T7343: IPsec add traffic-selector handling for VTI interfaces

Allow to set traffic-selector for VTI interfaces
We can set several local and remote IPv4 and IPv6 prefixes

```
set vpn ipsec site-to-site peer P1 vti traffic-selector local prefix 0.0.0.0/0
set vpn ipsec site-to-site peer P1 vti traffic-selector local prefix :/0
set vpn ipsec site-to-site peer P1 vti traffic-selector remote prefix 192.0.2.0/24
```

3 files changed, 158 insertions, 2 deletions

diff --git a/data/templates/ipsec/swanctl/peer.j2 b/data/templates/ipsec/swanctl/peer.j2
index 3a9af2c94..cf0865c88 100644
--- a/data/templates/ipsec/swanctl/peer.j2
+++ b/data/templates/ipsec/swanctl/peer.j2
@@ -68,8 +68,19 @@
                 rekey_packets = 0
                 rekey_time = 0s
 {%     endif %}
-                local_ts = 0.0.0.0/0,::/0
-                remote_ts = 0.0.0.0/0,::/0
+{#     set default traffic-selectors #}
+{%     set local_ts = '0.0.0.0/0,::/0' %}
+{%     set remote_ts = '0.0.0.0/0,::/0' %}
+{%     if peer_conf.vti.traffic_selector is vyos_defined %}
+{%         if peer_conf.vti.traffic_selector.local is vyos_defined and peer_conf.vti.traffic_selector.local.prefix is vyos_defined %}
+{%             set local_ts = peer_conf.vti.traffic_selector.local.prefix | join(',') %}
+{%         endif %}
+{%         if peer_conf.vti.traffic_selector.remote is vyos_defined and peer_conf.vti.traffic_selector.remote.prefix is vyos_defined %}
+{%             set remote_ts = peer_conf.vti.traffic_selector.remote.prefix | join(',') %}
+{%         endif %}
+{%     endif %}
+                local_ts = {{ local_ts }}
+                remote_ts = {{ remote_ts }}
                 updown = "/etc/ipsec.d/vti-up-down {{ peer_conf.vti.bind }}"
 {#              The key defaults to 0 and will match any policies which similarly do not have a lookup key configuration. #}
 {#              Thus we simply shift the key by one to also support a vti0 interface #}
diff --git a/interface-definitions/vpn_ipsec.xml.in b/interface-definitions/vpn_ipsec.xml.in
index 0cf526fad..873a4f882 100644
--- a/interface-definitions/vpn_ipsec.xml.in
+++ b/interface-definitions/vpn_ipsec.xml.in
@@ -1244,6 +1244,63 @@
                     <children>
                       #include <include/ipsec/bind.xml.i>
                       #include <include/ipsec/esp-group.xml.i>
+                      <node name="traffic-selector">
+                        <properties>
+                          <help>Traffic-selectors parameters</help>
+                        </properties>
+                        <children>
+                          <node name="local">
+                            <properties>
+                              <help>Local parameters for interesting traffic</help>
+                            </properties>
+                            <children>
+                              <leafNode name="prefix">
+                                <properties>
+                                  <help>Local IPv4 or IPv6 prefix</help>
+                                  <valueHelp>
+                                    <format>ipv4net</format>
+                                    <description>Local IPv4 prefix</description>
+                                  </valueHelp>
+                                  <valueHelp>
+                                    <format>ipv6net</format>
+                                    <description>Local IPv6 prefix</description>
+                                  </valueHelp>
+                                  <constraint>
+                                    <validator name="ipv4-prefix"/>
+                                    <validator name="ipv6-prefix"/>
+                                  </constraint>
+                                  <multi/>
+                                </properties>
+                              </leafNode>
+                            </children>
+                          </node>
+                          <node name="remote">
+                            <properties>
+                              <help>Remote parameters for interesting traffic</help>
+                            </properties>
+                            <children>
+                              <leafNode name="prefix">
+                                <properties>
+                                  <help>Remote IPv4 or IPv6 prefix</help>
+                                  <valueHelp>
+                                    <format>ipv4net</format>
+                                    <description>Remote IPv4 prefix</description>
+                                  </valueHelp>
+                                  <valueHelp>
+                                    <format>ipv6net</format>
+                                    <description>Remote IPv6 prefix</description>
+                                  </valueHelp>
+                                  <constraint>
+                                    <validator name="ipv4-prefix"/>
+                                    <validator name="ipv6-prefix"/>
+                                  </constraint>
+                                  <multi/>
+                                </properties>
+                              </leafNode>
+                            </children>
+                          </node>
+                        </children>
+                      </node>
                     </children>
                   </node>
                 </children>
diff --git a/smoketest/scripts/cli/test_vpn_ipsec.py b/smoketest/scripts/cli/test_vpn_ipsec.py
index 91a76e6f6..c1d943bde 100755
--- a/smoketest/scripts/cli/test_vpn_ipsec.py
+++ b/smoketest/scripts/cli/test_vpn_ipsec.py
@@ -352,6 +352,94 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase):
         self.tearDownPKI()
 
