summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorChristian Poessinger <christian@poessinger.com>2021-08-04 20:48:09 +0200
committerChristian Poessinger <christian@poessinger.com>2021-08-04 20:49:29 +0200
commit947f8290ea7094dbd2c4e72df42f54e763c7ec62 (patch)
tree7e99392adf1d96641ad99b5dba0a281924e64899
parent3a814957f412759b6ebc908ed78c7d299adedfb3 (diff)
downloadvyos-1x-947f8290ea7094dbd2c4e72df42f54e763c7ec62.tar.gz
vyos-1x-947f8290ea7094dbd2c4e72df42f54e763c7ec62.zip
ipsec: T3718: fix default processing of ike dh-group proposals
IKE dh-group defaults to 2 (modp1024).
-rw-r--r--interface-definitions/vpn_ipsec.xml.in2
-rwxr-xr-xsrc/conf_mode/vpn_ipsec.py11
2 files changed, 12 insertions, 1 deletions
diff --git a/interface-definitions/vpn_ipsec.xml.in b/interface-definitions/vpn_ipsec.xml.in
index 165fdfdf3..b28c86ae6 100644
--- a/interface-definitions/vpn_ipsec.xml.in
+++ b/interface-definitions/vpn_ipsec.xml.in
@@ -383,7 +383,6 @@
</properties>
<children>
<leafNode name="dh-group">
- <defaultValue>2</defaultValue>
<properties>
<help>dh-grouphelp</help>
<completionHelp>
@@ -481,6 +480,7 @@
<regex>^(1|2|5|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32)$</regex>
</constraint>
</properties>
+ <defaultValue>2</defaultValue>
</leafNode>
#include <include/vpn-ipsec-encryption.xml.i>
#include <include/vpn-ipsec-hash.xml.i>
diff --git a/src/conf_mode/vpn_ipsec.py b/src/conf_mode/vpn_ipsec.py
index 11ff12e94..329d84528 100755
--- a/src/conf_mode/vpn_ipsec.py
+++ b/src/conf_mode/vpn_ipsec.py
@@ -102,9 +102,20 @@ def get_config(config=None):
ipsec['esp_group'][group])
if 'ike_group' in ipsec:
default_values = defaults(base + ['ike-group'])
+ # proposal is a tag node which may come with individual defaults per node
+ if 'proposal' in default_values:
+ del default_values['proposal']
+
for group in ipsec['ike_group']:
ipsec['ike_group'][group] = dict_merge(default_values,
ipsec['ike_group'][group])
+
+ if 'proposal' in ipsec['ike_group'][group]:
+ default_values = defaults(base + ['ike-group', 'proposal'])
+ for proposal in ipsec['ike_group'][group]['proposal']:
+ ipsec['ike_group'][group]['proposal'][proposal] = dict_merge(default_values,
+ ipsec['ike_group'][group]['proposal'][proposal])
+
if 'remote_access' in ipsec and 'connection' in ipsec['remote_access']:
default_values = defaults(base + ['remote-access', 'connection'])
for rw in ipsec['remote_access']['connection']: