No OneTemporary
Actions

Size

70 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/data/templates/ipsec/ipsec.conf.tmpl b/data/templates/ipsec/ipsec.conf.tmpl
	index a9ea1aac7..1cb531e76 100644
	--- a/data/templates/ipsec/ipsec.conf.tmpl
	+++ b/data/templates/ipsec/ipsec.conf.tmpl
	@@ -1,24 +1,18 @@
	# Created by VyOS - manual changes will be overwritten

	config setup
	{% set charondebug = '' %}
	{% if log is defined and log.subsystem is defined and log.subsystem is not none %}
	{% set subsystem = log.subsystem %}
	{% if 'any' in log.subsystem %}
	{% set subsystem = ['dmn', 'mgr', 'ike', 'chd','job', 'cfg', 'knl', 'net', 'asn',
	'enc', 'lib', 'esp', 'tls', 'tnc', 'imc', 'imv', 'pts'] %}
	{% endif %}
	{% set charondebug = subsystem \| join (' ' ~ log.level ~ ', ') ~ ' ' ~ log.level %}
	{% endif %}
	charondebug = "{{ charondebug }}"
	uniqueids = {{ "no" if disable_uniqreqids is defined else "yes" }}

	{% if include_ipsec_conf is defined %}
	include {{ include_ipsec_conf }}
	{% endif %}
	-
	-{% if delim_ipsec_l2tp_begin is defined %}
	-{{delim_ipsec_l2tp_begin}}
	-include {{ipsec_ra_conn_file}}
	-{{delim_ipsec_l2tp_end}}
	-{% endif %}
	diff --git a/data/templates/ipsec/ipsec.secrets.tmpl b/data/templates/ipsec/ipsec.secrets.tmpl
	index 43b5fe0d2..057e291ed 100644
	--- a/data/templates/ipsec/ipsec.secrets.tmpl
	+++ b/data/templates/ipsec/ipsec.secrets.tmpl
	@@ -1,15 +1,5 @@
	# Created by VyOS - manual changes will be overwritten

	{% if include_ipsec_secrets is defined %}
	include {{ include_ipsec_secrets }}
	{% endif %}
	-
	-{% if delim_ipsec_l2tp_begin is defined %}
	-{{delim_ipsec_l2tp_begin}}
	-{% if ipsec_l2tp_auth_mode == 'pre-shared-secret' %}
	-{{outside_addr}} %any : PSK "{{ipsec_l2tp_secret}}"
	-{% elif ipsec_l2tp_auth_mode == 'x509' %}
	-: RSA {{server_key_file_copied}}
	-{% endif %}
	-{{delim_ipsec_l2tp_end}}
	-{% endif %}
	diff --git a/data/templates/ipsec/remote-access.tmpl b/data/templates/ipsec/remote-access.tmpl
	deleted file mode 100644
	index fae48232f..000000000
	--- a/data/templates/ipsec/remote-access.tmpl
	+++ /dev/null
	@@ -1,28 +0,0 @@
	-{{delim_ipsec_l2tp_begin}}
	-conn {{ra_conn_name}}
	- type=transport
	- left={{outside_addr}}
	- leftsubnet=%dynamic[/1701]
	- rightsubnet=%dynamic
	- mark_in=%unique
	- auto=add
	- ike=aes256-sha1-modp1024,3des-sha1-modp1024,3des-sha1-modp1024!
	- dpddelay=15
	- dpdtimeout=45
	- dpdaction=clear
	- esp=aes256-sha1,3des-sha1!
	- rekey=no
	-{% if ipsec_l2tp_auth_mode == 'pre-shared-secret' %}
	- authby=secret
	- leftauth=psk
	- rightauth=psk
	-{% elif ipsec_l2tp_auth_mode == 'x509' %}
	- authby=rsasig
	- leftrsasigkey=%cert
	- rightrsasigkey=%cert
	- rightca=%same
	- leftcert={{server_cert_file_copied}}
	-{% endif %}
	- ikelifetime={{ipsec_l2tp_ike_lifetime}}
	- keylife={{ipsec_l2tp_lifetime}}
	-{{delim_ipsec_l2tp_end}}
	diff --git a/data/templates/ipsec/swanctl.conf.tmpl b/data/templates/ipsec/swanctl.conf.tmpl
	index a6ab73cc2..102d7583f 100644
	--- a/data/templates/ipsec/swanctl.conf.tmpl
	+++ b/data/templates/ipsec/swanctl.conf.tmpl
	@@ -1,107 +1,127 @@
	### Autogenerated by vpn_ipsec.py ###
	+{% import 'ipsec/swanctl/l2tp.tmpl' as l2tp_tmpl %}
	{% import 'ipsec/swanctl/profile.tmpl' as profile_tmpl %}
	{% import 'ipsec/swanctl/peer.tmpl' as peer_tmpl %}
	{% import 'ipsec/swanctl/remote_access.tmpl' as remote_access_tmpl %}

	connections {
	{% if profile is defined %}
	{% for name, profile_conf in profile.items() if profile_conf.disable is not defined and profile_conf.bind is defined and profile_conf.bind.tunnel is defined %}
	{{ profile_tmpl.conn(name, profile_conf, ike_group, esp_group) }}
	{% endfor %}
	{% endif %}
	{% if site_to_site is defined and site_to_site.peer is defined %}
	{% for peer, peer_conf in site_to_site.peer.items() if peer not in dhcp_no_address and peer_conf.disable is not defined %}
	{{ peer_tmpl.conn(peer, peer_conf, ike_group, esp_group) }}
	{% endfor %}
	{% endif %}
	{% if remote_access is defined and remote_access is not none %}
	{% for rw, rw_conf in remote_access.items() if rw_conf.disable is not defined %}
	{{ remote_access_tmpl.conn(rw, rw_conf, ike_group, esp_group) }}
	{% endfor %}
	{% endif %}
	+{% if l2tp %}
	+{{ l2tp_tmpl.conn(l2tp, l2tp_outside_address, l2tp_ike_default, l2tp_esp_default, ike_group, esp_group) }}
	+{% endif %}
	}

	pools {
	{% if remote_access is defined %}
	{% for ra, ra_conf in remote_access.items() if ra_conf.pool.dhcp_enable is not defined %}
	ra-{{ ra }} {
	addrs = {{ ra_conf.pool.prefix }}
	dns = {{ ra_conf.pool.name_server \| join(",") }}
	{% if ra_conf.pool.exclude is defined %}
	split_exclude = {{ ra_conf.pool.exclude \| join(",") }}
	{% endif %}
	}
	{% endfor %}
	{% endif %}
	}

	secrets {
	{% if profile is defined %}
	{% for name, profile_conf in profile.items() if profile_conf.disable is not defined and profile_conf.bind is defined and profile_conf.bind.tunnel is defined %}
	{% if profile_conf.authentication.mode == 'pre-shared-secret' %}
	{% for interface in profile_conf.bind.tunnel %}
	ike-dmvpn-{{ interface }} {
	secret = {{ profile_conf.authentication.pre_shared_secret }}
	}
	{% endfor %}
	{% endif %}
	{% endfor %}
	{% endif %}
	{% if site_to_site is defined and site_to_site.peer is defined %}
	{% for peer, peer_conf in site_to_site.peer.items() if peer not in dhcp_no_address and peer_conf.disable is not defined %}
	{% set peer_name = peer.replace(".", "-").replace("@", "") %}
	{% if peer_conf.authentication.mode == 'pre-shared-secret' %}
	ike_{{ peer_name }} {
	{% if peer_conf.local_address is defined %}
	id-local = {{ peer_conf.local_address }} # dhcp:{{ peer_conf.dhcp_interface if 'dhcp_interface' in peer_conf else 'no' }}
	{% endif %}
	id-remote = {{ peer }}
	{% if peer_conf.authentication.id is defined %}
	id-localid = {{ peer_conf.authentication.id }}
	{% endif %}
	{% if peer_conf.authentication.remote_id is defined %}
	id-remoteid = {{ peer_conf.authentication.remote_id }}
	{% endif %}
	secret = "{{ peer_conf.authentication.pre_shared_secret }}"
	}
	{% elif peer_conf.authentication.mode == 'x509' %}
	private_{{ peer_name }} {
	file = {{ peer_conf.authentication.x509.certificate }}.pem
	{% if peer_conf.authentication.x509.passphrase is defined %}
	secret = "{{ peer_conf.authentication.x509.passphrase }}"
	{% endif %}
	}
	{% elif peer_conf.authentication.mode == 'rsa' %}
	rsa_{{ peer_name }}_local {
	file = {{ peer_conf.authentication.rsa.local_key }}.pem
	{% if peer_conf.authentication.rsa.passphrase is defined %}
	secret = "{{ peer_conf.authentication.rsa.passphrase }}"
	{% endif %}
	}
	{% endif %}
	{% endfor %}
	{% endif %}
	{% if remote_access is defined %}
	{% for ra, ra_conf in remote_access.items() if remote_access is defined %}
	{% if ra_conf.authentication.server_mode == 'pre-shared-secret' %}
	ike_{{ ra }} {
	{% if ra_conf.authentication.id is defined %}
	id = "{{ ra_conf.authentication.id }}"
	{% elif ra_conf.local_address is defined %}
	id = "{{ ra_conf.local_address }}"
	{% endif %}
	secret = "{{ ra_conf.authentication.pre_shared_secret }}"
	}
	{% endif %}
	{% if ra_conf.authentication.client_mode == 'eap-mschapv2' and ra_conf.authentication.local_users is defined and ra_conf.authentication.local_users.username is defined %}
	{% for user, user_conf in ra_conf.authentication.local_users.username.items() if user_conf.disable is not defined %}
	eap-{{ ra }}-{{ user }} {
	secret = "{{ user_conf.password }}"
	id-{{ ra }}-{{ user }} = "{{ user }}"
	}
	{% endfor %}
	{% endif %}
	{% endfor %}
	{% endif %}
	+{% if l2tp %}
	+{% if l2tp.authentication.mode == 'pre-shared-secret' %}
	+ ike_l2tp_remote_access {
	+ id = "{{ l2tp_outside_address }}"
	+ secret = "{{ l2tp.authentication.pre_shared_secret }}"
	+ }
	+{% elif l2tp.authentication.mode == 'x509' %}
	+ private_l2tp_remote_access {
	+ id = "{{ l2tp_outside_address }}"
	+ file = {{ l2tp.authentication.x509.certificate }}.pem
	+{% if l2tp.authentication.x509.passphrase is defined %}
	+ secret = "{{ l2tp.authentication.x509.passphrase }}"
	+{% endif %}
	+ }
	+{% endif %}
	+{% endif %}
	}

