vpp: T8262: Refactor IPsec settings to use only 'ipsec-acceleration' flag

5 files changed, 28 insertions, 50 deletions

diff --git a/data/templates/vpp/startup.conf.j2 b/data/templates/vpp/startup.conf.j2
index e6822f7c8..e4c42c5b0 100644
--- a/data/templates/vpp/startup.conf.j2
+++ b/data/templates/vpp/startup.conf.j2
@@ -120,7 +120,7 @@ plugins {
 
 crypto-engines {
     default { disable }
-{% if ipsec is vyos_defined %}
+{% if ipsec_acceleration is vyos_defined %}
     ipsecmb { enable }
     native { enable }
     openssl { enable }
@@ -201,18 +201,18 @@ dpdk {
     uio-bind-force
 }
 
-{% if ipsec is vyos_defined %}
+{% if ipsec_acceleration is vyos_defined %}
 linux-xfrm-nl {
      enable-route-mode-ipsec
-     interface {{ ipsec.interface_type }}
-{%     if ipsec.netlink.batch_delay_ms is vyos_defined %}
-     nl-batch-delay-ms {{ ipsec.netlink.batch_delay_ms }}
+     interface ipsec
+{%     if lcp.netlink.batch_delay_ms is vyos_defined %}
+     nl-batch-delay-ms {{ lcp.netlink.batch_delay_ms }}
 {%     endif %}
-{%     if ipsec.netlink.batch_size is vyos_defined %}
-     nl-batch-size {{ ipsec.netlink.batch_size }}
+{%     if lcp.netlink.batch_size is vyos_defined %}
+     nl-batch-size {{ lcp.netlink.batch_size }}
 {%     endif %}
-{%     if ipsec.netlink.rx_buffer_size is vyos_defined %}
-     nl-rx-buffer-size {{ ipsec.netlink.rx_buffer_size }}
+{%     if lcp.netlink.rx_buffer_size is vyos_defined %}
+     nl-rx-buffer-size {{ lcp.netlink.rx_buffer_size }}
 {%     endif %}
 }
 {% endif %}
diff --git a/interface-definitions/vpp.xml.in b/interface-definitions/vpp.xml.in
index f33f9a985..b431560d6 100644
--- a/interface-definitions/vpp.xml.in
+++ b/interface-definitions/vpp.xml.in
@@ -742,34 +742,12 @@
               </leafNode>
             </children>
           </node>
-          <node name="ipsec">
+          <leafNode name="ipsec-acceleration">
             <properties>
-              <help>IPsec settings</help>
+              <help>Enable IPsec acceleration</help>
+              <valueless/>
             </properties>
-            <children>
-              <leafNode name="interface-type">
-                <properties>
-                  <help>IPsec interface type</help>
-                  <completionHelp>
-                    <list>ipsec ipip</list>
-                  </completionHelp>
-                  <valueHelp>
-                    <format>ipsec</format>
-                    <description>IPsec interface type</description>
-                  </valueHelp>
-                  <valueHelp>
-                    <format>ipip</format>
-                    <description>IPIP tunnel interface type</description>
-                  </valueHelp>
-                  <constraint>
-                    <regex>(ipsec|ipip)</regex>
-                  </constraint>
-                </properties>
-                <defaultValue>ipsec</defaultValue>
-              </leafNode>
-              #include <include/vpp/netlink.xml.i>
-            </children>
-          </node>
+          </leafNode>
           <node name="l2learn">
             <properties>
               <help>Level 2 MAC address learning settings</help>
diff --git a/smoketest/scripts/cli/test_vpp.py b/smoketest/scripts/cli/test_vpp.py
index 941c32044..3fb23fe6c 100755
--- a/smoketest/scripts/cli/test_vpp.py
+++ b/smoketest/scripts/cli/test_vpp.py
@@ -1274,14 +1274,15 @@ class TestVPP(VyOSUnitTestSHIM.TestCase):
             self.assertEqual(conf['memory']['main-heap-page-size'], size)
 
     def test_14_vpp_ipsec_xfrm_nl(self):
-        base_ipsec = base_path + ['settings', 'ipsec']
+        base_lcp = base_path + ['settings', 'lcp']
         batch_delay = '250'
         batch_size = '150'
         rx_buffer_zise = '1024'
 
-        self.cli_set(base_ipsec + ['netlink', 'batch-delay-ms', batch_delay])
-        self.cli_set(base_ipsec + ['netlink', 'batch-size', batch_size])
-        self.cli_set(base_ipsec + ['netlink', 'rx-buffer-size', rx_buffer_zise])
+        self.cli_set(base_path + ['settings', 'ipsec-acceleration'])
+        self.cli_set(base_lcp + ['netlink', 'batch-delay-ms', batch_delay])
+        self.cli_set(base_lcp + ['netlink', 'batch-size', batch_size])
+        self.cli_set(base_lcp + ['netlink', 'rx-buffer-size', rx_buffer_zise])
         self.cli_commit()
 
         config_entries = (
@@ -1298,13 +1299,6 @@ class TestVPP(VyOSUnitTestSHIM.TestCase):
         for config_entry in config_entries:
             self.assertIn(config_entry, config)
 
-        # set IPsec tunnel-type ipip
-        self.cli_set(base_ipsec + ['interface-type', 'ipip'])
-        self.cli_commit()
-
-        config = read_file(VPP_CONF)
-        self.assertIn('interface ipip', config)
-
     def test_15_1_vpp_cgnat(self):
         base_cgnat = base_path + ['nat', 'cgnat']
         iface_out = 'eth0'
diff --git a/src/conf_mode/vpp.py b/src/conf_mode/vpp.py
index b26388cdc..2634eae44 100755
--- a/src/conf_mode/vpp.py
+++ b/src/conf_mode/vpp.py
@@ -305,10 +305,6 @@ def get_config(config=None):
 
     config = config_dict_merge(default_values, config)
 
-    # Ignore default XML values if config doesn't exists
-    if not conf.exists(base_settings + ['ipsec']):
-        del config['settings']['ipsec']
-
     # add running config
     if effective_config:
         default_values_effective = conf.get_config_defaults(
diff --git a/src/migration-scripts/vpp/7-to-8 b/src/migration-scripts/vpp/7-to-8
index e6cff9668..1e95bb43e 100644
--- a/src/migration-scripts/vpp/7-to-8
+++ b/src/migration-scripts/vpp/7-to-8
@@ -18,6 +18,8 @@
 #
 # Move 'vpp nat44' and 'vpp settings nat44' to 'vpp nat nat44'.
 # Drop settings for nat workers (T8254)
+#
+# Delete 'ipsec' node and all settings and replace it with single 'ipsec-acceleration' flag (T8262)
 
 
 from vyos.configtree import ConfigTree
@@ -54,6 +56,13 @@ def _migrate_vpp_nat44(config: ConfigTree) -> None:
             config.copy(settings_path + ['timeout'], new_base_path + ['timeout'])
         config.delete(settings_path)
 
+def _migrate_vpp_ipsec(config: ConfigTree) -> None:
+    base = ['vpp', 'settings']
+
+    if config.exists(base + ['ipsec']):
+        config.set(base + ['ipsec-acceleration'])
+        config.delete(base + ['ipsec'])
+
 
 def migrate(config: ConfigTree) -> None:
     if not config.exists(['vpp']):
@@ -62,3 +71,4 @@ def migrate(config: ConfigTree) -> None:
 
     _migrate_vpp_log(config)
     _migrate_vpp_nat44(config)
+    _migrate_vpp_ipsec(config)