summaryrefslogtreecommitdiff
path: root/src/conf_mode
diff options
context:
space:
mode:
authorChristian Poessinger <christian@poessinger.com>2021-07-18 21:35:53 +0200
committerChristian Poessinger <christian@poessinger.com>2021-07-18 21:35:53 +0200
commit48c768abbf53b752a55db2adea1f998cb28da55c (patch)
treef1f0870c19466ec128264af78701e08cea54744c /src/conf_mode
parent0a9ff39b48804af541ccd00f567c54014f8e1db2 (diff)
downloadvyos-1x-48c768abbf53b752a55db2adea1f998cb28da55c.tar.gz
vyos-1x-48c768abbf53b752a55db2adea1f998cb28da55c.zip
ipsec: T1210: remote-access pools can not hold both IPv4 and IPv6 prefixes
... this enables a dual-stack IKEv2 VPN deployment.
Diffstat (limited to 'src/conf_mode')
-rwxr-xr-xsrc/conf_mode/vpn_ipsec.py52
1 files changed, 42 insertions, 10 deletions
diff --git a/src/conf_mode/vpn_ipsec.py b/src/conf_mode/vpn_ipsec.py
index 078b70aee..49c6c6a2d 100755
--- a/src/conf_mode/vpn_ipsec.py
+++ b/src/conf_mode/vpn_ipsec.py
@@ -127,6 +127,33 @@ def get_config(config=None):
ipsec['l2tp_ike_default'] = 'aes256-sha1-modp1024,3des-sha1-modp1024,3des-sha1-modp1024'
ipsec['l2tp_esp_default'] = 'aes256-sha1,3des-sha1'
+ if 'remote_access' in ipsec:
+ for name, ra_conf in ipsec['remote_access'].items():
+ if 'pool' in ra_conf:
+ if 'name_server' in ra_conf['pool']:
+ ns_v4 = []
+ ns_v6 = []
+ for ns in ra_conf['pool']['name_server']:
+ if is_ipv4(ns): ns_v4.append(ns)
+ else: ns_v6.append(ns)
+
+ # Only update nameserver keys if there are address-family specific name-servers
+ if ns_v4:
+ ipsec['remote_access'][name]['pool'].update({'name_server_v4' : ns_v4})
+ if ns_v6:
+ ipsec['remote_access'][name]['pool'].update({'name_server_v6' : ns_v6})
+ del ipsec['remote_access'][name]['pool']['name_server']
+
+ if 'exclude' in ra_conf['pool']:
+ exclude_v4 = []
+ exclude_v6 = []
+ for exclude in ra_conf['pool']['exclude']:
+ if is_ipv4(exclude): exclude_v4.append(exclude)
+ else: exclude_v6.append(exclude)
+
+ ipsec['remote_access'][name]['pool'].update({'exclude_v4' : ns_v4, 'exclude_v6' : ns_v6})
+ del ipsec['remote_access'][name]['pool']['exclude']
+
return ipsec
def get_dhcp_address(iface):
@@ -261,16 +288,21 @@ def verify(ipsec):
raise ConfigError(f"Missing pre-shared-key on {name} remote-access config")
if 'pool' in ra_conf:
- if 'name_server' in ra_conf['pool']:
- dns_v4 = []
- dns_v6 = []
- for addr in ra_conf['pool']['name_server']:
- if is_ipv4(addr): dns_v4.append(addr)
- else: dns_v6.append(addr)
- if len(dns_v4) > 2:
- raise ConfigError(f'IPSec remote-access "{name}" supports only 2 IPv4 name-servers!')
- if len(dns_v6) > 2:
- raise ConfigError(f'IPSec remote-access "{name}" supports only 2 IPv6 name-servers!')
+ if 'name_server_ipv4' in ra_conf['pool'] and len(ra_conf['pool']['name_server_ipv4']) > 2:
+ raise ConfigError(f'IPSec remote-access "{name}" supports only two IPv4 name-servers!')
+ if 'name_server_ipv6' in ra_conf['pool'] and len(ra_conf['pool']['name_server_ipv6']) > 2:
+ raise ConfigError(f'IPSec remote-access "{name}" supports only two IPv6 name-servers!')
+
+ if 'prefix' in ra_conf['pool']:
+ prefix_v4 = []
+ prefix_v6 = []
+ for prefix in ra_conf['pool']['prefix']:
+ if is_ipv4(prefix): prefix_v4.append(prefix)
+ else: prefix_v6.append(prefix)
+ if len(prefix_v4) > 1:
+ raise ConfigError(f'IPSec remote-access "{name}" supports only one IPv4 prefix!')
+ if len(prefix_v6) > 1:
+ raise ConfigError(f'IPSec remote-access "{name}" supports only one IPv6 prefix!')
if 'site_to_site' in ipsec and 'peer' in ipsec['site_to_site']:
for peer, peer_conf in ipsec['site_to_site']['peer'].items():