Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

T4725: Fix Regex for correctly reset IPsec peers #1596

Merged
merged 1 commit into from Oct 14, 2022

Conversation

sever-sever
Copy link
Member

@sever-sever sever-sever commented Oct 14, 2022

Change Summary

As IPsec site-so-site was rewritten we do not need to replace ':' => '-'
as ':' can not be in the connection name.
So connection name can not use IP(v6) address as the peer name.
And current peers/connections not required the prefix peer_
Fix template that searches correctly the connection name of the peers that allow to reset them again (reset ipsec peer was broken)

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Code style update (formatting, renaming)
  • Refactoring (no functional changes)
  • Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
  • Other (please describe):

Related Task(s)

Component(s) name

ipsec

Proposed changes

How to test

Configure IPsec from both sites and try to reset peer
Current peer name:

vyos@r14:~$ cat /etc/swanctl/swanctl.conf | grep tunnel- -B1
        children {
            OFFICE-B-tunnel-0 {
vyos@r14:~$ 

before fix

vyos@r14:~$ show vpn ipsec sa
Connection         State    Uptime    Bytes In/Out    Packets In/Out    Remote address    Remote ID    Proposal
-----------------  -------  --------  --------------  ----------------  ----------------  -----------  ----------------------------------
OFFICE-B-tunnel-0  up       17m38s    0B/0B           0/0               203.0.113.2       203.0.113.2  AES_CBC_256/HMAC_SHA1_96/MODP_1024
vyos@r14:~$ 
vyos@r14:~$ 
vyos@r14:~$ reset vpn ipsec-peer OFFICE-B 
Tunnel(s) not found, aborting
vyos@r14:~$ 
vyos@r14:~$ 
vyos@r14:~$ reset vpn ipsec-peer OFFICE-B tunnel 0
Tunnel(s) not found, aborting
vyos@r14:~$ 

After fix:

vyos@r14:~$ show vpn ipsec sa 
Connection         State    Uptime    Bytes In/Out    Packets In/Out    Remote address    Remote ID    Proposal
-----------------  -------  --------  --------------  ----------------  ----------------  -----------  ---------------------------------------
OFFICE-B-tunnel-0  up       4s        0B/0B           0/0               192.0.2.2         192.0.2.2    AES_CBC_256/HMAC_SHA2_256_128/MODP_1024
vyos@r14:~$ 
vyos@r14:~$ 
vyos@r14:~$ reset vpn ipsec-peer OFFICE-B 
closing CHILD_SA OFFICE-B-tunnel-0{16} with SPIs cc364877_i (0 bytes) c521f540_o (0 bytes) and TS 192.168.0.0/24 === 10.0.0.0/21
CHILD_SA {16} closed successfully
generating QUICK_MODE request 1449430238 [ HASH SA No KE ID ID ]
sending packet: from 192.0.2.1[500] to 192.0.2.2[500] (332 bytes)
received packet: from 192.0.2.2[500] to 192.0.2.1[500] (332 bytes)
parsed QUICK_MODE response 1449430238 [ HASH SA No KE ID ID ]
selected proposal: ESP:AES_CBC_256/HMAC_SHA2_256_128/MODP_1024/NO_EXT_SEQ
CHILD_SA OFFICE-B-tunnel-0{17} established with SPIs cd451e27_i cfb63c3c_o and TS 192.168.0.0/24 === 10.0.0.0/21
generating QUICK_MODE request 1449430238 [ HASH ]
sending packet: from 192.0.2.1[500] to 192.0.2.2[500] (76 bytes)
connection 'OFFICE-B-tunnel-0' established successfully
Peer reset result: success
vyos@r14:~$ 

Checklist:

  • I have read the CONTRIBUTING document
  • I have linked this PR to one or more Phabricator Task(s)
  • I have run the components SMOKETESTS if applicable
  • My commit headlines contain a valid Task id
  • My change requires a change to the documentation
  • I have updated the documentation accordingly

As IPsec site-so-site was rewritten we do not need replace
':' => '-' as ':' can not be in the connection name
So connection name can not use IP(v6) address as peer name
And current peers/connections not required prefix 'peer_'
Fix template that search correctly connection name of the peers
that allow to reset them again (reset ipsec peer was broken)
@c-po c-po merged commit 783f5e2 into vyos:current Oct 14, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
2 participants