Merge pull request #5267 from vyos/T8099-strongswan-6.0

T8099: strongswan: 6.0.6 + Post quantum options

3 files changed, 40 insertions, 13 deletions

diff --git a/debian/control b/debian/control
index 6984e93d6..72f7f0e8c 100644
--- a/debian/control
+++ b/debian/control
@@ -303,14 +303,14 @@ Depends:
   nfct,
   nftables (>= 0.9.3),
 # For "vpn ipsec"
-  strongswan (>= 5.9.11),
-  strongswan-swanctl (>= 5.9.11),
-  charon-systemd (>= 5.9.11),
-  libcharon-extra-plugins (>= 5.9.11),
-  libcharon-extauth-plugins (>= 5.9.11),
-  libstrongswan-extra-plugins (>= 5.9.11),
-  libstrongswan-standard-plugins (>= 5.9.11),
-  python3-vici (>= 5.9.11),
+  strongswan (>= 6.0.6),
+  strongswan-swanctl (>= 6.0.6),
+  charon-systemd (>= 6.0.6),
+  libcharon-extra-plugins (>= 6.0.6),
+  libcharon-extauth-plugins (>= 6.0.6),
+  libstrongswan-extra-plugins (>= 6.0.6),
+  libstrongswan-standard-plugins (>= 6.0.6),
+  python3-vici (>= 6.0.6),
 # End "vpn ipsec"
 # For "nat64"
   jool,
diff --git a/interface-definitions/vpn_ipsec.xml.in b/interface-definitions/vpn_ipsec.xml.in
index ee8340a74..80490edd6 100644
--- a/interface-definitions/vpn_ipsec.xml.in
+++ b/interface-definitions/vpn_ipsec.xml.in
@@ -179,7 +179,7 @@
                 <properties>
                   <help>ESP Perfect Forward Secrecy</help>
                   <completionHelp>
-                    <list>enable dh-group1 dh-group2 dh-group5 dh-group14 dh-group15 dh-group16 dh-group17 dh-group18 dh-group19 dh-group20 dh-group21 dh-group22 dh-group23 dh-group24 dh-group25 dh-group26 dh-group27 dh-group28 dh-group29 dh-group30 dh-group31 dh-group32 disable</list>
+                    <list>enable dh-group1 dh-group2 dh-group5 dh-group14 dh-group15 dh-group16 dh-group17 dh-group18 dh-group19 dh-group20 dh-group21 dh-group22 dh-group23 dh-group24 dh-group25 dh-group26 dh-group27 dh-group28 dh-group29 dh-group30 dh-group31 dh-group32 dh-group33 dh-group34 dh-group35 disable</list>
                   </completionHelp>
                   <valueHelp>
                     <format>enable</format>
@@ -274,11 +274,23 @@
                     <description>Use Diffie-Hellman group 32 (curve448)</description>
                   </valueHelp>
                   <valueHelp>
+                    <format>dh-group33</format>
+                    <description>Use Diffie-Hellman group 33 (mlkem512)</description>
+                  </valueHelp>
+                  <valueHelp>
+                    <format>dh-group34</format>
+                    <description>Use Diffie-Hellman group 34 (mlkem768)</description>
+                  </valueHelp>
+                  <valueHelp>
+                    <format>dh-group35</format>
+                    <description>Use Diffie-Hellman group 35 (mlkem1024)</description>
+                  </valueHelp>
+                  <valueHelp>
                     <format>disable</format>
                     <description>Disable PFS</description>
                   </valueHelp>
                   <constraint>
-                    <regex>(enable|dh-group1|dh-group2|dh-group5|dh-group14|dh-group15|dh-group16|dh-group17|dh-group18|dh-group19|dh-group20|dh-group21|dh-group22|dh-group23|dh-group24|dh-group25|dh-group26|dh-group27|dh-group28|dh-group29|dh-group30|dh-group31|dh-group32|disable)</regex>
+                    <regex>(enable|dh-group1|dh-group2|dh-group5|dh-group14|dh-group15|dh-group16|dh-group17|dh-group18|dh-group19|dh-group20|dh-group21|dh-group22|dh-group23|dh-group24|dh-group25|dh-group26|dh-group27|dh-group28|dh-group29|dh-group30|dh-group31|dh-group32|dh-group33|dh-group34|dh-group35|disable)</regex>
                   </constraint>
                 </properties>
                 <defaultValue>enable</defaultValue>
@@ -461,7 +473,7 @@
                     <properties>
                       <help>dh-grouphelp</help>
                       <completionHelp>
-                        <list>1 2 5 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32</list>
+                        <list>1 2 5 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35</list>
                       </completionHelp>
                       <valueHelp>
                         <format>1</format>
@@ -551,8 +563,20 @@
                         <format>32</format>
                         <description>Diffie-Hellman group 32 (curve448)</description>
                       </valueHelp>
+                      <valueHelp>
+                        <format>33</format>
+                        <description>Diffie-Hellman group 33 (mlkem512)</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>34</format>
+                        <description>Diffie-Hellman group 34 (mlkem768)</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>35</format>
+                        <description>Diffie-Hellman group 35 (mlkem1024)</description>
+                      </valueHelp>
                       <constraint>
-                        <regex>(1|2|5|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32)</regex>
+                        <regex>(1|2|5|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32|33|34|35)</regex>
                       </constraint>
                     </properties>
                     <defaultValue>2</defaultValue>
diff --git a/python/vyos/template.py b/python/vyos/template.py
index 8a624d989..01c60a8b3 100755
--- a/python/vyos/template.py
+++ b/python/vyos/template.py
@@ -506,7 +506,10 @@ def get_esp_ike_cipher(group_config, ike_group=None):
         'dh-group29' : 'ecp384bp',
         'dh-group30' : 'ecp512bp',
         'dh-group31' : 'curve25519',
-        'dh-group32' : 'curve448'
+        'dh-group32' : 'curve448',
+        'dh-group33' : 'mlkem512',
+        'dh-group34' : 'mlkem768',
+        'dh-group35' : 'mlkem1024',
     }
 
     ciphers = []