From cdb97173c8ba251c577e30bb324555a418c32828 Mon Sep 17 00:00:00 2001 From: Oleksandr Kuchmystyi Date: Tue, 15 Jul 2025 12:31:07 +0300 Subject: ipsec: T7593: Add dynamic prefix for local and remote traffic selectors In case when there is no local/remote prefix configured in a tunnel settings, a protocol configured for such tunnel is ignored. The correct way to generate the configuration is to set the prefix to `dynamic` if it was not set. The correct config for the described case is: ``` local_ts = dynamic[gre/] remote_ts = dynamic[gre/] ``` --- src/conf_mode/vpn_ipsec.py | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'src') diff --git a/src/conf_mode/vpn_ipsec.py b/src/conf_mode/vpn_ipsec.py index 1871956b2..dcb9f9c69 100755 --- a/src/conf_mode/vpn_ipsec.py +++ b/src/conf_mode/vpn_ipsec.py @@ -696,6 +696,8 @@ def generate(ipsec): generate_pki_files_x509(ipsec['pki'], rw_conf['authentication']['x509']) if 'site_to_site' in ipsec and 'peer' in ipsec['site_to_site']: + DEFAULT_TS_PREFIX = 'dynamic' + for peer, peer_conf in ipsec['site_to_site']['peer'].items(): if f'peer_{peer}' in ipsec['dhcp_no_address']: continue @@ -724,7 +726,13 @@ def generate(ipsec): passthrough = None for local_prefix in local_prefixes: + if local_prefix == DEFAULT_TS_PREFIX: + continue + for remote_prefix in remote_prefixes: + if remote_prefix == DEFAULT_TS_PREFIX: + continue + local_net = ipaddress.ip_network(local_prefix) remote_net = ipaddress.ip_network(remote_prefix) if local_net.subnet_of(remote_net): -- cgit v1.2.3