ipsec: T1210: split out pool from remote-access configuration

Remote access IP pools can now be defined at a global level and referenced
in IPSec remote-access connections. To defined a pool use:

set vpn ipsec remote-access pool global-ipv4 name-server '172.16.1.1'
set vpn ipsec remote-access pool global-ipv4 prefix '192.168.0.0/24'
set vpn ipsec remote-access pool global-ipv6 name-server '2001:db8::1'
set vpn ipsec remote-access pool global-ipv6 prefix '2001:db8:1000::/64'

A connection can then reference the pool:

set vpn ipsec remote-access connection foo pool 'global-ipv4'
set vpn ipsec remote-access connection foo pool 'global-ipv6'

3 files changed, 25 insertions, 49 deletions

diff --git a/data/templates/ipsec/charon/dhcp.conf.tmpl b/data/templates/ipsec/charon/dhcp.conf.tmpl
index 2879550a8..96dfd7633 100644
--- a/data/templates/ipsec/charon/dhcp.conf.tmpl
+++ b/data/templates/ipsec/charon/dhcp.conf.tmpl
@@ -1,12 +1,11 @@
 dhcp {
     load = yes
-
-{% if options is defined and options.remote_access is defined and options.remote_access.dhcp_pool is defined %}
-{%   if options.remote_access.dhcp_pool.interface is defined %}
-    interface = {{ options.remote_access.dhcp_pool.interface }}
+{% if options is defined and options.remote_access is defined and options.remote_access.dhcp is defined %}
+{%   if options.remote_access.dhcp.interface is defined %}
+    interface = {{ options.remote_access.dhcp.interface }}
 {%   endif %}
-{%   if options.remote_access.dhcp_pool.server is defined %}
-    server = {{ options.remote_access.dhcp_pool.server }}
+{%   if options.remote_access.dhcp.server is defined %}
+    server = {{ options.remote_access.dhcp.server }}
 {%   endif %}
 {% endif %}
 
diff --git a/data/templates/ipsec/swanctl.conf.tmpl b/data/templates/ipsec/swanctl.conf.tmpl
index b85fe7d41..161f19f95 100644
--- a/data/templates/ipsec/swanctl.conf.tmpl
+++ b/data/templates/ipsec/swanctl.conf.tmpl
@@ -15,8 +15,8 @@ connections {
 {{     peer_tmpl.conn(peer, peer_conf, ike_group, esp_group) }}
 {%   endfor %}
 {%  endif %}
-{% if remote_access is defined and remote_access is not none %}
-{%   for rw, rw_conf in remote_access.items() if rw_conf.disable is not defined %}
+{% if remote_access is defined and remote_access.connection is defined and remote_access.connection is not none %}
+{%   for rw, rw_conf in remote_access.connection.items() if rw_conf.disable is not defined %}
 {{ remote_access_tmpl.conn(rw, rw_conf, ike_group, esp_group) }}
 {%   endfor %}
 {% endif %}
@@ -26,33 +26,19 @@ connections {
 }
 
