From 79f1c891f3ae72fae3028f114e652225a082d9ef Mon Sep 17 00:00:00 2001
From: sarthurdev <965089+sarthurdev@users.noreply.github.com>
Date: Sun, 4 Jul 2021 17:17:54 +0200
Subject: ipsec: T1210: T1251: extend ra config with address pools/traffic
 selectors

---
 interface-definitions/vpn_ipsec.xml.in | 126 +++++++++++++++++++++++++++++++++
 1 file changed, 126 insertions(+)

(limited to 'interface-definitions')

diff --git a/interface-definitions/vpn_ipsec.xml.in b/interface-definitions/vpn_ipsec.xml.in
index ef3b05e29..a9444ecc5 100644
--- a/interface-definitions/vpn_ipsec.xml.in
+++ b/interface-definitions/vpn_ipsec.xml.in
@@ -743,6 +743,132 @@
               #include <include/generic-disable-node.xml.i>
               #include <include/ipsec/esp-group.xml.i>
               #include <include/ipsec/ike-group.xml.i>
+              <leafNode name="local-address">
+                <properties>
+                  <help>IPv4 or IPv6 address of a local interface to use for VPN</help>
+                  <completionHelp>
+                    <list>any</list>
+                  </completionHelp>
+                  <valueHelp>
+                    <format>ipv4</format>
+                    <description>IPv4 address of a local interface for VPN</description>
+                  </valueHelp>
+                  <valueHelp>
+                    <format>ipv6</format>
+                    <description>IPv6 address of a local interface for VPN</description>
+                  </valueHelp>
+                  <valueHelp>
+                    <format>any</format>
+                    <description>Allow any IPv4 address present on the system to be used for VPN</description>
+                  </valueHelp>
+                  <constraint>
+                    <validator name="ipv4-address"/>
+                    <validator name="ipv6-address"/>
+                    <regex>^(any)$</regex>
+                  </constraint>
+                </properties>
+              </leafNode>
+              <node name="local-network">
+                <properties>
+                  <help>Local traffic selectors</help>
+                </properties>
+                <children>
+                  <leafNode name="port">
+                    <properties>
+                      <help>Any TCP or UDP port</help>
+                      <valueHelp>
+                        <format>port name</format>
+                        <description>Named port (any name in /etc/services, e.g., http)</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>u32:1-65535</format>
+                        <description>Numbered port</description>
+                      </valueHelp>
+                    </properties>
+                  </leafNode>
+                  <leafNode name="prefix">
+                    <properties>
+                      <help>Local IPv4 or IPv6 prefix</help>
+                      <valueHelp>
+                        <format>ipv4</format>
+                        <description>Local IPv4 prefix</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>ipv6</format>
+                        <description>Local IPv6 prefix</description>
+                      </valueHelp>
+                      <constraint>
+                        <validator name="ipv4-prefix"/>
+                        <validator name="ipv6-prefix"/>
+                      </constraint>
+                      <multi/>
+                    </properties>
+                  </leafNode>
+                </children>
+              </node>
+              <node name="pool">
+                <properties>
+                  <help>IP address pool for remote-access users</help>
+                </properties>
+                <children>
+                  <leafNode name="exclude">
+                    <properties>
+                      <help>Local IPv4 or IPv6 pool prefix exclusions</help>
+                      <valueHelp>
+                        <format>ipv4</format>
+                        <description>Local IPv4 pool prefix exclusion</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>ipv6</format>
+                        <description>Local IPv6 pool prefix exclusion</description>
+                      </valueHelp>
+                      <constraint>
+                        <validator name="ipv4-prefix"/>
+                        <validator name="ipv6-prefix"/>
+                      </constraint>
+                      <multi/>
+                    </properties>
+                  </leafNode>
+                  <leafNode name="prefix">
+                    <properties>
+                      <help>Local IPv4 or IPv6 pool prefix</help>
+                      <valueHelp>
+                        <format>ipv4</format>
+                        <description>Local IPv4 pool prefix</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>ipv6</format>
+                        <description>Local IPv6 pool prefix</description>
+                      </valueHelp>
+                      <constraint>
+                        <validator name="ipv4-prefix"/>
+                        <validator name="ipv6-prefix"/>
+                      </constraint>
+                    </properties>
+                  </leafNode>
+                  <leafNode name="dns-server">
+                    <properties>
+                      <help>IPv4 or IPv6 DNS addresses for pool</help>
+                      <completionHelp>
+                        <list>any</list>
+                      </completionHelp>
+                      <valueHelp>
+                        <format>ipv4</format>
+                        <description>IPv4 DNS address for pool</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>ipv6</format>
+                        <description>IPv6 DNS address for pool</description>
+                      </valueHelp>
+                      <constraint>
+                        <validator name="ipv4-address"/>
+                        <validator name="ipv6-address"/>
+                      </constraint>
+                      <multi/>
+                    </properties>
+                  </leafNode>
+                </children>
+              </node>
               <leafNode name="timeout">
                 <properties>
                   <help>Timeout to close connection if no data is transmitted</help>
-- 
cgit v1.2.3