	diff --git a/data/templates/ipsec/swanctl/l2tp.tmpl b/data/templates/ipsec/swanctl/l2tp.tmpl
	new file mode 100644
	index 000000000..2df5c2a4d
	--- /dev/null
	+++ b/data/templates/ipsec/swanctl/l2tp.tmpl
	@@ -0,0 +1,30 @@
	+{% macro conn(l2tp, l2tp_outside_address, l2tp_ike_default, l2tp_esp_default, ike_group, esp_group) %}
	+{% set l2tp_ike = ike_group[l2tp.ike_group] if l2tp.ike_group is defined else None %}
	+{% set l2tp_esp = esp_group[l2tp.esp_group] if l2tp.esp_group is defined else None %}
	+ l2tp_remote_access {
	+ proposals = {{ l2tp_ike \| get_esp_ike_cipher \| join(',') if l2tp_ike else l2tp_ike_default }}
	+ local_addrs = {{ l2tp_outside_address }}
	+ dpd_delay = 15s
	+ dpd_timeout = 45s
	+ rekey_time = {{ l2tp_ike.lifetime if l2tp_ike else l2tp.ike_lifetime }}s
	+ reauth_time = 0
	+ local {
	+ auth = {{ 'psk' if l2tp.authentication.mode == 'pre-shared-secret' else 'pubkey' }}
	+{% if l2tp.authentication.mode == 'x509' %}
	+ certs = {{ l2tp.authentication.x509.certificate }}.pem
	+{% endif %}
	+ }
	+ remote {
	+ auth = {{ 'psk' if l2tp.authentication.mode == 'pre-shared-secret' else 'pubkey' }}
	+ }
	+ children {
	+ l2tp_remote_access_esp {
	+ mode = transport
	+ esp_proposals = {{ l2tp_esp \| get_esp_ike_cipher \| join(',') if l2tp_esp else l2tp_esp_default }}
	+ life_time = {{ l2tp_esp.lifetime if l2tp_esp else l2tp.lifetime }}s
	+ local_ts = dynamic[/1701]
	+ remote_ts = dynamic
	+ }
	+ }
	+ }
	+{% endmacro %}
	diff --git a/interface-definitions/vpn_l2tp.xml.in b/interface-definitions/vpn_l2tp.xml.in
	index 4fbf3fa44..d9680c5db 100644
	--- a/interface-definitions/vpn_l2tp.xml.in
	+++ b/interface-definitions/vpn_l2tp.xml.in
	@@ -1,320 +1,285 @@
	<?xml version="1.0"?>
	<interfaceDefinition>
	<node name="vpn">
	<children>
	<node name="l2tp" owner="${vyos_conf_scripts_dir}/vpn_l2tp.py">
	<properties>
	<help>L2TP Virtual Private Network (VPN)</help>
	</properties>
	<children>
	<node name="remote-access">
	<properties>
	<help>Remote access L2TP VPN</help>
	</properties>
	<children>
	#include <include/accel-ppp/mtu-128-16384.xml.i>
	<leafNode name="outside-address">
	<properties>
	<help>External IP address to which VPN clients will connect</help>
	<constraint>
	<validator name="ipv4-address"/>
	</constraint>
	</properties>
	</leafNode>
	#include <include/accel-ppp/gateway-address.xml.i>
	#include <include/accel-ppp/name-server.xml.i>
	<node name="lns">
	<properties>
	<help>L2TP Network Server (LNS)</help>
	</properties>
	<children>
	<leafNode name="shared-secret">
	<properties>
	<help>Tunnel password used to authenticate the client (LAC)</help>
	</properties>
	</leafNode>
	</children>
	</node>
	<leafNode name="ccp-disable">
	<properties>
	<help>Disable Compression Control Protocol (CCP)</help>
	<valueless />
	</properties>
	</leafNode>
	<node name="ipsec-settings">
	<properties>
	<help>Internet Protocol Security (IPsec) for remote access L2TP VPN</help>
	</properties>
	<children>
	<node name="authentication">
	<properties>
	<help>IPsec authentication settings</help>
	</properties>
	<children>
	<leafNode name="mode">
	<properties>
	<help>Authentication mode for IPsec</help>
	<valueHelp>
	<format>pre-shared-secret</format>
	<description>Use pre-shared secret for IPsec authentication</description>
	</valueHelp>
	<valueHelp>
	<format>x509</format>
	<description>Use X.509 certificate for IPsec authentication</description>
	</valueHelp>
	<constraint>
	<regex>^(pre-shared-secret\|x509)$</regex>
	</constraint>
	<completionHelp>
	<list>pre-shared-secret x509</list>
	</completionHelp>
	</properties>
	</leafNode>
	<leafNode name="pre-shared-secret">
	<properties>
	<help>Pre-shared secret for IPsec</help>
	</properties>
	</leafNode>
	- <node name="x509">
	- <properties>
	- <help>X.509 certificate</help>
	- </properties>
	- <children>
	- #include <include/certificate-ca.xml.i>
	- <leafNode name="crl-file">
	- <properties>
	- <help>File containing the X.509 Certificate Revocation List (CRL)</help>
	- <valueHelp>
	- <format>txt</format>
	- <description>File in /config/auth</description>
	- </valueHelp>
	- </properties>
	- </leafNode>
	- <leafNode name="server-cert-file">
	- <properties>
	- <help>File containing the X.509 certificate for the remote access VPN server (this host)</help>
	- <valueHelp>
	- <format>txt</format>
	- <description>File in /config/auth</description>
	- </valueHelp>
	- </properties>
	- </leafNode>
	- <leafNode name="server-key-file">
	- <properties>
	- <help>File containing the private key for the X.509 certificate for the remote access VPN server (this host)</help>
	- <valueHelp>
	- <format>txt</format>
	- <description>File in /config/auth</description>
	- </valueHelp>
	- </properties>
	- </leafNode>
	- <leafNode name="server-key-password">
	- <properties>
	- <help>Password that protects the private key</help>
	- </properties>
	- </leafNode>
	- </children>
	- </node>
	+ #include <include/ipsec/authentication-x509.xml.i>
	</children>
	</node>
	<leafNode name="ike-lifetime">
	<properties>
	<help>IKE lifetime</help>
	<valueHelp>
	<format>u32:30-86400</format>
	<description>IKE lifetime in seconds (default 3600)</description>
	</valueHelp>
	<constraint>
	<validator name="numeric" argument="--range 30-86400"/>
	</constraint>
	</properties>
	+ <defaultValue>3600</defaultValue>
	</leafNode>
	<leafNode name="lifetime">
	<properties>
	<help>ESP lifetime</help>
	<valueHelp>
	<format>u32:30-86400</format>
	<description>IKE lifetime in seconds (default 3600)</description>
	</valueHelp>
	<constraint>
	<validator name="numeric" argument="--range 30-86400"/>
	</constraint>
	</properties>
	+ <defaultValue>3600</defaultValue>
	</leafNode>
	+ #include <include/ipsec/esp-group.xml.i>
	+ #include <include/ipsec/ike-group.xml.i>
	</children>
	</node>
	#include <include/accel-ppp/wins-server.xml.i>
	<node name="client-ip-pool">
	<properties>
	<help>Pool of client IP addresses (must be within a /24)</help>
	</properties>
	<children>
	#include <include/accel-ppp/client-ip-pool-start-stop.xml.i>
	#include <include/accel-ppp/client-ip-pool-subnet.xml.i>
	</children>
	</node>
	#include <include/accel-ppp/client-ipv6-pool.xml.i>
	<leafNode name="description">
	<properties>
	<help>Description for L2TP remote-access settings</help>
	</properties>
	</leafNode>
	<leafNode name="dhcp-interface">
	<properties>
	<help>DHCP interface to listen on</help>
	</properties>
	</leafNode>
	<leafNode name="idle">
	<properties>
	<help>PPP idle timeout</help>
	<valueHelp>
	<format>u32:30-86400</format>
	<description>PPP idle timeout in seconds (default 1800)</description>
	</valueHelp>
	<constraint>
	<validator name="numeric" argument="--range 30-86400"/>
	</constraint>
	</properties>
	</leafNode>
	<node name="authentication">
