vyos-1x.git/interface-definitions/vpn-ipsec.xml.in, branch feature/T9082-codeql-cppVyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git)
https://git.amelek.net/vyos/vyos-1x.git/atom?h=feature%2FT9082-codeql-cpp2023-12-31T22:49:48+00:00T5474: establish common file name pattern for XML conf mode commands2023-12-31T22:49:48+00:00Christian Breunigchristian@breunig.cc2023-12-30T22:25:20+00:00urn:sha1:4ef110fd2c501b718344c72d495ad7e16d2bd465
We will use _ as CLI level divider. The XML definition filename and also
the Python helper should match the CLI node.
Example:
set interfaces ethernet -> interfaces_ethernet.xml.in
set interfaces bond -> interfaces_bond.xml.in
set service dhcp-server -> service_dhcp-server-xml.in
T5870: ipsec remote access VPN: add x509 ("pubkey") authentication.2023-12-30T20:44:04+00:00Lucas Christianlucas@lucasec.com2023-12-29T06:07:07+00:00urn:sha1:656934e85cee799dba5b495d143f6be445ac22d5T5139: IPSec add IKE lifetime 0 for no rekeying2023-04-03T10:48:16+00:00Viacheslav Hletenkov.gletenko@vyos.io2023-04-03T10:48:16+00:00urn:sha1:16a1a69d6e74166001b296a8f66c26c8c00be1f1
IKE lifetime should starting from 0 for disabling rekeying
ipsec: T4593: Migrate and remove legacy `include-ipsec` nodes2023-02-15T11:57:25+00:00sarthurdev965089+sarthurdev@users.noreply.github.com2023-02-15T11:57:25+00:00urn:sha1:45b16864b11ea49087ce4a279e2c0e741a97c0ee
Not supported with swanctl
ipsec: T4968: Added default values to dpd and close action2023-02-13T15:14:37+00:00aapostoliuka.apostoliuk@vyos.io2023-02-13T15:14:37+00:00urn:sha1:b0f34f5fbdb0fba2e0bef279af9022775085708e
Based on https://docs.strongswan.org/docs/5.9/swanctl/swanctlConf.html
Added default value to dpd_action - clear
Added default value to close_action - none
Merge pull request #1761 from sever-sever/T4916-curr2023-01-30T08:56:38+00:00Viacheslav Hletenkov.gletenko@vyos.io2023-01-30T08:56:38+00:00urn:sha1:3c750f9b12b54d872848f6571deb02245ba8e28a
T4916: Rewrite IPsec peer authentication and psk migrationT4958: ocserv: openconnect: adds support for configuring RADIUS accounting2023-01-28T04:11:07+00:00Jamie Austinjamiea@opusv.com.au2023-01-27T06:32:29+00:00urn:sha1:e61f7abdb2136d8dfbf73729dbc14c3b5ab2ecba
Adds CLI configuration options to configure RADIUS accounting for OpenConnect VPN sessions. This functionality cannot be used outside of the RADIUS OpenConnect VPN authentication mode
T4916: Rewrite IPsec peer authentication and psk migration2023-01-26T11:28:03+00:00Viacheslav Hletenkov.gletenko@vyos.io2023-01-17T11:04:08+00:00urn:sha1:7ae0b404ad9fdefa856c7e450b224b47d854a4eb
Rewrite strongswan IPsec authentication to reflect structure
from swanctl.conf
The most important change is that more than one local/remote ID in the
same auth entry should be allowed
replace: 'ipsec site-to-site peer <tag> authentication pre-shared-secret xxx'
=> 'ipsec authentication psk <tag> secret xxx'
set vpn ipsec authentication psk <tag> id '192.0.2.1'
set vpn ipsec authentication psk <tag> id '192.0.2.2'
set vpn ipsec authentication psk <tag> secret 'xxx'
set vpn ipsec site-to-site peer <tag> authentication local-id '192.0.2.1'
set vpn ipsec site-to-site peer <tag> authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer <tag> authentication remote-id '192.0.2.2'
Add template filter for Jinja2 'generate_uuid4'
ipsec: T4925: Added PRF into IKE group2023-01-18T17:15:44+00:00aapostoliuka.apostoliuk@vyos.io2023-01-18T17:15:44+00:00urn:sha1:7a663a75dc8b2f9842b72a05e17240edb4008849
Added the possibility to configure Pseudo-Random Functions (PRF)
in IKE group
set vpn ipsec ike-group <Ike-grp> proposal <number> prf <PRF>
T4118: Add default value any for connection remote-id2023-01-12T17:47:53+00:00Viacheslav Hletenkov.gletenko@vyos.io2023-01-12T13:00:05+00:00urn:sha1:01386606982352de7eb51f55acc11c6a58ed4cef
If IPsec "peer <tag> authentication remote-id" is not set
it should be "%any" by default
https://docs.strongswan.org/docs/5.9/swanctl/swanctlConf.html#_connections_conn_remote
Set XML default value in use it in the python vpn_ipsec.py script