summaryrefslogtreecommitdiff
path: root/src/conf_mode
AgeCommit message (Collapse)Author
2021-07-18ipsec: T1210: remote-access pools can not hold both IPv4 and IPv6 prefixesChristian Poessinger
... this enables a dual-stack IKEv2 VPN deployment.
2021-07-18ipsec: T2816: limit remote-access nameservers to two IPv4 and two for IPv6Christian Poessinger
2021-07-18ipsec: l2tp: T2816: use common if 'key' in dict patternChristian Poessinger
2021-07-17ipsec: T2816: add missing +x permission on Python helperChristian Poessinger
2021-07-17Merge pull request #927 from zdc/T3655-sagittaChristian Poessinger
VRF: T3655: proper connection tracking for VRFs
2021-07-17VRF: T3655: proper connection tracking for VRFszsdc
Currently, all VRFs share the same connection tracking table, which can lead to problems: - traffic leaks to a wrong VRF - improper NAT rules handling when multiple VRFs contain the same IP networks - stateful firewall rules issues The commit implements connection tracking zones support. Each VRF utilizes its own zone, so connections will never mix up. It also adds some restrictions to VRF names and assigned table numbers, because of nftables and conntrack requirements: - VRF name should always start from a letter (interfaces that start from numbers are not supported in nftables rules) - table number must be in the 100-65535 range because conntrack supports only 65535 zones
2021-07-17ipsec: T2816: restore erroneous deleted fileChristian Poessinger
Commit 22739144 ('ipsec: T2816: migrate "ipsec interfaces" to "interface"') by accident deleted the vpn_ipsec.py Python handler. Handler was restored.
2021-07-17Revert "openvpn: T56: remove strict checks for tls cert-file and key-file"Christian Poessinger
This reverts commit c414479fdf1d5ad77170f977481fb9197c9559ae. This commit broke the smoketests and also OpenVPN complains: Options error: You must define certificate file (--cert) or PKCS#12 file (--pkcs12)
2021-07-17vxlan: T3683: bugfix on MTU calculation for IPv6 underlayChristian Poessinger
2021-07-17ipsec: T2816: migrate "ipsec interfaces" to "interface"Christian Poessinger
2021-07-15pki: ipsec: l2tp: T2816: T3642: Move IPSec/L2TP code into vpn_ipsec.py and ↵sarthurdev
update to use PKI.
2021-07-13T3663: remove some unused sleep imports.Daniil Baturin
2021-07-13T3663: use inotify-based watching for the IPsec process restart.Daniil Baturin
2021-07-13openvpn: T56: remove strict checks for tls cert-file and key-fileYun Zheng Hu
This makes the tls cert-file and key-file optional and allows for more advanced configurations via "openvpn-option", such as pkcs11 or pkcs12 options.
2021-07-11ipsec: T2816: use common "if key in dict:" patternChristian Poessinger
2021-07-11ipsec: T2816: fix NameErrorChristian Poessinger
Commit a5cd877a0a ("ipsec: T2816: Migrate ipsec-settings.xml.in and charon.conf to vpn_ipsec.py") unfortunately removed the dictionary definition for "data" which is required when running the l2tp handler script.
2021-07-07pki: T3642: Migrate rsa-keys to PKI configurationsarthurdev
2021-07-06ipsec: T2816: Migrate ipsec-settings.xml.in and charon.conf to vpn_ipsec.pysarthurdev
Also adds check for the charon socket instead of an arbitrary sleep()
2021-07-05ipsec: T1210: T1251: Add more features to remote-access connectionssarthurdev
- Adds client/server authentication methods. - Adds basic verification to remote-access. - Adds DHCP pool and options to remote-access. - Cleanup unused PKI files.
2021-07-05pki: ipsec: T3642: Fix issue with '.' being present in tag nodes, adds new ↵sarthurdev
vyos.util method `dict_search_args` to allow for dot characters in keys.
