T7168: Add IPsec XFRM netlink plugin and CLI

Add linux-xfrm-nl plugin
Add configuration commands for VPP IPsec

```
set vpp settings ipsec interface-type 'ipsec'
set vpp settings ipsec netlink batch-delay-ms '250'
set vpp settings ipsec netlink batch-size '150'
set vpp settings ipsec netlink rx-buffer-size '1024'
```

4 files changed, 104 insertions, 45 deletions

diff --git a/data/templates/vpp/startup.conf.j2 b/data/templates/vpp/startup.conf.j2
index 5cab34a97..cf10b6ce5 100644
--- a/data/templates/vpp/startup.conf.j2
+++ b/data/templates/vpp/startup.conf.j2
@@ -104,7 +104,15 @@ plugins {
     plugin geneve_plugin.so { enable }
     plugin gre_plugin.so { enable }
     plugin vxlan_plugin.so { enable }
-    plugin wireguard_plugin.so { enable }
+    # Secure
+    # plugin ikev2_plugin.so { enable }
+    # plugin dns_plugin.so { enable } # Probably required for FQDN peers
+{% if ipsec is vyos_defined %}
+    plugin crypto_ipsecmb_plugin.so { enable }
+    plugin crypto_native_plugin.so { enable }
+    plugin crypto_openssl_plugin.so { enable }
+{% endif %}
+    # plugin wireguard_plugin.so { enable }
 }
 
 linux-cp {
@@ -179,3 +187,19 @@ dpdk {
 {% endfor %}
     uio-bind-force
 }
+
+{% if ipsec is vyos_defined %}
+linux-xfrm-nl {
+     enable-route-mode-ipsec
+     interface {{ ipsec.interface_type }}
+{%     if ipsec.netlink.batch_delay_ms is vyos_defined %}
+     nl-batch-delay-ms {{ ipsec.netlink.batch_delay_ms }}
+{%     endif %}
+{%     if ipsec.netlink.batch_size is vyos_defined %}
+     nl-batch-size {{ ipsec.netlink.batch_size }}
+{%     endif %}
+{%     if ipsec.netlink.rx_buffer_size is vyos_defined %}
+     nl-rx-buffer-size {{ ipsec.netlink.rx_buffer_size }}
+{%     endif %}
+}
+{% endif %}
diff --git a/interface-definitions/include/vpp/netlink.xml.i b/interface-definitions/include/vpp/netlink.xml.i
new file mode 100644
index 000000000..903100d00
--- /dev/null
+++ b/interface-definitions/include/vpp/netlink.xml.i
@@ -0,0 +1,45 @@
+<!-- include start from vpp/netlink.xml.i -->
+<node name="netlink">
+  <properties>
+    <help>Netlink options</help>
+  </properties>
+  <children>
+   <leafNode name="rx-buffer-size">
+    <properties>
+      <help>Receive buffer size</help>
+      <valueHelp>
+        <format>u32:0-4294967295</format>
+        <description>Receive buffer size</description>
+      </valueHelp>
+      <constraint>
+        <validator name="numeric" argument="--range 0-4294967295"/>
+      </constraint>
+    </properties>
+  </leafNode>
+  <leafNode name="batch-size">
+    <properties>
+      <help>Batch size</help>
+      <valueHelp>
+        <format>u32:0-4294967295</format>
+        <description>Batch size</description>
+      </valueHelp>
+      <constraint>
+        <validator name="numeric" argument="--range 0-4294967295"/>
+      </constraint>
+    </properties>
+  </leafNode>
+  <leafNode name="batch-delay-ms">
+    <properties>
+      <help>Batch delay</help>
+      <valueHelp>
+        <format>u32:0-4294967295</format>
+        <description>Batch delay (in ms)</description>
+      </valueHelp>
+      <constraint>
+        <validator name="numeric" argument="--range 0-4294967295"/>
+      </constraint>
+    </properties>
+  </leafNode>
+</children>
+</node>
+<!-- include end -->
diff --git a/interface-definitions/vpp.xml.in b/interface-definitions/vpp.xml.in
index 77a461242..2160d0715 100644
--- a/interface-definitions/vpp.xml.in
+++ b/interface-definitions/vpp.xml.in
@@ -638,6 +638,34 @@
               </leafNode>
             </children>
           </node>
+          <node name="ipsec">
+            <properties>
+              <help>IPsec settings</help>
+            </properties>
+            <children>
+              <leafNode name="interface-type">
+                <properties>
+                  <help>IPsec interface type</help>
+                  <completionHelp>
+                    <list>ipsec ipip</list>
+                  </completionHelp>
+                  <valueHelp>
+                    <format>ipsec</format>
+                    <description>IPsec interface type</description>
+                  </valueHelp>
+                  <valueHelp>
+                    <format>ipip</format>
+                    <description>IPIP tunnel interface type</description>
+                  </valueHelp>
+                  <constraint>
+                    <regex>(ipsec|ipip)</regex>
+                  </constraint>
+                </properties>
+                <defaultValue>ipsec</defaultValue>
+              </leafNode>
+              #include <include/vpp/netlink.xml.i>
+            </children>
+          </node>
           <node name="l2learn">
             <properties>
               <help>Level 2 MAC address learning settings</help>
@@ -663,49 +691,7 @@
               <help>Linux control plane setting</help>
             </properties>
             <children>
-              <node name="netlink">
-                <properties>
-                  <help>Netlink options</help>
-                </properties>
-                <children>
-                 <leafNode name="rx-buffer-size">
-                  <properties>
-                    <help>Receive buffer size</help>
-                    <valueHelp>
-                      <format>u32:0-4294967295</format>
-                      <description>Receive buffer size</description>
-                    </valueHelp>
-                    <constraint>
-                      <validator name="numeric" argument="--range 0-4294967295"/>
-                    </constraint>
-                  </properties>
-                </leafNode>
-                <leafNode name="batch-size">
-                  <properties>
-                    <help>Batch size</help>
-                    <valueHelp>
-                      <format>u32:0-4294967295</format>
-                      <description>Batch size</description>
-                    </valueHelp>
-                    <constraint>
-                      <validator name="numeric" argument="--range 0-4294967295"/>
-                    </constraint>
-                  </properties>
-                </leafNode>
-                <leafNode name="batch-delay-ms">
-                  <properties>
-                    <help>Batch delay</help>
-                    <valueHelp>
-                      <format>u32:0-4294967295</format>
-                      <description>Batch delay (in ms)</description>
-                    </valueHelp>
-                    <constraint>
-                      <validator name="numeric" argument="--range 0-4294967295"/>
-                    </constraint>
-                  </properties>
-                </leafNode>
-              </children>
-            </node>
+              #include <include/vpp/netlink.xml.i>
             <leafNode name="ignore-kernel-routes">
               <properties>
                 <help>Ignore kernel routes</help>
diff --git a/src/conf_mode/vpp.py b/src/conf_mode/vpp.py
index 5126b7c79..ac95f8cb4 100755
--- a/src/conf_mode/vpp.py
+++ b/src/conf_mode/vpp.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023-2024 VyOS Inc.
+# Copyright (C) 2023-2025 VyOS Inc.
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -139,6 +139,10 @@ def get_config(config=None):
 
     config = config_dict_merge(default_values, config)
 
+    # Ignore default XML values if config doesn't exists
+    if not conf.exists(base_settings + ['ipsec']):
+        del config['settings']['ipsec']
+
     # add running config
     if effective_config:
         config['effective'] = effective_config