ipsec: T4353: fix Jinja2 linting errors

1 files changed, 39 insertions, 0 deletions

diff --git a/data/templates/ipsec/swanctl/profile.j2 b/data/templates/ipsec/swanctl/profile.j2
new file mode 100644
index 000000000..d4f417378
--- /dev/null
+++ b/data/templates/ipsec/swanctl/profile.j2
@@ -0,0 +1,39 @@
+{% macro conn(name, profile_conf, ike_group, esp_group) %}
+{# peer needs to reference the global IKE configuration for certain values #}
+{% set ike = ike_group[profile_conf.ike_group] %}
+{% set esp = esp_group[profile_conf.esp_group] %}
+{% if profile_conf.bind.tunnel is vyos_defined %}
+{%     for interface in profile_conf.bind.tunnel %}
+    dmvpn-{{ name }}-{{ interface }} {
+        proposals = {{ ike_group[profile_conf.ike_group] | get_esp_ike_cipher | join(',') }}
+        version = {{ ike.key_exchange[4:] if ike.key_exchange is vyos_defined else "0" }}
+        rekey_time = {{ ike.lifetime }}s
+        keyingtries = 0
+{%         if profile_conf.authentication.mode is vyos_defined('pre-shared-secret') %}
+        local {
+            auth = psk
+        }
+        remote {
+            auth = psk
+        }
+{%         endif %}
+        children {
+            dmvpn {
+                esp_proposals = {{ esp | get_esp_ike_cipher(ike) | join(',') }}
+                rekey_time = {{ esp.lifetime }}s
+                rand_time = 540s
+                local_ts = dynamic[gre]
+                remote_ts = dynamic[gre]
+                mode = {{ esp.mode }}
+{%         if ike.dead_peer_detection.action is vyos_defined %}
+                dpd_action = {{ ike.dead_peer_detection.action }}
+{%         endif %}
+{%         if esp.compression is vyos_defined('enable') %}
+                ipcomp = yes
+{%         endif %}
+            }
+        }
+    }
+{%     endfor %}
+{% endif %}
+{% endmacro %}