Skip to content

Commit cad4b3f

Browse files
alexandr-san4ezalexandr-san4ez
committed
ipsec: T7594: Rename respond connection-type in IPSec peer settings to trap
The previous 'connection-type respond' option in IPsec site-to-site peers was misleading - instead of passively waiting for peer initiation, it would initiate negotiation when matching traffic appeared, potentially causing SA duplication and renegotiation loops.
1 parent f4d46db commit cad4b3f

File tree

5 files changed

+47
-14
lines changed

5 files changed

+47
-14
lines changed

‎data/templates/ipsec/swanctl/peer.j2‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
reauth_time = 0
2828
{% elif peer_conf.connection_type is not vyos_defined or peer_conf.connection_type is vyos_defined('initiate') %}
2929
keyingtries = 0
30-
{% elif peer_conf.connection_type is vyos_defined('respond') %}
30+
{% elif peer_conf.connection_type is vyos_defined('trap') %}
3131
keyingtries = 1
3232
{% endif %}
3333
{% if peer_conf.force_udp_encapsulation is vyos_defined %}
@@ -96,7 +96,7 @@
9696
start_action = none
9797
{% elif peer_conf.connection_type is not vyos_defined or peer_conf.connection_type is vyos_defined('initiate') %}
9898
start_action = start
99-
{% elif peer_conf.connection_type is vyos_defined('respond') %}
99+
{% elif peer_conf.connection_type is vyos_defined('trap') %}
100100
start_action = trap
101101
{% elif peer_conf.connection_type is vyos_defined('none') %}
102102
start_action = none
@@ -160,7 +160,7 @@
160160
start_action = none
161161
{% elif peer_conf.connection_type is not vyos_defined or peer_conf.connection_type is vyos_defined('initiate') %}
162162
start_action = start
163-
{% elif peer_conf.connection_type is vyos_defined('respond') %}
163+
{% elif peer_conf.connection_type is vyos_defined('trap') %}
164164
start_action = trap
165165
{% elif peer_conf.connection_type is vyos_defined('none') %}
166166
start_action = none

‎interface-definitions/include/version/ipsec-version.xml.i‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
<!-- include start from include/version/ipsec-version.xml.i -->
2-
<syntaxVersion component='ipsec' version='13'></syntaxVersion>
2+
<syntaxVersion component='ipsec' version='14'></syntaxVersion>
33
<!-- include end -->

‎interface-definitions/vpn_ipsec.xml.in‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1160,22 +1160,22 @@
11601160
<properties>
11611161
<help>Connection type</help>
11621162
<completionHelp>
1163-
<list>initiate respond none</list>
1163+
<list>initiate trap none</list>
11641164
</completionHelp>
11651165
<valueHelp>
11661166
<format>initiate</format>
11671167
<description>Bring the connection up immediately</description>
11681168
</valueHelp>
11691169
<valueHelp>
1170-
<format>respond</format>
1171-
<description>Wait for the peer to initiate the connection</description>
1170+
<format>trap</format>
1171+
<description>Bring the connection up only when matching traffic is detected</description>
11721172
</valueHelp>
11731173
<valueHelp>
11741174
<format>none</format>
11751175
<description>Load the connection only</description>
11761176
</valueHelp>
11771177
<constraint>
1178-
<regex>(initiate|respond|none)</regex>
1178+
<regex>(initiate|trap|none)</regex>
11791179
</constraint>
11801180
</properties>
11811181
</leafNode>

