Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

T4906: Fix show vpn ipsec connections data #1762

Merged
merged 1 commit into from
Jan 17, 2023

Conversation

sever-sever
Copy link
Member

Change Summary

We get incorrect data when showing connections
As we get a list of all connections, we should compare the connection name with entries in the list and set the correct data if they match, and "continue" if the connection doesn't match

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Code style update (formatting, renaming)
  • Refactoring (no functional changes)
  • Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
  • Other (please describe):

Related Task(s)

Component(s) name

ipsec

Proposed changes

How to test

current output show wrong tunnel down for 203.0.113.1

vyos@r1:~$ show vpn ipsec connections 
Connection                 State    Type    Remote address    Local TS     Remote TS       Local id     Remote id    Proposal
-------------------------  -------  ------  ----------------  -----------  --------------  -----------  -----------  ---------------------------------------
peer-192.0.2.1-tunnel-0    up       IKEv1   192.0.2.1         -            -               192.0.2.2    192.0.2.1    AES_CBC/256/HMAC_SHA2_256_128/MODP_1024
peer-192.0.2.1-tunnel-0    up       IPsec   192.0.2.1         10.0.0.0/24  192.168.0.0/24  192.0.2.2    192.0.2.1    AES_CBC/256/HMAC_SHA2_256_128/MODP_1024
peer-203.0.113.1-tunnel-0  down     IKEv1   203.0.113.1       -            -               203.0.113.2  203.0.113.1  -
peer-203.0.113.1-tunnel-0  down     IPsec   203.0.113.1       10.0.1.0/24  192.168.1.0/24  203.0.113.2  203.0.113.1  -
vyos@r1:~$ 

Fixed output:

vyos@r1:~$ show vpn ipsec connections 
Connection                 State    Type    Remote address    Local TS     Remote TS       Local id     Remote id    Proposal
-------------------------  -------  ------  ----------------  -----------  --------------  -----------  -----------  ---------------------------------------
peer-192.0.2.1-tunnel-0    up       IKEv1   192.0.2.1         -            -               192.0.2.2    192.0.2.1    AES_CBC/256/HMAC_SHA2_256_128/MODP_1024
peer-192.0.2.1-tunnel-0    up       IPsec   192.0.2.1         10.0.0.0/24  192.168.0.0/24  192.0.2.2    192.0.2.1    AES_CBC/256/HMAC_SHA2_256_128/MODP_1024
peer-203.0.113.1-tunnel-0  up       IKEv1   203.0.113.1       -            -               203.0.113.2  203.0.113.1  AES_CBC/256/HMAC_SHA2_256_128/MODP_1024
peer-203.0.113.1-tunnel-0  up       IPsec   203.0.113.1       10.0.1.0/24  192.168.1.0/24  203.0.113.2  203.0.113.1  AES_CBC/256/HMAC_SHA2_256_128/MODP_1024
vyos@r1:~$

Actual data from swanctl:

vyos@r1:~$ sudo swanctl -l
peer-203.0.113.1-tunnel-0: #16, ESTABLISHED, IKEv1, 9561129d6150aeaf_i* a9645500b0a9a5de_r
  local  '203.0.113.2' @ 203.0.113.2[500]
  remote '203.0.113.1' @ 203.0.113.1[500]
  AES_CBC-256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024
  established 518s ago, reauth in 2480s
  peer-203.0.113.1-tunnel-0: #32, reqid 4, REKEYED, TUNNEL, ESP:AES_CBC-256/HMAC_SHA2_256_128/MODP_1024
    installed 1199s ago, rekeying in -438s, expires in 601s
    in  c32aee4b,      0 bytes,     0 packets
    out c257cecc,      0 bytes,     0 packets
    local  10.0.1.0/24
    remote 192.168.1.0/24
  peer-203.0.113.1-tunnel-0: #34, reqid 4, INSTALLED, TUNNEL, ESP:AES_CBC-256/HMAC_SHA2_256_128/MODP_1024
    installed 438s ago, rekeying in 284s, expires in 1362s
    in  c6988e2f,      0 bytes,     0 packets
    out cce4d526,      0 bytes,     0 packets
    local  10.0.1.0/24
    remote 192.168.1.0/24
peer-192.0.2.1-tunnel-0: #15, ESTABLISHED, IKEv1, c901ad07052afb53_i* 75db4d736b7992b4_r
  local  '192.0.2.2' @ 192.0.2.2[500]
  remote '192.0.2.1' @ 192.0.2.1[500]
  AES_CBC-256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024
  established 2578s ago, reauth in 240s
  peer-192.0.2.1-tunnel-0: #33, reqid 2, INSTALLED, TUNNEL, ESP:AES_CBC-256/HMAC_SHA2_256_128/MODP_1024
    installed 717s ago, rekeying in 97s, expires in 1083s
    in  c5eea7d2,      0 bytes,     0 packets
    out c05f9ffb,      0 bytes,     0 packets
    local  10.0.0.0/24
    remote 192.168.0.0/24
vyos@r1:~$

Checklist:

  • I have read the CONTRIBUTING document
  • I have linked this PR to one or more Phabricator Task(s)
  • I have run the components SMOKETESTS if applicable
  • My commit headlines contain a valid Task id
  • My change requires a change to the documentation
  • I have updated the documentation accordingly

We get incorrect data when shows connections
As we get list of all connections we should compare the connection
name with entries in list and set correct data if they match
@c-po c-po requested a review from a team January 17, 2023 16:55
@c-po c-po requested review from dmbaturin, sarthurdev, zdc, jestabro and c-po and removed request for a team January 17, 2023 16:55
@sever-sever sever-sever merged commit ac9631e into vyos:equuleus Jan 17, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

3 participants