diff options
| -rw-r--r-- | interface-definitions/vpn_ipsec.xml.in | 8 | ||||
| -rwxr-xr-x | smoketest/scripts/cli/test_vpn_ipsec.py | 62 | ||||
| -rwxr-xr-x | src/conf_mode/vpn_ipsec.py | 8 |
3 files changed, 78 insertions, 0 deletions
diff --git a/interface-definitions/vpn_ipsec.xml.in b/interface-definitions/vpn_ipsec.xml.in index a54b16736..517bf89fd 100644 --- a/interface-definitions/vpn_ipsec.xml.in +++ b/interface-definitions/vpn_ipsec.xml.in @@ -1228,6 +1228,13 @@ #include <include/generic-disable-node.xml.i> #include <include/ipsec/esp-group.xml.i> #include <include/ipsec/local-traffic-selector.xml.i> + <node name="local"> + <children> + <leafNode name="prefix"> + <defaultValue>dynamic</defaultValue> + </leafNode> + </children> + </node> #include <include/ip-protocol.xml.i> <leafNode name="priority"> <properties> @@ -1264,6 +1271,7 @@ </constraint> <multi/> </properties> + <defaultValue>dynamic</defaultValue> </leafNode> </children> </node> diff --git a/smoketest/scripts/cli/test_vpn_ipsec.py b/smoketest/scripts/cli/test_vpn_ipsec.py index 830e58fe8..7f52db74e 100755 --- a/smoketest/scripts/cli/test_vpn_ipsec.py +++ b/smoketest/scripts/cli/test_vpn_ipsec.py @@ -347,6 +347,68 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): for line in swanctl_conf_lines: self.assertIn(line, swanctl_conf) + def test_site_to_site_with_default_ts(self): + """Test 'site to site' with default value of local and remote Traffic Selection""" + + self.cli_set(base_path + ['ike-group', ike_group, 'key-exchange', 'ikev2']) + + local_address = '192.0.2.11' + life_bytes = '100000' + life_packets = '2000000' + + # vpn ipsec auth psk <tag> id <x.x.x.x> + self.cli_set( + base_path + ['authentication', 'psk', connection_name, 'id', local_id] + ) + self.cli_set( + base_path + ['authentication', 'psk', connection_name, 'id', remote_id] + ) + self.cli_set( + base_path + ['authentication', 'psk', connection_name, 'id', local_address] + ) + self.cli_set( + base_path + ['authentication', 'psk', connection_name, 'id', peer_ip] + ) + self.cli_set( + base_path + ['authentication', 'psk', connection_name, 'secret', secret] + ) + + # Site to site + peer_base_path = base_path + ['site-to-site', 'peer', connection_name] + + self.cli_set(base_path + ['esp-group', esp_group, 'life-bytes', life_bytes]) + self.cli_set(base_path + ['esp-group', esp_group, 'life-packets', life_packets]) + + self.cli_set(peer_base_path + ['authentication', 'mode', 'pre-shared-secret']) + self.cli_set(peer_base_path + ['ike-group', ike_group]) + self.cli_set(peer_base_path + ['default-esp-group', esp_group]) + self.cli_set(peer_base_path + ['local-address', local_address]) + self.cli_set(peer_base_path + ['remote-address', peer_ip]) + self.cli_set(peer_base_path + ['tunnel', '1', 'protocol', 'gre']) + + self.cli_commit() + + # Verify strongSwan configuration + swanctl_conf = read_file(swanctl_file) + swanctl_conf_lines = [ + f'version = 2', + f'auth = psk', + f'life_bytes = {life_bytes}', + f'life_packets = {life_packets}', + f'rekey_time = 28800s', # default value + f'proposals = aes128-sha1-modp1024', + f'esp_proposals = aes128-sha1-modp1024', + f'life_time = 3600s', # default value + f'local_addrs = {local_address} # dhcp:no', + f'remote_addrs = {peer_ip}', + f'mode = tunnel', + f'{connection_name}-tunnel-1', + f'local_ts = dynamic[gre/]', # default value + f'remote_ts = dynamic[gre/]', # default value + f'mode = tunnel', + ] + for line in swanctl_conf_lines: + self.assertIn(line, swanctl_conf) def test_site_to_site_vti(self): local_address = '192.0.2.10' diff --git a/src/conf_mode/vpn_ipsec.py b/src/conf_mode/vpn_ipsec.py index 1871956b2..dcb9f9c69 100755 --- a/src/conf_mode/vpn_ipsec.py +++ b/src/conf_mode/vpn_ipsec.py @@ -696,6 +696,8 @@ def generate(ipsec): generate_pki_files_x509(ipsec['pki'], rw_conf['authentication']['x509']) if 'site_to_site' in ipsec and 'peer' in ipsec['site_to_site']: + DEFAULT_TS_PREFIX = 'dynamic' + for peer, peer_conf in ipsec['site_to_site']['peer'].items(): if f'peer_{peer}' in ipsec['dhcp_no_address']: continue @@ -724,7 +726,13 @@ def generate(ipsec): passthrough = None for local_prefix in local_prefixes: + if local_prefix == DEFAULT_TS_PREFIX: + continue + for remote_prefix in remote_prefixes: + if remote_prefix == DEFAULT_TS_PREFIX: + continue + local_net = ipaddress.ip_network(local_prefix) remote_net = ipaddress.ip_network(remote_prefix) if local_net.subnet_of(remote_net): |