From 9556d78b1d54c7320a0154990c61d23c6197c38f Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Mon, 19 Jul 2021 19:01:43 +0200
Subject: ipsec: T1210: split out pool from remote-access configuration

Remote access IP pools can now be defined at a global level and referenced
in IPSec remote-access connections. To defined a pool use:

set vpn ipsec remote-access pool global-ipv4 name-server '172.16.1.1'
set vpn ipsec remote-access pool global-ipv4 prefix '192.168.0.0/24'
set vpn ipsec remote-access pool global-ipv6 name-server '2001:db8::1'
set vpn ipsec remote-access pool global-ipv6 prefix '2001:db8:1000::/64'

A connection can then reference the pool:

set vpn ipsec remote-access connection foo pool 'global-ipv4'
set vpn ipsec remote-access connection foo pool 'global-ipv6'
---
 data/templates/ipsec/swanctl.conf.tmpl | 46 ++++++++++++----------------------
 1 file changed, 16 insertions(+), 30 deletions(-)

(limited to 'data/templates/ipsec/swanctl.conf.tmpl')

diff --git a/data/templates/ipsec/swanctl.conf.tmpl b/data/templates/ipsec/swanctl.conf.tmpl
index b85fe7d41..161f19f95 100644
--- a/data/templates/ipsec/swanctl.conf.tmpl
+++ b/data/templates/ipsec/swanctl.conf.tmpl
@@ -15,8 +15,8 @@ connections {
 {{     peer_tmpl.conn(peer, peer_conf, ike_group, esp_group) }}
 {%   endfor %}
 {%  endif %}
-{% if remote_access is defined and remote_access is not none %}
-{%   for rw, rw_conf in remote_access.items() if rw_conf.disable is not defined %}
+{% if remote_access is defined and remote_access.connection is defined and remote_access.connection is not none %}
+{%   for rw, rw_conf in remote_access.connection.items() if rw_conf.disable is not defined %}
 {{ remote_access_tmpl.conn(rw, rw_conf, ike_group, esp_group) }}
 {%   endfor %}
 {% endif %}
@@ -26,33 +26,19 @@ connections {
 }
 
 pools {
-{%  if remote_access is defined %}
-{%    for ra, ra_conf in remote_access.items() if ra_conf.pool.dhcp_enable is not defined %}
-{%      if ra_conf.pool is defined and ra_conf.pool.prefix is defined %}
-{%        for prefix in ra_conf.pool.prefix %}
-{%          if prefix | is_ipv4 %}
-    ra-{{ ra }}-ipv4 {
-        addrs = {{ prefix }}
-{%            if ra_conf.pool.name_server_v4 is defined and ra_conf.pool.name_server_v4 is not none %}
-        dns = {{ ra_conf.pool.name_server_v4 | join(',') }}
-{%            endif %}
-{%            if ra_conf.pool.exclude_v4 is defined and ra_conf.pool.exclude_v4 is not none %}
-        split_exclude = {{ ra_conf.pool.exclude_v4 | join(',') }}
-{%            endif %}
-    }
-{%          elif prefix | is_ipv6 %}
-    ra-{{ ra }}-ipv6 {
-        addrs = {{ prefix }}
-{%            if ra_conf.pool.name_server_v6 is defined and ra_conf.pool.name_server_v6 is not none %}
-        dns = {{ ra_conf.pool.name_server_v6 | join(',') }}
-{%            endif %}
-{%            if ra_conf.pool.exclude_v6 is defined and ra_conf.pool.exclude_v6 is not none %}
-        split_exclude = {{ ra_conf.pool.exclude_v6 | join(',') }}
-{%            endif %}
-    }
-{%          endif %}
-{%        endfor %}
+{%  if remote_access is defined and remote_access.pool is defined and remote_access.pool is not none %}
+{%    for pool, pool_config in remote_access.pool.items() %}
+    {{ pool }} {
+{%      if pool_config.prefix is defined and pool_config.prefix is not none %}
+        addrs = {{ pool_config.prefix }}
 {%      endif %}
+{%      if pool_config.name_server is defined and pool_config.name_server is not none %}
+        dns = {{ pool_config.name_server | join(',') }}
+{%      endif %}
+{%      if pool_config.exclude is defined and pool_config.exclude is not none %}
+        split_exclude = {{ pool_config.exclude | join(',') }}
+{%      endif %}
+    }
 {%    endfor %}
 {%  endif %}
 }
@@ -103,8 +89,8 @@ secrets {
 {%      endif %}
 {%    endfor %}
 {%  endif %}
-{%  if remote_access is defined %}
-{%    for ra, ra_conf in remote_access.items() if remote_access is defined %}
+{%  if remote_access is defined and remote_access.connection is defined and remote_access.connection is not none %}
+{%    for ra, ra_conf in remote_access.connection.items() if ra_conf.disable is not defined %}
 {%      if ra_conf.authentication.server_mode == 'pre-shared-secret' %}
     ike_{{ ra }} {
 {%        if ra_conf.authentication.id is defined %}
-- 
cgit v1.2.3