IPsec: Update ipsec.conf for GRE/VTI changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index e1ec348aacd8d0358b9d1cdc2d521ac12598113e..c29c5d53d39a2c07435c1b5ef70e387d229eedf1 100644 (file)
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -295,15 +295,31 @@ sub writeipsecfiles {
                        $localside = $lvpnsettings{'VPN_IP'};
                }
 
                        $localside = $lvpnsettings{'VPN_IP'};
                }
 

+               my $interface_mode = $lconfighash{$key}[36];
+

                print CONF "conn $lconfighash{$key}[1]\n";
                print CONF "\tleft=$localside\n";
                print CONF "conn $lconfighash{$key}[1]\n";
                print CONF "\tleft=$localside\n";

-               print CONF "\tleftsubnet=" . &make_subnets($lconfighash{$key}[8]) . "\n";
+
+               if ($interface_mode eq "gre") {
+                       print CONF "\tleftsubnet=%dynamic[gre]\n";
+               } elsif ($interface_mode eq "vti") {
+                       print CONF "\tleftsubnet=0.0.0.0/0\n";
+               } else {
+                       print CONF "\tleftsubnet=" . &make_subnets($lconfighash{$key}[8]) . "\n";
+               }
+

                print CONF "\tleftfirewall=yes\n";
                print CONF "\tlefthostaccess=yes\n";
                print CONF "\tright=$lconfighash{$key}[10]\n";
 
                if ($lconfighash{$key}[3] eq 'net') {
                print CONF "\tleftfirewall=yes\n";
                print CONF "\tlefthostaccess=yes\n";
                print CONF "\tright=$lconfighash{$key}[10]\n";
 
                if ($lconfighash{$key}[3] eq 'net') {

-                       print CONF "\trightsubnet=" . &make_subnets($lconfighash{$key}[11]) . "\n";
+                       if ($interface_mode eq "gre") {
+                               print CONF "\trightsubnet=%dynamic[gre]\n";
+                       } elsif ($interface_mode eq "vti") {
+                               print CONF "\trightsubnet=0.0.0.0/0\n";
+                       } else {
+                               print CONF "\trightsubnet=" . &make_subnets($lconfighash{$key}[11]) . "\n";
+                       }

                }
 
                # Local Cert and Remote Cert (unless auth is DN dn-auth)
                }
 
                # Local Cert and Remote Cert (unless auth is DN dn-auth)


@@ -323,6 +339,11 @@ sub writeipsecfiles {
                        print CONF "\ttype=tunnel\n";
                }
 
                        print CONF "\ttype=tunnel\n";
                }
 

+               # Add mark for VTI
+               if ($interface_mode eq "vti") {
+                       print CONF "\tmark=$key\n";
+               }
+

                # Is PFS enabled?
                my $pfs = $lconfighash{$key}[28] eq 'on' ? 'on' : 'off';
 
                # Is PFS enabled?
                my $pfs = $lconfighash{$key}[28] eq 'on' ? 'on' : 'off';