T264: IPsec add base64 encoded secret-type feature #4198

sever-sever · 2024-11-19T17:59:17Z

Change Summary

Add the ability to configure base64 encoded passwords for VPN IPSec site-to-site peers

set vpn ipsec authentication psk PSK secret 'MTIzNDU2Nzg5MA=='
set vpn ipsec authentication psk PSK secret-type < base64|plaintext >

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Code style update (formatting, renaming)
Refactoring (no functional changes)
Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
Other (please describe):

Related Task(s)

https://vyos.dev/T264

Related PR(s)

Component(s) name

ipsec

Proposed changes

How to test

Configure base64 encoded password on the left node and clear password on the right node`

LEFT node:

set vpn ipsec authentication psk PSK id '192.0.2.1'
set vpn ipsec authentication psk PSK id '192.0.2.2'
set vpn ipsec authentication psk PSK secret 'MTIzNDU2Nzg5MA=='
set vpn ipsec authentication psk PSK secret-type 'base64'
set vpn ipsec esp-group ESP-group lifetime '3600'
set vpn ipsec esp-group ESP-group mode 'tunnel'
set vpn ipsec esp-group ESP-group pfs 'enable'
set vpn ipsec esp-group ESP-group proposal 1 encryption 'aes256'
set vpn ipsec esp-group ESP-group proposal 1 hash 'sha1'
set vpn ipsec ike-group IKE-group key-exchange 'ikev2'
set vpn ipsec ike-group IKE-group lifetime '28800'
set vpn ipsec ike-group IKE-group proposal 1 encryption 'aes256'
set vpn ipsec ike-group IKE-group proposal 1 hash 'sha1'
set vpn ipsec interface 'eth1'
set vpn ipsec site-to-site peer OFFICE-B authentication local-id '192.0.2.1'
set vpn ipsec site-to-site peer OFFICE-B authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer OFFICE-B authentication remote-id '192.0.2.2'
set vpn ipsec site-to-site peer OFFICE-B connection-type 'initiate'
set vpn ipsec site-to-site peer OFFICE-B ike-group 'IKE-group'
set vpn ipsec site-to-site peer OFFICE-B local-address '192.0.2.1'
set vpn ipsec site-to-site peer OFFICE-B remote-address '192.0.2.2'
set vpn ipsec site-to-site peer OFFICE-B tunnel 0 esp-group 'ESP-group'
set vpn ipsec site-to-site peer OFFICE-B tunnel 0 local prefix '100.64.1.0/24'
set vpn ipsec site-to-site peer OFFICE-B tunnel 0 remote prefix '100.64.2.0/24'

RIGHT node:

set vpn ipsec authentication psk PSK id '192.0.2.1'
set vpn ipsec authentication psk PSK id '192.0.2.2'
set vpn ipsec authentication psk PSK secret '1234567890'
set vpn ipsec esp-group ESP-group lifetime '3600'
set vpn ipsec esp-group ESP-group mode 'tunnel'
set vpn ipsec esp-group ESP-group pfs 'enable'
set vpn ipsec esp-group ESP-group proposal 1 encryption 'aes256'
set vpn ipsec esp-group ESP-group proposal 1 hash 'sha1'
set vpn ipsec ike-group IKE-group key-exchange 'ikev2'
set vpn ipsec ike-group IKE-group lifetime '28800'
set vpn ipsec ike-group IKE-group proposal 1 encryption 'aes256'
set vpn ipsec ike-group IKE-group proposal 1 hash 'sha1'
set vpn ipsec interface 'eth1'
set vpn ipsec site-to-site peer OFFICE-A authentication local-id '192.0.2.2'
set vpn ipsec site-to-site peer OFFICE-A authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer OFFICE-A authentication remote-id '192.0.2.1'
set vpn ipsec site-to-site peer OFFICE-A connection-type 'respond'
set vpn ipsec site-to-site peer OFFICE-A ike-group 'IKE-group'
set vpn ipsec site-to-site peer OFFICE-A local-address '192.0.2.2'
set vpn ipsec site-to-site peer OFFICE-A remote-address '192.0.2.1'
set vpn ipsec site-to-site peer OFFICE-A tunnel 0 esp-group 'ESP-group'
set vpn ipsec site-to-site peer OFFICE-A tunnel 0 local prefix '100.64.2.0/24'
set vpn ipsec site-to-site peer OFFICE-A tunnel 0 remote prefix '100.64.1.0/24'

