summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2021-07-06Merge pull request #911 from sarthurdev/pki_sanChristian Poessinger
pki: ipsec: T3642: T1210: T2816: Add SANs to generated certificates, more IPSec remote-access features and fixes
2021-07-06ipsec: T2816: Migrate ipsec-settings.xml.in and charon.conf to vpn_ipsec.pysarthurdev
Also adds check for the charon socket instead of an arbitrary sleep()
2021-07-05ipsec: T1210: T1251: Add more features to remote-access connectionssarthurdev
- Adds client/server authentication methods. - Adds basic verification to remote-access. - Adds DHCP pool and options to remote-access. - Cleanup unused PKI files.
2021-07-05T3663: python3-inotify should be a runtime dependencyJohn Estabrook
2021-07-05pki: ipsec: T3642: Fix issue with '.' being present in tag nodes, adds new ↵sarthurdev
vyos.util method `dict_search_args` to allow for dot characters in keys.
2021-07-05pki: T3642: Support for adding SANs on certificate requestssarthurdev
2021-07-04Merge pull request #910 from sarthurdev/pki_extChristian Poessinger
pki: T3642: Add standard extensions to generated certificates
2021-07-04pki: T3642: Add standard extensions to generated certificatessarthurdev
2021-07-04vyos.util: T3663: move inotify-based imports to function levelChristian Poessinger
Keep the vyos.util function clean and not pull in the rest of the world when importing it.
2021-07-04Merge pull request #908 from c-po/ipsec-ikev2-remote-accessChristian Poessinger
ipsec: T1210: T1251: IKEv2 road-warrior support
2021-07-04ipsec: T2816: add completion helper for tunnel interfacesChristian Poessinger
2021-07-04T3663: prerequisites for inotify-based watching implementations.Daniil Baturin
2021-07-04ipsec: T1210: T1251: add "local" traffic-selector include definitionChristian Poessinger
Used by both site2site and remote-access/road-warrior VPN connections.
2021-07-04ipsec: T1210: T1251: add remote-access "name-server" definition to pool configChristian Poessinger
2021-07-04ipsec: T2816: add completion helper for VTI interfacesChristian Poessinger
2021-07-04ipsec: T2816: add include definition for ipsec local-addressChristian Poessinger
2021-07-04ipsec: T2816: use common building block/include for port definitionChristian Poessinger
2021-07-04ipsec: T1210: T1251: extend ra config with address pools/traffic selectorssarthurdev
2021-07-04smoketest: pki: adjust to "type" node removal on CLIChristian Poessinger
A certificate "type" can be auto derived from the certificate itself.
2021-07-04ipsec: T1210: T1251: IKEv2 road-warrior supportChristian Poessinger
set vpn ipsec esp-group ESP-RW compression 'disable' set vpn ipsec esp-group ESP-RW lifetime '3600' set vpn ipsec esp-group ESP-RW pfs 'disable' set vpn ipsec esp-group ESP-RW proposal 10 encryption 'aes256' set vpn ipsec esp-group ESP-RW proposal 10 hash 'sha256' set vpn ipsec esp-group ESP-RW proposal 20 encryption 'aes256' set vpn ipsec esp-group ESP-RW proposal 20 hash 'sha1' set vpn ipsec ike-group IKE-RW key-exchange 'ikev2' set vpn ipsec ike-group IKE-RW lifetime '10800' set vpn ipsec ike-group IKE-RW mobike 'enable' set vpn ipsec ike-group IKE-RW proposal 10 dh-group '2' set vpn ipsec ike-group IKE-RW proposal 10 encryption 'aes256' set vpn ipsec ike-group IKE-RW proposal 10 hash 'sha1' set vpn ipsec ike-group IKE-RW proposal 20 dh-group '2' set vpn ipsec ike-group IKE-RW proposal 20 encryption 'aes128' set vpn ipsec ike-group IKE-RW proposal 20 hash 'sha1' set vpn ipsec ipsec-interfaces interface 'dum0' set vpn ipsec remote-access rw authentication id 'vyos' set vpn ipsec remote-access rw authentication local-users username vyos password vyos set vpn ipsec remote-access rw authentication x509 ca-certificate 'peer_172-18-254-202' set vpn ipsec remote-access rw authentication x509 certificate 'peer_172-18-254-202' set vpn ipsec remote-access rw description 'asdf' set vpn ipsec remote-access rw esp-group 'ESP-RW' set vpn ipsec remote-access rw ike-group 'IKE-RW'
2021-07-03ipsec: T2816: remove erroneously added config snipped for road-warriorsChristian Poessinger
Commit 32fab6c7c ("ipsec: T2816: provide esp and ike-group XML building block") by accident added an IKEv2 road-warrior configuration to swanctl template. The config blog was never activate as the CLI nodes are still missing. Still unclean :(.
2021-07-03Merge pull request #907 from sarthurdev/ipsec_cleanupChristian Poessinger
ipsec: T2816: Remove legacy vyatta code that references Openswan
2021-07-03ipsec: T2816: Remove legacy vyatta code that references Openswansarthurdev
2021-07-03Revert "ipsec: T2816: drop duplicate dict key "data" from generate()"Christian Poessinger
This reverts commit fb1802111155b52c9d63a079e18127de76033678.
