vyos-1x.git - VyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git)

Age	Commit message (Collapse)	Author
2021-07-03	ipsec: T2816: remove default values from Jinja2 template and place them in XML	Christian Poessinger
	VyOS has a known to work mechanism in supplying CLI default values into the Python configuration scripts. This commit removes hardcoded default values from the Jinja2 template and places them into the appropriate XML definitions. The big advantage is that the default value itself and the corresponding help string are located in the exact same file.
2021-07-03	ipsec: T2816: rework IKE and ESP key assignment	Christian Poessinger
	Commit 2d79a500 ("ipsec: T2816: add Jinja2 converter for ESP/IKE groups to string") added a Jinja2 helper function which can be used to transform VyOS CLI ESP and IKE key proposals into a strongSwan compatible string cipher. This commit changes the IPSec implementation to make use of this new Jinja2 filter fubction/Python helper. This is required base work for better automated tests (smoketests) but also for an IKEv2 road-warrior setup.
2021-07-02	ipsec: T2816: adjust Jinja2 template to coding style	Christian Poessinger
	* use indent = 2 * prefer 'if foo.bar is defined' over 'if "bar" in foo'
2021-07-01	Merge branch 'pki_ipsec' of https://github.com/sarthurdev/vyos-1x into pki-cli	Christian Poessinger
	* 'pki_ipsec' of https://github.com/sarthurdev/vyos-1x: pki: ipsec: T3642: Update migration script to account for file permission issues pki: ipsec: T3642: Migrate IPSec to use PKI configuration pki: T3642: New PKI config and management
2021-06-29	pki: ipsec: T3642: Migrate IPSec to use PKI configuration	sarthurdev

2021-06-28	ipsec: T1441: switch from vti to xfrm interfaces	Christian Poessinger
	XFRM interfaces are similar to VTI devices in their basic functionality but offer several advantages: * No tunnel endpoint addresses have to be configured on the interfaces. Compared to VTIs, which are layer 3 tunnel devices with mandatory endpoints, this resolves issues with wildcard addresses (only one VTI with wildcard endpoints is supported), avoids a 1:1 mapping between SAs and interfaces, and easily allows SAs with multiple peers to share the same interface. * Because there are no endpoint addresses, IPv4 and IPv6 SAs are supported on the same interface (VTI devices only support one address family). * IPsec modes other than tunnel are supported (VTI devices only support tunnel mode). * No awkward configuration via GRE keys and XFRM marks. Instead, a new identifier (XFRM interface ID) links policies and SAs with XFRM interfaces.
2021-06-15	ipsec: T2816: T645: T3613: Migrated IPsec to swanctl, includes multiple ↵	sarthurdev
	selectors, and selectors with VTI.