Check config on the left node

vyos@r14:~$ cat /etc/swanctl/swanctl.conf | grep secret -A 5
secrets {
    ike-PSK {
        # ID's from auth psk <tag> id xxx
        id-d8e5cef6-0390-40bc-b371-f6f179413112 = "192.0.2.1"
        id-b9696448-1430-4411-b74b-aafc906f90c7 = "192.0.2.2"
        secret = 0sMTIzNDU2Nzg5MA==
    }

}

Be sure the connection is working

Nov 19 17:57:16 r14 charon[41119]: 02[NET] <OFFICE-B|1> received packet: from 192.0.2.2[4500] to 192.0.2.1[4500] (220 bytes)
Nov 19 17:57:16 r14 charon[41119]: 02[ENC] <OFFICE-B|1> parsed IKE_AUTH response 1 [ IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) ]
Nov 19 17:57:16 r14 charon[41119]: 02[IKE] <OFFICE-B|1> authentication of '192.0.2.2' with pre-shared key successful
Nov 19 17:57:16 r14 charon[41119]: 02[IKE] <OFFICE-B|1> peer supports MOBIKE
Nov 19 17:57:16 r14 charon[41119]: 02[IKE] <OFFICE-B|1> IKE_SA OFFICE-B[1] established between 192.0.2.1[192.0.2.1]...192.0.2.2[192.0.2.2]
Nov 19 17:57:16 r14 charon[41119]: 02[IKE] <OFFICE-B|1> scheduling rekeying in 27280s
Nov 19 17:57:16 r14 charon[41119]: 02[IKE] <OFFICE-B|1> maximum IKE_SA lifetime 30160s
Nov 19 17:57:16 r14 charon[41119]: 02[CFG] <OFFICE-B|1> selected proposal: ESP:AES_CBC_256/HMAC_SHA1_96/NO_EXT_SEQ
Nov 19 17:57:16 r14 charon[41119]: 02[IKE] <OFFICE-B|1> CHILD_SA OFFICE-B-tunnel-0{1} established with SPIs ca76d43e_i ca6487b5_o and TS 100.64.1.0/24 === 100.64.2.0/24


vyos@r14:~$ show vpn ipsec connections 
Connection         State    Type    Remote address    Local TS       Remote TS      Local id    Remote id    Proposal
-----------------  -------  ------  ----------------  -------------  -------------  ----------  -----------  ----------------------------------
OFFICE-B           up       IKEv2   192.0.2.2         -              -              192.0.2.1   192.0.2.2    AES_CBC/256/HMAC_SHA1_96/MODP_1024
OFFICE-B-tunnel-0  up       IPsec   192.0.2.2         100.64.1.0/24  100.64.2.0/24  192.0.2.1   192.0.2.2    AES_CBC/256/HMAC_SHA1_96/None
vyos@r14:~$

Smoketest result

vyos@r14:~$ /usr/libexec/vyos/tests/smoke/cli/test_vpn_ipsec.py
test_dhcp_fail_handling (__main__.TestVPNIPsec.test_dhcp_fail_handling) ... ok
test_dmvpn (__main__.TestVPNIPsec.test_dmvpn) ... ok
test_flex_vpn_vips (__main__.TestVPNIPsec.test_flex_vpn_vips) ... ok
test_remote_access (__main__.TestVPNIPsec.test_remote_access) ... ok
test_remote_access_dhcp_fail_handling (__main__.TestVPNIPsec.test_remote_access_dhcp_fail_handling) ... ok
test_remote_access_eap_tls (__main__.TestVPNIPsec.test_remote_access_eap_tls) ... ok
test_remote_access_no_rekey (__main__.TestVPNIPsec.test_remote_access_no_rekey) ... ok
test_remote_access_pool_range (__main__.TestVPNIPsec.test_remote_access_pool_range) ... ok
test_remote_access_vti (__main__.TestVPNIPsec.test_remote_access_vti) ... ok
test_remote_access_x509 (__main__.TestVPNIPsec.test_remote_access_x509) ... ok
test_site_to_site (__main__.TestVPNIPsec.test_site_to_site) ... ok
test_site_to_site_vti (__main__.TestVPNIPsec.test_site_to_site_vti) ... ok
test_site_to_site_x509 (__main__.TestVPNIPsec.test_site_to_site_x509) ... ok

----------------------------------------------------------------------
Ran 13 tests in 80.993s

OK
vyos@r14:~$

Checklist:

I have read the CONTRIBUTING document
I have linked this PR to one or more Phabricator Task(s)
I have run the components SMOKETESTS if applicable
My commit headlines contain a valid Task id
My change requires a change to the documentation
I have updated the documentation accordingly

github-actions · 2024-11-19T17:59:35Z

👍
No issues in PR Title / Commit Title

c-po · 2024-11-20T19:33:21Z

data/templates/ipsec/swanctl.conf.j2

        secret = "{{ psk_config.secret }}"
+{%         else %}


If secret_type has a defaultValue in XML there is no need for a else code path.

