summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2016-02-11Set default pfs and ike dh group. (required by strongswan charon)Kim Hagen
2016-02-11Remove charonstart an interfaces from ipsec.conf file, they are depricated.Kim Hagen
2016-02-09Merge branch 'current' of github.com:vyos/vyatta-cfg-vpn into currentKim Hagen
2016-02-09Use dhcp instead of dhcp3.Kim Hagen
2016-01-29vyatta-cfg-vpn: Properly implement force-encapsulation and fix descriptionsJeff Leung
2016-01-250.12.105+vyos2+current2debian/0.12.105+vyos2+current2Daniil Baturin
2016-01-25Remove dependency on vyatta-ipsec for migration to upstream strongswan.Daniil Baturin
Update standards version and description.
2016-01-240.12.105+vyos2+current1debian/0.12.105+vyos2+current1Kim Hagen
2015-12-16Fix build depends.Thomas Jepp
2015-12-06Merge branch 'lithium' into lithium-strongswan5Jeff Leung
Conflicts: templates/vpn/ipsec/esp-group/node.tag/proposal/node.tag/encryption/node.def templates/vpn/ipsec/ike-group/node.tag/proposal/node.tag/encryption/node.def Get the GCM and ChaCha20+Poly1305 ciphers to play nice with each other
2015-12-05vyatta-cfg-vpn: validate peer address for vti based vpn connectionsAlex Harpin
Validate the peer address used for VTI based VPN connections to ensure only either an IPv4 or IPv6 address is used. Currently VTIs can only accept these for peer addresses, other values will fail with extraneous error messages, trap these earlier in the configuation commit process for now. Bug #359 http://bugzilla.vyos.net/show_bug.cgi?id=359
2015-12-05vyatta-cfg-vpn: validate local address for vti based vpn connectionsAlex Harpin
Validate the local address used for VTI based VPN connections to ensure only either an IPv4 or IPv6 address is used. Currently VTIs can only accept these for local addresses, other values will fail with extraneous error messages, trap these earlier in the configuation commit process for now. Bug #213 http://bugzilla.vyos.net/show_bug.cgi?id=213
2015-12-05vyatta-cfg-vpn: vti interfaces remain link down after ipsec sa renewalAlex Harpin
VTI interfaces can remain link down after IPSec SA expiry and renewal, leaving the actual IPSec tunnel up and active but the route relating to this VTI interface absent from the routing table; with the end result of no traffic passing through it without manual intervention. Earlier fixes for this issue in both bug #183 and bug #291 fixed one issue but introduced another, this commit fixes both scenarios. Bug #568 http://bugzilla.vyos.net/show_bug.cgi?id=568
2015-12-05vyatta-cfg-vpn: further tidy up of vyatta-vti-config.plAlex Harpin
Remove old comments and other minor tidying up / rearranging of scripts/vyatta-vti-config.pl
2015-12-05vyatta-cfg-vpn: formatting changes for style consistencyAlex Harpin
Perltidy run on scripts/vyatta-vti-config.pl to have consistent identation levels and style throughout.
2015-12-05Bug #469: add options for AES-128/256-GCM mode.Daniil Baturin
2015-12-05Move execution of nhrp script to "end" of ipsec config so it executes on all ↵Kim Hagen
changes made to the ipsec config
2015-12-05Add ChaCha20 Poly1305 cipher as an available cipher for IKE exchanges.Jeff Leung
Starting with strongSwan 5.3.3, chacha20poly1305 is a supported cipher for IKE and ESP configurations with an IKEv2 configuration.
2015-11-04Whitespace fixesJeff Leung
2015-11-04Allow the user to include a custom ipsec.secrets file.Jeff Leung
This may be useful for scenarios where a user prefers to use an ECDSA key or implement an xauth IPSec RA server without having to code for the VyOS/EdgeOS platform.
