diff options
| author | Christian Breunig <christian@breunig.cc> | 2023-01-12 19:40:42 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-01-12 19:40:42 +0100 |
| commit | 521fef5f0aded11e2341fe893ecf4b1a206dcfc2 (patch) | |
| tree | 9af2913a50138003a93cb9360b43f81912320389 | |
| parent | 0b59afbb9fd06abf87ed340f05b977e52e516266 (diff) | |
| parent | 01386606982352de7eb51f55acc11c6a58ed4cef (diff) | |
| download | vyos-1x-521fef5f0aded11e2341fe893ecf4b1a206dcfc2.tar.gz vyos-1x-521fef5f0aded11e2341fe893ecf4b1a206dcfc2.zip | |
Merge pull request #1752 from sever-sever/T4118
T4118: Add default value any for connection remote-id
| -rw-r--r-- | data/templates/ipsec/swanctl/peer.j2 | 4 | ||||
| -rw-r--r-- | interface-definitions/vpn-ipsec.xml.in | 1 | ||||
| -rwxr-xr-x | src/conf_mode/vpn_ipsec.py | 9 |
3 files changed, 10 insertions, 4 deletions
diff --git a/data/templates/ipsec/swanctl/peer.j2 b/data/templates/ipsec/swanctl/peer.j2 index 837fa263c..9d95271fe 100644 --- a/data/templates/ipsec/swanctl/peer.j2 +++ b/data/templates/ipsec/swanctl/peer.j2 @@ -45,11 +45,7 @@ {% endif %} } remote { -{% if peer_conf.authentication.remote_id is vyos_defined %} id = "{{ peer_conf.authentication.remote_id }}" -{% else %} - id = "{{ peer }}" -{% endif %} auth = {{ 'psk' if peer_conf.authentication.mode == 'pre-shared-secret' else 'pubkey' }} {% if peer_conf.authentication.mode == 'rsa' %} pubkeys = {{ peer_conf.authentication.rsa.remote_key }}.pem diff --git a/interface-definitions/vpn-ipsec.xml.in b/interface-definitions/vpn-ipsec.xml.in index 64966b540..fd74a51d7 100644 --- a/interface-definitions/vpn-ipsec.xml.in +++ b/interface-definitions/vpn-ipsec.xml.in @@ -957,6 +957,7 @@ <description>ID used for peer authentication</description> </valueHelp> </properties> + <defaultValue>%any</defaultValue> </leafNode> <leafNode name="use-x509-id"> <properties> diff --git a/src/conf_mode/vpn_ipsec.py b/src/conf_mode/vpn_ipsec.py index b79e9847a..3af2af4d9 100755 --- a/src/conf_mode/vpn_ipsec.py +++ b/src/conf_mode/vpn_ipsec.py @@ -95,6 +95,7 @@ def get_config(config=None): del default_values['esp_group'] del default_values['ike_group'] del default_values['remote_access'] + del default_values['site_to_site'] ipsec = dict_merge(default_values, ipsec) if 'esp_group' in ipsec: @@ -143,6 +144,14 @@ def get_config(config=None): ipsec['remote_access']['radius']['server'][server] = dict_merge(default_values, ipsec['remote_access']['radius']['server'][server]) + # XXX: T2665: we can not safely rely on the defaults() when there are + # tagNodes in place, it is better to blend in the defaults manually. + if dict_search('site_to_site.peer', ipsec): + default_values = defaults(base + ['site-to-site', 'peer']) + for peer in ipsec['site_to_site']['peer']: + ipsec['site_to_site']['peer'][peer] = dict_merge(default_values, + ipsec['site_to_site']['peer'][peer]) + ipsec['dhcp_no_address'] = {} ipsec['install_routes'] = 'no' if conf.exists(base + ["options", "disable-route-autoinstall"]) else default_install_routes ipsec['interface_change'] = leaf_node_changed(conf, base + ['interface']) |