diff options
| author | Christian Poessinger <christian@poessinger.com> | 2021-07-03 15:31:38 +0200 |
|---|---|---|
| committer | Christian Poessinger <christian@poessinger.com> | 2021-07-03 15:31:38 +0200 |
| commit | a1abb118c9eb413f3c78cfb2077f9c0d4b443c3a (patch) | |
| tree | 7e44119b3054f54d18e216a8f63e84346e92073d /data/templates/ipsec/swanctl/profile.tmpl | |
| parent | 2d79a5000c8a02fd7570f629c3182fd55fdb8c86 (diff) | |
| download | vyos-1x-a1abb118c9eb413f3c78cfb2077f9c0d4b443c3a.tar.gz vyos-1x-a1abb118c9eb413f3c78cfb2077f9c0d4b443c3a.zip | |
ipsec: T2816: rework IKE and ESP key assignment
Commit 2d79a500 ("ipsec: T2816: add Jinja2 converter for ESP/IKE groups to
string") added a Jinja2 helper function which can be used to transform VyOS CLI
ESP and IKE key proposals into a strongSwan compatible string cipher.
This commit changes the IPSec implementation to make use of this new Jinja2
filter fubction/Python helper. This is required base work for better automated
tests (smoketests) but also for an IKEv2 road-warrior setup.
Diffstat (limited to 'data/templates/ipsec/swanctl/profile.tmpl')
| -rw-r--r-- | data/templates/ipsec/swanctl/profile.tmpl | 13 |
1 files changed, 8 insertions, 5 deletions
diff --git a/data/templates/ipsec/swanctl/profile.tmpl b/data/templates/ipsec/swanctl/profile.tmpl index f6f6f4d70..0360972f6 100644 --- a/data/templates/ipsec/swanctl/profile.tmpl +++ b/data/templates/ipsec/swanctl/profile.tmpl @@ -1,9 +1,12 @@ -{% macro conn(name, profile_conf, ike, esp, ciphers) %} +{% macro conn(name, profile_conf, ike_group, esp_group) %} +{# peer needs to reference the global IKE configuration for certain values #} +{% set ike = ike_group[profile_conf.ike_group] %} +{% set esp = esp_group[profile_conf.esp_group] %} {% if profile_conf.bind is defined and profile_conf.bind.tunnel is defined %} {% for interface in profile_conf.bind.tunnel %} dmvpn-{{ name }}-{{ interface }} { - proposals = {{ ciphers.ike[profile_conf.ike_group] }} - version = {{ ike.key_exchange[4:] if ike.key_exchange is defined else "0" }} + proposals = {{ ike_group[profile_conf.ike_group] | get_esp_ike_cipher | join(',') }} + version = {{ ike.key_exchange[4:] if ike is defined and ike.key_exchange is defined else "0" }} rekey_time = {{ ike.lifetime if ike.lifetime is defined else '28800' }}s keyingtries = 0 {% if profile_conf.authentication is defined and profile_conf.authentication.mode is defined and profile_conf.authentication.mode == 'pre-shared-secret' %} @@ -16,12 +19,12 @@ {% endif %} children { dmvpn { - esp_proposals = {{ ciphers.esp[profile_conf.esp_group] }} + esp_proposals = {{ esp | get_esp_ike_cipher | join(',') }} rekey_time = {{ esp.lifetime if esp.lifetime is defined else '3600' }}s rand_time = 540s local_ts = dynamic[gre] remote_ts = dynamic[gre] - mode = {{ esp.mode if esp.mode is defined else "transport" }} + mode = {{ esp.mode if esp.mode is defined else 'transport' }} {% if ike.dead_peer_detection is defined and ike.dead_peer_detection.action is defined %} dpd_action = {{ ike.dead_peer_detection.action }} {% endif %} |