Merge pull request #4930 from giga1699/T8136

ipsec: T8136: IPSEC PPK support

3 files changed, 41 insertions, 0 deletions

diff --git a/data/templates/ipsec/swanctl.conf.j2 b/data/templates/ipsec/swanctl.conf.j2
index e4e0b373d..6e143d5be 100644
--- a/data/templates/ipsec/swanctl.conf.j2
+++ b/data/templates/ipsec/swanctl.conf.j2
@@ -91,6 +91,8 @@ secrets {
 {%         endif %}
 {%         if psk_config.secret_type is vyos_defined('base64') %}
         secret = 0s{{ psk_config.secret }}
+{%         elif psk_config.secret_type is vyos_defined('hex') %}
+        secret = 0x{{ psk_config.secret }}
 {%         elif psk_config.secret_type is vyos_defined('plaintext') %}
         secret = "{{ psk_config.secret }}"
 {%         endif %}
@@ -98,6 +100,27 @@ secrets {
 {%     endfor %}
 {% endif %}
 
+{% if authentication.ppk is vyos_defined %}
+{%     for ppk, ppk_config in authentication.ppk.items() %}
+    ppk-{{ ppk }} {
+{%         if ppk_config.id is vyos_defined %}
+        # ID's from auth ppk <tag> id xxx
+{%             for id in ppk_config.id %}
+{%                 set gen_uuid = '' | generate_uuid4 %}
+        id-{{ gen_uuid }} = "{{ id }}"
+{%             endfor %}
+{%         endif %}
+{%         if ppk_config.secret_type is vyos_defined('base64') %}
+        secret = 0s{{ ppk_config.secret }}
+{%         elif ppk_config.secret_type is vyos_defined('hex') %}
+        secret = 0x{{ ppk_config.secret }}
+{%         elif ppk_config.secret_type is vyos_defined('plaintext') %}
+        secret = "{{ ppk_config.secret }}"
+{%         endif %}
+    }
+{%     endfor %}
+{% endif %}
+
 {% if remote_access.connection is vyos_defined %}
 {%     for ra, ra_conf in remote_access.connection.items() if ra_conf.disable is not vyos_defined %}
 {%         if ra_conf.authentication.server_mode is vyos_defined('pre-shared-secret') %}
diff --git a/data/templates/ipsec/swanctl/peer.j2 b/data/templates/ipsec/swanctl/peer.j2
index 15b5f5956..24d037fe1 100644
--- a/data/templates/ipsec/swanctl/peer.j2
+++ b/data/templates/ipsec/swanctl/peer.j2
@@ -3,6 +3,15 @@
 {# peer needs to reference the global IKE configuration for certain values #}
 {% set ike = ike_group[peer_conf.ike_group] %}
     {{ name }} {
+{% if peer_conf.authentication.ppk.id is vyos_defined %}
+        ppk_id = {{ peer_conf.authentication.ppk.id }}
+{% endif %}
+{% if peer_conf.authentication.ppk.required is vyos_defined %}
+        ppk_required = yes
+{% endif %}
+{% if peer_conf.childless is vyos_defined %}
+        childless = {{ peer_conf.childless }}
+{% endif %}
         proposals = {{ ike | get_esp_ike_cipher | join(',') }}
         version = {{ ike.key_exchange[4:] if ike.key_exchange is vyos_defined else "0" }}
 {% if peer_conf.virtual_address is vyos_defined %}
diff --git a/data/templates/ipsec/swanctl/remote_access.j2 b/data/templates/ipsec/swanctl/remote_access.j2
index d06b3d74b..77731e827 100644
--- a/data/templates/ipsec/swanctl/remote_access.j2
+++ b/data/templates/ipsec/swanctl/remote_access.j2
@@ -3,6 +3,15 @@
 {% set ike = ike_group[rw_conf.ike_group] %}
 {% set esp = esp_group[rw_conf.esp_group] %}
     ra-{{ name }} {
+{% if rw_conf.authentication.ppk.id is vyos_defined %}
+        ppk_id = {{ rw_conf.authentication.ppk.id }}
+{% endif %}
+{% if rw_conf.authentication.ppk.required is vyos_defined %}
+        ppk_required = yes
+{% endif %}
+{% if rw_conf.childless is vyos_defined %}
+        childless = {{ rw_conf.childless }}
+{% endif %}
         remote_addrs = %any
         local_addrs = {{ rw_conf.local_address if rw_conf.local_address is not vyos_defined('any') else '%any' }} # dhcp:{{ rw_conf.dhcp_interface if rw_conf.dhcp_interface is vyos_defined else 'no' }}
         proposals = {{ ike_group[rw_conf.ike_group] | get_esp_ike_cipher | join(',') }}