2015-11-04Actually implement custom ipsec.conf filesJeff Leung
2015-06-280.12.105+vyos2+lithium17debian/0.12.105+vyos2+lithium17Alex Harpin
2015-06-26vyatta-cfg-vpn: validate local address for vti based vpn connectionsAlex Harpin
Validate the local address used for VTI based VPN connections to ensure only either an IPv4 or IPv6 address is used. Currently VTIs can only accept these for local addresses, other values will fail with extraneous error messages, trap these earlier in the configuation commit process for now. Bug #213 http://bugzilla.vyos.net/show_bug.cgi?id=213
2015-06-260.12.105+vyos2+lithium16debian/0.12.105+vyos2+lithium16Alex Harpin
2015-06-22vyatta-cfg-vpn: validate peer address for vti based vpn connectionsAlex Harpin
Validate the peer address used for VTI based VPN connections to ensure only either an IPv4 or IPv6 address is used. Currently VTIs can only accept these for peer addresses, other values will fail with extraneous error messages, trap these earlier in the configuation commit process for now. Bug #359 http://bugzilla.vyos.net/show_bug.cgi?id=359
2015-06-180.12.105+vyos2+lithium15debian/0.12.105+vyos2+lithium15Alex Harpin
2015-06-18vyatta-cfg-vpn: vti interfaces remain link down after ipsec sa renewalAlex Harpin
VTI interfaces can remain link down after IPSec SA expiry and renewal, leaving the actual IPSec tunnel up and active but the route relating to this VTI interface absent from the routing table; with the end result of no traffic passing through it without manual intervention. Earlier fixes for this issue in both bug #183 and bug #291 fixed one issue but introduced another, this commit fixes both scenarios. Bug #568 http://bugzilla.vyos.net/show_bug.cgi?id=568
2015-06-17vyatta-cfg-vpn: further tidy up of vyatta-vti-config.plAlex Harpin
Remove old comments and other minor tidying up / rearranging of scripts/vyatta-vti-config.pl
2015-06-17vyatta-cfg-vpn: formatting changes for style consistencyAlex Harpin
Perltidy run on scripts/vyatta-vti-config.pl to have consistent identation levels and style throughout.
2015-06-160.12.105+vyos2+lithium14debian/0.12.105+vyos2+lithium14Alex Harpin
2015-06-16vyatta-cfg-vpn: update dh_gencontrol with new development build flagAlex Harpin
2015-06-140.12.105+vyos2+lithium13debian/0.12.105+vyos2+lithium13Daniil Baturin
2015-06-14Bug #504: add an option for pulling IPsec local id from the cert.Daniil Baturin
2015-06-09Merge pull request #1 from ryanriske/lithium-strongswan5-rsaJeff Leung
Update support for RSA keys with strongSwan 5.2.x
2015-05-040.12.105+vyos2+lithium12debian/0.12.105+vyos2+lithium12Daniil Baturin
2015-05-04Bug #469: add options for AES-128/256-GCM mode.Daniil Baturin
2015-04-020.12.105+vyos2+lithium11debian/0.12.105+vyos2+lithium11Alex Harpin
2015-03-02Fix ipsec.secrets generation for PEM-formatted RSA key.Ryan Riske
2015-03-01Exclude '0s' from public key string input in rsa_convert_pubkey_pemRyan Riske
2015-03-01Add support for RSA keys with strongSwan 5.2.xRyan Riske
strongSwan 5.2.x no longer recognizes keys in RFC 3110 format inlined in ipsec.conf and ipsec.secrets. We need to convert the local private key and peer public keys to PEM format, without changing the config templates or user-visible key formats. This patch will require the Debian packages 'libcrypt-openssl-bignum-perl' and 'libcrypt-openssl-rsa-perl' to be added to the system.
2015-02-16Move execution of nhrp script to "end" of ipsec config so it executes on all ↵Kim Hagen
changes made to the ipsec config
2015-02-13Remove the automatic generation of implicit connectionsJeff Leung
Since charon's existence, generating them is redundant and as a matter of fact causes issues with establishing multiple IKEv1 IPSec tunnels to the same peer.
2015-02-10Allow the user to force UDP encapsulation for a named peerJeff Leung
This might help with strongSwan traversing through firewalls that filter proto 51, but not UDP traffic.
2015-02-090.12.105+vyos2+lithium10debian/0.12.105+vyos2+lithium10Alex Harpin
2015-02-09Removing generation of leftsourceip= parameter in ipsec.confJeff Leung
As confirmed by Thermi in the strongSwan IRC channel inside freenode, this parameter should not have been generated for a S2S VPN setup. If leftsourceip= is specified on both ends in an IKEv1 S2S VPN tunnel, both ends will have charon hanging on MODE_CONFIG. This is because both ends are trying to ask an IP from the remote end which doesn't exist.
2015-02-08Slightly alter aggressive mode selection logicJeff Leung
If the user defines main mode, the config script will always enable aggressive mode. Fix the logic to correctly disable aggressive mode when main mode is asked for in IKEv1 connections.
2015-02-08Correct typo'd aggressive optionJeff Leung
Originally we meant aggressive, not ikev2
2015-02-07Remove the code that generates our ipsec logger at runtimeJeff Leung
Since we're invoking the logger at runtime, there's really no point on keeping this codeblock
2015-02-07Configure the ipsec debug logger at runtimeJeff Leung
Instead of configuring the ipsec logger at config time, configure it at runtime. The codeblock that generated the logger will be removed in a subsequent commit
2015-02-07Merge remote branch 'origin/lithium' into lithium-strongswan5Jeff Leung
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-29 04:36:09 +0000