I wanted to play it safe and make a fallback.

If secret_type has a defaultValue in XML there is no need for a else code path.

done!

c-po · 2024-11-20T19:35:13Z

smoketest/scripts/cli/test_vpn_ipsec.py

@@ -106,6 +107,32 @@
 CERT_PATH   = f'{swanctl_dir}/x509/'
 CA_PATH     = f'{swanctl_dir}/x509ca/'

+
+def _encode_to_base64(input_string):


Probably a good candidate for vyos.utils.convert?

It probably is, we can move it there is more use cases for it arise for sure.

Moved to vyos.utils.convert

dmbaturin · 2024-11-21T11:45:10Z

smoketest/scripts/cli/test_vpn_ipsec.py

@@ -106,6 +107,32 @@
 CERT_PATH   = f'{swanctl_dir}/x509/'
 CA_PATH     = f'{swanctl_dir}/x509ca/'

+
+def _encode_to_base64(input_string):


It probably is, we can move it there is more use cases for it arise for sure.

Add the ability to configure base64 encoded passwords for VPN IPSec site-to-site peers authentication psk PSK secret 'xxxxx==' authentication psk PSK secret-type <base64|plaintext>

github-actions · 2024-11-21T14:51:36Z

CI integration 👍 passed!

Details

CI logs

CLI Smoketests (no interfaces) 👍 passed
CLI Smoketests (interfaces only) 👍 passed
Config tests 👍 passed
RAID1 tests 👍 passed
TPM tests 👍 passed

sever-sever requested a review from a team as a code owner November 19, 2024 17:59

sever-sever requested review from dmbaturin, sarthurdev, zdc, jestabro, c-po and nicolas-fort November 19, 2024 17:59

github-actions bot assigned sever-sever Nov 19, 2024

github-actions bot added the current label Nov 19, 2024

sever-sever force-pushed the T264 branch from 78d910c to 4d45698 Compare November 20, 2024 11:36

c-po requested changes Nov 20, 2024

View reviewed changes

dmbaturin approved these changes Nov 21, 2024

View reviewed changes

T264: IPsec add base64 encoded secret-type feature

5c7647b

Add the ability to configure base64 encoded passwords for VPN IPSec site-to-site peers authentication psk PSK secret 'xxxxx==' authentication psk PSK secret-type <base64|plaintext>

sever-sever force-pushed the T264 branch from 4d45698 to 5c7647b Compare November 21, 2024 13:35

sever-sever requested a review from c-po November 21, 2024 13:36

c-po approved these changes Nov 26, 2024

View reviewed changes

c-po merged commit f3a46fc into vyos:current Nov 26, 2024
15 of 16 checks passed

sever-sever mentioned this pull request Nov 27, 2024

Add IPSec base64 secrets vyos/vyos-documentation#1572

Merged

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

T264: IPsec add base64 encoded secret-type feature #4198

T264: IPsec add base64 encoded secret-type feature #4198

sever-sever commented Nov 19, 2024 •

edited

Loading

github-actions bot commented Nov 19, 2024 •

edited

Loading

c-po Nov 20, 2024

sever-sever Nov 21, 2024

sever-sever Nov 21, 2024

c-po Nov 20, 2024

dmbaturin Nov 21, 2024

sever-sever Nov 21, 2024

dmbaturin Nov 21, 2024

github-actions bot commented Nov 21, 2024

T264: IPsec add base64 encoded secret-type feature #4198

T264: IPsec add base64 encoded secret-type feature #4198

Conversation

sever-sever commented Nov 19, 2024 • edited Loading

Change Summary

Types of changes

Related Task(s)

Related PR(s)

Component(s) name

Proposed changes

How to test

Smoketest result

Checklist:

github-actions bot commented Nov 19, 2024 • edited Loading

c-po Nov 20, 2024

Choose a reason for hiding this comment

sever-sever Nov 21, 2024

Choose a reason for hiding this comment

sever-sever Nov 21, 2024

Choose a reason for hiding this comment

c-po Nov 20, 2024

Choose a reason for hiding this comment

dmbaturin Nov 21, 2024

Choose a reason for hiding this comment

sever-sever Nov 21, 2024

Choose a reason for hiding this comment

dmbaturin Nov 21, 2024

Choose a reason for hiding this comment

github-actions bot commented Nov 21, 2024

Details

sever-sever commented Nov 19, 2024 •

edited

Loading

github-actions bot commented Nov 19, 2024 •

edited

Loading