diff options
| author | Oleksandr Kuchmystyi <o.kuchmystyi@vyos.io> | 2025-07-25 16:44:37 +0300 |
|---|---|---|
| committer | Oleksandr Kuchmystyi <o.kuchmystyi@vyos.io> | 2025-07-28 11:43:42 +0300 |
| commit | 46a0e2cfc99a41a43fbcede2f02d8ad8f98daffb (patch) | |
| tree | 1a22e0b475ae0e4c576702cd1ac9f174f9374eac /interface-definitions | |
| parent | 6c6bcb59b85efdb60129639afaade482a2419cfe (diff) | |
| download | vyos-1x-46a0e2cfc99a41a43fbcede2f02d8ad8f98daffb.tar.gz vyos-1x-46a0e2cfc99a41a43fbcede2f02d8ad8f98daffb.zip | |
ipsec: T7581: Fix unsupported 'all' protocol in site-to-site tunnels after upgrade to 1.4.x
Upgrading from VyOS 1.3.8 (strongSwan 5.7.2) to 1.4.x (strongSwan 5.9.11) caused
the IPsec service to fail if the configuration contained:
```
set vpn ipsec site-to-site peer <peer> tunnel <id> protocol 'all'
```
In 1.3.8, 'all' was supported in the CLI for protocol and converted internally to '%any'
in ipsec.conf traffic selectors, allowing the tunnel to match all protocols. However, in
1.4.x and strongSwan 5.9.11+, the '[all/]' syntax is no longer supported, and use of
'protocol all' produces an invalid traffic selector (e.g., 'x.x.x.0/24[all/]'), causing
the strongSwan service to fail on reload.
This fix ensures that 'protocol all' is converted to just the subnet notation (e.g.,
'x.x.x.0/24') in the generated traffic selector, restoring previous behavior and allowing
seamless service startup after upgrade.
Diffstat (limited to 'interface-definitions')
0 files changed, 0 insertions, 0 deletions