	<properties>
	<help>Authentication for remote access L2TP VPN</help>
	</properties>
	<children>
	<leafNode name="require">
	<properties>
	<help>Authentication protocol for remote access peer L2TP VPN</help>
	<valueHelp>
	<format>pap</format>
	<description>Require the peer to authenticate itself using PAP [Password Authentication Protocol].</description>
	</valueHelp>
	<valueHelp>
	<format>chap</format>
	<description>Require the peer to authenticate itself using CHAP [Challenge Handshake Authentication Protocol].</description>
	</valueHelp>
	<valueHelp>
	<format>mschap</format>
	<description>Require the peer to authenticate itself using CHAP [Challenge Handshake Authentication Protocol].</description>
	</valueHelp>
	<valueHelp>
	<format>mschap-v2</format>
	<description>Require the peer to authenticate itself using MS-CHAPv2 [Microsoft Challenge Handshake Authentication Protocol, Version 2].</description>
	</valueHelp>
	<constraint>
	<regex>^(pap\|chap\|mschap\|mschap-v2)$</regex>
	</constraint>
	<completionHelp>
	<list>pap chap mschap mschap-v2</list>
	</completionHelp>
	<multi />
	</properties>
	</leafNode>
	#include <include/accel-ppp/ppp-mppe.xml.i>
	#include <include/accel-ppp/auth-mode.xml.i>
	#include <include/accel-ppp/auth-local-users.xml.i>
	#include <include/radius-server-ipv4.xml.i>
	<node name="radius">
	<children>
	<tagNode name="server">
	<children>
	#include <include/accel-ppp/radius-additions-disable-accounting.xml.i>
	<leafNode name="fail-time">
	<properties>
	<help>Mark server unavailable for <n> seconds on failure</help>
	<valueHelp>
	<format>0-600</format>
	<description>Fail time penalty</description>
	</valueHelp>
	<constraint>
	<validator name="numeric" argument="--range 0-600"/>
	</constraint>
	<constraintErrorMessage>Fail time must be between 0 and 600 seconds</constraintErrorMessage>
	</properties>
	</leafNode>
	</children>
	</tagNode>
	<leafNode name="timeout">
	<properties>
	<help>Timeout to wait response from server (seconds)</help>
	</properties>
	</leafNode>
	<leafNode name="acct-timeout">
	<properties>
	<help>Timeout to wait reply for Interim-Update packets. (default 3 seconds)</help>
	</properties>
	</leafNode>
	<leafNode name="max-try">
	<properties>
	<help>Maximum number of tries to send Access-Request/Accounting-Request queries</help>
	</properties>
	</leafNode>
	<leafNode name="nas-identifier">
	<properties>
	<help>Value to send to RADIUS server in NAS-Identifier attribute and to be matched in DM/CoA requests.</help>
	</properties>
	</leafNode>
	<node name="dae-server">
	<properties>
	<help>IPv4 address and port to bind Dynamic Authorization Extension server (DM/CoA)</help>
	</properties>
	<children>
	<leafNode name="ip-address">
	<properties>
	<help>IP address for Dynamic Authorization Extension server (DM/CoA)</help>
	</properties>
	</leafNode>
	<leafNode name="port">
	<properties>
	<help>Port for Dynamic Authorization Extension server (DM/CoA)</help>
	</properties>
	</leafNode>
	<leafNode name="secret">
	<properties>
	<help>Secret for Dynamic Authorization Extension server (DM/CoA)</help>
	</properties>
	</leafNode>
	</children>
	</node>
	<node name="rate-limit">
	<properties>
	<help>Upload/Download speed limits</help>
	</properties>
	<children>
	<leafNode name="attribute">
	<properties>
	<help>Specifies which radius attribute contains rate information. (default is Filter-Id)</help>
	</properties>
	</leafNode>
	<leafNode name="vendor">
	<properties>
	<help>Specifies the vendor dictionary. (dictionary needs to be in /usr/share/accel-ppp/radius)</help>
	</properties>
	</leafNode>
	<leafNode name="enable">
	<properties>
	<help>Enables Bandwidth shaping via RADIUS</help>
	<valueless />
	</properties>
	</leafNode>
	</children>
	</node>
	</children>
	</node>
	</children>
	</node>
	<node name="ppp-options">
	<properties>
	<help>Advanced protocol options</help>
	</properties>
	<children>
	#include <include/accel-ppp/lcp-echo-interval-failure.xml.i>
	#include <include/accel-ppp/ppp-options-ipv6.xml.i>
	</children>
	</node>
	</children>
	</node>
	</children>
	</node>
	</children>
	</node>
	</interfaceDefinition>
	diff --git a/smoketest/configs/pki-ipsec b/smoketest/configs/pki-ipsec
	index 5025117f7..6fc239d27 100644
	--- a/smoketest/configs/pki-ipsec
	+++ b/smoketest/configs/pki-ipsec
	@@ -1,121 +1,148 @@
	interfaces {
	dummy dum0 {
	address 172.20.0.1/30
	}
	ethernet eth0 {
	address 192.168.150.1/24
	}
	}
	system {
	config-management {
	commit-revisions 100
	}
	console {
	device ttyS0 {
	speed 115200
	}
	}
	host-name vyos
	login {
	user vyos {
	authentication {
	encrypted-password $6$2Ta6TWHd/U$NmrX0x9kexCimeOcYK1MfhMpITF9ELxHcaBU/znBq.X2ukQOj61fVI2UYP/xBzP4QtiTcdkgs7WOQMHWsRymO/
	plaintext-password ""
	}
	}
	}
	ntp {
	server time1.vyos.net {
	}
	server time2.vyos.net {
	}
	server time3.vyos.net {
	}
	}
	syslog {
	global {
	facility all {
	level info
	}
	facility protocols {
	level debug
	}
	}
	}
	}
	vpn {
	ipsec {
	esp-group MyESPGroup {
	proposal 1 {
	encryption aes128
	hash sha1
	}
	}
	ike-group MyIKEGroup {
	proposal 1 {
	dh-group 2
	encryption aes128
	hash sha1
	}
	}
	ipsec-interfaces {
	interface eth0
	}
	site-to-site {
	peer 192.168.150.2 {
	authentication {
	mode x509
	x509 {
	ca-cert-file ovpn_test_ca.pem
	cert-file ovpn_test_server.pem
	key {
	file ovpn_test_server.key
	}
	}
	}
	default-esp-group MyESPGroup
	ike-group MyIKEGroup
	local-address 192.168.150.1
	tunnel 0 {
	local {
	prefix 172.20.0.0/24
	}
	remote {
	prefix 172.21.0.0/24
	}
	}
	}
	peer 192.168.150.3 {
	authentication {
	mode rsa
	pre-shared-secret MYSECRETKEY
	rsa-key-name peer2
	}
	default-esp-group MyESPGroup
	ike-group MyIKEGroup
	local-address 192.168.150.1
	tunnel 0 {
	local {
	prefix 172.20.0.0/24
	}
	remote {
	prefix 172.22.0.0/24
	}
	}
	}
	}
	}
	+ l2tp {
	+ remote-access {
	+ authentication {
	+ local-users {
	+ username alice {
	+ password notsecure
	+ }
	+ }
	+ mode local
	+ }
	+ client-ip-pool {
	+ start 192.168.255.2
	+ stop 192.168.255.254
	+ }
	+ ipsec-settings {
	+ authentication {
	+ mode x509
	+ x509 {
	+ ca-cert-file /config/auth/ovpn_test_ca.pem
	+ server-cert-file /config/auth/ovpn_test_server.pem
	+ server-key-file /config/auth/ovpn_test_server.key
	+ }
	+ }
	+ }
	+ outside-address 192.168.150.1
	+ }
	+ }
	rsa-keys {
	local-key {
	file /config/auth/ovpn_test_server.key
	}
	rsa-key-name peer2 {
	rsa-key 0sAwEAAbudt5WQZSW2plbixjpgx4yVN/WMHdYRIZhyypJWO4ujQ/UQS9j3oTBgV2+RLtQ0YQ7eocwIfkvJVUnnZVMyZ4asQMOarQgbQ5nFGliCcDOMtNXRxHlMsvmjLx4o6FWbGukwgoxsT2x915n0XMn4XJNNSIEQotxj2GWFhEfBSPHyOM++kODk0lkbE7mLeHMMFq02vQhoczzEPWxjUUoY3jywhmHMfb4PdAKLFyt9x40znmPCYh+NSMQmpBXtD3gjGtX62bgrqKuP3BJU44x1gLlv8rJAJ4SY74YKnFUZ8m5GSbnVapwPOrp65lJZFKOGs2XXjAp5leoR+wmSYyqbDJM=
	}
	}
	}


