Skip to content

4.10 strongswan ike fixes #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
w4rri0r3k wants to merge 8 commits into
base: master
Choose a base branch
from
Open

4.10 strongswan ike fixes #1

Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
0d22919
initial attempt to fix strongswan support for cs4.10+
Jan 10, 2018
19ceea3
changed rightsubnet=%s" % peerlist to rightsubnet=%s" % subnet
Jan 10, 2018
32b6029
fixed split
Jan 11, 2018
5a081f4
Revert "fixed split"
Jan 11, 2018
c061ece
fixed cidr split enumeration
Jan 11, 2018
0eb504d
fixed mixing conn line
Jan 11, 2018
f2d251d
fixed broken also line
Jan 11, 2018
a599d80
Update configure.py
w4rri0r3k Mar 26, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
59 changes: 35 additions & 24 deletions systemvm/patches/debian/config/opt/cloud/bin/configure.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -550,30 +550,41 @@ def configure_ipsec(self, obj):
if rightpeer in self.confips:
self.confips.remove(rightpeer)
file = CsFile(vpnconffile)
file.add("#conn for vpn-%s" % rightpeer, 0)
file.search("conn ", "conn vpn-%s" % rightpeer)
file.addeq(" left=%s" % leftpeer)
file.addeq(" leftsubnet=%s" % obj['local_guest_cidr'])
file.addeq(" leftnexthop=%s" % obj['local_public_gateway'])
file.addeq(" right=%s" % rightpeer)
file.addeq(" rightsubnet=%s" % peerlist)
file.addeq(" type=tunnel")
file.addeq(" authby=secret")
file.addeq(" keyexchange=ike")
file.addeq(" ike=%s" % ikepolicy)
file.addeq(" ikelifetime=%s" % self.convert_sec_to_h(obj['ike_lifetime']))
file.addeq(" esp=%s" % esppolicy)
file.addeq(" lifetime=%s" % self.convert_sec_to_h(obj['esp_lifetime']))
file.addeq(" pfs=%s" % pfs)
file.addeq(" keyingtries=2")
file.addeq(" auto=start")
if 'encap' not in obj:
obj['encap']=False
file.addeq(" forceencaps=%s" % CsHelper.bool_to_yn(obj['encap']))
if obj['dpd']:
file.addeq(" dpddelay=30")
file.addeq(" dpdtimeout=120")
file.addeq(" dpdaction=restart")
file.repopulate()

for idx,subnet in enumerate(peerlist.split(',')):
if idx==0:
file.append("#conn for vpn-%s" % rightpeer)
file.append("conn vpn-%s" % rightpeer)
file.append(" left=%s" % leftpeer)
file.append(" leftsubnet=%s" % obj['local_guest_cidr'])
file.append(" leftnexthop=%s" % obj['local_public_gateway'])
file.append(" right=%s" % rightpeer)
file.append(" rightsubnet=%s" % subnet)
file.append(" type=tunnel")
file.append(" authby=secret")
file.append(" keyexchange=ike")
file.append(" ike=%s" % ikepolicy)
file.append(" ikelifetime=%s" % self.convert_sec_to_h(obj['ike_lifetime']))
file.append(" esp=%s" % esppolicy)
file.append(" lifetime=%s" % self.convert_sec_to_h(obj['esp_lifetime']))
file.append(" pfs=%s" % pfs)
file.append(" keyingtries=2")
file.append(" auto=route")
if 'encap' not in obj:
obj['encap']=False
file.append(" forceencaps=%s" % CsHelper.bool_to_yn(obj['encap']))
if obj['dpd']:
file.append(" dpddelay=30")
file.append(" dpdtimeout=120")
file.append(" dpdaction=restart")
else:
file.append("")
file.append("conn vpn-%s-%d" % (rightpeer,idx))
file.append(" also=vpn-%s" % rightpeer)
file.append(" rightsubnet=%s" % subnet)


secret = CsFile(vpnsecretsfile)
secret.search("%s " % leftpeer, "%s %s : PSK \"%s\"" % (leftpeer, rightpeer, obj['ipsec_psk']))
if secret.is_changed() or file.is_changed():
Expand Down