From 6e82d5d87f0f7603a9de77f895b3ac3b67323a63 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Mon, 15 Aug 2022 20:05:18 +0200
Subject: ocserv: T4333: migrate to new vyos_defined Jinja2 test

---
 data/templates/ocserv/ocserv_config.j2 | 29 ++++++++++-------------------
 1 file changed, 10 insertions(+), 19 deletions(-)

(limited to 'data/templates/ocserv')

diff --git a/data/templates/ocserv/ocserv_config.j2 b/data/templates/ocserv/ocserv_config.j2
index 8418a2185..d3d022bb0 100644
--- a/data/templates/ocserv/ocserv_config.j2
+++ b/data/templates/ocserv/ocserv_config.j2
@@ -56,34 +56,25 @@ ban-reset-time = 300
 # The name to use for the tun device
 device = sslvpn
 
-# An alternative way of specifying the network:
-{% if network_settings %}
 # DNS settings
-{%     if network_settings.name_server is string %}
-dns = {{ network_settings.name_server }}
-{%     else %}
-{%         for dns in network_settings.name_server %}
+{% if network_settings.name_server is vyos_defined %}
+{%     for dns in network_settings.name_server %}
 dns = {{ dns }}
-{%         endfor %}
-{%     endif %}
+{%     endfor %}
+{% endif %}
+
 # IPv4 network pool
-{%     if network_settings.client_ip_settings %}
-{%         if network_settings.client_ip_settings.subnet %}
+{% if network_settings.client_ip_settings.subnet is vyos_defined %}
 ipv4-network = {{ network_settings.client_ip_settings.subnet }}
-{%         endif %}
-{%     endif %}
+{% endif %}
+
 # IPv6 network pool
-{%     if network_settings.client_ipv6_pool %}
-{%         if network_settings.client_ipv6_pool.prefix %}
+{% if network_settings.client_ipv6_pool.prefix is vyos_defined %}
 ipv6-network = {{ network_settings.client_ipv6_pool.prefix }}
 ipv6-subnet-prefix = {{ network_settings.client_ipv6_pool.mask }}
-{%         endif %}
-{%     endif %}
 {% endif %}
 
-{% if network_settings.push_route is string %}
-route = {{ network_settings.push_route }}
-{% else %}
+{% if network_settings.push_route is vyos_defined %}
 {%     for route in network_settings.push_route %}
 route = {{ route }}
 {%     endfor %}
-- 
cgit v1.2.3


From e41685a2f56cca0a53b4f8c084f61a85cf561c80 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Mon, 15 Aug 2022 20:16:02 +0200
Subject: ocserv: openconnect: T4614: add support for split-dns

set vpn openconnect network-settings split-dns <domain>
---
 data/templates/ocserv/ocserv_config.j2        |  5 +++++
 interface-definitions/vpn-openconnect.xml.in  | 13 +++++++++++++
 smoketest/scripts/cli/test_vpn_openconnect.py |  4 ++++
 3 files changed, 22 insertions(+)

(limited to 'data/templates/ocserv')

diff --git a/data/templates/ocserv/ocserv_config.j2 b/data/templates/ocserv/ocserv_config.j2
index d3d022bb0..e0cad5181 100644
--- a/data/templates/ocserv/ocserv_config.j2
+++ b/data/templates/ocserv/ocserv_config.j2
@@ -80,3 +80,8 @@ route = {{ route }}
 {%     endfor %}
 {% endif %}
 
+{% if network_settings.split_dns is vyos_defined %}
+{%     for tmp in network_settings.split_dns %}
+split-dns = {{ tmp }}
+{%     endfor %}
+{% endif %}
diff --git a/interface-definitions/vpn-openconnect.xml.in b/interface-definitions/vpn-openconnect.xml.in
index 21b47125d..6309863c5 100644
--- a/interface-definitions/vpn-openconnect.xml.in
+++ b/interface-definitions/vpn-openconnect.xml.in
@@ -265,6 +265,19 @@
                 </children>
               </node>
               #include <include/name-server-ipv4-ipv6.xml.i>
+              <leafNode name="split-dns">
+                <properties>
+                  <help>Domains over which the provided DNS should be used</help>
+                  <valueHelp>
+                    <format>txt</format>
+                    <description>Client prefix length</description>
+                  </valueHelp>
+                  <constraint>
+                    <validator name="fqdn"/>
+                  </constraint>
+                  <multi/>
+                </properties>
+              </leafNode>
             </children>
           </node>
       </children>
diff --git a/smoketest/scripts/cli/test_vpn_openconnect.py b/smoketest/scripts/cli/test_vpn_openconnect.py
index 094812791..8572d6d66 100755
--- a/smoketest/scripts/cli/test_vpn_openconnect.py
+++ b/smoketest/scripts/cli/test_vpn_openconnect.py
@@ -98,6 +98,8 @@ class TestVPNOpenConnect(VyOSUnitTestSHIM.TestCase):
 
         for ns in name_server:
             self.cli_set(base_path + ['network-settings', 'name-server', ns])
+        for domain in split_dns:
+            self.cli_set(base_path + ['network-settings', 'split-dns', domain])
 
         self.cli_set(base_path + ['ssl', 'ca-certificate', 'openconnect'])
         self.cli_set(base_path + ['ssl', 'certificate', 'openconnect'])
@@ -115,6 +117,8 @@ class TestVPNOpenConnect(VyOSUnitTestSHIM.TestCase):
 
         for ns in name_server:
             self.assertIn(f'dns = {ns}', daemon_config)
+        for domain in split_dns:
+            self.assertIn(f'split-dns = {domain}', daemon_config)
 
         auth_config = read_file(auth_file)
         self.assertIn(f'{user}:*:$', auth_config)
-- 
cgit v1.2.3