T7168: Add IPsec XFRM netlink plugin and CLI

Add linux-xfrm-nl plugin
Add configuration commands for VPP IPsec

```
set vpp settings ipsec interface-type 'ipsec'
set vpp settings ipsec netlink batch-delay-ms '250'
set vpp settings ipsec netlink batch-size '150'
set vpp settings ipsec netlink rx-buffer-size '1024'
```

1 files changed, 25 insertions, 1 deletions

diff --git a/data/templates/vpp/startup.conf.j2 b/data/templates/vpp/startup.conf.j2
index 5cab34a97..cf10b6ce5 100644
--- a/data/templates/vpp/startup.conf.j2
+++ b/data/templates/vpp/startup.conf.j2
@@ -104,7 +104,15 @@ plugins {
     plugin geneve_plugin.so { enable }
     plugin gre_plugin.so { enable }
     plugin vxlan_plugin.so { enable }
-    plugin wireguard_plugin.so { enable }
+    # Secure
+    # plugin ikev2_plugin.so { enable }
+    # plugin dns_plugin.so { enable } # Probably required for FQDN peers
+{% if ipsec is vyos_defined %}
+    plugin crypto_ipsecmb_plugin.so { enable }
+    plugin crypto_native_plugin.so { enable }
+    plugin crypto_openssl_plugin.so { enable }
+{% endif %}
+    # plugin wireguard_plugin.so { enable }
 }
 
 linux-cp {
@@ -179,3 +187,19 @@ dpdk {
 {% endfor %}
     uio-bind-force
 }
+
+{% if ipsec is vyos_defined %}
+linux-xfrm-nl {
+     enable-route-mode-ipsec
+     interface {{ ipsec.interface_type }}
+{%     if ipsec.netlink.batch_delay_ms is vyos_defined %}
+     nl-batch-delay-ms {{ ipsec.netlink.batch_delay_ms }}
+{%     endif %}
+{%     if ipsec.netlink.batch_size is vyos_defined %}
+     nl-batch-size {{ ipsec.netlink.batch_size }}
+{%     endif %}
+{%     if ipsec.netlink.rx_buffer_size is vyos_defined %}
+     nl-rx-buffer-size {{ ipsec.netlink.rx_buffer_size }}
+{%     endif %}
+}
+{% endif %}