diff options
| author | Oleksandr Kuchmystyi <o.kuchmystyi@vyos.io> | 2025-07-25 16:44:37 +0300 |
|---|---|---|
| committer | Oleksandr Kuchmystyi <o.kuchmystyi@vyos.io> | 2025-07-28 11:43:42 +0300 |
| commit | 46a0e2cfc99a41a43fbcede2f02d8ad8f98daffb (patch) | |
| tree | 1a22e0b475ae0e4c576702cd1ac9f174f9374eac /data | |
| parent | 6c6bcb59b85efdb60129639afaade482a2419cfe (diff) | |
| download | vyos-1x-46a0e2cfc99a41a43fbcede2f02d8ad8f98daffb.tar.gz vyos-1x-46a0e2cfc99a41a43fbcede2f02d8ad8f98daffb.zip | |
ipsec: T7581: Fix unsupported 'all' protocol in site-to-site tunnels after upgrade to 1.4.x
Upgrading from VyOS 1.3.8 (strongSwan 5.7.2) to 1.4.x (strongSwan 5.9.11) caused
the IPsec service to fail if the configuration contained:
```
set vpn ipsec site-to-site peer <peer> tunnel <id> protocol 'all'
```
In 1.3.8, 'all' was supported in the CLI for protocol and converted internally to '%any'
in ipsec.conf traffic selectors, allowing the tunnel to match all protocols. However, in
1.4.x and strongSwan 5.9.11+, the '[all/]' syntax is no longer supported, and use of
'protocol all' produces an invalid traffic selector (e.g., 'x.x.x.0/24[all/]'), causing
the strongSwan service to fail on reload.
This fix ensures that 'protocol all' is converted to just the subnet notation (e.g.,
'x.x.x.0/24') in the generated traffic selector, restoring previous behavior and allowing
seamless service startup after upgrade.
Diffstat (limited to 'data')
| -rw-r--r-- | data/templates/ipsec/swanctl/peer.j2 | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/data/templates/ipsec/swanctl/peer.j2 b/data/templates/ipsec/swanctl/peer.j2 index cf0865c88..b6b5d2dac 100644 --- a/data/templates/ipsec/swanctl/peer.j2 +++ b/data/templates/ipsec/swanctl/peer.j2 @@ -111,6 +111,12 @@ {% set tunnel_esp_name = tunnel_conf.esp_group if tunnel_conf.esp_group is vyos_defined else peer_conf.default_esp_group %} {% set tunnel_esp = esp_group[tunnel_esp_name] %} {% set proto = tunnel_conf.protocol if tunnel_conf.protocol is vyos_defined else '' %} +{# VyOS 1.3.x (with strongSwan 5.7.x) previously allowed using `all` in traffic selectors, converting it to `%any`. #} +{# In strongSwan 5.9.x (VyOS >= 1.4.x), the syntax `x.x.x.0/24[all/]` is no longer accepted. #} +{# We must now explicitly specify a protocol (e.g., `tcp`, `udp`). #} +{# To achieve "all" protocol behavior, simply use the subnet notation without brackets, #} +{# such as `x.x.x.0/24` or `x.x.x.0/24[/443]`. #} +{% set proto = '' if proto == 'all' else proto %} {% set local_port = tunnel_conf.local.port if tunnel_conf.local.port is vyos_defined else '' %} {% set local_suffix = '[{0}/{1}]'.format(proto, local_port) if proto or local_port else '' %} {% set remote_port = tunnel_conf.remote.port if tunnel_conf.remote.port is vyos_defined else '' %} |