summaryrefslogtreecommitdiff
path: root/scripts
AgeCommit message (Collapse)Author
2021-12-28IPsec: T4087: increasing the number of proposals allowed for the IKE groupgoodNETnick
2021-12-23dmvpn: T4092: Add new line after mobike optionViacheslav
It was missed a new line after "mobike" option for configuration DMVPN So it generates a wrong config format for swanctl.conf
2021-09-07ipsec: T3808: add missing exit if 'vpn ipsec' has been deletedJohn Estabrook
2021-06-09cfg-vpn: T2916: T2855: Fix typo for vti interface disable statesever-sever
(cherry picked from commit 2d24f456b15dd3a5c53b8119cbc98f45fba3f89e)
2021-05-07cfg-vpn: T2806: Fix local prefix is source from loopbacksever-sever
2021-02-09IPsec: T2647: Replace obsoleted ipsec.conf optionerkin
2020-10-31T3035: allow mixed protocol IPsec (IPv4 over IPv6 and vice versa).Daniil Baturin
2020-07-30IPSec tunnels: T2728: Fixed protocol selector for tunnelszsdc
The protocol selector used for tunnels in transport mode was ignored by the configuration script. This commit adding it as a part of left|rightsubnet, as required by strongSwan.
2020-07-30ESP: T2701: Fixed "pfs enable" option usagezsdc
When in ESP group configured "pfs enable" option (default behavior), PFS settings are taken from the IKE proposal 1. In case if there is no "proposal 1", this ends up with broken ESP settings and unusable VPN peer. This fix replacing logic by taking PFS from the first one IKE proposal, regardless of its number.
2020-07-26dmvpn: T2091: Move variable to cycle for multiple profilesDmitriyEshenko
2020-07-26strongSwan: T2000: Add warning message if local prefix did not configuredDmitriyEshenko
2020-05-12VTI: T1291: Fix for invlid VTI interface down statezsdc
In case when between hosts exists two IPSec tunnels for VTI (for example, when both sides act as connection initiators), the older unused/replaced tunnel may switch VTI interface to the "down" state even if a newer IPSec connection is still in-use. Depending on other IPSec settings, this leads to a situation when VTI interfaces continuously flapping or stuck in a "down" state. This fix is an adaptation of PR from @m-asama for the current code base. It adding new dependency from actual SA state of IPSec connection, and do not allow to switch down a VTI interface if at least one of child connections is active or try to change the state of a VTI interface to the same, as already active.
2020-01-20T1780 Adding IPSec IKE close-actionDmitriyEshenko
2019-03-14Fixes T1298 use vti tunnel with ipsec and dhcp.Kim
* make dhcp interface work for vti interfaces * clean up code, loger timeout use python api * change vti tunnel ip on new dhcp lease * only change ip on up and do not get non dhcp ip * fix error in function, include up-host and down-host
2019-01-21fix typo in dead-pear-detectionKim
2019-01-15fix typoKim Hagen
2019-01-15do not display connection header when there are no tunnels createdKim Hagen
2019-01-11Reference IPsec profile name in DMPN connection names for op mode.Daniil Baturin
2018-12-06Fix: T1048: [IPSec] Protocol all does not work in IPSec Tunnelhagbard
2018-11-13T1006: replace the is_valid_address.pl script with ipaddrcheck.Daniil Baturin
2018-08-08T767: cleanup vpn-config.pl - removal of KLIPSChristian Poessinger
Two IPsec kernel stacks are currently available: KLIPS and NETKEY. The Linux kernel NETKEY code is a rewrite from scratch of the KAME IPsec code. The KAME Project was a group effort of six companies in Japan to provide a free IPv6 and IPsec (for both IPv4 and IPv6) protocol stack implementation for variants of the BSD UNIX computer operating system. KLIPS is not a part of the Linux kernel. When using KLIPS, you must apply a patch to the kernel to support NAT-T. When using NETKEY, NAT-T support is already inside the kernel, and there is no need to patch the kernel. [1] KLIPS part has been removed as we always used the NETKEY path in the Perl script. [1]: https://www.linuxjournal.com/article/9916
2018-08-08T767: remove IPSEC deprecated keyword 'interfaces'Christian Poessinger
'interfaces' option no longer available in StrongSWAN as of their Wiki [1]. [1]: https://wiki.strongswan.org/projects/strongswan/wiki/ConfigSetupSection
2018-08-05T628: delete the default route from the StrongSWAN table (220 hardcoded) for ↵Daniil Baturin
VTI connections
2017-10-31T126: charon listening on ALL interfaces(correct sorting)Taniadz
2017-10-27T126: charon listening on ALL interfaces(add ipsec restart)Taniadz
2017-10-25T126: charon listening on ALL interfaces( fix the style issues)Taniadz
2017-10-24T126: charon listening on ALL interfacesTaniadz
2017-03-23Fix VTI interface configuration to set both ikey and okeySylvain Munaut
Without this, the outgoing traffic is marked and encrypted but incoming traffic isn't properly forwarded to the VTI and just gets dropped. Partially Fixes T137 Signed-off-by: Sylvain Munaut <s.munaut@whatever-company.com>
2016-03-23load swanctl configuration on ipsec startUnicronNL
2016-03-16use 'dh-group' for first ike proposalUnicronNL
enable config for dead peer detection
2016-03-08add secret from config to swanctl.confUnicronNL
2016-02-24First version of new dmvpn script rewrite.Kim Hagen
2016-02-24remove reference to dmvpn.secrets and chang dmvpn.conf to swanctl.confKim Hagen
2016-02-11Merge branch 'lithium-strongswan5' of ↵Daniil Baturin
https://github.com/TriJetScud/vyatta-cfg-vpn into current
2016-02-11Revert "Remove charonstart an interfaces from ipsec.conf file, they are ↵Kim Hagen
depricated." This reverts commit fbddff7f2b6b485c93b5d3cf4d60a75f84c3a2b6.
