diff --git a/.gitlab/tests/cram/arcadyan-mozart/005-build-config.t b/.gitlab/tests/cram/arcadyan-mozart/005-build-config.t index d29debbb16..fa78d87f41 100644 --- a/.gitlab/tests/cram/arcadyan-mozart/005-build-config.t +++ b/.gitlab/tests/cram/arcadyan-mozart/005-build-config.t @@ -133,6 +133,7 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_ipset=y CONFIG_PACKAGE_iptables-mod-conntrack-extra=y CONFIG_PACKAGE_iptables-mod-ipopt=y + CONFIG_PACKAGE_iptables-mod-ipsec=y CONFIG_PACKAGE_iptables-mod-nfqueue=y CONFIG_PACKAGE_iptables-zz-legacy=y CONFIG_PACKAGE_iputils-ping=y @@ -155,6 +156,7 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_kmod-ipt-core=y CONFIG_PACKAGE_kmod-ipt-extra=y CONFIG_PACKAGE_kmod-ipt-ipopt=y + CONFIG_PACKAGE_kmod-ipt-ipsec=y CONFIG_PACKAGE_kmod-ipt-ipset=y CONFIG_PACKAGE_kmod-ipt-nat=y CONFIG_PACKAGE_kmod-ipt-nat6=y @@ -288,6 +290,7 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_libuspprotobuf=y CONFIG_PACKAGE_libuv=y CONFIG_PACKAGE_libwebsockets4-full=y + CONFIG_PACKAGE_libwireguard=y CONFIG_PACKAGE_libxml2=y CONFIG_PACKAGE_libxtables=y CONFIG_PACKAGE_lighttpd=y @@ -378,15 +381,19 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_netmodel-dslite=y CONFIG_PACKAGE_netmodel-ethernet=y CONFIG_PACKAGE_netmodel-gni=y + CONFIG_PACKAGE_netmodel-gre=y CONFIG_PACKAGE_netmodel-ip=y CONFIG_PACKAGE_netmodel-iprouter=y + CONFIG_PACKAGE_netmodel-ipsec=y CONFIG_PACKAGE_netmodel-logical=y CONFIG_PACKAGE_netmodel-netdev=y CONFIG_PACKAGE_netmodel-optical=y CONFIG_PACKAGE_netmodel-ppp=y CONFIG_PACKAGE_netmodel-radio=y CONFIG_PACKAGE_netmodel-ssid=y + CONFIG_PACKAGE_netmodel-tuntap=y CONFIG_PACKAGE_netmodel-vlan=y + CONFIG_PACKAGE_netmodel-wireguard=y CONFIG_PACKAGE_netmodel-xpon=y # CONFIG_PACKAGE_nftables-json is not set CONFIG_PACKAGE_obudpst=y @@ -484,9 +491,11 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_tr181-firewall=y CONFIG_PACKAGE_tr181-flashmonitor=y CONFIG_PACKAGE_tr181-gnimanager=y + CONFIG_PACKAGE_tr181-gre=y CONFIG_PACKAGE_tr181-homeplug=y CONFIG_PACKAGE_tr181-httpaccess=y CONFIG_PACKAGE_tr181-ipdiagnostics=y + CONFIG_PACKAGE_tr181-ipsec=y CONFIG_PACKAGE_tr181-led=y CONFIG_PACKAGE_tr181-logical=y CONFIG_PACKAGE_tr181-mcastd=y @@ -504,10 +513,12 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_tr181-sfp=y CONFIG_PACKAGE_tr181-syslog=y CONFIG_PACKAGE_tr181-temperature=y + CONFIG_PACKAGE_tr181-tuntap=y CONFIG_PACKAGE_tr181-upnp=y CONFIG_PACKAGE_tr181-upnpdiscovery=y CONFIG_PACKAGE_tr181-usb=y CONFIG_PACKAGE_tr181-usermanagement=y + CONFIG_PACKAGE_tr181-wireguard=y CONFIG_PACKAGE_tr181-xpon=y CONFIG_PACKAGE_umdns-prpl=y CONFIG_PACKAGE_unbound-daemon-prpl=y @@ -671,12 +682,18 @@ Assure expected build configuration (PCF-1413): CONFIG_SAH_AMX_TR181_GNIMANAGER_ORDER=25 CONFIG_SAH_AMX_TR181_GNIMANAGER_RUN_AS_GROUP="tr181_app" CONFIG_SAH_AMX_TR181_GNIMANAGER_RUN_AS_USER="tr181_app" + CONFIG_SAH_AMX_TR181_GRE=y + CONFIG_SAH_AMX_TR181_GRE_START_ORDER=81 + CONFIG_SAH_AMX_TR181_GRE_STOP_ORDER=19 CONFIG_SAH_AMX_TR181_HOMEPLUG=y CONFIG_SAH_AMX_TR181_HOMEPLUG_START_ORDER=31 CONFIG_SAH_AMX_TR181_HOMEPLUG_STOP_ORDER=69 CONFIG_SAH_AMX_TR181_HTTPACCESS=y CONFIG_SAH_AMX_TR181_HTTPACCESS_FIREWALL=y CONFIG_SAH_AMX_TR181_HTTPACCESS_ORDER=49 + CONFIG_SAH_AMX_TR181_IPSEC=y + CONFIG_SAH_AMX_TR181_IPSEC_START_ORDER=84 + CONFIG_SAH_AMX_TR181_IPSEC_STOP_ORDER=16 CONFIG_SAH_AMX_TR181_IP=y CONFIG_SAH_AMX_TR181_IP_RUN_AS_GROUP="tr181_app" CONFIG_SAH_AMX_TR181_IP_RUN_AS_USER="tr181_app" @@ -741,6 +758,9 @@ Assure expected build configuration (PCF-1413): CONFIG_SAH_AMX_TR181_TEMPERATURE_RUN_AS_USER="tr181_app" CONFIG_SAH_AMX_TR181_TIME=y CONFIG_SAH_AMX_TR181_TIME_ORDER=30 + CONFIG_SAH_AMX_TR181_TUNTAP=y + CONFIG_SAH_AMX_TR181_TUNTAP_START_ORDER=82 + CONFIG_SAH_AMX_TR181_TUNTAP_STOP_ORDER=18 CONFIG_SAH_AMX_TR181_UPNP=y CONFIG_SAH_AMX_TR181_UPNPDISCOVERY=y CONFIG_SAH_AMX_TR181_UPNPDISCOVERY_RUN_AS_GROUP="tr181_app" @@ -751,6 +771,9 @@ Assure expected build configuration (PCF-1413): CONFIG_SAH_AMX_TR181_UPNP_ORDER=80 CONFIG_SAH_AMX_TR181_UPNP_RUN_AS_GROUP="tr181_app" CONFIG_SAH_AMX_TR181_UPNP_RUN_AS_USER="tr181_app" + CONFIG_SAH_AMX_TR181_WIREGUARD=y + CONFIG_SAH_AMX_TR181_WIREGUARD_START_ORDER=25 + CONFIG_SAH_AMX_TR181_WIREGUARD_STOP_ORDER=75 CONFIG_SAH_AMX_TR181_XPON=y CONFIG_SAH_AMX_TR181_XPON_MAX_ONUS=1 CONFIG_SAH_AMX_TR181_XPON_ORDER=30 diff --git a/.gitlab/tests/cram/generic/acceleration-plan-components/133-ipsec-e2e.t b/.gitlab/tests/cram/generic/acceleration-plan-components/133-ipsec-e2e.t new file mode 100644 index 0000000000..2457c43a14 --- /dev/null +++ b/.gitlab/tests/cram/generic/acceleration-plan-components/133-ipsec-e2e.t @@ -0,0 +1,157 @@ +End-to-end IPsec tunnel test with certificate authentication (IKEv2 + +ESP). The remote peer runs a dedicated charon instance inside a network +namespace on the DUT: ip-full's netns exec provides a private mount +namespace, so /var/run is remounted as tmpfs to isolate the peer charon +(pid file, vici socket) from the CPE charon instance. + +Create R alias: + + $ alias R="${CRAM_REMOTE_COMMAND:-}" + + $ R logger -t cram "Starting IPsec E2E test" + +Create the peer network namespace with a veth link emulating the WAN: + + $ R "(ip netns add ipsecpeer; \ + > ip link add veth-ips type veth peer name veth-ipsp; \ + > ip link set veth-ipsp netns ipsecpeer; \ + > ip addr add 192.168.79.1/24 dev veth-ips; \ + > ip link set veth-ips up; \ + > ip netns exec ipsecpeer ip addr add 192.168.79.2/24 dev veth-ipsp; \ + > ip netns exec ipsecpeer ip addr add 10.30.0.1/24 dev veth-ipsp; \ + > ip netns exec ipsecpeer ip link set veth-ipsp up; \ + > ip netns exec ipsecpeer ip link set lo up) > /dev/null 2>&1" + +Generate the certificates. IKEv2RemoteAuthenticationMethod designates the +authority the peer is validated against, so the peer needs an end entity +certificate issued by the imported certificate: a self-signed certificate +is never its own issuer and is rejected by the constraint check. The CPE +authenticates with a self-signed certificate, pinned by the peer. The CA key +and serial stay outside the swanctl tree, which is loaded wholesale and fails +on any file in it that is not a certificate. Issuing the peer certificate runs +without the system openssl.cnf: it enables the pkcs11 engine for softhsm, and +an enabled engine makes signing with an on-disk CA key fail on OpenSSL 3 with +"digital envelope routines:default_check:command not supported". + + $ R "(mkdir -p /root/certs /etc/config/autocert /tmp/ipsecpeer/swanctl/x509 /tmp/ipsecpeer/swanctl/x509ca /tmp/ipsecpeer/swanctl/private; \ + > openssl req -x509 -newkey rsa:2048 -nodes -days 30 \ + > -keyout /root/certs/tr181-ipsec.pem \ + > -out /etc/config/autocert/tr181-ipsec.pem \ + > -subj '/CN=tr181-ipsec@prplos.test'; \ + > openssl req -x509 -newkey rsa:2048 -nodes -days 30 \ + > -keyout /tmp/ipsecpeer/ca-key.pem \ + > -out /tmp/ipsecpeer/ca-cert.pem \ + > -subj '/CN=ipsec-peer-ca@prplos.test'; \ + > openssl req -new -newkey rsa:2048 -nodes \ + > -keyout /tmp/ipsecpeer/swanctl/private/peer-key.pem \ + > -out /tmp/ipsecpeer/peer-csr.pem \ + > -subj '/CN=ipsec-peer@prplos.test'; \ + > OPENSSL_CONF=/dev/null openssl x509 -req -days 30 -sha256 \ + > -CAserial /tmp/ipsecpeer/ca-cert.srl -CAcreateserial \ + > -in /tmp/ipsecpeer/peer-csr.pem \ + > -CA /tmp/ipsecpeer/ca-cert.pem \ + > -CAkey /tmp/ipsecpeer/ca-key.pem \ + > -out /tmp/ipsecpeer/swanctl/x509/peer-cert.pem; \ + > cp /etc/config/autocert/tr181-ipsec.pem /tmp/ipsecpeer/swanctl/x509/cpe-cert.pem; \ + > cp /tmp/ipsecpeer/ca-cert.pem /tmp/ipsecpeer/swanctl/x509ca/peer-ca.pem; \ + > cp /tmp/ipsecpeer/ca-cert.pem /etc/config/autocert/ipsec-peer.pem) > /dev/null 2>&1" + +Import the certificates into the Security data model: + + $ R "/etc/init.d/tr181-security restart > /dev/null 2>&1" + $ sleep 3 + $ CPECERTIDX=$(R "ba-cli 'Security.Certificate.