‎smoketest/config-tests/bgp-azure-ipsec-gateway‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -176,7 +176,7 @@ set vpn ipsec log level '2'
176176
set vpn ipsec log subsystem 'ike'
177177
set vpn ipsec site-to-site peer peer_51-105-0-1 authentication mode 'pre-shared-secret'
178178
set vpn ipsec site-to-site peer peer_51-105-0-1 authentication remote-id '51.105.0.1'
179-
set vpn ipsec site-to-site peer peer_51-105-0-1 connection-type 'respond'
179+
set vpn ipsec site-to-site peer peer_51-105-0-1 connection-type 'none'
180180
set vpn ipsec site-to-site peer peer_51-105-0-1 default-esp-group 'ESP-AZURE'
181181
set vpn ipsec site-to-site peer peer_51-105-0-1 ike-group 'IKE-AZURE'
182182
set vpn ipsec site-to-site peer peer_51-105-0-1 ikev2-reauth 'inherit'
@@ -185,7 +185,7 @@ set vpn ipsec site-to-site peer peer_51-105-0-1 remote-address '51.105.0.1'
185185
set vpn ipsec site-to-site peer peer_51-105-0-1 vti bind 'vti51'
186186
set vpn ipsec site-to-site peer peer_51-105-0-2 authentication mode 'pre-shared-secret'
187187
set vpn ipsec site-to-site peer peer_51-105-0-2 authentication remote-id '51.105.0.2'
188-
set vpn ipsec site-to-site peer peer_51-105-0-2 connection-type 'respond'
188+
set vpn ipsec site-to-site peer peer_51-105-0-2 connection-type 'none'
189189
set vpn ipsec site-to-site peer peer_51-105-0-2 default-esp-group 'ESP-AZURE'
190190
set vpn ipsec site-to-site peer peer_51-105-0-2 ike-group 'IKE-AZURE'
191191
set vpn ipsec site-to-site peer peer_51-105-0-2 ikev2-reauth 'inherit'
@@ -194,7 +194,7 @@ set vpn ipsec site-to-site peer peer_51-105-0-2 remote-address '51.105.0.2'
194194
set vpn ipsec site-to-site peer peer_51-105-0-2 vti bind 'vti52'
195195
set vpn ipsec site-to-site peer peer_51-105-0-3 authentication mode 'pre-shared-secret'
196196
set vpn ipsec site-to-site peer peer_51-105-0-3 authentication remote-id '51.105.0.3'
197-
set vpn ipsec site-to-site peer peer_51-105-0-3 connection-type 'respond'
197+
set vpn ipsec site-to-site peer peer_51-105-0-3 connection-type 'none'
198198
set vpn ipsec site-to-site peer peer_51-105-0-3 ike-group 'IKE-AZURE'
199199
set vpn ipsec site-to-site peer peer_51-105-0-3 ikev2-reauth 'inherit'
200200
set vpn ipsec site-to-site peer peer_51-105-0-3 local-address '192.0.2.189'
@@ -203,7 +203,7 @@ set vpn ipsec site-to-site peer peer_51-105-0-3 vti bind 'vti32'
203203
set vpn ipsec site-to-site peer peer_51-105-0-3 vti esp-group 'ESP-AZURE'
204204
set vpn ipsec site-to-site peer peer_51-105-0-4 authentication mode 'pre-shared-secret'
205205
set vpn ipsec site-to-site peer peer_51-105-0-4 authentication remote-id '51.105.0.4'
206-
set vpn ipsec site-to-site peer peer_51-105-0-4 connection-type 'respond'
206+
set vpn ipsec site-to-site peer peer_51-105-0-4 connection-type 'none'
207207
set vpn ipsec site-to-site peer peer_51-105-0-4 ike-group 'IKE-AZURE'
208208
set vpn ipsec site-to-site peer peer_51-105-0-4 ikev2-reauth 'inherit'
209209
set vpn ipsec site-to-site peer peer_51-105-0-4 local-address '192.0.2.189'
@@ -212,7 +212,7 @@ set vpn ipsec site-to-site peer peer_51-105-0-4 vti bind 'vti31'
212212
set vpn ipsec site-to-site peer peer_51-105-0-4 vti esp-group 'ESP-AZURE'
213213
set vpn ipsec site-to-site peer peer_51-105-0-5 authentication mode 'pre-shared-secret'
214214
set vpn ipsec site-to-site peer peer_51-105-0-5 authentication remote-id '51.105.0.5'
215-
set vpn ipsec site-to-site peer peer_51-105-0-5 connection-type 'respond'
215+
set vpn ipsec site-to-site peer peer_51-105-0-5 connection-type 'none'
216216
set vpn ipsec site-to-site peer peer_51-105-0-5 ike-group 'IKE-AZURE'
217217
set vpn ipsec site-to-site peer peer_51-105-0-5 ikev2-reauth 'inherit'
218218
set vpn ipsec site-to-site peer peer_51-105-0-5 local-address '192.0.2.189'
@@ -221,7 +221,7 @@ set vpn ipsec site-to-site peer peer_51-105-0-5 vti bind 'vti42'
221221
set vpn ipsec site-to-site peer peer_51-105-0-5 vti esp-group 'ESP-AZURE'
222222
set vpn ipsec site-to-site peer peer_51-105-0-6 authentication mode 'pre-shared-secret'
223223
set vpn ipsec site-to-site peer peer_51-105-0-6 authentication remote-id '51.105.0.6'
224-
set vpn ipsec site-to-site peer peer_51-105-0-6 connection-type 'respond'
224+
set vpn ipsec site-to-site peer peer_51-105-0-6 connection-type 'none'
225225
set vpn ipsec site-to-site peer peer_51-105-0-6 ike-group 'IKE-AZURE'
226226
set vpn ipsec site-to-site peer peer_51-105-0-6 ikev2-reauth 'inherit'
227227
set vpn ipsec site-to-site peer peer_51-105-0-6 local-address '192.0.2.189'

‎src/migration-scripts/ipsec/13-to-14‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# Copyright VyOS maintainers and contributors <[email protected]>
2+
#
3+
# This library is free software; you can redistribute it and/or
4+
# modify it under the terms of the GNU Lesser General Public
5+
# License as published by the Free Software Foundation; either
6+
# version 2.1 of the License, or (at your option) any later version.
7+
#
8+
# This library is distributed in the hope that it will be useful,
9+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
10+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11+
# Lesser General Public License for more details.
12+
#
13+
# You should have received a copy of the GNU Lesser General Public License
14+
# along with this library. If not, see <http://www.gnu.org/licenses/>.
15+
16+
# Rename connection-type 'respond' to 'none' (T7594):
17+
# vpn ipsec site-to-site peer <name> connection-type respond -> none
18+
19+
from vyos.configtree import ConfigTree
20+
21+
base = ['vpn', 'ipsec', 'site-to-site']
22+
23+
def migrate(config: ConfigTree) -> None:
24+
# If IPsec config does not exist, nothing to do
25+
if not config.exists(base):
26+
return
27+
28+
# Iterate through defined peers
29+
for peer in config.list_nodes(base + ['peer']):
30+
path = base + ['peer', peer, 'connection-type']
31+
if config.value_exists(path, 'respond'):
32+
# Replace old behavior with explicit passive type
33+
config.set(path, 'none', replace=True)

0 commit comments

Comments
 (0)