diff options
| author | Christian Breunig <christian@breunig.cc> | 2024-04-22 06:59:09 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-04-22 06:59:09 +0200 |
| commit | b5d3d36d1f70e53ef6a8a6634ab863d94d791bf2 (patch) | |
| tree | ab470519b8d5d63b7b19ba56bc3d688761c87f18 | |
| parent | 0cb4294fdfe5ae0e0e8fd06436f38b67f16413a2 (diff) | |
| parent | 78ea623df20b44309cc6ac9848ed18e97fc4ed03 (diff) | |
| download | vyos-1x-b5d3d36d1f70e53ef6a8a6634ab863d94d791bf2.tar.gz vyos-1x-b5d3d36d1f70e53ef6a8a6634ab863d94d791bf2.zip | |
Merge pull request #3337 from Embezzle/T6237
T6237: IPSec remote access VPN: ability to set EAP ID of clients
| -rw-r--r-- | data/templates/ipsec/swanctl/remote_access.j2 | 2 | ||||
| -rw-r--r-- | interface-definitions/vpn_ipsec.xml.in | 20 | ||||
| -rwxr-xr-x | smoketest/scripts/cli/test_vpn_ipsec.py | 5 |
3 files changed, 26 insertions, 1 deletions
diff --git a/data/templates/ipsec/swanctl/remote_access.j2 b/data/templates/ipsec/swanctl/remote_access.j2 index adfa32bde..6bced88c7 100644 --- a/data/templates/ipsec/swanctl/remote_access.j2 +++ b/data/templates/ipsec/swanctl/remote_access.j2 @@ -33,7 +33,7 @@ auth = pubkey {% elif rw_conf.authentication.client_mode.startswith("eap") %} auth = {{ rw_conf.authentication.client_mode }} - eap_id = %any + eap_id = {{ '%any' if rw_conf.authentication.eap_id == 'any' else rw_conf.authentication.eap_id }} {% endif %} {% if rw_conf.authentication.client_mode is vyos_defined('eap-tls') or rw_conf.authentication.client_mode is vyos_defined('x509') %} {# pass all configured CAs as filenames, separated by commas #} diff --git a/interface-definitions/vpn_ipsec.xml.in b/interface-definitions/vpn_ipsec.xml.in index 833019d68..7f425d982 100644 --- a/interface-definitions/vpn_ipsec.xml.in +++ b/interface-definitions/vpn_ipsec.xml.in @@ -768,6 +768,26 @@ <children> #include <include/ipsec/authentication-id.xml.i> #include <include/ipsec/authentication-x509.xml.i> + <leafNode name="eap-id"> + <properties> + <help>Remote EAP ID for client authentication</help> + <valueHelp> + <format>txt</format> + <description>Remote EAP ID for client authentication</description> + </valueHelp> + <completionHelp> + <list>any</list> + </completionHelp> + <valueHelp> + <format>any</format> + <description>Allow any EAP ID</description> + </valueHelp> + <constraint> + <regex>[[:ascii:]]{1,64}</regex> + </constraint> + </properties> + <defaultValue>any</defaultValue> + </leafNode> <leafNode name="client-mode"> <properties> <help>Client authentication mode</help> diff --git a/smoketest/scripts/cli/test_vpn_ipsec.py b/smoketest/scripts/cli/test_vpn_ipsec.py index 145b5990e..27356d70e 100755 --- a/smoketest/scripts/cli/test_vpn_ipsec.py +++ b/smoketest/scripts/cli/test_vpn_ipsec.py @@ -782,6 +782,11 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): self.assertTrue(os.path.exists(os.path.join(CA_PATH, f'{ca_name}.pem'))) self.assertTrue(os.path.exists(os.path.join(CERT_PATH, f'{peer_name}.pem'))) + # Test setting of custom EAP ID + self.cli_set(base_path + ['remote-access', 'connection', conn_name, 'authentication', 'eap-id', 'eap-user@vyos.net']) + self.cli_commit() + self.assertIn(r'eap_id = eap-user@vyos.net', read_file(swanctl_file)) + self.tearDownPKI() def test_remote_access_x509(self): |