	// Warning: Do not remove the following line.
	// vyos-config-version: "bgp@1:broadcast-relay@1:cluster@1:config-management@1:conntrack@2:conntrack-sync@2:dhcp-relay@2:dhcp-server@5:dhcpv6-server@1:dns-forwarding@3:firewall@5:https@2:interfaces@22:ipoe-server@1:ipsec@6:isis@1:l2tp@3:lldp@1:mdns@1:nat@5:nat66@1:ntp@1:policy@1:pppoe-server@5:pptp@2:qos@1:quagga@9:rpki@1:salt@1:snmp@2:ssh@2:sstp@3:system@21:vrf@2:vrrp@2:vyos-accel-ppp@2:wanloadbalance@3:webproxy@2:zone-policy@1"
	// Release version: 1.4-rolling-202106290839
	diff --git a/src/conf_mode/ipsec-settings.py b/src/conf_mode/ipsec-settings.py
	deleted file mode 100755
	index a9885f3d3..000000000
	--- a/src/conf_mode/ipsec-settings.py
	+++ /dev/null
	@@ -1,222 +0,0 @@
	-#!/usr/bin/env python3
	-#
	-# Copyright (C) 2018-2020 VyOS maintainers and contributors
	-#
	-# This program is free software; you can redistribute it and/or modify
	-# it under the terms of the GNU General Public License version 2 or later as
	-# published by the Free Software Foundation.
	-#
	-# This program is distributed in the hope that it will be useful,
	-# but WITHOUT ANY WARRANTY; without even the implied warranty of
	-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	-# GNU General Public License for more details.
	-#
	-# You should have received a copy of the GNU General Public License
	-# along with this program. If not, see <http://www.gnu.org/licenses/>.
	-
	-import re
	-import os
	-
	-from sys import exit
	-
	-from vyos.config import Config
	-from vyos import ConfigError
	-from vyos.util import call, wait_for_file_write_complete
	-from vyos.template import render
	-
	-from vyos import airbag
	-airbag.enable()
	-
	-ra_conn_name = "remote-access"
	-ipsec_secrets_file = "/etc/ipsec.secrets"
	-ipsec_ra_conn_dir = "/etc/ipsec.d/tunnels/"
	-ipsec_ra_conn_file = ipsec_ra_conn_dir + ra_conn_name
	-ipsec_conf_file = "/etc/ipsec.conf"
	-ca_cert_path = "/etc/ipsec.d/cacerts"
	-server_cert_path = "/etc/ipsec.d/certs"
	-server_key_path = "/etc/ipsec.d/private"
	-delim_ipsec_l2tp_begin = "### VyOS L2TP VPN Begin ###"
	-delim_ipsec_l2tp_end = "### VyOS L2TP VPN End ###"
	-charon_pidfile = "/var/run/charon.pid"
	-
	-def get_config(config=None):
	- if config:
	- config = config
	- else:
	- config = Config()
	-
	- data = {}
	- if config.exists("vpn ipsec ipsec-interfaces interface"):
	- data["ipsec_interfaces"] = config.return_values("vpn ipsec ipsec-interfaces interface")
	-
	- # Init config variables
	- data["delim_ipsec_l2tp_begin"] = delim_ipsec_l2tp_begin
	- data["delim_ipsec_l2tp_end"] = delim_ipsec_l2tp_end
	- data["ipsec_ra_conn_file"] = ipsec_ra_conn_file
	- data["ra_conn_name"] = ra_conn_name
	- # Get l2tp ipsec settings
	- data["ipsec_l2tp"] = False
	- conf_ipsec_command = "vpn l2tp remote-access ipsec-settings " #last space is useful
	- if config.exists(conf_ipsec_command):
	- data["ipsec_l2tp"] = True
	-
	- # Authentication params
	- if config.exists(conf_ipsec_command + "authentication mode"):
	- data["ipsec_l2tp_auth_mode"] = config.return_value(conf_ipsec_command + "authentication mode")
	- if config.exists(conf_ipsec_command + "authentication pre-shared-secret"):
	- data["ipsec_l2tp_secret"] = config.return_value(conf_ipsec_command + "authentication pre-shared-secret")
	-
	- # mode x509
	- if config.exists(conf_ipsec_command + "authentication x509 ca-cert-file"):
	- data["ipsec_l2tp_x509_ca_cert_file"] = config.return_value(conf_ipsec_command + "authentication x509 ca-cert-file")
	- if config.exists(conf_ipsec_command + "authentication x509 crl-file"):
	- data["ipsec_l2tp_x509_crl_file"] = config.return_value(conf_ipsec_command + "authentication x509 crl-file")
	- if config.exists(conf_ipsec_command + "authentication x509 server-cert-file"):
	- data["ipsec_l2tp_x509_server_cert_file"] = config.return_value(conf_ipsec_command + "authentication x509 server-cert-file")
	- data["server_cert_file_copied"] = server_cert_path+"/"+re.search('\w+(?:\.\w+)*$', config.return_value(conf_ipsec_command + "authentication x509 server-cert-file")).group(0)
	- if config.exists(conf_ipsec_command + "authentication x509 server-key-file"):
	- data["ipsec_l2tp_x509_server_key_file"] = config.return_value(conf_ipsec_command + "authentication x509 server-key-file")
	- data["server_key_file_copied"] = server_key_path+"/"+re.search('\w+(?:\.\w+)*$', config.return_value(conf_ipsec_command + "authentication x509 server-key-file")).group(0)
	- if config.exists(conf_ipsec_command + "authentication x509 server-key-password"):
	- data["ipsec_l2tp_x509_server_key_password"] = config.return_value(conf_ipsec_command + "authentication x509 server-key-password")
	-
	- # Common l2tp ipsec params
	- if config.exists(conf_ipsec_command + "ike-lifetime"):
	- data["ipsec_l2tp_ike_lifetime"] = config.return_value(conf_ipsec_command + "ike-lifetime")
	- else:
	- data["ipsec_l2tp_ike_lifetime"] = "3600"
	-
	- if config.exists(conf_ipsec_command + "lifetime"):
	- data["ipsec_l2tp_lifetime"] = config.return_value(conf_ipsec_command + "lifetime")
	- else:
	- data["ipsec_l2tp_lifetime"] = "3600"
	-
	- if config.exists("vpn l2tp remote-access outside-address"):
	- data['outside_addr'] = config.return_value('vpn l2tp remote-access outside-address')
	-
	- return data
	-
	-def write_ipsec_secrets(c):
	- if c.get("ipsec_l2tp_auth_mode") == "pre-shared-secret":
	- secret_txt = "{0}\n{1} %any : PSK \"{2}\"\n{3}\n".format(delim_ipsec_l2tp_begin, c['outside_addr'], c['ipsec_l2tp_secret'], delim_ipsec_l2tp_end)
	- elif c.get("ipsec_l2tp_auth_mode") == "x509":
	- secret_txt = "{0}\n: RSA {1}\n{2}\n".format(delim_ipsec_l2tp_begin, c['server_key_file_copied'], delim_ipsec_l2tp_end)
	-
	- old_umask = os.umask(0o077)
	- with open(ipsec_secrets_file, 'a+') as f:
	- f.write(secret_txt)
	- os.umask(old_umask)
	-
	-def write_ipsec_conf(c):
	- ipsec_confg_txt = "{0}\ninclude {1}\n{2}\n".format(delim_ipsec_l2tp_begin, ipsec_ra_conn_file, delim_ipsec_l2tp_end)
	-
	- old_umask = os.umask(0o077)
	- with open(ipsec_conf_file, 'a+') as f:
	- f.write(ipsec_confg_txt)
	- os.umask(old_umask)
	-
	-### Remove config from file by delimiter
	-def remove_confs(delim_begin, delim_end, conf_file):
	- call("sed -i '/"+delim_begin+"/,/"+delim_end+"/d' "+conf_file)
	-
	-
	-### Checking certificate storage and notice if certificate not in /config directory
	-def check_cert_file_store(cert_name, file_path, dts_path):
	- if not re.search('^\/config\/.+', file_path):
	- print("Warning: \"" + file_path + "\" lies outside of /config/auth directory. It will not get preserved during image upgrade.")
	- #Checking file existence
	- if not os.path.isfile(file_path):
	- raise ConfigError("L2TP VPN configuration error: Invalid "+cert_name+" \""+file_path+"\"")
	- else:
	- ### Cpy file to /etc/ipsec.d/certs/ /etc/ipsec.d/cacerts/
	- # todo make check
	- ret = call('cp -f '+file_path+' '+dts_path)
	- if ret:
	- raise ConfigError("L2TP VPN configuration error: Cannot copy "+file_path)
	-
	-def verify(data):
	- # l2tp ipsec check
	- if 'ipsec_l2tp' in data:
	- # Checking dependecies for "authentication mode pre-shared-secret"
	- if data.get("ipsec_l2tp_auth_mode") == "pre-shared-secret":
	- if not data.get("ipsec_l2tp_secret"):
	- raise ConfigError("pre-shared-secret required")
	- if not data.get("outside_addr"):
	- raise ConfigError("outside-address not defined")
	-
	- # Checking dependecies for "authentication mode x509"
	- if data.get("ipsec_l2tp_auth_mode") == "x509":
	- if not data.get("ipsec_l2tp_x509_server_key_file"):
	- raise ConfigError("L2TP VPN configuration error: \"server-key-file\" not defined.")
	- else:
	- check_cert_file_store("server-key-file", data['ipsec_l2tp_x509_server_key_file'], server_key_path)
	-
	- if not data.get("ipsec_l2tp_x509_server_cert_file"):
	- raise ConfigError("L2TP VPN configuration error: \"server-cert-file\" not defined.")
	- else:
	- check_cert_file_store("server-cert-file", data['ipsec_l2tp_x509_server_cert_file'], server_cert_path)
	-
	- if not data.get("ipsec_l2tp_x509_ca_cert_file"):
	- raise ConfigError("L2TP VPN configuration error: \"ca-cert-file\" must be defined for X.509")
	- else:
	- check_cert_file_store("ca-cert-file", data['ipsec_l2tp_x509_ca_cert_file'], ca_cert_path)
	-
	- if not data.get('ipsec_interfaces'):
	- raise ConfigError("L2TP VPN configuration error: \"vpn ipsec ipsec-interfaces\" must be specified.")
	-
	-def generate(data):
	- if 'ipsec_l2tp' in data:
	- remove_confs(delim_ipsec_l2tp_begin, delim_ipsec_l2tp_end, ipsec_secrets_file)
	- # old_umask = os.umask(0o077)
	- # render(ipsec_secrets_file, 'ipsec/ipsec.secrets.tmpl', data)
	- # os.umask(old_umask)
	- ## Use this method while IPSec CLI handler won't be overwritten to python
	- write_ipsec_secrets(data)
	-
	- old_umask = os.umask(0o077)
	-
	- # Create tunnels directory if does not exist
	- if not os.path.exists(ipsec_ra_conn_dir):
	- os.makedirs(ipsec_ra_conn_dir)
	-
	- render(ipsec_ra_conn_file, 'ipsec/remote-access.tmpl', data)
	- os.umask(old_umask)
	-
	- remove_confs(delim_ipsec_l2tp_begin, delim_ipsec_l2tp_end, ipsec_conf_file)
	- # old_umask = os.umask(0o077)
	- # render(ipsec_conf_file, 'ipsec/ipsec.conf.tmpl', data)
	- # os.umask(old_umask)
	- ## Use this method while IPSec CLI handler won't be overwritten to python
	- write_ipsec_conf(data)
	-
	- else:
	- if os.path.exists(ipsec_ra_conn_file):
	- remove_confs(delim_ipsec_l2tp_begin, delim_ipsec_l2tp_end, ipsec_ra_conn_file)
	- remove_confs(delim_ipsec_l2tp_begin, delim_ipsec_l2tp_end, ipsec_secrets_file)
	- remove_confs(delim_ipsec_l2tp_begin, delim_ipsec_l2tp_end, ipsec_conf_file)
	-
	-def restart_ipsec():
	- try:
	- wait_for_file_write_complete(charon_pidfile,
	- pre_hook=(lambda: call('ipsec restart >&/dev/null')),
	- timeout=10)
	-
	- # Force configuration load
	- call('swanctl -q >&/dev/null')
	-
	- except OSError:
	- raise ConfigError('VPN configuration error: IPSec process did not start.')
	-
	-def apply(data):
	- # Restart IPSec daemon
	- restart_ipsec()
	-
	-if __name__ == '__main__':
	- try:
	- c = get_config()
	- verify(c)
	- generate(c)
	- apply(c)
	- except ConfigError as e:
	- print(e)
	- exit(1)
	diff --git a/src/conf_mode/vpn_ipsec.py b/src/conf_mode/vpn_ipsec.py
	index 3fab8e868..645108a8f 100755
	--- a/src/conf_mode/vpn_ipsec.py
	+++ b/src/conf_mode/vpn_ipsec.py
	@@ -1,494 +1,531 @@
	#!/usr/bin/env python3
	#
	# Copyright (C) 2021 VyOS maintainers and contributors
	#
	# This program is free software; you can redistribute it and/or modify
	# it under the terms of the GNU General Public License version 2 or later as
	# published by the Free Software Foundation.
	#
	# This program is distributed in the hope that it will be useful,
	# but WITHOUT ANY WARRANTY; without even the implied warranty of
	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	# GNU General Public License for more details.
	#
	# You should have received a copy of the GNU General Public License
	# along with this program. If not, see <http://www.gnu.org/licenses/>.