2016-02-11Revert "Set default pfs and ike dh group. (required by strongswan charon)"Kim Hagen
This reverts commit 8353f0f8fc746c69d6006e5bba9baf45afe16385.
2016-02-11Set default pfs and ike dh group. (required by strongswan charon)Kim Hagen
2016-02-11Remove charonstart an interfaces from ipsec.conf file, they are depricated.Kim Hagen
2016-02-09Use dhcp instead of dhcp3.Kim Hagen
2016-01-29vyatta-cfg-vpn: Properly implement force-encapsulation and fix descriptionsJeff Leung
2015-12-06Merge branch 'lithium' into lithium-strongswan5Jeff Leung
Conflicts: templates/vpn/ipsec/esp-group/node.tag/proposal/node.tag/encryption/node.def templates/vpn/ipsec/ike-group/node.tag/proposal/node.tag/encryption/node.def Get the GCM and ChaCha20+Poly1305 ciphers to play nice with each other
2015-12-05vyatta-cfg-vpn: validate peer address for vti based vpn connectionsAlex Harpin
Validate the peer address used for VTI based VPN connections to ensure only either an IPv4 or IPv6 address is used. Currently VTIs can only accept these for peer addresses, other values will fail with extraneous error messages, trap these earlier in the configuation commit process for now. Bug #359 http://bugzilla.vyos.net/show_bug.cgi?id=359
2015-12-05vyatta-cfg-vpn: validate local address for vti based vpn connectionsAlex Harpin
Validate the local address used for VTI based VPN connections to ensure only either an IPv4 or IPv6 address is used. Currently VTIs can only accept these for local addresses, other values will fail with extraneous error messages, trap these earlier in the configuation commit process for now. Bug #213 http://bugzilla.vyos.net/show_bug.cgi?id=213
2015-12-05vyatta-cfg-vpn: vti interfaces remain link down after ipsec sa renewalAlex Harpin
VTI interfaces can remain link down after IPSec SA expiry and renewal, leaving the actual IPSec tunnel up and active but the route relating to this VTI interface absent from the routing table; with the end result of no traffic passing through it without manual intervention. Earlier fixes for this issue in both bug #183 and bug #291 fixed one issue but introduced another, this commit fixes both scenarios. Bug #568 http://bugzilla.vyos.net/show_bug.cgi?id=568
2015-12-05vyatta-cfg-vpn: further tidy up of vyatta-vti-config.plAlex Harpin
Remove old comments and other minor tidying up / rearranging of scripts/vyatta-vti-config.pl
2015-12-05vyatta-cfg-vpn: formatting changes for style consistencyAlex Harpin
Perltidy run on scripts/vyatta-vti-config.pl to have consistent identation levels and style throughout.
2015-11-04Whitespace fixesJeff Leung
2015-11-04Allow the user to include a custom ipsec.secrets file.Jeff Leung
This may be useful for scenarios where a user prefers to use an ECDSA key or implement an xauth IPSec RA server without having to code for the VyOS/EdgeOS platform.
2015-11-04Actually implement custom ipsec.conf filesJeff Leung
2015-06-26vyatta-cfg-vpn: validate local address for vti based vpn connectionsAlex Harpin
Validate the local address used for VTI based VPN connections to ensure only either an IPv4 or IPv6 address is used. Currently VTIs can only accept these for local addresses, other values will fail with extraneous error messages, trap these earlier in the configuation commit process for now. Bug #213 http://bugzilla.vyos.net/show_bug.cgi?id=213
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-10 00:54:49 +0000