ipsec: T1210: T1251: extend ra config with address pools/traffic selectors

3 files changed, 146 insertions, 3 deletions

diff --git a/data/templates/ipsec/swanctl.conf.tmpl b/data/templates/ipsec/swanctl.conf.tmpl
index 15c035688..03f1e9942 100644
--- a/data/templates/ipsec/swanctl.conf.tmpl
+++ b/data/templates/ipsec/swanctl.conf.tmpl
@@ -21,6 +21,20 @@ connections {
 {% endif %}
 }
 
+pools {
+{%  if remote_access is defined %}
+{%    for ra, ra_conf in remote_access.items() if remote_access is defined %}
+    ra-{{ ra }} {
+        addrs = {{ ra_conf.pool.prefix }}
+        dns = {{ ra_conf.pool.dns_server | join(",") }}
+{%      if ra_conf.pool.exclude is defined %}
+        split_exclude = {{ ra_conf.pool.exclude | join(",") }}
+{%      endif %}
+    }
+{%    endfor %}
+{%  endif %}
+}
+
 secrets {
 {%  if profile is defined %}
 {%    for name, profile_conf in profile.items() if profile_conf.disable is not defined and profile_conf.bind is defined and profile_conf.bind.tunnel is defined %}
diff --git a/data/templates/ipsec/swanctl/remote_access.tmpl b/data/templates/ipsec/swanctl/remote_access.tmpl
index 89f6e343e..004aace2e 100644
--- a/data/templates/ipsec/swanctl/remote_access.tmpl
+++ b/data/templates/ipsec/swanctl/remote_access.tmpl
@@ -4,12 +4,13 @@
 {%   set esp = esp_group[rw_conf.esp_group] %}
     ra-{{ name }} {
         remote_addrs = %any
-        local_addrs = %any
+        local_addrs = {{ rw_conf.local_address if rw_conf.local_address is defined else '%any' }}
         proposals = {{ ike_group[rw_conf.ike_group] | get_esp_ike_cipher | join(',') }}
         version = {{ ike.key_exchange[4:] if ike is defined and ike.key_exchange is defined else "0" }}
         send_certreq = no
         rekey_time = {{ ike.lifetime }}s
         keyingtries = 0
+        pools = ra-{{ name }}
         local {
             auth = pubkey
 {%   if rw_conf.authentication is defined and rw_conf.authentication.id is defined and rw_conf.authentication.use_x509_id is not defined %}
@@ -21,7 +22,6 @@
         }
         remote {
             auth = eap-mschapv2
-            id = %any
             eap_id = %any
         }
         children {
@@ -29,8 +29,11 @@
                 esp_proposals = {{ esp | get_esp_ike_cipher | join(',')  }}
                 rekey_time = {{ esp.lifetime }}s
                 rand_time = 540s
-                local_ts = 0.0.0.0/0
                 dpd_action = clear
+{%   set local_prefix = rw_conf.local_network.prefix if rw_conf.local_network is defined and rw_conf.local_network.prefix is defined else ['0.0.0.0/0', '::/0'] %}
+{%   set local_port = rw_conf.local_network.port if rw_conf.local_network is defined and rw_conf.local_network.port is defined else '' %}
+{%   set local_suffix = '[%any/{1}]'.format(local_port) if local_port else '' %}
+                local_ts = {{ local_prefix | join(local_suffix + ",") }}{{ local_suffix }}
             }
         }
     }
diff --git a/interface-definitions/vpn_ipsec.xml.in b/interface-definitions/vpn_ipsec.xml.in
index ef3b05e29..a9444ecc5 100644
--- a/interface-definitions/vpn_ipsec.xml.in
+++ b/interface-definitions/vpn_ipsec.xml.in
@@ -743,6 +743,132 @@
               #include <include/generic-disable-node.xml.i>
               #include <include/ipsec/esp-group.xml.i>
               #include <include/ipsec/ike-group.xml.i>
+              <leafNode name="local-address">
+                <properties>
+                  <help>IPv4 or IPv6 address of a local interface to use for VPN</help>
+                  <completionHelp>
+                    <list>any</list>
+                  </completionHelp>
+                  <valueHelp>
+                    <format>ipv4</format>
+                    <description>IPv4 address of a local interface for VPN</description>
+                  </valueHelp>
+                  <valueHelp>
+                    <format>ipv6</format>
+                    <description>IPv6 address of a local interface for VPN</description>
+                  </valueHelp>
+                  <valueHelp>
+                    <format>any</format>
+                    <description>Allow any IPv4 address present on the system to be used for VPN</description>
+                  </valueHelp>
+                  <constraint>
+                    <validator name="ipv4-address"/>
+                    <validator name="ipv6-address"/>
+                    <regex>^(any)$</regex>
+                  </constraint>
+                </properties>
+              </leafNode>
+              <node name="local-network">
+                <properties>
+                  <help>Local traffic selectors</help>
+                </properties>
+                <children>
+                  <leafNode name="port">
+                    <properties>
+                      <help>Any TCP or UDP port</help>
+                      <valueHelp>
+                        <format>port name</format>
+                        <description>Named port (any name in /etc/services, e.g., http)</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>u32:1-65535</format>
+                        <description>Numbered port</description>
+                      </valueHelp>
+                    </properties>
+                  </leafNode>
+                  <leafNode name="prefix">
+                    <properties>
+                      <help>Local IPv4 or IPv6 prefix</help>
+                      <valueHelp>
+                        <format>ipv4</format>
+                        <description>Local IPv4 prefix</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>ipv6</format>
+                        <description>Local IPv6 prefix</description>
+                      </valueHelp>
+                      <constraint>
+                        <validator name="ipv4-prefix"/>
+                        <validator name="ipv6-prefix"/>
+                      </constraint>
+                      <multi/>
+                    </properties>
+                  </leafNode>
+                </children>
+              </node>
+              <node name="pool">
+                <properties>
+                  <help>IP address pool for remote-access users</help>
+                </properties>
+                <children>
+                  <leafNode name="exclude">
+                    <properties>
+                      <help>Local IPv4 or IPv6 pool prefix exclusions</help>
+                      <valueHelp>
+                        <format>ipv4</format>
+                        <description>Local IPv4 pool prefix exclusion</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>ipv6</format>
+                        <description>Local IPv6 pool prefix exclusion</description>
+                      </valueHelp>
+                      <constraint>
+                        <validator name="ipv4-prefix"/>
+                        <validator name="ipv6-prefix"/>
+                      </constraint>
+                      <multi/>
+                    </properties>
+                  </leafNode>
+                  <leafNode name="prefix">
+                    <properties>
+                      <help>Local IPv4 or IPv6 pool prefix</help>
+                      <valueHelp>
+                        <format>ipv4</format>
+                        <description>Local IPv4 pool prefix</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>ipv6</format>
+                        <description>Local IPv6 pool prefix</description>
+                      </valueHelp>
+                      <constraint>
+                        <validator name="ipv4-prefix"/>
+                        <validator name="ipv6-prefix"/>
+                      </constraint>
+                    </properties>
+                  </leafNode>
+                  <leafNode name="dns-server">
+                    <properties>
+                      <help>IPv4 or IPv6 DNS addresses for pool</help>
+                      <completionHelp>
+                        <list>any</list>
+                      </completionHelp>
+                      <valueHelp>
+                        <format>ipv4</format>
+                        <description>IPv4 DNS address for pool</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>ipv6</format>
+                        <description>IPv6 DNS address for pool</description>
+                      </valueHelp>
+                      <constraint>
+                        <validator name="ipv4-address"/>
+                        <validator name="ipv6-address"/>
+                      </constraint>
+                      <multi/>
+                    </properties>
+                  </leafNode>
+                </children>
+              </node>
               <leafNode name="timeout">
                 <properties>
                   <help>Timeout to close connection if no data is transmitted</help>