	import ipaddress
	import os

	from sys import exit
	from time import sleep
	from time import time

	from vyos.config import Config
	from vyos.configdict import leaf_node_changed
	from vyos.configverify import verify_interface_exists
	from vyos.configdict import dict_merge
	from vyos.ifconfig import Interface
	from vyos.pki import encode_public_key
	from vyos.pki import load_private_key
	from vyos.pki import wrap_certificate
	from vyos.pki import wrap_crl
	from vyos.pki import wrap_public_key
	from vyos.pki import wrap_private_key
	from vyos.template import ip_from_cidr
	from vyos.template import render
	from vyos.validate import is_ipv6_link_local
	from vyos.util import call
	from vyos.util import dict_search_args
	from vyos.util import run
	from vyos.xml import defaults
	from vyos import ConfigError
	from vyos import airbag
	airbag.enable()

	dhcp_wait_attempts = 2
	dhcp_wait_sleep = 1

	swanctl_dir = '/etc/swanctl'
	ipsec_conf = '/etc/ipsec.conf'
	ipsec_secrets = '/etc/ipsec.secrets'
	charon_conf = '/etc/strongswan.d/charon.conf'
	charon_dhcp_conf = '/etc/strongswan.d/charon/dhcp.conf'
	interface_conf = '/etc/strongswan.d/interfaces_use.conf'
	swanctl_conf = f'{swanctl_dir}/swanctl.conf'

	default_install_routes = 'yes'

	vici_socket = '/var/run/charon.vici'

	CERT_PATH = f'{swanctl_dir}/x509/'
	PUBKEY_PATH = f'{swanctl_dir}/pubkey/'
	KEY_PATH = f'{swanctl_dir}/private/'
	CA_PATH = f'{swanctl_dir}/x509ca/'
	CRL_PATH = f'{swanctl_dir}/x509crl/'

	DHCP_BASE = '/var/lib/dhcp/dhclient'
	DHCP_HOOK_IFLIST = '/tmp/ipsec_dhcp_waiting'

	def get_config(config=None):
	if config:
	conf = config
	else:
	conf = Config()
	base = ['vpn', 'ipsec']
	+ l2tp_base = ['vpn', 'l2tp', 'remote-access', 'ipsec-settings']
	if not conf.exists(base):
	return None

	# retrieve common dictionary keys
	ipsec = conf.get_config_dict(base, key_mangling=('-', '_'),
	get_first_key=True, no_tag_node_value_mangle=True)

	# We have gathered the dict representation of the CLI, but there are default
	# options which we need to update into the dictionary retrived.
	default_values = defaults(base)
	# XXX: T2665: we must safely remove default values for tag nodes, those are
	# added in a more fine grained way later on
	del default_values['esp_group']
	del default_values['ike_group']
	del default_values['remote_access']
	ipsec = dict_merge(default_values, ipsec)

	if 'esp_group' in ipsec:
	default_values = defaults(base + ['esp-group'])
	for group in ipsec['esp_group']:
	ipsec['esp_group'][group] = dict_merge(default_values,
	ipsec['esp_group'][group])
	if 'ike_group' in ipsec:
	default_values = defaults(base + ['ike-group'])
	for group in ipsec['ike_group']:
	ipsec['ike_group'][group] = dict_merge(default_values,
	ipsec['ike_group'][group])
	if 'remote_access' in ipsec:
	default_values = defaults(base + ['remote-access'])
	for rw in ipsec['remote_access']:
	ipsec['remote_access'][rw] = dict_merge(default_values,
	ipsec['remote_access'][rw])

	ipsec['dhcp_no_address'] = {}
	ipsec['install_routes'] = 'no' if conf.exists(base + ["options", "disable-route-autoinstall"]) else default_install_routes
	ipsec['interface_change'] = leaf_node_changed(conf, base + ['ipsec-interfaces',
	'interface'])
	- ipsec['l2tp_exists'] = conf.exists(['vpn', 'l2tp', 'remote-access',
	- 'ipsec-settings'])
	ipsec['nhrp_exists'] = conf.exists(['protocols', 'nhrp', 'tunnel'])
	ipsec['pki'] = conf.get_config_dict(['pki'], key_mangling=('-', '_'),
	get_first_key=True,
	no_tag_node_value_mangle=True)

