diff options
| author | sarthurdev <965089+sarthurdev@users.noreply.github.com> | 2021-09-13 13:51:49 +0200 |
|---|---|---|
| committer | sarthurdev <965089+sarthurdev@users.noreply.github.com> | 2021-09-13 14:23:54 +0200 |
| commit | 2e68b070f1531c87d5976213565d9b929c5589ab (patch) | |
| tree | 8e9f48b32cb2cb6832b07babaf282120fa14e5ed /python | |
| parent | f86b7314d025fd0cf11c2d91638ed3cc7c4fa507 (diff) | |
| download | vyos-1x-2e68b070f1531c87d5976213565d9b929c5589ab.tar.gz vyos-1x-2e68b070f1531c87d5976213565d9b929c5589ab.zip | |
ipsec: T3828: Use IKE dh-group when ESP dh-group is set to `enable`
Diffstat (limited to 'python')
| -rw-r--r-- | python/vyos/template.py | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/python/vyos/template.py b/python/vyos/template.py index ee6e52e1d..d13915766 100644 --- a/python/vyos/template.py +++ b/python/vyos/template.py @@ -393,8 +393,15 @@ def get_ip(interface): from vyos.ifconfig import Interface return Interface(interface).get_addr() +def get_first_ike_dh_group(ike_group): + if ike_group and 'proposal' in ike_group: + for priority, proposal in ike_group['proposal'].items(): + if 'dh_group' in proposal: + return 'dh-group' + proposal['dh_group'] + return 'dh-group2' # Fallback on dh-group2 + @register_filter('get_esp_ike_cipher') -def get_esp_ike_cipher(group_config): +def get_esp_ike_cipher(group_config, ike_group=None): pfs_lut = { 'dh-group1' : 'modp768', 'dh-group2' : 'modp1024', @@ -433,7 +440,7 @@ def get_esp_ike_cipher(group_config): elif 'pfs' in group_config and group_config['pfs'] != 'disable': group = group_config['pfs'] if group_config['pfs'] == 'enable': - group = 'dh-group2' + group = get_first_ike_dh_group(ike_group) tmp += '-' + pfs_lut[group] ciphers.append(tmp) |