 
+    def test_site_to_site_vti_ts_afi(self):
+        local_address = '192.0.2.10'
+        vti = 'vti10'
+        # IKE
+        self.cli_set(base_path + ['ike-group', ike_group, 'key-exchange', 'ikev2'])
+        self.cli_set(base_path + ['ike-group', ike_group, 'disable-mobike'])
+        # ESP
+        self.cli_set(base_path + ['esp-group', esp_group, 'compression'])
+        # VTI interface
+        self.cli_set(vti_path + [vti, 'address', '10.1.1.1/24'])
+
+        # vpn ipsec auth psk <tag> id <x.x.x.x>
+        self.cli_set(base_path + ['authentication', 'psk', connection_name, 'id', local_id])
+        self.cli_set(base_path + ['authentication', 'psk', connection_name, 'id', remote_id])
+        self.cli_set(base_path + ['authentication', 'psk', connection_name, 'id', peer_ip])
+        self.cli_set(base_path + ['authentication', 'psk', connection_name, 'secret', secret])
+
+        # Site to site
+        peer_base_path = base_path + ['site-to-site', 'peer', connection_name]
+        self.cli_set(peer_base_path + ['authentication', 'mode', 'pre-shared-secret'])
+        self.cli_set(peer_base_path + ['connection-type', 'none'])
+        self.cli_set(peer_base_path + ['force-udp-encapsulation'])
+        self.cli_set(peer_base_path + ['ike-group', ike_group])
+        self.cli_set(peer_base_path + ['default-esp-group', esp_group])
+        self.cli_set(peer_base_path + ['local-address', local_address])
+        self.cli_set(peer_base_path + ['remote-address', peer_ip])
+        self.cli_set(peer_base_path + ['vti', 'bind', vti])
+        self.cli_set(peer_base_path + ['vti', 'esp-group', esp_group])
+        self.cli_set(peer_base_path + ['vti', 'traffic-selector', 'local', 'prefix', '0.0.0.0/0'])
+        self.cli_set(peer_base_path + ['vti', 'traffic-selector', 'remote', 'prefix', '192.0.2.1/32'])
+        self.cli_set(peer_base_path + ['vti', 'traffic-selector', 'remote', 'prefix', '192.0.2.3/32'])
+
+        self.cli_commit()
+
+        swanctl_conf = read_file(swanctl_file)
+        if_id = vti.lstrip('vti')
+        # The key defaults to 0 and will match any policies which similarly do
+        # not have a lookup key configuration - thus we shift the key by one
+        # to also support a vti0 interface
+        if_id = str(int(if_id) +1)
+        swanctl_conf_lines = [
+            f'version = 2',
+            f'auth = psk',
+            f'proposals = aes128-sha1-modp1024',
+            f'esp_proposals = aes128-sha1-modp1024',
+            f'local_addrs = {local_address} # dhcp:no',
+            f'mobike = no',
+            f'remote_addrs = {peer_ip}',
+            f'mode = tunnel',
+            f'local_ts = 0.0.0.0/0',
+            f'remote_ts = 192.0.2.1/32,192.0.2.3/32',
+            f'ipcomp = yes',
+            f'start_action = none',
+            f'replay_window = 32',
+            f'if_id_in = {if_id}', # will be 11 for vti10 - shifted by one
+            f'if_id_out = {if_id}',
+            f'updown = "/etc/ipsec.d/vti-up-down {vti}"'
+        ]
+        for line in swanctl_conf_lines:
+            self.assertIn(line, swanctl_conf)
+
+        # Check IPv6 TS
+        self.cli_delete(peer_base_path + ['vti', 'traffic-selector'])
+        self.cli_set(peer_base_path + ['vti', 'traffic-selector', 'local', 'prefix', '::/0'])
+        self.cli_set(peer_base_path + ['vti', 'traffic-selector', 'remote', 'prefix', '::/0'])
+        self.cli_commit()
+        swanctl_conf = read_file(swanctl_file)
+        swanctl_conf_lines = [
+            f'local_ts = ::/0',
+            f'remote_ts = ::/0',
+            f'updown = "/etc/ipsec.d/vti-up-down {vti}"'
+        ]
+        for line in swanctl_conf_lines:
+            self.assertIn(line, swanctl_conf)
+
+        # Check both TS (IPv4 + IPv6)
+        self.cli_delete(peer_base_path + ['vti', 'traffic-selector'])
+        self.cli_commit()
+        swanctl_conf = read_file(swanctl_file)
+        swanctl_conf_lines = [
+            f'local_ts = 0.0.0.0/0,::/0',
+            f'remote_ts = 0.0.0.0/0,::/0',
+            f'updown = "/etc/ipsec.d/vti-up-down {vti}"'
+        ]
+        for line in swanctl_conf_lines:
+            self.assertIn(line, swanctl_conf)
+
+
     def test_dmvpn(self):
         ike_lifetime = '3600'
         esp_lifetime = '1800'