[CAFileName == \"tr181-ipsec.pem\"].SerialNumber?'" | sed -ne 's/^Security.Certificate.\([0-9]\+\)\..*/\1/p' | head -n 1) + $ PEERCERTIDX=$(R "ba-cli 'Security.Certificate.[CAFileName == \"ipsec-peer.pem\"].SerialNumber?'" | sed -ne 's/^Security.Certificate.\([0-9]\+\)\..*/\1/p' | head -n 1) + $ R "ba-cli 'Security.Certificate.$CPECERTIDX.PrivateKeyURI=\"file:///root/certs/tr181-ipsec.pem\"'" > /dev/null 2>&1 + $ test -n "$CPECERTIDX" && test -n "$PEERCERTIDX" && echo certs-imported + certs-imported + +Configure the strongSwan peer inside the namespace: + + $ R "printf '%s\n' \ + > 'charon {' \ + > ' port = 500' \ + > ' port_nat_t = 4500' \ + > '}' > /tmp/ipsecpeer/strongswan.conf" + $ R "printf '%s\n' \ + > 'connections {' \ + > ' cpe {' \ + > ' version = 2' \ + > ' local_addrs = 192.168.79.2' \ + > ' remote_addrs = 192.168.79.1' \ + > ' proposals = aes256-sha256-modp3072' \ + > ' local {' \ + > ' auth = pubkey' \ + > ' certs = peer-cert.pem' \ + > ' id = \"CN=ipsec-peer@prplos.test\"' \ + > ' }' \ + > ' remote {' \ + > ' auth = pubkey' \ + > ' certs = cpe-cert.pem' \ + > ' id = \"CN=tr181-ipsec@prplos.test\"' \ + > ' }' \ + > ' children {' \ + > ' cpe {' \ + > ' local_ts = 10.30.0.0/24' \ + > ' remote_ts = 192.168.1.1/32' \ + > ' esp_proposals = aes256-sha512' \ + > ' }' \ + > ' }' \ + > ' }' \ + > '}' > /tmp/ipsecpeer/swanctl/swanctl.conf" + +Start the peer charon and load its configuration (private /var/run keeps +it separated from the CPE charon): + + $ R "ip netns exec ipsecpeer sh -c ' \ + > mount -t tmpfs tmpfs /var/run; \ + > STRONGSWAN_CONF=/tmp/ipsecpeer/strongswan.conf /usr/lib/ipsec/charon > /tmp/ipsecpeer/charon.log 2>&1 & \ + > echo \$! > /tmp/ipsecpeer/charon.pid; \ + > sleep 3; \ + > STRONGSWAN_CONF=/tmp/ipsecpeer/strongswan.conf SWANCTL_DIR=/tmp/ipsecpeer/swanctl swanctl --load-all >> /tmp/ipsecpeer/charon.log 2>&1; \ + > echo \$?'" + 0 + +Configure the CPE IPsec profile and filter through the data model: + + $ PROFIDX=$(R "ba-cli 'IPsec.Profile.+{Alias=\"e2e\",ESPAllowedEncryptionAlgorithms=\"AES-CBC\",ESPAllowedIntegrityAlgorithms=\"HMAC-SHA2-512-256\",IKEv2AllowedDiffieHellmanGroupTransforms=\"MODP-3072\",IKEv2AllowedEncryptionAlgorithms=\"AES-CBC\",IKEv2AllowedIntegrityAlgorithms=\"HMAC-SHA2-256-128\",IKEv2AuthenticationMethod=\"Device.Security.Certificate.$CPECERTIDX\",IKEv2RemoteAuthenticationMethod=\"Device.Security.Certificate.$PEERCERTIDX\",IKEv2LocalID=\"CN=tr181-ipsec@prplos.test\",IKEv2RemoteID=\"CN=ipsec-peer@prplos.test\",RemoteEndpoints=\"192.168.79.2\"}'" 2>/dev/null | sed -ne 's/^IPsec.Profile.\([0-9]\+\).$/\1/p') + $ R "ba-cli 'IPsec.Filter.+{Alias=\"e2e\",AllInterfaces=1,DestIP=\"192.168.1.1\",SourceIP=\"10.30.0.0/24\",Enable=1,ProcessingChoice=\"Protect\",Profile=\"Device.IPsec.Profile.$PROFIDX\"}'" > /dev/null 2>&1 + +The plugin binds the security policies to the xfrm interface it creates for +the profile, so the remote subnet must be routed through that interface for +the traffic to be protected: + + $ IPSECDEV="ipsec$((PROFIDX - 1))" + $ R "(ip link set $IPSECDEV up; ip route add 10.30.0.0/24 dev $IPSECDEV) > /dev/null 2>&1; true" + $ sleep 5 + +Send traffic matching the filter to trigger the IKE negotiation: + + $ R "ping -I 192.168.1.1 -c 2 -W 15 10.30.0.1 > /dev/null 2>&1; true" + $ R "ping -I 192.168.1.1 -c 3 -W 10 10.30.0.1 > /dev/null 2>&1; echo \$?" + 0 + +Verify the IKEv2 SA and its Child SA are up: + + $ R "ba-cli 'IPsec.IKEv2SA.*.Status?'" | grep -c '"Up"' + 1 + $ R "ba-cli 'IPsec.IKEv2SA.*.ChildSA.*.Status?'" | grep -c '"Up"' + 1 + +Traffic counters increase on the Child SA: + + $ R "ba-cli 'IPsec.IKEv2SA.*.ChildSA.*.Stats.PacketsSent?'" | sed -ne 's/.*PacketsSent=\([0-9]\+\).*/\1/p' | head -n 1 | awk '{print (($1 > 0) ? "packets-sent" : "no-packets")}' + packets-sent + +Cleanup: + + $ R "ba-cli 'IPsec.Filter.e2e-'" > /dev/null 2>&1 + $ R "ba-cli 'IPsec.Profile.e2e-'" > /dev/null 2>&1 + $ R "(kill \$(cat /tmp/ipsecpeer/charon.pid) 2>/dev/null; \ + > ip route del 10.30.0.0/24 dev $IPSECDEV; \ + > ip netns del ipsecpeer; \ + > rm -rf /tmp/ipsecpeer; \ + > rm -f /root/certs/tr181-ipsec.pem /etc/config/autocert/tr181-ipsec.pem /etc/config/autocert/ipsec-peer.pem; \ + > /etc/init.d/tr181-security restart) > /dev/null 2>&1; true" + + $ R logger -t cram "IPsec E2E test finished" diff --git a/.gitlab/tests/cram/generic/acceleration-plan-components/133-tr181-ipsec.t b/.gitlab/tests/cram/generic/acceleration-plan-components/133-tr181-ipsec.t new file mode 100644 index 0000000000..ad7674c1bc --- /dev/null +++ b/.gitlab/tests/cram/generic/acceleration-plan-components/133-tr181-ipsec.t @@ -0,0 +1,39 @@ +Create R alias: + + $ alias R="${CRAM_REMOTE_COMMAND:-}" + +Check IPsec root datamodel: + + $ R ba-cli 'IPsec.Filter.*.-\;IPsec.Profile.*.-' >/dev/null 2>&1; true + $ R "ubus -S call IPsec _get" + {"IPsec.":{"IKEv2SupportedEncryptionAlgorithms":"DES,3DES,CAST,BLOWFISH,AES-CBC,AES-CTR,AES-CCM-8,AES-CCM-12,AES-CCM-16,AES-GCM-8,AES-GCM-12,AES-GCM-16","ProfileNumberOfEntries":0,"Status":"Enabled","Enable":true,"IKEv2SupportedIDTypes":"ID_IPV4_ADDR,ID_FQDN,ID_RFC822_ADDR,ID_IPV6_ADDR,ID_KEY_ID,ID_DER_ASN1_DN,ID_DER_ASN1_GN","AHSupported":true,"FilterNumberOfEntries":0,"MaxProfileEntries":0,"MaxFilterEntries":0,"SupportedIntegrityAlgorithms":"HMAC-MD5-96,HMAC-SHA1-96,AES-XCBC-96,HMAC-MD5-128,HMAC-SHA1-160,HMAC-SHA2-256-128,HMAC-SHA2-256-256,HMAC-SHA2-384-192,HMAC-SHA2-512-256","ESPSupportedEncryptionAlgorithms":"NULL,DES,3DES,CAST,BLOWFISH,AES-CBC,AES-CTR,AES-CCM-8,AES-CCM-12,AES-CCM-16,AES-GCM-8,AES-GCM-12,AES-GCM-16","InterfaceNumberOfEntries":0,"SupportedDiffieHellmanGroupTransforms":"MODP-768,MODP-1024,MODP-1536,MODP-2048,MODP-3072,MODP-4096,MODP-6144,MODP-8192,ECP-256,ECP-384,ECP-521,MODP-1024-PRIME-160,MODP-2048-PRIME-224,MODP-2048-PRIME-256,ECP-192,ECP-224","IKEv2SANumberOfEntries":0,"IKEv2SupportedPseudoRandomFunctions":"HMAC-MD5,HMAC-SHA1,AES-128-XCBC,HMAC-SHA2-256,HMAC-SHA2-384,HMAC-SHA2-512","SecretNumberOfEntries":0,"TunnelNumberOfEntries":0}} + {} + {"amxd-error-code":0} + +Create an IPsec Profile and map a Filter on it: + + $ IPSECIDXPROFILE=`R ba-cli "IPsec.Profile.+{Alias='p1'}" 2>/dev/null | sed -ne 's/^IPsec.Profile.\([0-9]\+\).$/\1/p'` + $ IPSECIDXFILTER=`R ba-cli "IPsec.Filter.+{Alias='f1',Enable=1,ProcessingChoice='Protect',Profile='Device.IPsec.Profile.$IPSECIDXPROFILE'}" 2>/dev/null | sed -ne 's/^IPsec.Filter.\([0-9]\+\).$/\1/p'` + $ IPSECIFACE=`R ba-cli "protected\;IPsec.Interface.$IPSECIDXPROFILE.Name?" | sed -ne 's/^IPsec.Interface.[0-9]\+.Name="\(.*\)"$/\1/p'` + $ R ba-cli "IPsec.Filter.$IPSECIDXFILTER.Status?" | sed -ne 2p + IPsec.Filter.[0-9]+.Status="Error_Misconfigured" (re) + $ R ba-cli "protected\;IPsec.Interface.$IPSECIFACE.Status?" | sed -ne '/^IPsec.Interface.*$/p' + IPsec.Interface.[0-9]+.Status="Down" (re) + $ R ba-cli "IPsec.Tunnel.$IPSECIFACE.Filters?" | sed -ne 2p + IPsec.Tunnel.[0-9]+.Filters="Device.IPsec.Filter.