2021-07-04ipsec: T1210: T1251: IKEv2 road-warrior supportChristian Poessinger
set vpn ipsec esp-group ESP-RW compression 'disable' set vpn ipsec esp-group ESP-RW lifetime '3600' set vpn ipsec esp-group ESP-RW pfs 'disable' set vpn ipsec esp-group ESP-RW proposal 10 encryption 'aes256' set vpn ipsec esp-group ESP-RW proposal 10 hash 'sha256' set vpn ipsec esp-group ESP-RW proposal 20 encryption 'aes256' set vpn ipsec esp-group ESP-RW proposal 20 hash 'sha1' set vpn ipsec ike-group IKE-RW key-exchange 'ikev2' set vpn ipsec ike-group IKE-RW lifetime '10800' set vpn ipsec ike-group IKE-RW mobike 'enable' set vpn ipsec ike-group IKE-RW proposal 10 dh-group '2' set vpn ipsec ike-group IKE-RW proposal 10 encryption 'aes256' set vpn ipsec ike-group IKE-RW proposal 10 hash 'sha1' set vpn ipsec ike-group IKE-RW proposal 20 dh-group '2' set vpn ipsec ike-group IKE-RW proposal 20 encryption 'aes128' set vpn ipsec ike-group IKE-RW proposal 20 hash 'sha1' set vpn ipsec ipsec-interfaces interface 'dum0' set vpn ipsec remote-access rw authentication id 'vyos' set vpn ipsec remote-access rw authentication local-users username vyos password vyos set vpn ipsec remote-access rw authentication x509 ca-certificate 'peer_172-18-254-202' set vpn ipsec remote-access rw authentication x509 certificate 'peer_172-18-254-202' set vpn ipsec remote-access rw description 'asdf' set vpn ipsec remote-access rw esp-group 'ESP-RW' set vpn ipsec remote-access rw ike-group 'IKE-RW'
2021-07-03Revert "ipsec: T2816: drop duplicate dict key "data" from generate()"Christian Poessinger
This reverts commit fb1802111155b52c9d63a079e18127de76033678.
2021-07-03ipsec: T2816: drop duplicate dict key "data" from generate()Christian Poessinger
2021-07-03ipsec: T2816: provide esp and ike-group XML building blockChristian Poessinger
2021-07-03ipsec: T2816: rework log options for debuggingChristian Poessinger
Renamed CLI from "logging log-modes" to "log subsystem" and "logging log-level" to "log level". THat is more human firendly.
2021-07-03ipsec: T2816: remove default values from Jinja2 template and place them in XMLChristian Poessinger
VyOS has a known to work mechanism in supplying CLI default values into the Python configuration scripts. This commit removes hardcoded default values from the Jinja2 template and places them into the appropriate XML definitions. The big advantage is that the default value itself and the corresponding help string are located in the exact same file.
2021-07-03ipsec: T2816: rework IKE and ESP key assignmentChristian Poessinger
Commit 2d79a500 ("ipsec: T2816: add Jinja2 converter for ESP/IKE groups to string") added a Jinja2 helper function which can be used to transform VyOS CLI ESP and IKE key proposals into a strongSwan compatible string cipher. This commit changes the IPSec implementation to make use of this new Jinja2 filter fubction/Python helper. This is required base work for better automated tests (smoketests) but also for an IKEv2 road-warrior setup.
2021-07-02conntrack: T3535: add support for multiple failsave linksChristian Poessinger
2021-07-02ipsec: T3656: T3659: Fix pass-through with ipv6. Fix op-mode ipsec commands. ↵sarthurdev
Remove python3-crypto dependency.
2021-07-01vyos.util: remove no longer needed copy_file helper methodChristian Poessinger
The IPSec ceritifcate handling is now done by storing the CA key inside the running configuration.
2021-07-01Merge branch 'pki_ipsec' of https://github.com/sarthurdev/vyos-1x into pki-cliChristian Poessinger
* 'pki_ipsec' of https://github.com/sarthurdev/vyos-1x: pki: ipsec: T3642: Update migration script to account for file permission issues pki: ipsec: T3642: Migrate IPSec to use PKI configuration pki: T3642: New PKI config and management
2021-07-01ipsec: T3643: bugfix on wrong destination file path for x509 key fileChristian Poessinger
Commit a6b526fd982 ("ipsec: T3643: us vyos.util.copy_file() over raw UNIX cp command") used a new helper to copy the x509 certificate files, but it also added a bug where the certificate key file was copied to the wrong location. This has been fixed and the corect path is used again.
