ipsec: T3656: T3659: Fix pass-through with ipv6. Fix op-mode ipsec commands. Remove python3-crypto dependency.

6 files changed, 8 insertions, 38 deletions

diff --git a/debian/control b/debian/control
index c0805804e..ddccc9e14 100644
--- a/debian/control
+++ b/debian/control
@@ -110,7 +110,7 @@ Depends:
   procps,
   python3,
   python3-certbot-nginx,
-  python3-crypt | python3-pycryptodome,
+  python3-pycryptodome,
   python3-cryptography,
   python3-flask,
   python3-hurry.filesize,
diff --git a/op-mode-definitions/vpn-ipsec.xml.in b/op-mode-definitions/vpn-ipsec.xml.in
index 76f4893c1..fe0597eed 100644
--- a/op-mode-definitions/vpn-ipsec.xml.in
+++ b/op-mode-definitions/vpn-ipsec.xml.in
@@ -101,7 +101,7 @@
         <properties>
           <help>Restart IPSec VPN</help>
         </properties>
-        <command>if pgrep charon >/dev/null ; then sudo /usr/sbin/ipsec restart ; else echo "IPSec process not running" ; fi</command>
+        <command>if pgrep charon >/dev/null ; then sudo ipsec restart ; sleep 3 ; sudo swanctl -q ; else echo "IPSec process not running" ; fi</command>
       </node>
     </children>
   </node>
diff --git a/python/vyos/util.py b/python/vyos/util.py
index 586c79fff..cf90dc74f 100644
--- a/python/vyos/util.py
+++ b/python/vyos/util.py
@@ -705,38 +705,6 @@ def get_all_vrfs():
         data[name] = entry
     return data
 
-def cidr_fit(cidr_a, cidr_b, both_directions = False):
-    """
-    Does CIDR A fit inside of CIDR B?
-
-    Credit: https://gist.github.com/magnetikonline/686fde8ee0bce4d4930ce8738908a009
-    """
-    def split_cidr(cidr):
-        part_list = cidr.split("/")
-        if len(part_list) == 1:
-            # if just an IP address, assume /32
-            part_list.append("32")
-
-        # return address and prefix size
-        return part_list[0].strip(), int(part_list[1])
-    def address_to_bits(address):
-        # convert each octet of IP address to binary
-        bit_list = [bin(int(part)) for part in address.split(".")]
-
-        # join binary parts together
-        # note: part[2:] to slice off the leading "0b" from bin() results
-        return "".join([part[2:].zfill(8) for part in bit_list])
-    def binary_network_prefix(cidr):
-        # return CIDR as bits, to the length of the prefix size only (drop the rest)
-        address, prefix_size = split_cidr(cidr)
-        return address_to_bits(address)[:prefix_size]
-
-    prefix_a = binary_network_prefix(cidr_a)
-    prefix_b = binary_network_prefix(cidr_b)
-    if both_directions:
-        return prefix_a.startswith(prefix_b) or prefix_b.startswith(prefix_a)
-    return prefix_a.startswith(prefix_b)
-
 def print_error(str='', end='\n'):
     """
     Print `str` to stderr, terminated with `end`.
diff --git a/src/conf_mode/vpn_ipsec.py b/src/conf_mode/vpn_ipsec.py
index bf4aa332a..ce72ee094 100755
--- a/src/conf_mode/vpn_ipsec.py
+++ b/src/conf_mode/vpn_ipsec.py
@@ -14,6 +14,7 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+import ipaddress
 import os
 
 from sys import exit
@@ -34,7 +35,6 @@ from vyos.util import call
 from vyos.util import dict_search
 from vyos.util import process_named_running
 from vyos.util import run
-from vyos.util import cidr_fit
 from vyos import ConfigError
 from vyos import airbag
 airbag.enable()
@@ -407,7 +407,9 @@ def generate(ipsec):
 
                         for local_prefix in local_prefixes:
                             for remote_prefix in remote_prefixes:
-                                if cidr_fit(local_prefix, remote_prefix):
+                                local_net = ipaddress.ip_network(local_prefix)
+                                remote_net = ipaddress.ip_network(remote_prefix)
+                                if local_net.overlaps(remote_net):
                                     passthrough.append(local_prefix)
 
                         data['site_to_site']['peer'][peer]['tunnel'][tunnel]['passthrough'] = passthrough
diff --git a/src/op_mode/show_ipsec_sa.py b/src/op_mode/show_ipsec_sa.py
index a94c7efc6..e491267fd 100755
--- a/src/op_mode/show_ipsec_sa.py
+++ b/src/op_mode/show_ipsec_sa.py
@@ -26,7 +26,7 @@ import vyos.util
 def format_output(conns, sas):
     sa_data = []
 
-    for peer, parent_conn in conn.items():
+    for peer, parent_conn in conns.items():
         if peer not in sas:
             continue
 
diff --git a/src/op_mode/vpn_ipsec.py b/src/op_mode/vpn_ipsec.py
index dd5a85ed3..ad7efbf2d 100755
--- a/src/op_mode/vpn_ipsec.py
+++ b/src/op_mode/vpn_ipsec.py
@@ -23,7 +23,7 @@ import argparse
 from subprocess import TimeoutExpired
 
 from vyos.util import ask_yes_no, call, cmd, process_named_running
-from Crypto.PublicKey.RSA import importKey
+from Cryptodome.PublicKey.RSA import importKey
 
 RSA_LOCAL_KEY_PATH = '/config/ipsec.d/rsa-keys/localhost.key'
 RSA_LOCAL_PUB_PATH = '/etc/ipsec.d/certs/localhost.pub'