[0-9]+" (re) + +Verify status in NetModel, once the interface has been resolved: + + $ R "i=1; while [ \$i -lt 10 ] && \ + > ! ba-cli 'NetModel.Intf.ip-$IPSECIFACE.Status_ext?' | grep -q '\"Up\"'; \ + > do i=\$((i+1)); sleep 1; done" + $ R ba-cli "NetModel.Intf.ipsec-$IPSECIFACE.Status_ext?" | sed -ne 2p + NetModel.Intf.[0-9]+.Status_ext="Down" (re) + $ R ba-cli "NetModel.Intf.ip-$IPSECIFACE.Status_ext?" | sed -ne 2p + NetModel.Intf.[0-9]+.Status_ext="Up" (re) + $ R ba-cli "NetModel.Intf.ip-$IPSECIFACE-tunneled.Status_ext?" | sed -ne 2p + NetModel.Intf.[0-9]+.Status_ext="Unknown" (re) + +Cleanup: + + $ R ba-cli "IPsec.Filter.f1-\;IPsec.Profile.p1-" >/dev/null 2>&1 diff --git a/.gitlab/tests/cram/generic/fixtures/obuspa.expected b/.gitlab/tests/cram/generic/fixtures/obuspa.expected index 73324dfc74..11b7d2e7e2 100644 --- a/.gitlab/tests/cram/generic/fixtures/obuspa.expected +++ b/.gitlab/tests/cram/generic/fixtures/obuspa.expected @@ -1895,6 +1895,158 @@ Device.IP.Interface.{i}.X_PRPLWARE-COM_IPv6Config.NeighborReachableTime Device.IP.Interface.{i}.X_PRPLWARE-COM_MTUMode proto::ip-manager Device.IP.InterfaceNumberOfEntries proto::ip-manager Device.IP.ULAPrefix proto::ip-manager +Device.IPsec. proto::tr181-ipsec +Device.IPsec.AHSupported proto::tr181-ipsec +Device.IPsec.ESPSupportedEncryptionAlgorithms proto::tr181-ipsec +Device.IPsec.Enable proto::tr181-ipsec +Device.IPsec.Filter.{i}. proto::tr181-ipsec +Device.IPsec.Filter.{i}.Alias proto::tr181-ipsec +Device.IPsec.Filter.{i}.AllInterfaces proto::tr181-ipsec +Device.IPsec.Filter.{i}.DestIP proto::tr181-ipsec +Device.IPsec.Filter.{i}.DestIPExclude proto::tr181-ipsec +Device.IPsec.Filter.{i}.DestMask proto::tr181-ipsec +Device.IPsec.Filter.{i}.DestPort proto::tr181-ipsec +Device.IPsec.Filter.{i}.DestPortExclude proto::tr181-ipsec +Device.IPsec.Filter.{i}.DestPortRangeMax proto::tr181-ipsec +Device.IPsec.Filter.{i}.Enable proto::tr181-ipsec +Device.IPsec.Filter.{i}.Interface proto::tr181-ipsec +Device.IPsec.Filter.{i}.Order proto::tr181-ipsec +Device.IPsec.Filter.{i}.ProcessingChoice proto::tr181-ipsec +Device.IPsec.Filter.{i}.Profile proto::tr181-ipsec +Device.IPsec.Filter.{i}.Protocol proto::tr181-ipsec +Device.IPsec.Filter.{i}.ProtocolExclude proto::tr181-ipsec +Device.IPsec.Filter.{i}.SourceIP proto::tr181-ipsec +Device.IPsec.Filter.{i}.SourceIPExclude proto::tr181-ipsec +Device.IPsec.Filter.{i}.SourceMask proto::tr181-ipsec +Device.IPsec.Filter.{i}.SourcePort proto::tr181-ipsec +Device.IPsec.Filter.{i}.SourcePortExclude proto::tr181-ipsec +Device.IPsec.Filter.{i}.SourcePortRangeMax proto::tr181-ipsec +Device.IPsec.Filter.{i}.Status proto::tr181-ipsec +Device.IPsec.FilterNumberOfEntries proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}. proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.Alias proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.ChildSA.{i}. proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.ChildSA.{i}.Alias proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.ChildSA.{i}.CreationTime proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.ChildSA.{i}.InboundSPI proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.ChildSA.{i}.OutboundSPI proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.ChildSA.{i}.Stats. proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.ChildSA.{i}.Stats.BytesReceived proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.ChildSA.{i}.Stats.BytesSent proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.ChildSA.{i}.Stats.DecryptionErrors proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.ChildSA.{i}.Stats.ErrorsSent proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.ChildSA.{i}.Stats.IntegrityErrors proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.ChildSA.{i}.Stats.OtherReceiveErrors proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.ChildSA.{i}.Stats.PacketsReceived proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.ChildSA.{i}.Stats.PacketsSent proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.ChildSA.{i}.Stats.PolicyErrors proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.ChildSA.{i}.Stats.ReplayErrors proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.ChildSA.{i}.Status proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.ChildSANumberOfEntries proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.CreationTime proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.DiffieHellmanGroupTransform proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.EncryptionAlgorithm proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.EncryptionKeyLength proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.IntegrityAlgorithm proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.LocalAddress proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.NATDetected proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.PseudoRandomFunction proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.ReceivedCPAttr.{i}. proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.ReceivedCPAttr.{i}.Type proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.ReceivedCPAttr.{i}.Value proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.ReceivedCPAttrNumberOfEntries proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.RemoteAddress proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.Stats. proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.Stats.BytesReceived proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.Stats.BytesSent proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.Stats.DecryptionErrors proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.Stats.ErrorsSent proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.Stats.IntegrityErrors proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.Stats.OtherReceiveErrors proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.Stats.PacketsReceived proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.Stats.PacketsSent proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.Status proto::tr181-ipsec +Device.IPsec.IKEv2SA.{i}.Tunnel proto::tr181-ipsec +Device.IPsec.IKEv2SANumberOfEntries proto::tr181-ipsec +Device.IPsec.IKEv2SupportedEncryptionAlgorithms proto::tr181-ipsec +Device.IPsec.IKEv2SupportedIDTypes proto::tr181-ipsec +Device.IPsec.IKEv2SupportedPseudoRandomFunctions proto::tr181-ipsec +Device.IPsec.InterfaceNumberOfEntries proto::tr181-ipsec +Device.IPsec.MaxFilterEntries proto::tr181-ipsec +Device.IPsec.MaxProfileEntries proto::tr181-ipsec +Device.IPsec.Profile.{i}. proto::tr181-ipsec +Device.IPsec.Profile.{i}.AHAllowedIntegrityAlgorithms proto::tr181-ipsec +Device.IPsec.Profile.{i}.Alias proto::tr181-ipsec +Device.IPsec.Profile.{i}.AntiReplayWindowSize proto::tr181-ipsec +Device.IPsec.Profile.{i}.ChildSAExpiryAction proto::tr181-ipsec +Device.IPsec.Profile.{i}.ChildSATimeLimit proto::tr181-ipsec +Device.IPsec.Profile.{i}.ChildSATrafficLimit proto::tr181-ipsec +Device.IPsec.Profile.{i}.DSCPMarkPolicy proto::tr181-ipsec +Device.IPsec.Profile.{i}.DoNotFragment proto::tr181-ipsec +Device.IPsec.Profile.{i}.ESPAllowedEncryptionAlgorithms proto::tr181-ipsec +Device.IPsec.Profile.{i}.ESPAllowedIntegrityAlgorithms proto::tr181-ipsec +Device.IPsec.Profile.{i}.ForwardingPolicy proto::tr181-ipsec +Device.IPsec.Profile.{i}.HardwareOffload proto::tr181-ipsec +Device.IPsec.Profile.