diff options
| author | Christian Breunig <christian@breunig.cc> | 2024-05-30 16:35:43 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-05-30 16:35:43 +0200 |
| commit | 9859440abcad1e32b76b14a413c84c218f48bc0b (patch) | |
| tree | 4a7708d720b87d103ac0039ce5a14faafe5f9785 /src | |
| parent | 5978273c679b053dab2b878b476f0fd350a3e243 (diff) | |
| parent | e6fe6e50a5c817e18c453e7bc42bb2e1c4b17671 (diff) | |
| download | vyos-1x-9859440abcad1e32b76b14a413c84c218f48bc0b.tar.gz vyos-1x-9859440abcad1e32b76b14a413c84c218f48bc0b.zip | |
Merge pull request #3552 from c-po/ipsec-profile
op-mode: ipsec: T6407: fix profile generation
Diffstat (limited to 'src')
| -rwxr-xr-x | src/op_mode/ikev2_profile_generator.py | 19 |
1 files changed, 13 insertions, 6 deletions
diff --git a/src/op_mode/ikev2_profile_generator.py b/src/op_mode/ikev2_profile_generator.py index 2b29f94bf..4ac4fb14a 100755 --- a/src/op_mode/ikev2_profile_generator.py +++ b/src/op_mode/ikev2_profile_generator.py @@ -144,15 +144,22 @@ tmp = reversed(tmp) data['rfqdn'] = '.'.join(tmp) pki = conf.get_config_dict(pki_base, get_first_key=True) -ca_name = data['authentication']['x509']['ca_certificate'] cert_name = data['authentication']['x509']['certificate'] -ca_cert = load_certificate(pki['ca'][ca_name]['certificate']) -cert = load_certificate(pki['certificate'][cert_name]['certificate']) +data['certs'] = [] + +for ca_name in data['authentication']['x509']['ca_certificate']: + tmp = {} + ca_cert = load_certificate(pki['ca'][ca_name]['certificate']) + cert = load_certificate(pki['certificate'][cert_name]['certificate']) + + + tmp['ca_cn'] = ca_cert.subject.get_attributes_for_oid(NameOID.COMMON_NAME)[0].value + tmp['cert_cn'] = cert.subject.get_attributes_for_oid(NameOID.COMMON_NAME)[0].value + tmp['ca_cert'] = conf.value(pki_base + ['ca', ca_name, 'certificate']) + + data['certs'].append(tmp) -data['ca_cn'] = ca_cert.subject.get_attributes_for_oid(NameOID.COMMON_NAME)[0].value -data['cert_cn'] = cert.subject.get_attributes_for_oid(NameOID.COMMON_NAME)[0].value -data['ca_cert'] = conf.value(pki_base + ['ca', ca_name, 'certificate']) esp_proposals = conf.get_config_dict(ipsec_base + ['esp-group', data['esp_group'], 'proposal'], key_mangling=('-', '_'), get_first_key=True) |