	+ ipsec['l2tp'] = conf.get_config_dict(l2tp_base, key_mangling=('-', '_'),
	+ get_first_key=True,
	+ no_tag_node_value_mangle=True)
	+ if ipsec['l2tp']:
	+ l2tp_defaults = defaults(l2tp_base)
	+ ipsec['l2tp'] = dict_merge(l2tp_defaults, ipsec['l2tp'])
	+ ipsec['l2tp_outside_address'] = conf.return_value(['vpn', 'l2tp', 'remote-access', 'outside-address'])
	+ ipsec['l2tp_ike_default'] = 'aes256-sha1-modp1024,3des-sha1-modp1024,3des-sha1-modp1024'
	+ ipsec['l2tp_esp_default'] = 'aes256-sha1,3des-sha1'
	+
	return ipsec

	def get_dhcp_address(iface):
	addresses = Interface(iface).get_addr()
	if not addresses:
	return None
	for address in addresses:
	if not is_ipv6_link_local(address):
	return ip_from_cidr(address)
	return None

	def verify_pki_x509(pki, x509_conf):
	if not pki or 'ca' not in pki or 'certificate' not in pki:
	raise ConfigError(f'PKI is not configured')

	ca_cert_name = x509_conf['ca_certificate']
	cert_name = x509_conf['certificate']

	if not dict_search_args(pki, 'ca', ca_cert_name, 'certificate'):
	raise ConfigError(f'Missing CA certificate on specified PKI CA certificate "{ca_cert_name}"')

	if not dict_search_args(pki, 'certificate', cert_name, 'certificate'):
	raise ConfigError(f'Missing certificate on specified PKI certificate "{cert_name}"')

	if not dict_search_args(pki, 'certificate', cert_name, 'private', 'key'):
	raise ConfigError(f'Missing private key on specified PKI certificate "{cert_name}"')

	return True

	def verify_pki_rsa(pki, rsa_conf):
	if not pki or 'key_pair' not in pki:
	raise ConfigError(f'PKI is not configured')

	local_key = rsa_conf['local_key']
	remote_key = rsa_conf['remote_key']

	if not dict_search_args(pki, 'key_pair', local_key, 'private', 'key'):
	raise ConfigError(f'Missing private key on specified local-key "{local_key}"')

	if not dict_search_args(pki, 'key_pair', remote_key, 'public', 'key'):
	raise ConfigError(f'Missing public key on specified remote-key "{remote_key}"')

	return True

	def verify(ipsec):
	if not ipsec:
	return None

	if 'ipsec_interfaces' in ipsec and 'interface' in ipsec['ipsec_interfaces']:
	interfaces = ipsec['ipsec_interfaces']['interface']
	if isinstance(interfaces, str):
	interfaces = [interfaces]

	for ifname in interfaces:
	verify_interface_exists(ifname)

	+ if ipsec['l2tp']:
	+ if 'esp_group' in ipsec['l2tp']:
	+ if 'esp_group' not in ipsec or ipsec['l2tp']['esp_group'] not in ipsec['esp_group']:
	+ raise ConfigError(f"Invalid esp-group on L2TP remote-access config")
	+
	+ if 'ike_group' in ipsec['l2tp']:
	+ if 'ike_group' not in ipsec or ipsec['l2tp']['ike_group'] not in ipsec['ike_group']:
	+ raise ConfigError(f"Invalid ike-group on L2TP remote-access config")
	+
	+ if 'authentication' not in ipsec['l2tp']:
	+ raise ConfigError(f'Missing authentication settings on L2TP remote-access config')
	+
	+ if 'mode' not in ipsec['l2tp']['authentication']:
	+ raise ConfigError(f'Missing authentication mode on L2TP remote-access config')
	+
	+ if not ipsec['l2tp_outside_address']:
	+ raise ConfigError(f'Missing outside-address on L2TP remote-access config')
	+
	+ if ipsec['l2tp']['authentication']['mode'] == 'pre-shared-secret':
	+ if 'pre_shared_secret' not in ipsec['l2tp']['authentication']:
	+ raise ConfigError(f'Missing pre shared secret on L2TP remote-access config')
	+
	+ if ipsec['l2tp']['authentication']['mode'] == 'x509':
	+ if 'x509' not in ipsec['l2tp']['authentication']:
	+ raise ConfigError(f'Missing x509 settings on L2TP remote-access config')
	+
	+ x509 = ipsec['l2tp']['authentication']['x509']
	+
	+ if 'ca_certificate' not in x509 or 'certificate' not in x509:
	+ raise ConfigError(f'Missing x509 certificates on L2TP remote-access config')
	+
	+ verify_pki_x509(ipsec['pki'], x509)
	+
	if 'profile' in ipsec:
	for profile, profile_conf in ipsec['profile'].items():
	if 'esp_group' in profile_conf:
	if 'esp_group' not in ipsec or profile_conf['esp_group'] not in ipsec['esp_group']:
	raise ConfigError(f"Invalid esp-group on {profile} profile")
	else:
	raise ConfigError(f"Missing esp-group on {profile} profile")

	if 'ike_group' in profile_conf:
	if 'ike_group' not in ipsec or profile_conf['ike_group'] not in ipsec['ike_group']:
	raise ConfigError(f"Invalid ike-group on {profile} profile")
	else:
	raise ConfigError(f"Missing ike-group on {profile} profile")

	if 'authentication' not in profile_conf:
	raise ConfigError(f"Missing authentication on {profile} profile")

	if 'remote_access' in ipsec:
	for name, ra_conf in ipsec['remote_access'].items():
	if 'esp_group' in ra_conf:
	if 'esp_group' not in ipsec or ra_conf['esp_group'] not in ipsec['esp_group']:
	raise ConfigError(f"Invalid esp-group on {name} remote-access config")
	else:
	raise ConfigError(f"Missing esp-group on {name} remote-access config")

	if 'ike_group' in ra_conf:
	if 'ike_group' not in ipsec or ra_conf['ike_group'] not in ipsec['ike_group']:
	raise ConfigError(f"Invalid ike-group on {name} remote-access config")
	else:
	raise ConfigError(f"Missing ike-group on {name} remote-access config")

	if 'authentication' not in ra_conf:
	raise ConfigError(f"Missing authentication on {name} remote-access config")

	if ra_conf['authentication']['server_mode'] == 'x509':
	if 'x509' not in ra_conf['authentication']:
	raise ConfigError(f"Missing x509 settings on {name} remote-access config")

	x509 = ra_conf['authentication']['x509']

	if 'ca_certificate' not in x509 or 'certificate' not in x509:
	raise ConfigError(f"Missing x509 certificates on {name} remote-access config")

	verify_pki_x509(ipsec['pki'], x509)
	elif ra_conf['authentication']['server_mode'] == 'pre-shared-secret':
	if 'pre_shared_secret' not in ra_conf['authentication']:
	raise ConfigError(f"Missing pre-shared-key on {name} remote-access config")

	if 'site_to_site' in ipsec and 'peer' in ipsec['site_to_site']:
	for peer, peer_conf in ipsec['site_to_site']['peer'].items():
	has_default_esp = False
	if 'default_esp_group' in peer_conf:
	has_default_esp = True
	if 'esp_group' not in ipsec or peer_conf['default_esp_group'] not in ipsec['esp_group']:
	raise ConfigError(f"Invalid esp-group on site-to-site peer {peer}")

	if 'ike_group' in peer_conf:
	if 'ike_group' not in ipsec or peer_conf['ike_group'] not in ipsec['ike_group']:
	raise ConfigError(f"Invalid ike-group on site-to-site peer {peer}")
	else:
	raise ConfigError(f"Missing ike-group on site-to-site peer {peer}")

	if 'authentication' not in peer_conf or 'mode' not in peer_conf['authentication']:
	raise ConfigError(f"Missing authentication on site-to-site peer {peer}")

	if peer_conf['authentication']['mode'] == 'x509':
	if 'x509' not in peer_conf['authentication']:
	raise ConfigError(f"Missing x509 settings on site-to-site peer {peer}")

	x509 = peer_conf['authentication']['x509']

	if 'ca_certificate' not in x509 or 'certificate' not in x509:
	raise ConfigError(f"Missing x509 certificates on site-to-site peer {peer}")

	verify_pki_x509(ipsec['pki'], x509)
	elif peer_conf['authentication']['mode'] == 'rsa':
	if 'rsa' not in peer_conf['authentication']:
	raise ConfigError(f"Missing RSA settings on site-to-site peer {peer}")

	rsa = peer_conf['authentication']['rsa']

	if 'local_key' not in rsa:
	raise ConfigError(f"Missing RSA local-key on site-to-site peer {peer}")

	if 'remote_key' not in rsa:
	raise ConfigError(f"Missing RSA remote-key on site-to-site peer {peer}")