2021-07-03Merge pull request #906 from sarthurdev/pki_typoChristian Poessinger
pki: T3642: Fix for correct method on encoding certificate request
2021-07-03pki: T3642: Fix for correct method on encoding certificate requestsarthurdev
2021-07-03ipsec: T1210: T1251: add dependency on libcharon-extauth-pluginsChristian Poessinger
2021-07-03ipsec: T2816: drop duplicate dict key "data" from generate()Christian Poessinger
2021-07-03ipsec: T2816: provide x509 certificate base auth building blocksChristian Poessinger
2021-07-03ipsec: T2816: provide esp and ike-group XML building blockChristian Poessinger
2021-07-03Merge pull request #905 from sarthurdev/pki_subcaChristian Poessinger
pki: T3642: Add support for signing and revoking subordinate CAs
2021-07-03ipsec: T2816: rework log options for debuggingChristian Poessinger
Renamed CLI from "logging log-modes" to "log subsystem" and "logging log-level" to "log level". THat is more human firendly.
2021-07-03pki: T3642: Add support for signing and revoking subordinate CAssarthurdev
2021-07-03Merge branch 'ipsec-ikev2-remote-access' of github.com:c-po/vyos-1x into currentChristian Poessinger
* 'ipsec-ikev2-remote-access' of github.com:c-po/vyos-1x: ipsec: T2816: remove default values from Jinja2 template and place them in XML ipsec: T2816: rework IKE and ESP key assignment ipsec: T2816: add Jinja2 converter for ESP/IKE groups to string ipsec: T2816: adjust Jinja2 template to coding style xml: provide building block for a generic description node
2021-07-03ipsec: T2816: remove default values from Jinja2 template and place them in XMLChristian Poessinger
VyOS has a known to work mechanism in supplying CLI default values into the Python configuration scripts. This commit removes hardcoded default values from the Jinja2 template and places them into the appropriate XML definitions. The big advantage is that the default value itself and the corresponding help string are located in the exact same file.
2021-07-03ipsec: T2816: rework IKE and ESP key assignmentChristian Poessinger
Commit 2d79a500 ("ipsec: T2816: add Jinja2 converter for ESP/IKE groups to string") added a Jinja2 helper function which can be used to transform VyOS CLI ESP and IKE key proposals into a strongSwan compatible string cipher. This commit changes the IPSec implementation to make use of this new Jinja2 filter fubction/Python helper. This is required base work for better automated tests (smoketests) but also for an IKEv2 road-warrior setup.
2021-07-03ipsec: T2816: add Jinja2 converter for ESP/IKE groups to stringChristian Poessinger
2021-07-02conntrack: T3535: add support for multiple failsave linksChristian Poessinger
2021-07-02conntrack: T3660: make peer port configurableChristian Poessinger
2021-07-02ipsec: T2816: adjust Jinja2 template to coding styleChristian Poessinger
* use indent = 2 * prefer 'if foo.bar is defined' over 'if "bar" in foo'
2021-07-02xml: provide building block for a generic description nodeChristian Poessinger
2021-07-02conntrack: T3535: add missing valueHelp/constraint for peer CLI nodeChristian Poessinger
2021-07-02smoketest: ipam: add site2site x509 auth testcaseChristian Poessinger
2021-07-02smoketest: ipsec: place peer local-address into variableChristian Poessinger
2021-07-02smoketest: ipsec: IKE and ESP settings can be done one time in setUp()Christian Poessinger
2021-07-02Merge pull request #903 from sarthurdev/T3659_T3656Christian Poessinger
ipsec: T3656: T3659: Fix passthrough with ipv6. Fix op-mode ipsec commands. Remove python3-crypto dependency.
2021-07-02ipsec: T3656: T3659: Fix pass-through with ipv6. Fix op-mode ipsec commands. ↵sarthurdev
Remove python3-crypto dependency.
2021-07-01vyos.util: remove no longer needed copy_file helper methodChristian Poessinger
The IPSec ceritifcate handling is now done by storing the CA key inside the running configuration.
2021-07-01Merge branch 'pki_ipsec' of https://github.com/sarthurdev/vyos-1x into pki-cliChristian Poessinger
* 'pki_ipsec' of https://github.com/sarthurdev/vyos-1x: pki: ipsec: T3642: Update migration script to account for file permission issues pki: ipsec: T3642: Migrate IPSec to use PKI configuration pki: T3642: New PKI config and management
2021-07-01ipsec: T3643: bugfix on wrong destination file path for x509 key fileChristian Poessinger
Commit a6b526fd982 ("ipsec: T3643: us vyos.util.copy_file() over raw UNIX cp command") used a new helper to copy the x509 certificate files, but it also added a bug where the certificate key file was copied to the wrong location. This has been fixed and the corect path is used again.
generated by cgit v1.2.3 (git 2.39.1) at 2024-10-10 10:28:02 +0000