{i}.IKEv2AllowedDiffieHellmanGroupTransforms proto::tr181-ipsec +Device.IPsec.Profile.{i}.IKEv2AllowedEncryptionAlgorithms proto::tr181-ipsec +Device.IPsec.Profile.{i}.IKEv2AllowedIntegrityAlgorithms proto::tr181-ipsec +Device.IPsec.Profile.{i}.IKEv2AllowedPseudoRandomFunctions proto::tr181-ipsec +Device.IPsec.Profile.{i}.IKEv2AuthenticationMethod proto::tr181-ipsec +Device.IPsec.Profile.{i}.IKEv2DeadPeerDetectionTimeout proto::tr181-ipsec +Device.IPsec.Profile.{i}.IKEv2LocalID proto::tr181-ipsec +Device.IPsec.Profile.{i}.IKEv2LocalIDType proto::tr181-ipsec +Device.IPsec.Profile.{i}.IKEv2NATTKeepaliveTimeout proto::tr181-ipsec +Device.IPsec.Profile.{i}.IKEv2RemoteAuthenticationMethod proto::tr181-ipsec +Device.IPsec.Profile.{i}.IKEv2RemoteID proto::tr181-ipsec +Device.IPsec.Profile.{i}.IKEv2RemoteIDType proto::tr181-ipsec +Device.IPsec.Profile.{i}.IKEv2SAExpiryAction proto::tr181-ipsec +Device.IPsec.Profile.{i}.IKEv2SATimeLimit proto::tr181-ipsec +Device.IPsec.Profile.{i}.IKEv2SATrafficLimit proto::tr181-ipsec +Device.IPsec.Profile.{i}.MaxChildSAs proto::tr181-ipsec +Device.IPsec.Profile.{i}.Protocol proto::tr181-ipsec +Device.IPsec.Profile.{i}.RemoteEndpoints proto::tr181-ipsec +Device.IPsec.Profile.{i}.SentCPAttr.{i}. proto::tr181-ipsec +Device.IPsec.Profile.{i}.SentCPAttr.{i}.Alias proto::tr181-ipsec +Device.IPsec.Profile.{i}.SentCPAttr.{i}.Enable proto::tr181-ipsec +Device.IPsec.Profile.{i}.SentCPAttr.{i}.Type proto::tr181-ipsec +Device.IPsec.Profile.{i}.SentCPAttr.{i}.Value proto::tr181-ipsec +Device.IPsec.Profile.{i}.SentCPAttrNumberOfEntries proto::tr181-ipsec +Device.IPsec.ProfileNumberOfEntries proto::tr181-ipsec +Device.IPsec.Secret.{i}. proto::tr181-ipsec +Device.IPsec.Secret.{i}.Alias proto::tr181-ipsec +Device.IPsec.Secret.{i}.Enable proto::tr181-ipsec +Device.IPsec.Secret.{i}.KeyPassphrase proto::tr181-ipsec +Device.IPsec.Secret.{i}.PreSharedKey proto::tr181-ipsec +Device.IPsec.Secret.{i}.Status proto::tr181-ipsec +Device.IPsec.SecretNumberOfEntries proto::tr181-ipsec +Device.IPsec.Stats. proto::tr181-ipsec +Device.IPsec.Stats.BytesReceived proto::tr181-ipsec +Device.IPsec.Stats.BytesSent proto::tr181-ipsec +Device.IPsec.Stats.DecryptionErrors proto::tr181-ipsec +Device.IPsec.Stats.ErrorsSent proto::tr181-ipsec +Device.IPsec.Stats.IntegrityErrors proto::tr181-ipsec +Device.IPsec.Stats.NegotiationFailures proto::tr181-ipsec +Device.IPsec.Stats.OtherReceiveErrors proto::tr181-ipsec +Device.IPsec.Stats.PacketsReceived proto::tr181-ipsec +Device.IPsec.Stats.PacketsSent proto::tr181-ipsec +Device.IPsec.Stats.PolicyErrors proto::tr181-ipsec +Device.IPsec.Stats.ReplayErrors proto::tr181-ipsec +Device.IPsec.Stats.UnknownSPIErrors proto::tr181-ipsec +Device.IPsec.Status proto::tr181-ipsec +Device.IPsec.SupportedDiffieHellmanGroupTransforms proto::tr181-ipsec +Device.IPsec.SupportedIntegrityAlgorithms proto::tr181-ipsec +Device.IPsec.Tunnel.{i}. proto::tr181-ipsec +Device.IPsec.Tunnel.{i}.Alias proto::tr181-ipsec +Device.IPsec.Tunnel.{i}.Filters proto::tr181-ipsec +Device.IPsec.Tunnel.{i}.Stats. proto::tr181-ipsec +Device.IPsec.Tunnel.{i}.Stats.DecryptionErrors proto::tr181-ipsec +Device.IPsec.Tunnel.{i}.Stats.IntegrityErrors proto::tr181-ipsec +Device.IPsec.Tunnel.{i}.Stats.OtherReceiveErrors proto::tr181-ipsec +Device.IPsec.Tunnel.{i}.Stats.PolicyErrors proto::tr181-ipsec +Device.IPsec.Tunnel.{i}.Stats.ReplayErrors proto::tr181-ipsec +Device.IPsec.Tunnel.{i}.TunnelInterface proto::tr181-ipsec +Device.IPsec.Tunnel.{i}.TunneledInterface proto::tr181-ipsec +Device.IPsec.TunnelNumberOfEntries proto::tr181-ipsec Device.InterfaceStack.{i}. proto::tr181-device Device.InterfaceStack.{i}.Alias proto::tr181-device Device.InterfaceStack.{i}.HigherAlias proto::tr181-device diff --git a/.gitlab/tests/cram/generic/ubus-datamodel-list.t b/.gitlab/tests/cram/generic/ubus-datamodel-list.t index df998890ab..9dbaee5719 100644 --- a/.gitlab/tests/cram/generic/ubus-datamodel-list.t +++ b/.gitlab/tests/cram/generic/ubus-datamodel-list.t @@ -100,6 +100,7 @@ Check that ubus has expected datamodels available: Device.Hosts Device.IP Device.IP.Diagnostics + Device.IPsec Device.InterfaceStack Device.LEDs Device.Logical @@ -233,6 +234,14 @@ Check that ubus has expected datamodels available: IPDiagnostics.X_PRPLWARE-COM_UploadResult.IncrementalResult IPDiagnostics.X_PRPLWARE-COM_UploadResult.PerConnectionResult IPDiagnostics.X_PRPLWARE-COM_UploadResult.Process + IPsec + IPsec.Filter + IPsec.IKEv2SA + IPsec.Interface + IPsec.Profile + IPsec.Secret + IPsec.Stats + IPsec.Tunnel KernelFaults KernelFaults.KernelFault LEDs diff --git a/.gitlab/tests/cram/generic/verify-config-restore/020-verify-backup-restore-flags.t b/.gitlab/tests/cram/generic/verify-config-restore/020-verify-backup-restore-flags.t index c2c97ba0a2..349fc2db27 100644 --- a/.gitlab/tests/cram/generic/verify-config-restore/020-verify-backup-restore-flags.t +++ b/.gitlab/tests/cram/generic/verify-config-restore/020-verify-backup-restore-flags.t @@ -24,6 +24,12 @@ PPW-1729, PPW-1731 and PPW-1786: /etc/amx/timingila/softwaremodules_definition.odl /etc/amx/tr181-cpu/tr181-cpu_definition.odl /etc/amx/tr181-gre/tr181-gre_definition.odl + /etc/amx/tr181-ipsec/tr181-ipsec_definition.odl + /etc/amx/tr181-ipsec/tr181-ipsec_filter.odl + /etc/amx/tr181-ipsec/tr181-ipsec_profile.odl + /etc/amx/tr181-ipsec/tr181-ipsec_secret.odl + /etc/amx/tr181-ipsec/tr181-ipsec_tunnel.odl + /etc/amx/tr181-mqtt/tr181-mqtt_definition.odl /etc/amx/tr181-usb/tr181-usb_port.odl /etc/amx/tr181-wireguard/tr181-wireguard_definition.odl diff --git a/.gitlab/tests/cram/mxl25641-hdk-6/005-build-config.t b/.gitlab/tests/cram/mxl25641-hdk-6/005-build-config.t index cbee777943..d3a8a65612 100644 --- a/.gitlab/tests/cram/mxl25641-hdk-6/005-build-config.t +++ b/.gitlab/tests/cram/mxl25641-hdk-6/005-build-config.t @@ -284,6 +284,7 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_ipset=y CONFIG_PACKAGE_iptables-mod-conntrack-extra=y CONFIG_PACKAGE_iptables-mod-ipopt=y + CONFIG_PACKAGE_iptables-mod-ipsec=y CONFIG_PACKAGE_iptables-mod-nfqueue=y CONFIG_PACKAGE_iptables-zz-legacy=y CONFIG_PACKAGE_iputils-ping=y @@ -303,11 +304,17 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_kmod-crypto-aead=y CONFIG_PACKAGE_kmod-crypto-authenc=y CONFIG_PACKAGE_kmod-crypto-cbc=y + CONFIG_PACKAGE_kmod-crypto-chacha20poly1305=y CONFIG_PACKAGE_kmod-crypto-deflate=y CONFIG_PACKAGE_kmod-crypto-des=y CONFIG_PACKAGE_kmod-crypto-echainiv=y CONFIG_PACKAGE_kmod-crypto-geniv=y CONFIG_PACKAGE_kmod-crypto-hmac=y + CONFIG_PACKAGE_kmod-crypto-kpp=y + CONFIG_PACKAGE_kmod-crypto-lib-chacha20=y + CONFIG_PACKAGE_kmod-crypto-lib-chacha20poly1305=y + CONFIG_PACKAGE_kmod-crypto-lib-curve25519=y + CONFIG_PACKAGE_kmod-crypto-lib-poly1305=y CONFIG_PACKAGE_kmod-crypto-manager=y CONFIG_PACKAGE_kmod-crypto-md5=y CONFIG_PACKAGE_kmod-crypto-null=y @@ -352,6 +359,7 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_kmod-ipt-core=y CONFIG_PACKAGE_kmod-ipt-extra=y CONFIG_PACKAGE_kmod-ipt-ipopt=y + CONFIG_PACKAGE_kmod-ipt-ipsec=y CONFIG_PACKAGE_kmod-ipt-ipset=y CONFIG_PACKAGE_kmod-ipt-nat=y CONFIG_PACKAGE_kmod-ipt-nat6=y @@ -461,7 +469,9 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_kmod-usb-xhci-hcd=y CONFIG_PACKAGE_kmod-usb3=y CONFIG_PACKAGE_kmod-veth=y + CONFIG_PACKAGE_kmod-wireguard=y CONFIG_PACKAGE_kmod-wwan=y + CONFIG_PACKAGE_kmod-xfrm-interface=y