Merge pull request #4608 from alexandr-san4ez/T7593-current

ipsec: T7593: Add dynamic prefix for local and remote traffic selectors

3 files changed, 78 insertions, 0 deletions

diff --git a/interface-definitions/vpn_ipsec.xml.in b/interface-definitions/vpn_ipsec.xml.in
index a54b16736..517bf89fd 100644
--- a/interface-definitions/vpn_ipsec.xml.in
+++ b/interface-definitions/vpn_ipsec.xml.in
@@ -1228,6 +1228,13 @@
                       #include <include/generic-disable-node.xml.i>
                       #include <include/ipsec/esp-group.xml.i>
                       #include <include/ipsec/local-traffic-selector.xml.i>
+                      <node name="local">
+                        <children>
+                          <leafNode name="prefix">
+                            <defaultValue>dynamic</defaultValue>
+                          </leafNode>
+                        </children>
+                      </node>
                       #include <include/ip-protocol.xml.i>
                       <leafNode name="priority">
                         <properties>
@@ -1264,6 +1271,7 @@
                               </constraint>
                               <multi/>
                             </properties>
+                            <defaultValue>dynamic</defaultValue>
                           </leafNode>
                         </children>
                       </node>
diff --git a/smoketest/scripts/cli/test_vpn_ipsec.py b/smoketest/scripts/cli/test_vpn_ipsec.py
index 830e58fe8..7f52db74e 100755
--- a/smoketest/scripts/cli/test_vpn_ipsec.py
+++ b/smoketest/scripts/cli/test_vpn_ipsec.py
@@ -347,6 +347,68 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase):
         for line in swanctl_conf_lines:
             self.assertIn(line, swanctl_conf)
 
+    def test_site_to_site_with_default_ts(self):
+        """Test 'site to site' with default value of local and remote Traffic Selection"""
+
+        self.cli_set(base_path + ['ike-group', ike_group, 'key-exchange', 'ikev2'])
+
+        local_address = '192.0.2.11'
+        life_bytes = '100000'
+        life_packets = '2000000'
+
+        # vpn ipsec auth psk <tag> id <x.x.x.x>
+        self.cli_set(
+            base_path + ['authentication', 'psk', connection_name, 'id', local_id]
+        )
+        self.cli_set(
+            base_path + ['authentication', 'psk', connection_name, 'id', remote_id]
+        )
+        self.cli_set(
+            base_path + ['authentication', 'psk', connection_name, 'id', local_address]
+        )
+        self.cli_set(
+            base_path + ['authentication', 'psk', connection_name, 'id', peer_ip]
+        )
+        self.cli_set(
+            base_path + ['authentication', 'psk', connection_name, 'secret', secret]
+        )
+
+        # Site to site
+        peer_base_path = base_path + ['site-to-site', 'peer', connection_name]
+
+        self.cli_set(base_path + ['esp-group', esp_group, 'life-bytes', life_bytes])
+        self.cli_set(base_path + ['esp-group', esp_group, 'life-packets', life_packets])
+
+        self.cli_set(peer_base_path + ['authentication', 'mode', 'pre-shared-secret'])
+        self.cli_set(peer_base_path + ['ike-group', ike_group])
+        self.cli_set(peer_base_path + ['default-esp-group', esp_group])
+        self.cli_set(peer_base_path + ['local-address', local_address])
+        self.cli_set(peer_base_path + ['remote-address', peer_ip])
+        self.cli_set(peer_base_path + ['tunnel', '1', 'protocol', 'gre'])
+
+        self.cli_commit()
+
+        # Verify strongSwan configuration
+        swanctl_conf = read_file(swanctl_file)
+        swanctl_conf_lines = [
+            f'version = 2',
+            f'auth = psk',
+            f'life_bytes = {life_bytes}',
+            f'life_packets = {life_packets}',
+            f'rekey_time = 28800s',  # default value
+            f'proposals = aes128-sha1-modp1024',
+            f'esp_proposals = aes128-sha1-modp1024',
+            f'life_time = 3600s',  # default value
+            f'local_addrs = {local_address} # dhcp:no',
+            f'remote_addrs = {peer_ip}',
+            f'mode = tunnel',
+            f'{connection_name}-tunnel-1',
+            f'local_ts = dynamic[gre/]',  # default value
+            f'remote_ts = dynamic[gre/]',  # default value
+            f'mode = tunnel',
+        ]
+        for line in swanctl_conf_lines:
+            self.assertIn(line, swanctl_conf)
 
     def test_site_to_site_vti(self):
         local_address = '192.0.2.10'
diff --git a/src/conf_mode/vpn_ipsec.py b/src/conf_mode/vpn_ipsec.py
index 1871956b2..dcb9f9c69 100755
--- a/src/conf_mode/vpn_ipsec.py
+++ b/src/conf_mode/vpn_ipsec.py
@@ -696,6 +696,8 @@ def generate(ipsec):
                 generate_pki_files_x509(ipsec['pki'], rw_conf['authentication']['x509'])
 
     if 'site_to_site' in ipsec and 'peer' in ipsec['site_to_site']:
+        DEFAULT_TS_PREFIX = 'dynamic'
+
         for peer, peer_conf in ipsec['site_to_site']['peer'].items():
             if f'peer_{peer}' in ipsec['dhcp_no_address']:
                 continue
@@ -724,7 +726,13 @@ def generate(ipsec):
                     passthrough = None
 
                     for local_prefix in local_prefixes:
+                        if local_prefix == DEFAULT_TS_PREFIX:
+                            continue
+
                         for remote_prefix in remote_prefixes:
+                            if remote_prefix == DEFAULT_TS_PREFIX:
+                                continue
+
                             local_net = ipaddress.ip_network(local_prefix)
                             remote_net = ipaddress.ip_network(remote_prefix)
                             if local_net.subnet_of(remote_net):