summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorChristian Poessinger <christian@poessinger.com>2021-09-15 19:14:37 +0200
committerChristian Poessinger <christian@poessinger.com>2021-09-15 19:39:22 +0200
commit3e85333ae7c53fc8b2ceae1d1788e795fd92c939 (patch)
tree874233b4b1426f89c2419ba250b242521a856510
parent74878d14157408ef3a4c42f32608dcd5bbf812a1 (diff)
downloadvyos-1x-3e85333ae7c53fc8b2ceae1d1788e795fd92c939.tar.gz
vyos-1x-3e85333ae7c53fc8b2ceae1d1788e795fd92c939.zip
ipsec: T3830: "authentication id|use-x509-id" are mutually exclusive
Manually set peer id and use-x509-id are mutually exclusive!
-rw-r--r--data/templates/ipsec/swanctl/peer.tmpl2
-rwxr-xr-xsrc/conf_mode/vpn_ipsec.py3
2 files changed, 4 insertions, 1 deletions
diff --git a/data/templates/ipsec/swanctl/peer.tmpl b/data/templates/ipsec/swanctl/peer.tmpl
index 5d69b3d66..98c09436c 100644
--- a/data/templates/ipsec/swanctl/peer.tmpl
+++ b/data/templates/ipsec/swanctl/peer.tmpl
@@ -31,7 +31,7 @@
encap = yes
{% endif %}
local {
-{% if peer_conf.authentication is defined and peer_conf.authentication.id is defined and peer_conf.authentication.use_x509_id is not defined %}
+{% if peer_conf.authentication is defined and peer_conf.authentication.id is defined and peer_conf.authentication.id is not none %}
id = "{{ peer_conf.authentication.id }}"
{% endif %}
auth = {{ 'psk' if peer_conf.authentication.mode == 'pre-shared-secret' else 'pubkey' }}
diff --git a/src/conf_mode/vpn_ipsec.py b/src/conf_mode/vpn_ipsec.py
index ff6090e22..99b82ca2d 100755
--- a/src/conf_mode/vpn_ipsec.py
+++ b/src/conf_mode/vpn_ipsec.py
@@ -362,6 +362,9 @@ def verify(ipsec):
if 'authentication' not in peer_conf or 'mode' not in peer_conf['authentication']:
raise ConfigError(f"Missing authentication on site-to-site peer {peer}")
+ if {'id', 'use_x509_id'} <= set(peer_conf['authentication']):
+ raise ConfigError(f"Manually set peer id and use-x509-id are mutually exclusive!")
+
if peer_conf['authentication']['mode'] == 'x509':
if 'x509' not in peer_conf['authentication']:
raise ConfigError(f"Missing x509 settings on site-to-site peer {peer}")