 pools {
-{%  if remote_access is defined %}
-{%    for ra, ra_conf in remote_access.items() if ra_conf.pool.dhcp_enable is not defined %}
-{%      if ra_conf.pool is defined and ra_conf.pool.prefix is defined %}
-{%        for prefix in ra_conf.pool.prefix %}
-{%          if prefix | is_ipv4 %}
-    ra-{{ ra }}-ipv4 {
-        addrs = {{ prefix }}
-{%            if ra_conf.pool.name_server_v4 is defined and ra_conf.pool.name_server_v4 is not none %}
-        dns = {{ ra_conf.pool.name_server_v4 | join(',') }}
-{%            endif %}
-{%            if ra_conf.pool.exclude_v4 is defined and ra_conf.pool.exclude_v4 is not none %}
-        split_exclude = {{ ra_conf.pool.exclude_v4 | join(',') }}
-{%            endif %}
-    }
-{%          elif prefix | is_ipv6 %}
-    ra-{{ ra }}-ipv6 {
-        addrs = {{ prefix }}
-{%            if ra_conf.pool.name_server_v6 is defined and ra_conf.pool.name_server_v6 is not none %}
-        dns = {{ ra_conf.pool.name_server_v6 | join(',') }}
-{%            endif %}
-{%            if ra_conf.pool.exclude_v6 is defined and ra_conf.pool.exclude_v6 is not none %}
-        split_exclude = {{ ra_conf.pool.exclude_v6 | join(',') }}
-{%            endif %}
-    }
-{%          endif %}
-{%        endfor %}
+{%  if remote_access is defined and remote_access.pool is defined and remote_access.pool is not none %}
+{%    for pool, pool_config in remote_access.pool.items() %}
+    {{ pool }} {
+{%      if pool_config.prefix is defined and pool_config.prefix is not none %}
+        addrs = {{ pool_config.prefix }}
 {%      endif %}
+{%      if pool_config.name_server is defined and pool_config.name_server is not none %}
+        dns = {{ pool_config.name_server | join(',') }}
+{%      endif %}
+{%      if pool_config.exclude is defined and pool_config.exclude is not none %}
+        split_exclude = {{ pool_config.exclude | join(',') }}
+{%      endif %}
+    }
 {%    endfor %}
 {%  endif %}
 }
@@ -103,8 +89,8 @@ secrets {
 {%      endif %}
 {%    endfor %}
 {%  endif %}
-{%  if remote_access is defined %}
-{%    for ra, ra_conf in remote_access.items() if remote_access is defined %}
+{%  if remote_access is defined and remote_access.connection is defined and remote_access.connection is not none %}
+{%    for ra, ra_conf in remote_access.connection.items() if ra_conf.disable is not defined %}
 {%      if ra_conf.authentication.server_mode == 'pre-shared-secret' %}
     ike_{{ ra }} {
 {%        if ra_conf.authentication.id is defined %}
diff --git a/data/templates/ipsec/swanctl/remote_access.tmpl b/data/templates/ipsec/swanctl/remote_access.tmpl
index ea79a6d6b..66ac94b13 100644
--- a/data/templates/ipsec/swanctl/remote_access.tmpl
+++ b/data/templates/ipsec/swanctl/remote_access.tmpl
@@ -10,18 +10,9 @@
         send_certreq = no
         rekey_time = {{ ike.lifetime }}s
         keyingtries = 0
-{%   if rw_conf.pool is defined and rw_conf.pool.dhcp_enable is defined %}
-        pools = dhcp
-{%   elif rw_conf.pool is defined and rw_conf.pool.prefix is defined and rw_conf.pool.prefix is not none %}
-{%   set pool = namespace(name='')  %}
-{%     for prefix in rw_conf.pool.prefix %}
-{%       if not loop.first %}
-{%         set pool.name = pool.name ~ ',' %}
-{%       endif %}
-{%       set afi = '-ipv4' if prefix | is_ipv4 else '-ipv6' %}
-{%       set pool.name = pool.name + 'ra-' + name + afi %}
-{%     endfor %}
-        pools = {{ pool.name }}
+        unique = never
+{%   if rw_conf.pool is defined and rw_conf.pool is not none %}
+        pools = {{ rw_conf.pool | join(',') }}
 {%   endif %}
         local {
 {%   if rw_conf.authentication.id is defined and rw_conf.authentication.use_x509_id is not defined %}
@@ -42,7 +33,7 @@
         }
         children {
             ikev2-vpn  {
-                esp_proposals = {{ esp | get_esp_ike_cipher | join(',')  }}
+                esp_proposals = {{ esp | get_esp_ike_cipher | join(',') }}
                 rekey_time = {{ esp.lifetime }}s
                 rand_time = 540s
                 dpd_action = clear