CONFIG_PACKAGE_lib-cli=y CONFIG_PACKAGE_libacl=y CONFIG_PACKAGE_libaio=y @@ -511,8 +521,10 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_libfiletransfer=y CONFIG_PACKAGE_libfwinterface=y CONFIG_PACKAGE_libfwrules=y + CONFIG_PACKAGE_libgcrypt=y CONFIG_PACKAGE_libgmap-client=y CONFIG_PACKAGE_libgmap-ext=y + CONFIG_PACKAGE_libgmp=y CONFIG_PACKAGE_libhelper=y CONFIG_PACKAGE_libimtp=y CONFIG_PACKAGE_libip4tc=y @@ -532,6 +544,7 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_liblua5.3=y CONFIG_PACKAGE_liblxc=y CONFIG_PACKAGE_liblzma=y + CONFIG_PACKAGE_libmariadb=y CONFIG_PACKAGE_libmbim=y CONFIG_PACKAGE_libmfg=y CONFIG_PACKAGE_libmicrohttpd-no-ssl=y @@ -554,6 +567,7 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_libnl-nf=y CONFIG_PACKAGE_libnl-route=y CONFIG_PACKAGE_libocispec=y + CONFIG_PACKAGE_libopenldap=y CONFIG_PACKAGE_libopensc=y CONFIG_PACKAGE_libopenssl-conf=y CONFIG_PACKAGE_libp11=y @@ -602,6 +616,8 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_libuuid=y CONFIG_PACKAGE_libuv=y CONFIG_PACKAGE_libwebsockets4-full=y + CONFIG_PACKAGE_libwireguard=y + CONFIG_PACKAGE_libwolfssl=y CONFIG_PACKAGE_libxml2=y CONFIG_PACKAGE_libxtables=y CONFIG_PACKAGE_libyaml=y @@ -708,15 +724,19 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_netmodel-dslite=y CONFIG_PACKAGE_netmodel-ethernet=y CONFIG_PACKAGE_netmodel-gni=y + CONFIG_PACKAGE_netmodel-gre=y CONFIG_PACKAGE_netmodel-ip=y CONFIG_PACKAGE_netmodel-iprouter=y + CONFIG_PACKAGE_netmodel-ipsec=y CONFIG_PACKAGE_netmodel-logical=y CONFIG_PACKAGE_netmodel-netdev=y CONFIG_PACKAGE_netmodel-optical=y CONFIG_PACKAGE_netmodel-ppp=y CONFIG_PACKAGE_netmodel-radio=y CONFIG_PACKAGE_netmodel-ssid=y + CONFIG_PACKAGE_netmodel-tuntap=y CONFIG_PACKAGE_netmodel-vlan=y + CONFIG_PACKAGE_netmodel-wireguard=y CONFIG_PACKAGE_netmodel-xpon=y CONFIG_PACKAGE_nftables-json=m CONFIG_PACKAGE_obudpst=y @@ -823,6 +843,40 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_speedtest-modules=y CONFIG_PACKAGE_sse_fapi_lgm=y CONFIG_PACKAGE_ssh-server=y + CONFIG_PACKAGE_strongswan=y + CONFIG_PACKAGE_strongswan-charon=y + CONFIG_PACKAGE_strongswan-default=y + CONFIG_PACKAGE_strongswan-mod-aes=y + CONFIG_PACKAGE_strongswan-mod-attr=y + CONFIG_PACKAGE_strongswan-mod-connmark=y + CONFIG_PACKAGE_strongswan-mod-constraints=y + CONFIG_PACKAGE_strongswan-mod-des=y + CONFIG_PACKAGE_strongswan-mod-dnskey=y + CONFIG_PACKAGE_strongswan-mod-fips-prf=y + CONFIG_PACKAGE_strongswan-mod-gmp=y + CONFIG_PACKAGE_strongswan-mod-hmac=y + CONFIG_PACKAGE_strongswan-mod-kernel-netlink=y + CONFIG_PACKAGE_strongswan-mod-md5=y + CONFIG_PACKAGE_strongswan-mod-mgf1=y + CONFIG_PACKAGE_strongswan-mod-openssl=y + CONFIG_PACKAGE_strongswan-mod-pem=y + CONFIG_PACKAGE_strongswan-mod-pgp=y + CONFIG_PACKAGE_strongswan-mod-pkcs1=y + CONFIG_PACKAGE_strongswan-mod-pubkey=y + CONFIG_PACKAGE_strongswan-mod-random=y + CONFIG_PACKAGE_strongswan-mod-rc2=y + CONFIG_PACKAGE_strongswan-mod-resolve=y + CONFIG_PACKAGE_strongswan-mod-revocation=y + CONFIG_PACKAGE_strongswan-mod-sha1=y + CONFIG_PACKAGE_strongswan-mod-sha2=y + CONFIG_PACKAGE_strongswan-mod-socket-default=y + CONFIG_PACKAGE_strongswan-mod-sshkey=y + CONFIG_PACKAGE_strongswan-mod-updown=y + CONFIG_PACKAGE_strongswan-mod-vici=y + CONFIG_PACKAGE_strongswan-mod-x509=y + CONFIG_PACKAGE_strongswan-mod-xauth-generic=y + CONFIG_PACKAGE_strongswan-mod-xcbc=y + CONFIG_PACKAGE_strongswan-swanctl=y CONFIG_PACKAGE_swpal_6x-uci-prpl=y CONFIG_PACKAGE_swupdate=y CONFIG_PACKAGE_syslog-ng=y @@ -853,9 +907,11 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_tr181-firewall=y CONFIG_PACKAGE_tr181-flashmonitor=y CONFIG_PACKAGE_tr181-gnimanager=y + CONFIG_PACKAGE_tr181-gre=y CONFIG_PACKAGE_tr181-homeplug=y CONFIG_PACKAGE_tr181-httpaccess=y CONFIG_PACKAGE_tr181-ipdiagnostics=y + CONFIG_PACKAGE_tr181-ipsec=y CONFIG_PACKAGE_tr181-led=y CONFIG_PACKAGE_tr181-logical=y CONFIG_PACKAGE_tr181-mcastd=y @@ -874,10 +930,12 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_tr181-sfp=y CONFIG_PACKAGE_tr181-syslog=y CONFIG_PACKAGE_tr181-temperature=y + CONFIG_PACKAGE_tr181-tuntap=y CONFIG_PACKAGE_tr181-upnp=y CONFIG_PACKAGE_tr181-upnpdiscovery=y CONFIG_PACKAGE_tr181-usb=y CONFIG_PACKAGE_tr181-usermanagement=y + CONFIG_PACKAGE_tr181-wireguard=y CONFIG_PACKAGE_tr181-xpon=y CONFIG_PACKAGE_uboot-envtools=y CONFIG_PACKAGE_uboot-octopus-urx641-4GB-ddr-overlay-fit-p34x-phy-emmc-prpl=y @@ -898,6 +956,7 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_wfa_quicktrack=y CONFIG_PACKAGE_wifi-scheduler=y CONFIG_PACKAGE_wifi-sensing=y + CONFIG_PACKAGE_wireguard-tools=y CONFIG_PACKAGE_wwan=y CONFIG_PACKAGE_xtables-legacy=y CONFIG_PACKAGE_yajl=y @@ -1064,6 +1123,9 @@ Assure expected build configuration (PCF-1413): CONFIG_SAH_AMX_TR181_GNIMANAGER_ORDER=25 CONFIG_SAH_AMX_TR181_GNIMANAGER_RUN_AS_GROUP="tr181_app" CONFIG_SAH_AMX_TR181_GNIMANAGER_RUN_AS_USER="tr181_app" + CONFIG_SAH_AMX_TR181_GRE=y + CONFIG_SAH_AMX_TR181_GRE_START_ORDER=81 + CONFIG_SAH_AMX_TR181_GRE_STOP_ORDER=19 CONFIG_SAH_AMX_TR181_HOMEPLUG=y CONFIG_SAH_AMX_TR181_HOMEPLUG_START_ORDER=31 CONFIG_SAH_AMX_TR181_HOMEPLUG_STOP_ORDER=69 @@ -1071,6 +1133,9 @@ Assure expected build configuration (PCF-1413): CONFIG_SAH_AMX_TR181_HTTPACCESS_FIREWALL=y CONFIG_SAH_AMX_TR181_HTTPACCESS_ORDER=49 CONFIG_SAH_AMX_TR181_IP=y + CONFIG_SAH_AMX_TR181_IPSEC=y + CONFIG_SAH_AMX_TR181_IPSEC_START_ORDER=84 + CONFIG_SAH_AMX_TR181_IPSEC_STOP_ORDER=16 CONFIG_SAH_AMX_TR181_IP_RUN_AS_GROUP="tr181_app" CONFIG_SAH_AMX_TR181_IP_RUN_AS_USER="tr181_app" CONFIG_SAH_AMX_TR181_IP_START_ORDER=21 @@ -1139,6 +1204,9 @@ Assure expected build configuration (PCF-1413): CONFIG_SAH_AMX_TR181_TEMPERATURE_RUN_AS_USER="tr181_app" CONFIG_SAH_AMX_TR181_TIME=y CONFIG_SAH_AMX_TR181_TIME_ORDER=30 + CONFIG_SAH_AMX_TR181_TUNTAP=y + CONFIG_SAH_AMX_TR181_TUNTAP_START_ORDER=82 + CONFIG_SAH_AMX_TR181_TUNTAP_STOP_ORDER=18 CONFIG_SAH_AMX_TR181_UPNP=y CONFIG_SAH_AMX_TR181_UPNPDISCOVERY=y CONFIG_SAH_AMX_TR181_UPNPDISCOVERY_RUN_AS_GROUP="tr181_app" @@ -1149,6 +1217,9 @@ Assure expected build configuration (PCF-1413): CONFIG_SAH_AMX_TR181_UPNP_ORDER=80 CONFIG_SAH_AMX_TR181_UPNP_RUN_AS_GROUP="tr181_app" CONFIG_SAH_AMX_TR181_UPNP_RUN_AS_USER="tr181_app" + CONFIG_SAH_AMX_TR181_WIREGUARD=y + CONFIG_SAH_AMX_TR181_WIREGUARD_START_ORDER=25 + CONFIG_SAH_AMX_TR181_WIREGUARD_STOP_ORDER=75 CONFIG_SAH_AMX_TR181_XPON=y CONFIG_SAH_AMX_TR181_XPON_MAX_ONUS=1 CONFIG_SAH_AMX_TR181_XPON_ORDER=30 @@ -1275,6 +1346,8 @@ Assure expected build configuration (PCF-1413): CONFIG_SQLITE3_FTS4=y CONFIG_SQLITE3_FTS5=y CONFIG_SQLITE3_RTREE=y + CONFIG_STRONGSWAN_ROUTING_TABLE="220" + CONFIG_STRONGSWAN_ROUTING_TABLE_PRIO="220" CONFIG_SWITCH_DEVICE_ID=0 CONFIG_SWITCH_LAN_PORTS="0 1 2 4" CONFIG_SWITCH_MII1_PORT="5" @@ -1299,5 +1372,6 @@ Assure expected build configuration (PCF-1413): CONFIG_WAVE_700=y CONFIG_WIRELESS_AFC=y CONFIG_WIRELESS_STA=y + CONFIG_WOLFSSL_HAS_NO_HW=y CONFIG_shadow-all=y # CONFIG_VERSION_FILENAMES is not set diff --git a/.gitlab/tests/cram/mxl25641-hdk-6/011-tls.t b/.gitlab/tests/cram/mxl25641-hdk-6/011-tls.t index af1c91943d..d9895740ba 100644 --- a/.gitlab/tests/cram/mxl25641-hdk-6/011-tls.t +++ b/.gitlab/tests/cram/mxl25641-hdk-6/011-tls.t @@ -4,9 +4,44 @@ Create R alias: Check that there is just single TLS library OpenSSL: - $ R "opkg list-installed" | grep -E '(openssl|mbedtls|wolfssl)' | sort | awk -F ' - ' '{print $1}' + $ R "opkg list-installed" | grep -E '(openssl|mbedtls|wolfssl|strongswan)' | sort | awk -F ' - ' '{print $1}' libopenssl-conf libopenssl.* (re) libustream-openssl.* (re) lighttpd-mod-openssl openssl-util + strongswan + strongswan-charon + strongswan-default + strongswan-mod-aes + strongswan-mod-attr + strongswan-mod-connmark + strongswan-mod-constraints + strongswan-mod-des + strongswan-mod-dnskey + strongswan-mod-fips-prf + strongswan-mod-gmp + strongswan-mod-hmac + strongswan-mod-kdf + strongswan-mod-kernel-netlink + strongswan-mod-md5 + strongswan-mod-mgf1 + strongswan-mod-openssl + strongswan-mod-pem + strongswan-mod-pgp + strongswan-mod-pkcs1 + strongswan-mod-pubkey + strongswan-mod-random + strongswan-mod-rc2 + strongswan-mod-resolve + strongswan-mod-revocation + strongswan-mod-sha1 + strongswan-mod-sha2 + strongswan-mod-socket-default + strongswan-mod-sshkey + strongswan-mod-updown + strongswan-mod-vici + strongswan-mod-x509 + strongswan-mod-xauth-generic + strongswan-mod-xcbc + strongswan-swanctl diff --git a/.gitlab/tests/cram/prpl-haze/005-build-config.t b/.gitlab/tests/cram/prpl-haze/005-build-config.t index 6ca607d353..f3c4932637 100644 --- a/.gitlab/tests/cram/prpl-haze/005-build-config.t +++ b/.gitlab/tests/cram/prpl-haze/005-build-config.t @@ -133,6 +133,7 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_ipset=y CONFIG_PACKAGE_iptables-mod-conntrack-extra=y CONFIG_PACKAGE_iptables-mod-ipopt=y + CONFIG_PACKAGE_iptables-mod-ipsec=y CONFIG_PACKAGE_iptables-mod-nfqueue=y CONFIG_PACKAGE_iptables-zz-legacy=y CONFIG_PACKAGE_iputils-ping=y @@ -156,6 +157,7 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_kmod-ipt-core=y CONFIG_PACKAGE_kmod-ipt-extra=y CONFIG_PACKAGE_kmod-ipt-ipopt=y + CONFIG_PACKAGE_kmod-ipt-ipsec=y CONFIG_PACKAGE_kmod-ipt-ipset=y CONFIG_PACKAGE_kmod-ipt-nat=y CONFIG_PACKAGE_kmod-ipt-nat6=y @@ -284,6 +286,7 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_libuspprotobuf=y CONFIG_PACKAGE_libuv=y CONFIG_PACKAGE_libwebsockets4-full=y + CONFIG_PACKAGE_libwireguard=y CONFIG_PACKAGE_libxml2=y CONFIG_PACKAGE_libxtables=y CONFIG_PACKAGE_lighttpd=y @@ -374,15 +377,19 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_netmodel-dslite=y CONFIG_PACKAGE_netmodel-ethernet=y CONFIG_PACKAGE_netmodel-gni=y + CONFIG_PACKAGE_netmodel-gre=y CONFIG_PACKAGE_netmodel-ip=y CONFIG_PACKAGE_netmodel-iprouter=y + CONFIG_PACKAGE_netmodel-ipsec=y CONFIG_PACKAGE_netmodel-logical=y CONFIG_PACKAGE_netmodel-netdev=y CONFIG_PACKAGE_netmodel-optical=y CONFIG_PACKAGE_netmodel-ppp=y CONFIG_PACKAGE_netmodel-radio=y CONFIG_PACKAGE_netmodel-ssid=y + CONFIG_PACKAGE_netmodel-tuntap=y CONFIG_PACKAGE_netmodel-vlan=y + CONFIG_PACKAGE_netmodel-wireguard=y CONFIG_PACKAGE_netmodel-xpon=y # CONFIG_PACKAGE_nftables-json is not set CONFIG_PACKAGE_obuspa=y @@ -473,9 +480,11 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_tr181-firewall=y CONFIG_PACKAGE_tr181-flashmonitor=y CONFIG_PACKAGE_tr181-gnimanager=y + CONFIG_PACKAGE_tr181-gre=y CONFIG_PACKAGE_tr181-homeplug=y CONFIG_PACKAGE_tr181-httpaccess=y CONFIG_PACKAGE_tr181-ipdiagnostics=y + CONFIG_PACKAGE_tr181-ipsec=y CONFIG_PACKAGE_tr181-led=y CONFIG_PACKAGE_tr181-logical=y CONFIG_PACKAGE_tr181-mcastd=y @@ -493,10 +502,12 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_tr181-sfp=y CONFIG_PACKAGE_tr181-syslog=y CONFIG_PACKAGE_tr181-temperature=y + CONFIG_PACKAGE_tr181-tuntap=y CONFIG_PACKAGE_tr181-upnp=y CONFIG_PACKAGE_tr181-upnpdiscovery=y CONFIG_PACKAGE_tr181-usb=y CONFIG_PACKAGE_tr181-usermanagement=y + CONFIG_PACKAGE_tr181-wireguard=y CONFIG_PACKAGE_tr181-xpon=y CONFIG_PACKAGE_umdns-prpl=y CONFIG_PACKAGE_unbound-daemon-prpl=y @@ -632,12 +643,18 @@ Assure expected build configuration (PCF-1413): CONFIG_SAH_AMX_TR181_GNIMANAGER_ORDER=25 CONFIG_SAH_AMX_TR181_GNIMANAGER_RUN_AS_GROUP="tr181_app" CONFIG_SAH_AMX_TR181_GNIMANAGER_RUN_AS_USER="tr181_app" + CONFIG_SAH_AMX_TR181_GRE=y + CONFIG_SAH_AMX_TR181_GRE_START_ORDER=81 + CONFIG_SAH_AMX_TR181_GRE_STOP_ORDER=19 CONFIG_SAH_AMX_TR181_HOMEPLUG=y CONFIG_SAH_AMX_TR181_HOMEPLUG_START_ORDER=31 CONFIG_SAH_AMX_TR181_HOMEPLUG_STOP_ORDER=69 CONFIG_SAH_AMX_TR181_HTTPACCESS=y CONFIG_SAH_AMX_TR181_HTTPACCESS_FIREWALL=y CONFIG_SAH_AMX_TR181_HTTPACCESS_ORDER=49 + CONFIG_SAH_AMX_TR181_IPSEC=y + CONFIG_SAH_AMX_TR181_IPSEC_START_ORDER=84 + CONFIG_SAH_AMX_TR181_IPSEC_STOP_ORDER=16 CONFIG_SAH_AMX_TR181_IP=y CONFIG_SAH_AMX_TR181_IP_RUN_AS_GROUP="tr181_app" CONFIG_SAH_AMX_TR181_IP_RUN_AS_USER="tr181_app" @@ -691,6 +708,9 @@ Assure expected build configuration (PCF-1413): CONFIG_SAH_AMX_TR181_TEMPERATURE_RUN_AS_USER="tr181_app" CONFIG_SAH_AMX_TR181_TIME=y CONFIG_SAH_AMX_TR181_TIME_ORDER=30 + CONFIG_SAH_AMX_TR181_TUNTAP=y + CONFIG_SAH_AMX_TR181_TUNTAP_START_ORDER=82 + CONFIG_SAH_AMX_TR181_TUNTAP_STOP_ORDER=18 CONFIG_SAH_AMX_TR181_UPNP=y CONFIG_SAH_AMX_TR181_UPNPDISCOVERY=y CONFIG_SAH_AMX_TR181_UPNPDISCOVERY_RUN_AS_GROUP="tr181_app" @@ -701,6 +721,9 @@ Assure expected build configuration (PCF-1413): CONFIG_SAH_AMX_TR181_UPNP_ORDER=80 CONFIG_SAH_AMX_TR181_UPNP_RUN_AS_GROUP="tr181_app" CONFIG_SAH_AMX_TR181_UPNP_RUN_AS_USER="tr181_app" + CONFIG_SAH_AMX_TR181_WIREGUARD=y + CONFIG_SAH_AMX_TR181_WIREGUARD_START_ORDER=25 + CONFIG_SAH_AMX_TR181_WIREGUARD_STOP_ORDER=75 CONFIG_SAH_AMX_TR181_XPON=y CONFIG_SAH_AMX_TR181_XPON_MAX_ONUS=1 CONFIG_SAH_AMX_TR181_XPON_ORDER=30 diff --git a/.gitlab/tests/cram/turris-omnia/005-build-config.t b/.gitlab/tests/cram/turris-omnia/005-build-config.t index b872163469..177e631e29 100644 --- a/.gitlab/tests/cram/turris-omnia/005-build-config.t +++ b/.gitlab/tests/cram/turris-omnia/005-build-config.t @@ -151,6 +151,7 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_ipset=y CONFIG_PACKAGE_iptables-mod-conntrack-extra=y CONFIG_PACKAGE_iptables-mod-ipopt=y + CONFIG_PACKAGE_iptables-mod-ipsec=y CONFIG_PACKAGE_iptables-mod-nfqueue=y CONFIG_PACKAGE_iptables-zz-legacy=y CONFIG_PACKAGE_iputils-ping=y @@ -175,6 +176,7 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_kmod-ipt-core=y CONFIG_PACKAGE_kmod-ipt-extra=y CONFIG_PACKAGE_kmod-ipt-ipopt=y + CONFIG_PACKAGE_kmod-ipt-ipsec=y CONFIG_PACKAGE_kmod-ipt-ipset=y CONFIG_PACKAGE_kmod-ipt-nat=y CONFIG_PACKAGE_kmod-ipt-nat6=y @@ -302,6 +304,7 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_libuspprotobuf=y CONFIG_PACKAGE_libuv=y CONFIG_PACKAGE_libwebsockets4-full=y + CONFIG_PACKAGE_libwireguard=y CONFIG_PACKAGE_libxml2=y CONFIG_PACKAGE_libxtables=y CONFIG_PACKAGE_lighttpd=y @@ -392,15 +395,19 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_netmodel-dslite=y CONFIG_PACKAGE_netmodel-ethernet=y CONFIG_PACKAGE_netmodel-gni=y + CONFIG_PACKAGE_netmodel-gre=y CONFIG_PACKAGE_netmodel-ip=y CONFIG_PACKAGE_netmodel-iprouter=y + CONFIG_PACKAGE_netmodel-ipsec=y CONFIG_PACKAGE_netmodel-logical=y CONFIG_PACKAGE_netmodel-netdev=y CONFIG_PACKAGE_netmodel-optical=y CONFIG_PACKAGE_netmodel-ppp=y CONFIG_PACKAGE_netmodel-radio=y CONFIG_PACKAGE_netmodel-ssid=y + CONFIG_PACKAGE_netmodel-tuntap=y CONFIG_PACKAGE_netmodel-vlan=y + CONFIG_PACKAGE_netmodel-wireguard=y CONFIG_PACKAGE_netmodel-xpon=y # CONFIG_PACKAGE_nftables-json is not set CONFIG_PACKAGE_obuspa=y @@ -491,9 +498,11 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_tr181-firewall=y CONFIG_PACKAGE_tr181-flashmonitor=y CONFIG_PACKAGE_tr181-gnimanager=y + CONFIG_PACKAGE_tr181-gre=y CONFIG_PACKAGE_tr181-homeplug=y CONFIG_PACKAGE_tr181-httpaccess=y CONFIG_PACKAGE_tr181-ipdiagnostics=y + CONFIG_PACKAGE_tr181-ipsec=y CONFIG_PACKAGE_tr181-led=y CONFIG_PACKAGE_tr181-logical=y CONFIG_PACKAGE_tr181-mcastd=y @@ -511,10 +520,12 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_tr181-sfp=y CONFIG_PACKAGE_tr181-syslog=y CONFIG_PACKAGE_tr181-temperature=y + CONFIG_PACKAGE_tr181-tuntap=y CONFIG_PACKAGE_tr181-upnp=y CONFIG_PACKAGE_tr181-upnpdiscovery=y CONFIG_PACKAGE_tr181-usb=y CONFIG_PACKAGE_tr181-usermanagement=y + CONFIG_PACKAGE_tr181-wireguard=y CONFIG_PACKAGE_tr181-xpon=y # CONFIG_PACKAGE_ucode-mod-uci is not set CONFIG_PACKAGE_umdns-prpl=y @@ -651,12 +662,18 @@ Assure expected build configuration (PCF-1413): CONFIG_SAH_AMX_TR181_GNIMANAGER_ORDER=25 CONFIG_SAH_AMX_TR181_GNIMANAGER_RUN_AS_GROUP="tr181_app" CONFIG_SAH_AMX_TR181_GNIMANAGER_RUN_AS_USER="tr181_app" + CONFIG_SAH_AMX_TR181_GRE=y + CONFIG_SAH_AMX_TR181_GRE_START_ORDER=81 + CONFIG_SAH_AMX_TR181_GRE_STOP_ORDER=19 CONFIG_SAH_AMX_TR181_HOMEPLUG=y CONFIG_SAH_AMX_TR181_HOMEPLUG_START_ORDER=31 CONFIG_SAH_AMX_TR181_HOMEPLUG_STOP_ORDER=69 CONFIG_SAH_AMX_TR181_HTTPACCESS=y CONFIG_SAH_AMX_TR181_HTTPACCESS_FIREWALL=y CONFIG_SAH_AMX_TR181_HTTPACCESS_ORDER=49 + CONFIG_SAH_AMX_TR181_IPSEC=y + CONFIG_SAH_AMX_TR181_IPSEC_START_ORDER=84 + CONFIG_SAH_AMX_TR181_IPSEC_STOP_ORDER=16 CONFIG_SAH_AMX_TR181_IP=y CONFIG_SAH_AMX_TR181_IP_RUN_AS_GROUP="tr181_app" CONFIG_SAH_AMX_TR181_IP_RUN_AS_USER="tr181_app" @@ -710,6 +727,9 @@ Assure expected build configuration (PCF-1413): CONFIG_SAH_AMX_TR181_TEMPERATURE_RUN_AS_USER="tr181_app" CONFIG_SAH_AMX_TR181_TIME=y CONFIG_SAH_AMX_TR181_TIME_ORDER=30 + CONFIG_SAH_AMX_TR181_TUNTAP=y + CONFIG_SAH_AMX_TR181_TUNTAP_START_ORDER=82 + CONFIG_SAH_AMX_TR181_TUNTAP_STOP_ORDER=18 CONFIG_SAH_AMX_TR181_UPNP=y CONFIG_SAH_AMX_TR181_UPNPDISCOVERY=y CONFIG_SAH_AMX_TR181_UPNPDISCOVERY_RUN_AS_GROUP="tr181_app" @@ -720,6 +740,9 @@ Assure expected build configuration (PCF-1413): CONFIG_SAH_AMX_TR181_UPNP_ORDER=80 CONFIG_SAH_AMX_TR181_UPNP_RUN_AS_GROUP="tr181_app" CONFIG_SAH_AMX_TR181_UPNP_RUN_AS_USER="tr181_app" + CONFIG_SAH_AMX_TR181_WIREGUARD=y + CONFIG_SAH_AMX_TR181_WIREGUARD_START_ORDER=25 + CONFIG_SAH_AMX_TR181_WIREGUARD_STOP_ORDER=75 CONFIG_SAH_AMX_TR181_XPON=y CONFIG_SAH_AMX_TR181_XPON_MAX_ONUS=1 CONFIG_SAH_AMX_TR181_XPON_ORDER=30 diff --git a/.gitlab/tests/cram/urx851-b0-dk/005-build-config.t b/.gitlab/tests/cram/urx851-b0-dk/005-build-config.t index 3a32cbdac4..d5e2e2c021 100644 --- a/.gitlab/tests/cram/urx851-b0-dk/005-build-config.t +++ b/.gitlab/tests/cram/urx851-b0-dk/005-build-config.t @@ -260,6 +260,7 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_ipset=y CONFIG_PACKAGE_iptables-mod-conntrack-extra=y CONFIG_PACKAGE_iptables-mod-ipopt=y + CONFIG_PACKAGE_iptables-mod-ipsec=y CONFIG_PACKAGE_iptables-mod-nfqueue=y CONFIG_PACKAGE_iptables-zz-legacy=y CONFIG_PACKAGE_iputils-ping=y @@ -280,6 +281,11 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_kmod-crypto-des=y CONFIG_PACKAGE_kmod-crypto-echainiv=y CONFIG_PACKAGE_kmod-crypto-hmac=y + CONFIG_PACKAGE_kmod-crypto-kpp=y + CONFIG_PACKAGE_kmod-crypto-lib-chacha20=y + CONFIG_PACKAGE_kmod-crypto-lib-chacha20poly1305=y + CONFIG_PACKAGE_kmod-crypto-lib-curve25519=y + CONFIG_PACKAGE_kmod-crypto-lib-poly1305=y CONFIG_PACKAGE_kmod-crypto-manager=y CONFIG_PACKAGE_kmod-crypto-md5=y CONFIG_PACKAGE_kmod-crypto-null=y @@ -317,6 +323,7 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_kmod-ipt-core=y CONFIG_PACKAGE_kmod-ipt-extra=y CONFIG_PACKAGE_kmod-ipt-ipopt=y + CONFIG_PACKAGE_kmod-ipt-ipsec=y CONFIG_PACKAGE_kmod-ipt-ipset=y CONFIG_PACKAGE_kmod-ipt-nat=y CONFIG_PACKAGE_kmod-ipt-nat6=y @@ -447,6 +454,7 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_libfwrules=y CONFIG_PACKAGE_libgmap-client=y CONFIG_PACKAGE_libgmap-ext=y + CONFIG_PACKAGE_libgmp=y CONFIG_PACKAGE_libhelper=y CONFIG_PACKAGE_libimtp=y CONFIG_PACKAGE_libip4tc=y @@ -519,6 +527,7 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_libuuid=y CONFIG_PACKAGE_libuv=y CONFIG_PACKAGE_libwebsockets4-full=y + CONFIG_PACKAGE_libwireguard=y CONFIG_PACKAGE_libxml2=y CONFIG_PACKAGE_libxtables=y CONFIG_PACKAGE_lighttpd=y @@ -612,15 +621,19 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_netmodel-dslite=y CONFIG_PACKAGE_netmodel-ethernet=y CONFIG_PACKAGE_netmodel-gni=y + CONFIG_PACKAGE_netmodel-gre=y CONFIG_PACKAGE_netmodel-ip=y CONFIG_PACKAGE_netmodel-iprouter=y + CONFIG_PACKAGE_netmodel-ipsec=y CONFIG_PACKAGE_netmodel-logical=y CONFIG_PACKAGE_netmodel-netdev=y CONFIG_PACKAGE_netmodel-optical=y CONFIG_PACKAGE_netmodel-ppp=y CONFIG_PACKAGE_netmodel-radio=y CONFIG_PACKAGE_netmodel-ssid=y + CONFIG_PACKAGE_netmodel-tuntap=y CONFIG_PACKAGE_netmodel-vlan=y + CONFIG_PACKAGE_netmodel-wireguard=y CONFIG_PACKAGE_netmodel-xpon=y CONFIG_PACKAGE_nftables-json=m CONFIG_PACKAGE_obudpst=y @@ -717,6 +730,41 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_speedtest-modules=y CONFIG_PACKAGE_sse_fapi_lgm=y CONFIG_PACKAGE_ssh-server=y + CONFIG_PACKAGE_strongswan=y + CONFIG_PACKAGE_strongswan-charon=y + CONFIG_PACKAGE_strongswan-default=y + CONFIG_PACKAGE_strongswan-mod-aes=y + CONFIG_PACKAGE_strongswan-mod-attr=y + CONFIG_PACKAGE_strongswan-mod-connmark=y + CONFIG_PACKAGE_strongswan-mod-constraints=y + CONFIG_PACKAGE_strongswan-mod-des=y + CONFIG_PACKAGE_strongswan-mod-dnskey=y + CONFIG_PACKAGE_strongswan-mod-fips-prf=y + CONFIG_PACKAGE_strongswan-mod-gmp=y + CONFIG_PACKAGE_strongswan-mod-hmac=y + CONFIG_PACKAGE_strongswan-mod-kdf=y + CONFIG_PACKAGE_strongswan-mod-kernel-netlink=y + CONFIG_PACKAGE_strongswan-mod-md5=y + CONFIG_PACKAGE_strongswan-mod-mgf1=y + CONFIG_PACKAGE_strongswan-mod-openssl=y + CONFIG_PACKAGE_strongswan-mod-pem=y + CONFIG_PACKAGE_strongswan-mod-pgp=y + CONFIG_PACKAGE_strongswan-mod-pkcs1=y + CONFIG_PACKAGE_strongswan-mod-pubkey=y + CONFIG_PACKAGE_strongswan-mod-random=y + CONFIG_PACKAGE_strongswan-mod-rc2=y + CONFIG_PACKAGE_strongswan-mod-resolve=y + CONFIG_PACKAGE_strongswan-mod-revocation=y + CONFIG_PACKAGE_strongswan-mod-sha1=y + CONFIG_PACKAGE_strongswan-mod-sha2=y + CONFIG_PACKAGE_strongswan-mod-socket-default=y + CONFIG_PACKAGE_strongswan-mod-sshkey=y + CONFIG_PACKAGE_strongswan-mod-updown=y + CONFIG_PACKAGE_strongswan-mod-vici=y + CONFIG_PACKAGE_strongswan-mod-x509=y + CONFIG_PACKAGE_strongswan-mod-xauth-generic=y + CONFIG_PACKAGE_strongswan-mod-xcbc=y + CONFIG_PACKAGE_strongswan-swanctl=y CONFIG_PACKAGE_swpal_6x-uci-prpl=y CONFIG_PACKAGE_syslog-ng=y CONFIG_PACKAGE_tc-tiny=y @@ -742,9 +790,11 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_tr181-firewall=y CONFIG_PACKAGE_tr181-flashmonitor=y CONFIG_PACKAGE_tr181-gnimanager=y + CONFIG_PACKAGE_tr181-gre=y CONFIG_PACKAGE_tr181-homeplug=y CONFIG_PACKAGE_tr181-httpaccess=y CONFIG_PACKAGE_tr181-ipdiagnostics=y + CONFIG_PACKAGE_tr181-ipsec=y CONFIG_PACKAGE_tr181-led=y CONFIG_PACKAGE_tr181-logical=y CONFIG_PACKAGE_tr181-mcastd=y @@ -762,10 +812,12 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_tr181-sfp=y CONFIG_PACKAGE_tr181-syslog=y CONFIG_PACKAGE_tr181-temperature=y + CONFIG_PACKAGE_tr181-tuntap=y CONFIG_PACKAGE_tr181-upnp=y CONFIG_PACKAGE_tr181-upnpdiscovery=y CONFIG_PACKAGE_tr181-usb=y CONFIG_PACKAGE_tr181-usermanagement=y + CONFIG_PACKAGE_tr181-wireguard=y CONFIG_PACKAGE_tr181-xpon=y CONFIG_PACKAGE_uboot-envtools=y CONFIG_PACKAGE_uboot-osp-tb341-p34x-phy-emmc=y @@ -905,12 +957,18 @@ Assure expected build configuration (PCF-1413): CONFIG_SAH_AMX_TR181_GNIMANAGER_ORDER=25 