VPN/IPsec add new MVC module - #6187
Conversation
…d hook events for show/hide
…so we can "predict" an identifier upfront which eases navigation inside the edit tab (so we can hook grids for child entries)
Add local, remote auth and children in model and controller, show in view when editting an existing entry.
Fix child navigation
…ed legacy properties
…ing a record. o implement cascading delete o use org_uuid field to let setter know this was a copy so we can copy children as well for ease of use.
…ication of both ends of the tunnel (legacy "My identifier" + "Peer identifier")
…connections" with [new] as this will eventually replace/supersede the current tunnel settings.
…mal viable product. Eventually we can also push attributes here, but for now we trust the attr plugin (https://docs.strongswan.org/docs/5.9/plugins/attr.html) to handle these (all pools the same)
…ata to feed swanctl
… add stub to be populated later for local and remote nets so we can easily show and search them in the connection grid.
… intrefaces and make sure to show current assigned legacy tunnels
|
Greetings. As I'm curious - will those IPSec changes/updates enable us to API-manage tunnels (create/update/delete P1+P2) in the future? Thanks (: - AnsibleGuy |
|
Hello @ansibleguy, Yes it will. Biggest caveat is that we won’t migrate legacy data to new format (modelled around swanctl.conf) so with 23.1 you have a full API but existing P1/P2 can’t be edited. The plan forward is not fully decided. We might just remove the legacy pages in 2024. Whether an automatic migration makes sense depends on user feedback and funding in 2023. But we would much rather keep working on API additions for other lacking components. Cheers, |
|
Awesome! :D Thanks for the information. -AnsibleGuy |
That was my secret hope :D Thanks for your work! |
FYI: The Ansible modules for IPSec are available => Docs - AnsibleGuy |
3 participants
Add new component to manage IPsec connections in a similar format as
swanctl.confis defined (https://docs.strongswan.org/docs/5.9/swanctl/swanctlConf.html). As this needs to work in conjunction with the legacy IPsec module, some minor changes are needed to the current state.o VPN/IPsec/Pre-Shared Keys - add optional remote identifier (merges in
ipsec.inc)o VPN/IPsec/Virtual Tunnel Interfaces - new component to show existing VTI's and add new ones (as these are separate entities)
o VPN/IPsec/Connections [new] - configuration tool to build
swanctl.confo Integrate MVC generated
swanctl.confintoipsec.inc(legacy overlays)o Integrate manually configured VTI's into
ipsec.inc(array_merge(ipsec_get_configured_vtis(), (new \OPNsense\IPsec\Swanctl())->getVtiDevices()))o fix minor php warning when changing reqid's (
$local|remote_configuredinitialisation when$configured_intf[$intf]not found)