2021-06-29pki: ipsec: T3642: Migrate IPSec to use PKI configurationsarthurdev
2021-06-29pki: T3642: New PKI config and managementsarthurdev
2021-06-28ipsec: T1441: switch from vti to xfrm interfacesChristian Poessinger
XFRM interfaces are similar to VTI devices in their basic functionality but offer several advantages: * No tunnel endpoint addresses have to be configured on the interfaces. Compared to VTIs, which are layer 3 tunnel devices with mandatory endpoints, this resolves issues with wildcard addresses (only one VTI with wildcard endpoints is supported), avoids a 1:1 mapping between SAs and interfaces, and easily allows SAs with multiple peers to share the same interface. * Because there are no endpoint addresses, IPv4 and IPv6 SAs are supported on the same interface (VTI devices only support one address family). * IPsec modes other than tunnel are supported (VTI devices only support tunnel mode). * No awkward configuration via GRE keys and XFRM marks. Instead, a new identifier (XFRM interface ID) links policies and SAs with XFRM interfaces.
2021-06-28bgp: T3657: fix remote-as validator for IPv6 link-local peeringChristian Poessinger
The "v6only" CLI tree was not taken into account during validation. vyos@vyos:~$ show configuration commands | grep bgp set protocols bgp local-as '200' set protocols bgp neighbor eth0.204 address-family ipv6-unicast set protocols bgp neighbor eth0.204 interface v6only remote-as '100' vyos@vyos:~$ show bgp ipv6 sum IPv6 Unicast Summary: BGP router identifier 172.18.254.201, local AS number 200 vrf-id 0 BGP table version 0 RIB entries 0, using 0 bytes of memory Peers 1, using 21 KiB of memory Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt eth0.204 4 100 99 99 0 0 0 01:35:07 0 0 Total number of neighbors 1
2021-06-26banner: T2135: adjust to raw strings from vyatta-cfg repoChristian Poessinger
2021-06-26ipsec: T3643: us vyos.util.copy_file() over raw UNIX cp commandChristian Poessinger
2021-06-26ipsec: T3643: use variable for path namesChristian Poessinger
2021-06-26Revert "ipsec: T3643: move swanctl.conf to /run"Christian Poessinger
This reverts commit 95bbbb8bed92a60a320ff255c8b8656145f3c540.
2021-06-25openvpn: T1704: drop deprecated disable-ncp optionChristian Poessinger
2021-06-24ipsec: T3643: move swanctl.conf to /runChristian Poessinger
This is the completion of commit 50a742b5 ("IPSec: T3643: Fix path for swanctl.conf file") that moves the generated swanctl file from non-volatile to a volatile (tmpfs backed) storage like we do for all out configuration files. Thus it is ensured after a reboot or service deprecation there are no accidential leftovers from previous configurations stored on the system.
2021-06-21ipsec: T3641: Debian Bullseye uses python3-pycryptodomeChristian Poessinger
2021-06-20Merge pull request #887 from sarthurdev/mdns_vrrpChristian Poessinger
mdns: vrrp: T3635: Add ability to use mDNS repeater with VRRP
2021-06-20vrf: T3637: bind-to-all didn't work properlyDate Huang
because of typo change from `bind_to_all` to `bind-to-all` refer: interface-definitions/vrf.xml.in
2021-06-19mdns: vrrp: T3635: Add ability to use mDNS repeater with VRRPsarthurdev
2021-06-16tunnel: T3555: fix configuration error message grammarChristian Poessinger
2021-06-15ipsec: T2816: T645: T3613: Migrated IPsec to swanctl, includes multiple ↵sarthurdev
selectors, and selectors with VTI.
2021-06-13wwan: T3620: auto detect IP protocol based on requested addressesChristian Poessinger
(cherry picked from commit 1eb6aee88f411127175fdab031d896af1e1adbc3)
2021-06-13wwan: T3622: add support for APN authenticationChristian Poessinger
Some APNs require a username/password. Add CLI nodes (matching the PPPoE syntax) for client authentication. One APN would be the IPv4/IPv6 APN from Deutsche Telekom (Germany) APN Name: Telekom Internet IPv6 APN: internet.v6.telekom Benutzername: telekom Passwort: tm (cherry picked from commit c667a45a8fb06cb76c907348c4f1e3ec708b6e03)
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-16 23:38:09 +0000