CONFIG_SAH_AMX_TR181_GNIMANAGER_RUN_AS_GROUP="tr181_app" CONFIG_SAH_AMX_TR181_GNIMANAGER_RUN_AS_USER="tr181_app" + CONFIG_SAH_AMX_TR181_GRE=y + CONFIG_SAH_AMX_TR181_GRE_START_ORDER=81 + CONFIG_SAH_AMX_TR181_GRE_STOP_ORDER=19 CONFIG_SAH_AMX_TR181_HOMEPLUG=y CONFIG_SAH_AMX_TR181_HOMEPLUG_START_ORDER=31 CONFIG_SAH_AMX_TR181_HOMEPLUG_STOP_ORDER=69 CONFIG_SAH_AMX_TR181_HTTPACCESS=y CONFIG_SAH_AMX_TR181_HTTPACCESS_FIREWALL=y CONFIG_SAH_AMX_TR181_HTTPACCESS_ORDER=49 + CONFIG_SAH_AMX_TR181_IPSEC=y + CONFIG_SAH_AMX_TR181_IPSEC_START_ORDER=84 + CONFIG_SAH_AMX_TR181_IPSEC_STOP_ORDER=16 CONFIG_SAH_AMX_TR181_IP=y CONFIG_SAH_AMX_TR181_IP_RUN_AS_GROUP="tr181_app" CONFIG_SAH_AMX_TR181_IP_RUN_AS_USER="tr181_app" @@ -964,6 +1022,9 @@ Assure expected build configuration (PCF-1413): CONFIG_SAH_AMX_TR181_TEMPERATURE_RUN_AS_USER="tr181_app" CONFIG_SAH_AMX_TR181_TIME=y CONFIG_SAH_AMX_TR181_TIME_ORDER=30 + CONFIG_SAH_AMX_TR181_TUNTAP=y + CONFIG_SAH_AMX_TR181_TUNTAP_START_ORDER=82 + CONFIG_SAH_AMX_TR181_TUNTAP_STOP_ORDER=18 CONFIG_SAH_AMX_TR181_UPNP=y CONFIG_SAH_AMX_TR181_UPNPDISCOVERY=y CONFIG_SAH_AMX_TR181_UPNPDISCOVERY_RUN_AS_GROUP="tr181_app" @@ -974,6 +1035,9 @@ Assure expected build configuration (PCF-1413): CONFIG_SAH_AMX_TR181_UPNP_ORDER=80 CONFIG_SAH_AMX_TR181_UPNP_RUN_AS_GROUP="tr181_app" CONFIG_SAH_AMX_TR181_UPNP_RUN_AS_USER="tr181_app" + CONFIG_SAH_AMX_TR181_WIREGUARD=y + CONFIG_SAH_AMX_TR181_WIREGUARD_START_ORDER=25 + CONFIG_SAH_AMX_TR181_WIREGUARD_STOP_ORDER=75 CONFIG_SAH_AMX_TR181_XPON=y CONFIG_SAH_AMX_TR181_XPON_MAX_ONUS=1 CONFIG_SAH_AMX_TR181_XPON_ORDER=30 @@ -1062,6 +1126,8 @@ Assure expected build configuration (PCF-1413): CONFIG_SQLITE3_FTS4=y CONFIG_SQLITE3_FTS5=y CONFIG_SQLITE3_RTREE=y + CONFIG_STRONGSWAN_ROUTING_TABLE="220" + CONFIG_STRONGSWAN_ROUTING_TABLE_PRIO="220" CONFIG_SWITCH_DEVICE_ID=0 CONFIG_SWITCH_LAN_PORTS="0 1 2 4" CONFIG_SWITCH_MII1_PORT="5" diff --git a/.gitlab/tests/cram/wnc-freedom/005-build-config.t b/.gitlab/tests/cram/wnc-freedom/005-build-config.t index 52cb5ca758..a64cc671a2 100644 --- a/.gitlab/tests/cram/wnc-freedom/005-build-config.t +++ b/.gitlab/tests/cram/wnc-freedom/005-build-config.t @@ -180,6 +180,7 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_iptables-mod-conntrack-extra=y CONFIG_PACKAGE_iptables-mod-extra=y CONFIG_PACKAGE_iptables-mod-ipopt=y + CONFIG_PACKAGE_iptables-mod-ipsec=y CONFIG_PACKAGE_iptables-mod-nfqueue=y CONFIG_PACKAGE_iptables-zz-legacy=y CONFIG_PACKAGE_iputils-ping=y @@ -216,6 +217,7 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_kmod-ip6tables-extra=y CONFIG_PACKAGE_kmod-ipt-extra=y CONFIG_PACKAGE_kmod-ipt-ipopt=y + CONFIG_PACKAGE_kmod-ipt-ipsec=y CONFIG_PACKAGE_kmod-ipt-ipset=y CONFIG_PACKAGE_kmod-ipt-nat=y CONFIG_PACKAGE_kmod-ipt-nat6=y @@ -295,7 +297,9 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_kmod-usb-storage-uas=y CONFIG_PACKAGE_kmod-usb-wdm=y CONFIG_PACKAGE_kmod-veth=y + CONFIG_PACKAGE_kmod-wireguard=y CONFIG_PACKAGE_kmod-wwan=y + CONFIG_PACKAGE_kmod-xfrm-interface=y CONFIG_PACKAGE_libacl=y CONFIG_PACKAGE_libaio=y CONFIG_PACKAGE_libamxa=y @@ -338,6 +342,7 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_libfiletransfer=y CONFIG_PACKAGE_libfwinterface=y CONFIG_PACKAGE_libfwrules=y + CONFIG_PACKAGE_libgcrypt=y CONFIG_PACKAGE_libgmap-client=y CONFIG_PACKAGE_libgmap-ext=y CONFIG_PACKAGE_libimtp=y @@ -355,6 +360,7 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_liblua5.3=y CONFIG_PACKAGE_liblxc=y CONFIG_PACKAGE_liblzma=y + CONFIG_PACKAGE_libmariadb=y CONFIG_PACKAGE_libmbim=y CONFIG_PACKAGE_libmfg=y CONFIG_PACKAGE_libmicrohttpd-no-ssl=y @@ -376,6 +382,7 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_libnl-route=y CONFIG_PACKAGE_libnl-tcpst=y CONFIG_PACKAGE_libocispec=y + CONFIG_PACKAGE_libopenldap=y CONFIG_PACKAGE_libopensc=y CONFIG_PACKAGE_libp11=y CONFIG_PACKAGE_libpacket-interception=y @@ -416,6 +423,8 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_libuspprotobuf=y CONFIG_PACKAGE_libuv=y CONFIG_PACKAGE_libwebsockets4-full=y + CONFIG_PACKAGE_libwireguard=y + CONFIG_PACKAGE_libwolfssl=y CONFIG_PACKAGE_libxml2=y CONFIG_PACKAGE_libxtables=y CONFIG_PACKAGE_libyaml=y @@ -516,15 +525,19 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_netmodel-dslite=y CONFIG_PACKAGE_netmodel-ethernet=y CONFIG_PACKAGE_netmodel-gni=y + CONFIG_PACKAGE_netmodel-gre=y CONFIG_PACKAGE_netmodel-ip=y CONFIG_PACKAGE_netmodel-iprouter=y + CONFIG_PACKAGE_netmodel-ipsec=y CONFIG_PACKAGE_netmodel-logical=y CONFIG_PACKAGE_netmodel-netdev=y CONFIG_PACKAGE_netmodel-optical=y CONFIG_PACKAGE_netmodel-ppp=y CONFIG_PACKAGE_netmodel-radio=y CONFIG_PACKAGE_netmodel-ssid=y + CONFIG_PACKAGE_netmodel-tuntap=y CONFIG_PACKAGE_netmodel-vlan=y + CONFIG_PACKAGE_netmodel-wireguard=y CONFIG_PACKAGE_netmodel-xpon=y # CONFIG_PACKAGE_nftables-json is not set CONFIG_PACKAGE_nss-tcp-st-cli=y @@ -636,9 +649,11 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_tr181-firewall=y CONFIG_PACKAGE_tr181-flashmonitor=y CONFIG_PACKAGE_tr181-gnimanager=y + CONFIG_PACKAGE_tr181-gre=y CONFIG_PACKAGE_tr181-homeplug=y CONFIG_PACKAGE_tr181-httpaccess=y CONFIG_PACKAGE_tr181-ipdiagnostics=y + CONFIG_PACKAGE_tr181-ipsec=y CONFIG_PACKAGE_tr181-led=y CONFIG_PACKAGE_tr181-logical=y CONFIG_PACKAGE_tr181-mcastd=y @@ -657,10 +672,12 @@ Assure expected build configuration (PCF-1413): CONFIG_PACKAGE_tr181-sfp=y CONFIG_PACKAGE_tr181-syslog=y CONFIG_PACKAGE_tr181-temperature=y + CONFIG_PACKAGE_tr181-tuntap=y CONFIG_PACKAGE_tr181-upnp=y CONFIG_PACKAGE_tr181-upnpdiscovery=y CONFIG_PACKAGE_tr181-usb=y CONFIG_PACKAGE_tr181-usermanagement=y + CONFIG_PACKAGE_tr181-wireguard=y CONFIG_PACKAGE_tr181-xpon=y CONFIG_PACKAGE_uboot-tools=y CONFIG_PACKAGE_umbim=y @@ -841,12 +858,18 @@ Assure expected build configuration (PCF-1413): CONFIG_SAH_AMX_TR181_GNIMANAGER_ORDER=25 CONFIG_SAH_AMX_TR181_GNIMANAGER_RUN_AS_GROUP="tr181_app" CONFIG_SAH_AMX_TR181_GNIMANAGER_RUN_AS_USER="tr181_app" + CONFIG_SAH_AMX_TR181_GRE=y + CONFIG_SAH_AMX_TR181_GRE_START_ORDER=81 + CONFIG_SAH_AMX_TR181_GRE_STOP_ORDER=19 CONFIG_SAH_AMX_TR181_HOMEPLUG=y CONFIG_SAH_AMX_TR181_HOMEPLUG_START_ORDER=31 CONFIG_SAH_AMX_TR181_HOMEPLUG_STOP_ORDER=69 CONFIG_SAH_AMX_TR181_HTTPACCESS=y CONFIG_SAH_AMX_TR181_HTTPACCESS_FIREWALL=y CONFIG_SAH_AMX_TR181_HTTPACCESS_ORDER=49 + CONFIG_SAH_AMX_TR181_IPSEC=y + CONFIG_SAH_AMX_TR181_IPSEC_START_ORDER=84 + CONFIG_SAH_AMX_TR181_IPSEC_STOP_ORDER=16 CONFIG_SAH_AMX_TR181_IP=y CONFIG_SAH_AMX_TR181_IP_RUN_AS_GROUP="tr181_app" CONFIG_SAH_AMX_TR181_IP_RUN_AS_USER="tr181_app" @@ -916,6 +939,9 @@ Assure expected build configuration (PCF-1413): CONFIG_SAH_AMX_TR181_TEMPERATURE_RUN_AS_USER="tr181_app" CONFIG_SAH_AMX_TR181_TIME=y CONFIG_SAH_AMX_TR181_TIME_ORDER=30 + CONFIG_SAH_AMX_TR181_TUNTAP=y + CONFIG_SAH_AMX_TR181_TUNTAP_START_ORDER=82 + CONFIG_SAH_AMX_TR181_TUNTAP_STOP_ORDER=18 CONFIG_SAH_AMX_TR181_UPNP=y CONFIG_SAH_AMX_TR181_UPNPDISCOVERY=y CONFIG_SAH_AMX_TR181_UPNPDISCOVERY_RUN_AS_GROUP="tr181_app" @@ -926,6 +952,9 @@ Assure expected build configuration (PCF-1413): CONFIG_SAH_AMX_TR181_UPNP_ORDER=80 CONFIG_SAH_AMX_TR181_UPNP_RUN_AS_GROUP="tr181_app" CONFIG_SAH_AMX_TR181_UPNP_RUN_AS_USER="tr181_app" + CONFIG_SAH_AMX_TR181_WIREGUARD=y + CONFIG_SAH_AMX_TR181_WIREGUARD_START_ORDER=25 + CONFIG_SAH_AMX_TR181_WIREGUARD_STOP_ORDER=75 CONFIG_SAH_AMX_TR181_XPON=y CONFIG_SAH_AMX_TR181_XPON_MAX_ONUS=1 CONFIG_SAH_AMX_TR181_XPON_ORDER=30