	verify_pki_rsa(ipsec['pki'], rsa)

	if 'local_address' not in peer_conf and 'dhcp_interface' not in peer_conf:
	raise ConfigError(f"Missing local-address or dhcp-interface on site-to-site peer {peer}")

	if 'dhcp_interface' in peer_conf:
	dhcp_interface = peer_conf['dhcp_interface']

	verify_interface_exists(dhcp_interface)

	if not os.path.exists(f'{DHCP_BASE}_{dhcp_interface}.conf'):
	raise ConfigError(f"Invalid dhcp-interface on site-to-site peer {peer}")

	address = get_dhcp_address(dhcp_interface)
	count = 0
	while not address and count < dhcp_wait_attempts:
	address = get_dhcp_address(dhcp_interface)
	count += 1
	sleep(dhcp_wait_sleep)

	if not address:
	ipsec['dhcp_no_address'][peer] = dhcp_interface
	print(f"Failed to get address from dhcp-interface on site-to-site peer {peer} -- skipped")
	continue

	if 'vti' in peer_conf:
	if 'local_address' in peer_conf and 'dhcp_interface' in peer_conf:
	raise ConfigError(f"A single local-address or dhcp-interface is required when using VTI on site-to-site peer {peer}")

	if 'bind' in peer_conf['vti']:
	vti_interface = peer_conf['vti']['bind']
	if not os.path.exists(f'/sys/class/net/{vti_interface}'):
	raise ConfigError(f'VTI interface {vti_interface} for site-to-site peer {peer} does not exist!')

	if 'vti' not in peer_conf and 'tunnel' not in peer_conf:
	raise ConfigError(f"No VTI or tunnel specified on site-to-site peer {peer}")

	if 'tunnel' in peer_conf:
	for tunnel, tunnel_conf in peer_conf['tunnel'].items():
	if 'esp_group' not in tunnel_conf and not has_default_esp:
	raise ConfigError(f"Missing esp-group on tunnel {tunnel} for site-to-site peer {peer}")

	esp_group_name = tunnel_conf['esp_group'] if 'esp_group' in tunnel_conf else peer_conf['default_esp_group']

	if esp_group_name not in ipsec['esp_group']:
	raise ConfigError(f"Invalid esp-group on tunnel {tunnel} for site-to-site peer {peer}")

	esp_group = ipsec['esp_group'][esp_group_name]

	if 'mode' in esp_group and esp_group['mode'] == 'transport':
	if 'protocol' in tunnel_conf and ((peer in ['any', '0.0.0.0']) or ('local_address' not in peer_conf or peer_conf['local_address'] in ['any', '0.0.0.0'])):
	raise ConfigError(f"Fixed local-address or peer required when a protocol is defined with ESP transport mode on tunnel {tunnel} for site-to-site peer {peer}")

	if ('local' in tunnel_conf and 'prefix' in tunnel_conf['local']) or ('remote' in tunnel_conf and 'prefix' in tunnel_conf['remote']):
	raise ConfigError(f"Local/remote prefix cannot be used with ESP transport mode on tunnel {tunnel} for site-to-site peer {peer}")

	def cleanup_pki_files():
	for path in [CERT_PATH, CA_PATH, CRL_PATH, KEY_PATH, PUBKEY_PATH]:
	if not os.path.exists(path):
	continue
	for file in os.listdir(path):
	file_path = os.path.join(path, file)
	if os.path.isfile(file_path):
	os.unlink(file_path)

	def generate_pki_files_x509(pki, x509_conf):
	ca_cert_name = x509_conf['ca_certificate']
	ca_cert_data = dict_search_args(pki, 'ca', ca_cert_name, 'certificate')
	ca_cert_crls = dict_search_args(pki, 'ca', ca_cert_name, 'crl') or []
	crl_index = 1

	cert_name = x509_conf['certificate']
	cert_data = dict_search_args(pki, 'certificate', cert_name, 'certificate')
	key_data = dict_search_args(pki, 'certificate', cert_name, 'private', 'key')
	protected = 'passphrase' in x509_conf

	with open(os.path.join(CA_PATH, f'{ca_cert_name}.pem'), 'w') as f:
	f.write(wrap_certificate(ca_cert_data))

	for crl in ca_cert_crls:
	with open(os.path.join(CRL_PATH, f'{ca_cert_name}_{crl_index}.pem'), 'w') as f:
	f.write(wrap_crl(crl))
	crl_index += 1

	with open(os.path.join(CERT_PATH, f'{cert_name}.pem'), 'w') as f:
	f.write(wrap_certificate(cert_data))

	with open(os.path.join(KEY_PATH, f'x509_{cert_name}.pem'), 'w') as f:
	f.write(wrap_private_key(key_data, protected))

	def generate_pki_files_rsa(pki, rsa_conf):
	local_key_name = rsa_conf['local_key']
	local_key_data = dict_search_args(pki, 'key_pair', local_key_name, 'private', 'key')
	protected = 'passphrase' in rsa_conf
	remote_key_name = rsa_conf['remote_key']
	remote_key_data = dict_search_args(pki, 'key_pair', remote_key_name, 'public', 'key')

	local_key = load_private_key(local_key_data, rsa_conf['passphrase'] if protected else None)

	with open(os.path.join(KEY_PATH, f'rsa_{local_key_name}.pem'), 'w') as f:
	f.write(wrap_private_key(local_key_data, protected))

	with open(os.path.join(PUBKEY_PATH, f'{local_key_name}.pem'), 'w') as f:
	f.write(encode_public_key(local_key.public_key()))

	with open(os.path.join(PUBKEY_PATH, f'{remote_key_name}.pem'), 'w') as f:
	f.write(wrap_public_key(remote_key_data))

	def generate(ipsec):
	cleanup_pki_files()

	if not ipsec:
	for config_file in [ipsec_conf, ipsec_secrets, charon_dhcp_conf, interface_conf, swanctl_conf]:
	if os.path.isfile(config_file):
	os.unlink(config_file)
	render(charon_conf, 'ipsec/charon.tmpl', {'install_routes': default_install_routes})
	return

	if ipsec['dhcp_no_address']:
	with open(DHCP_HOOK_IFLIST, 'w') as f:
	f.write(" ".join(ipsec['dhcp_no_address'].values()))

	for path in [swanctl_dir, CERT_PATH, CA_PATH, CRL_PATH, PUBKEY_PATH]:
	if not os.path.exists(path):
	os.mkdir(path, mode=0o755)

	if not os.path.exists(KEY_PATH):
	os.mkdir(KEY_PATH, mode=0o700)

	+ if ipsec['l2tp']:
	+ if 'authentication' in ipsec['l2tp'] and 'x509' in ipsec['l2tp']['authentication']:
	+ generate_pki_files_x509(ipsec['pki'], ipsec['l2tp']['authentication']['x509'])
	+
	if 'remote_access' in ipsec:
	for rw, rw_conf in ipsec['remote_access'].items():
	if 'authentication' in rw_conf and 'x509' in rw_conf['authentication']:
	generate_pki_files_x509(ipsec['pki'], rw_conf['authentication']['x509'])

	if 'site_to_site' in ipsec and 'peer' in ipsec['site_to_site']:
	for peer, peer_conf in ipsec['site_to_site']['peer'].items():
	if peer in ipsec['dhcp_no_address']:
	continue

	if peer_conf['authentication']['mode'] == 'x509':
	generate_pki_files_x509(ipsec['pki'], peer_conf['authentication']['x509'])
	elif peer_conf['authentication']['mode'] == 'rsa':
	generate_pki_files_rsa(ipsec['pki'], peer_conf['authentication']['rsa'])

	local_ip = ''
	if 'local_address' in peer_conf:
	local_ip = peer_conf['local_address']
	elif 'dhcp_interface' in peer_conf:
	local_ip = get_dhcp_address(peer_conf['dhcp_interface'])

	ipsec['site_to_site']['peer'][peer]['local_address'] = local_ip

	if 'tunnel' in peer_conf:
	for tunnel, tunnel_conf in peer_conf['tunnel'].items():
	local_prefixes = dict_search_args(tunnel_conf, 'local', 'prefix')
	remote_prefixes = dict_search_args(tunnel_conf, 'remote', 'prefix')

	if not local_prefixes or not remote_prefixes:
	continue

	passthrough = []

	for local_prefix in local_prefixes:
	for remote_prefix in remote_prefixes:
	local_net = ipaddress.ip_network(local_prefix)
	remote_net = ipaddress.ip_network(remote_prefix)
	if local_net.overlaps(remote_net):
	passthrough.append(local_prefix)

	ipsec['site_to_site']['peer'][peer]['tunnel'][tunnel]['passthrough'] = passthrough


	render(ipsec_conf, 'ipsec/ipsec.conf.tmpl', ipsec)
	render(ipsec_secrets, 'ipsec/ipsec.secrets.tmpl', ipsec)
	render(charon_conf, 'ipsec/charon.tmpl', ipsec)
	render(charon_dhcp_conf, 'ipsec/charon/dhcp.conf.tmpl', ipsec)
	render(interface_conf, 'ipsec/interfaces_use.conf.tmpl', ipsec)
	render(swanctl_conf, 'ipsec/swanctl.conf.tmpl', ipsec)

