP-RW proposal 20 hash 'sha1' set vpn ipsec ike-group IKE-RW key-exchange 'ikev2' set vpn ipsec ike-group IKE-RW lifetime '10800' set vpn ipsec ike-group IKE-RW mobike 'enable' set vpn ipsec ike-group IKE-RW proposal 10 dh-group '2' set vpn ipsec ike-group IKE-RW proposal 10 encryption 'aes256' set vpn ipsec ike-group IKE-RW proposal 10 hash 'sha1' set vpn ipsec ike-group IKE-RW proposal 20 dh-group '2' set vpn ipsec ike-group IKE-RW proposal 20 encryption 'aes128' set vpn ipsec ike-group IKE-RW proposal 20 hash 'sha1' set vpn ipsec ipsec-interfaces interface 'dum0' set vpn ipsec remote-access rw authentication id 'vyos' set vpn ipsec remote-access rw authentication local-users username vyos password vyos set vpn ipsec remote-access rw authentication x509 ca-certificate 'peer_172-18-254-202' set vpn ipsec remote-access rw authentication x509 certificate 'peer_172-18-254-202' set vpn ipsec remote-access rw description 'asdf' set vpn ipsec remote-access rw esp-group 'ESP-RW' set vpn ipsec remote-access rw ike-group 'IKE-RW' | |||
2021-07-03 | ipsec: T2816: remove erroneously added config snipped for road-warriors | Christian Poessinger | |
Commit 32fab6c7c ("ipsec: T2816: provide esp and ike-group XML building block") by accident added an IKEv2 road-warrior configuration to swanctl template. The config blog was never activate as the CLI nodes are still missing. Still unclean :(. | |||
2021-07-03 | Merge pull request #907 from sarthurdev/ipsec_cleanup | Christian Poessinger | |
ipsec: T2816: Remove legacy vyatta code that references Openswan | |||
2021-07-03 | ipsec: T2816: Remove legacy vyatta code that references Openswan | sarthurdev | |
2021-07-03 | Revert "ipsec: T2816: drop duplicate dict key "data" from generate()" | Christian Poessinger | |
This reverts commit fb1802111155b52c9d63a079e18127de76033678. | |||
2021-07-03 | Merge pull request #906 from sarthurdev/pki_typo | Christian Poessinger | |
pki: T3642: Fix for correct method on encoding certificate request | |||
2021-07-03 | pki: T3642: Fix for correct method on encoding certificate request | sarthurdev | |
2021-07-03 | ipsec: T1210: T1251: add dependency on libcharon-extauth-plugins | Christian Poessinger | |
2021-07-03 | ipsec: T2816: drop duplicate dict key "data" from generate() | Christian Poessinger | |
2021-07-03 | ipsec: T2816: provide x509 certificate base auth building blocks | Christian Poessinger | |
2021-07-03 | ipsec: T2816: provide esp and ike-group XML building block | Christian Poessinger | |
2021-07-03 | Merge pull request #905 from sarthurdev/pki_subca | Christian Poessinger | |
pki: T3642: Add support for signing and revoking subordinate CAs | |||
2021-07-03 | ipsec: T2816: rework log options for debugging | Christian Poessinger | |
Renamed CLI from "logging log-modes" to "log subsystem" and "logging log-level" to "log level". THat is more human firendly. | |||
2021-07-03 | pki: T3642: Add support for signing and revoking subordinate CAs | sarthurdev | |
2021-07-03 | Merge branch 'ipsec-ikev2-remote-access' of github.com:c-po/vyos-1x into current | Christian Poessinger | |
* 'ipsec-ikev2-remote-access' of github.com:c-po/vyos-1x: ipsec: T2816: remove default values from Jinja2 template and place them in XML ipsec: T2816: rework IKE and ESP key assignment ipsec: T2816: add Jinja2 converter for ESP/IKE groups to string ipsec: T2816: adjust Jinja2 template to coding style xml: provide building block for a generic description node | |||
2021-07-03 | ipsec: T2816: remove default values from Jinja2 template and place them in XML | Christian Poessinger | |
VyOS has a known to work mechanism in supplying CLI default values into the Python configuration scripts. This commit removes hardcoded default values from the Jinja2 template and places them into the appropriate XML definitions. The big advantage is that the default value itself and the corresponding help string are located in the exact same file. | |||
2021-07-03 | ipsec: T2816: rework IKE and ESP key assignment | Christian Poessinger | |
Commit 2d79a500 ("ipsec: T2816: add Jinja2 converter for ESP/IKE groups to string") added a Jinja2 helper function which can be used to transform VyOS CLI ESP and IKE key proposals into a strongSwan compatible string cipher. This commit changes the IPSec implementation to make use of this new Jinja2 filter fubction/Python helper. This is required base work for better automated tests (smoketests) but also for an IKEv2 road-warrior setup. | |||
2021-07-03 | ipsec: T2816: add Jinja2 converter for ESP/IKE groups to string | Christian Poessinger | |
2021-07-02 | conntrack: T3535: add support for multiple failsave links | Christian Poessinger | |
2021-07-02 | conntrack: T3660: make peer port configurable | Christian Poessinger | |
2021-07-02 | ipsec: T2816: adjust Jinja2 template to coding style | Christian Poessinger | |
* use indent = 2 * prefer 'if foo.bar is defined' over 'if "bar" in foo' | |||
2021-07-02 | xml: provide building block for a generic description node | Christian Poessinger | |
2021-07-02 | conntrack: T3535: add missing valueHelp/constraint for peer CLI node | Christian Poessinger | |
2021-07-02 | smoketest: ipam: add site2site x509 auth testcase | Christian Poessinger | |
2021-07-02 | smoketest: ipsec: place peer local-address into variable | Christian Poessinger | |
2021-07-02 | smoketest: ipsec: IKE and ESP settings can be done one time in setUp() | Christian Poessinger | |
2021-07-02 | Merge pull request #903 from sarthurdev/T3659_T3656 | Christian Poessinger | |
ipsec: T3656: T3659: Fix passthrough with ipv6. Fix op-mode ipsec commands. Remove python3-crypto dependency. | |||
2021-07-02 | ipsec: T3656: T3659: Fix pass-through with ipv6. Fix op-mode ipsec commands. ↵ | sarthurdev | |
Remove python3-crypto dependency. | |||
2021-07-01 | vyos.util: remove no longer needed copy_file helper method | Christian Poessinger | |
The IPSec ceritifcate handling is now done by storing the CA key inside the running configuration. | |||
2021-07-01 | Merge branch 'pki_ipsec' of https://github.com/sarthurdev/vyos-1x into pki-cli | Christian Poessinger | |
* 'pki_ipsec' of https://github.com/sarthurdev/vyos-1x: pki: ipsec: T3642: Update migration script to account for file permission issues pki: ipsec: T3642: Migrate IPSec to use PKI configuration pki: T3642: New PKI config and management | |||
2021-07-01 | ipsec: T3643: bugfix on wrong destination file path for x509 key file | Christian Poessinger | |
Commit a6b526fd982 ("ipsec: T3643: us vyos.util.copy_file() over raw UNIX cp command") used a new helper to copy the x509 certificate files, but it also added a bug where the certificate key file was copied to the wrong location. This has been fixed and the corect path is used again. | |||
2021-07-01 | vyos.util: fix IsADirectoryError and SameFileError for copy_file | Christian Poessinger | |
Commit 5303ec39 ("vyos.util: add new helper copy_file()") added a new helper function to copy a file from A -> B and create the destination directory if required. It did also throw an excpetion if the destination file already existed and consisted of the same file - this is now ignored and we always copy the source to the destination. | |||
2021-07-01 | pki: ipsec: T3642: Update migration script to account for file permission issues | sarthurdev | |
2021-06-30 | smoketest: ipsec: add more re-usable variable definitions throughout the test | Christian Poessinger | |
2021-06-30 | Merge pull request #902 from bstepler/T3658 | Christian Poessinger | |
dhcpdv6: T3658: add support for dhcpdv6 fixed-prefix6 | |||
2021-06-30 | dhcpdv6: T3658: add support for dhcpdv6 fixed-prefix6 | Brandon Stepler | |
2021-06-29 | Debian: T3641: remove absolut path to tcpdump which now resides in /usr/bin | Christian Poessinger | |
2021-06-29 | pki: ipsec: T3642: Migrate IPSec to use PKI configuration | sarthurdev | |
2021-06-29 | pppoe-server: T3405: Add interface cache feature | DmitriyEshenko | |
2021-06-29 | smoketest: bgp: T3657: test ipv6 link-local peering | Christian Poessinger | |