	-def resync_l2tp(ipsec):
	- if ipsec and not ipsec['l2tp_exists']:
	- return
	-
	- tmp = run('/usr/libexec/vyos/conf_mode/ipsec-settings.py')
	- if tmp > 0:
	- print('ERROR: failed to reapply L2TP IPSec settings!')
	-
	def resync_nhrp(ipsec):
	if ipsec and not ipsec['nhrp_exists']:
	return

	tmp = run('/usr/libexec/vyos/conf_mode/protocols_nhrp.py')
	if tmp > 0:
	print('ERROR: failed to reapply NHRP settings!')

	def wait_for_vici_socket(timeout=5, sleep_interval=0.1):
	start_time = time()
	test_command = f'sudo socat -u OPEN:/dev/null UNIX-CONNECT:{vici_socket}'
	while True:
	if (start_time + timeout) < time():
	return None
	result = run(test_command)
	if result == 0:
	return True
	sleep(sleep_interval)

	def apply(ipsec):
	if not ipsec:
	call('sudo ipsec stop')
	else:
	args = ''
	if 'auto_update' in ipsec:
	args = '--auto-update ' + ipsec['auto_update']
	call(f'sudo ipsec restart {args}')
	call('sudo ipsec rereadall')
	call('sudo ipsec reload')

	if wait_for_vici_socket():
	call('sudo swanctl -q')

	- resync_l2tp(ipsec)
	resync_nhrp(ipsec)

	if __name__ == '__main__':
	try:
	ipsec = get_config()
	verify(ipsec)
	generate(ipsec)
	apply(ipsec)
	except ConfigError as e:
	print(e)
	exit(1)
	diff --git a/src/migration-scripts/l2tp/3-to-4 b/src/migration-scripts/l2tp/3-to-4
	new file mode 100755
	index 000000000..18eabadec
	--- /dev/null
	+++ b/src/migration-scripts/l2tp/3-to-4
	@@ -0,0 +1,169 @@
	+#!/usr/bin/env python3
	+#
	+# Copyright (C) 2021 VyOS maintainers and contributors
	+#
	+# This program is free software; you can redistribute it and/or modify
	+# it under the terms of the GNU General Public License version 2 or later as
	+# published by the Free Software Foundation.
	+#
	+# This program is distributed in the hope that it will be useful,
	+# but WITHOUT ANY WARRANTY; without even the implied warranty of
	+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	+# GNU General Public License for more details.
	+#
	+# You should have received a copy of the GNU General Public License
	+# along with this program. If not, see <http://www.gnu.org/licenses/>.
	+
	+# - remove primary/secondary identifier from nameserver
	+# - TODO: remove radius server req-limit
	+
	+import os
	+
	+from sys import argv
	+from sys import exit
	+from vyos.configtree import ConfigTree
	+from vyos.pki import load_certificate
	+from vyos.pki import load_crl
	+from vyos.pki import load_private_key
	+from vyos.pki import encode_certificate
	+from vyos.pki import encode_private_key
	+from vyos.util import run
	+
	+if (len(argv) < 1):
	+ print("Must specify file name!")
	+ exit(1)
	+
	+file_name = argv[1]
	+
	+with open(file_name, 'r') as f:
	+ config_file = f.read()
	+
	+config = ConfigTree(config_file)
	+base = ['vpn', 'l2tp', 'remote-access', 'ipsec-settings']
	+pki_base = ['pki']
	+
	+if not config.exists(base):
	+ exit(0)
	+
	+AUTH_DIR = '/config/auth'
	+
	+def wrapped_pem_to_config_value(pem):
	+ return "".join(pem.strip().split("\n")[1:-1])
	+
	+if not config.exists(base + ['authentication', 'x509']):
	+ exit(0)
	+
	+x509_base = base + ['authentication', 'x509']
	+pki_name = 'l2tp_remote_access'
	+
	+if not config.exists(pki_base + ['ca']):
	+ config.set(pki_base + ['ca'])
	+ config.set_tag(pki_base + ['ca'])
	+
	+if not config.exists(pki_base + ['certificate']):
	+ config.set(pki_base + ['certificate'])
	+ config.set_tag(pki_base + ['certificate'])
	+
	+if config.exists(x509_base + ['ca-cert-file']):
	+ cert_file = config.return_value(x509_base + ['ca-cert-file'])
	+ cert_path = os.path.join(AUTH_DIR, cert_file)
	+ cert = None
	+
	+ if os.path.isfile(cert_path):
	+ if not os.access(cert_path, os.R_OK):
	+ run(f'sudo chmod 644 {cert_path}')
	+
	+ with open(cert_path, 'r') as f:
	+ cert_data = f.read()
	+ cert = load_certificate(cert_data, wrap_tags=False)
	+
	+ if cert:
	+ cert_pem = encode_certificate(cert)
	+ config.set(pki_base + ['ca', pki_name, 'certificate'], value=wrapped_pem_to_config_value(cert_pem))
	+ config.set(x509_base + ['ca-certificate'], value=pki_name)
	+ else:
	+ print(f'Failed to migrate CA certificate on l2tp remote-access config')
	+
	+ config.delete(x509_base + ['ca-cert-file'])
	+
	+if config.exists(x509_base + ['crl-file']):
	+ crl_file = config.return_value(x509_base + ['crl-file'])
	+ crl_path = os.path.join(AUTH_DIR, crl_file)
	+ crl = None
	+
	+ if os.path.isfile(crl_path):
	+ if not os.access(crl_path, os.R_OK):
	+ run(f'sudo chmod 644 {crl_path}')
	+
	+ with open(crl_path, 'r') as f:
	+ crl_data = f.read()
	+ crl = load_certificate(crl_data, wrap_tags=False)
	+
	+ if crl:
	+ crl_pem = encode_certificate(crl)
	+ config.set(pki_base + ['ca', pki_name, 'crl'], value=wrapped_pem_to_config_value(crl_pem))
	+ else:
	+ print(f'Failed to migrate CRL on l2tp remote-access config')
	+
	+ config.delete(x509_base + ['crl-file'])
	+
	+if config.exists(x509_base + ['server-cert-file']):
	+ cert_file = config.return_value(x509_base + ['server-cert-file'])
	+ cert_path = os.path.join(AUTH_DIR, cert_file)
	+ cert = None
	+
	+ if os.path.isfile(cert_path):
	+ if not os.access(cert_path, os.R_OK):
	+ run(f'sudo chmod 644 {cert_path}')
	+
	+ with open(cert_path, 'r') as f:
	+ cert_data = f.read()
	+ cert = load_certificate(cert_data, wrap_tags=False)
	+
	+ if cert:
	+ cert_pem = encode_certificate(cert)
	+ config.set(pki_base + ['certificate', pki_name, 'certificate'], value=wrapped_pem_to_config_value(cert_pem))
	+ config.set(x509_base + ['certificate'], value=pki_name)
	+ else:
	+ print(f'Failed to migrate certificate on l2tp remote-access config')
	+
	+ config.delete(x509_base + ['server-cert-file'])
	+
	+if config.exists(x509_base + ['server-key-file']):
	+ key_file = config.return_value(x509_base + ['server-key-file'])
	+ key_passphrase = None
	+
	+ if config.exists(x509_base + ['server-key-password']):
	+ key_passphrase = config.return_value(x509_base + ['server-key-password'])
	+
	+ key_path = os.path.join(AUTH_DIR, key_file)
	+ key = None
	+
	+ if os.path.isfile(key_path):
	+ if not os.access(key_path, os.R_OK):
	+ run(f'sudo chmod 644 {key_path}')
	+
	+ with open(key_path, 'r') as f:
	+ key_data = f.read()
	+ key = load_private_key(key_data, passphrase=key_passphrase, wrap_tags=False)
	+
	+ if key:
	+ key_pem = encode_private_key(key, passphrase=key_passphrase)
	+ config.set(pki_base + ['certificate', pki_name, 'private', 'key'], value=wrapped_pem_to_config_value(key_pem))
	+
	+ if key_passphrase:
	+ config.set(pki_base + ['certificate', pki_name, 'private', 'password-protected'])
	+ config.set(x509_base + ['private-key-passphrase'], value=key_passphrase)
	+ else:
	+ print(f'Failed to migrate private key on l2tp remote-access config')
	+
	+ config.delete(x509_base + ['server-key-file'])
	+ if config.exists(x509_base + ['server-key-password']):
	+ config.delete(x509_base + ['server-key-password'])
	+
	+try:
	+ with open(file_name, 'w') as f:
	+ f.write(config.to_string())
	+except OSError as e:
	+ print("Failed to save the modified config: {}".format(e))
	+ exit(1)

File Metadata

Mime Type: text/x-diff
Expires: Sat, Oct 17, 12:08 AM (1 d, 1 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 4405918
Default Alt Text: (70 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions