ipsec: T9254: split get_esp_ike_cipher() into get_esp_cipher() / get_ike_cipher()

get_esp_ike_cipher() took an esn flag defaulting to True (ESP/CHILD_SA
semantics), and every IKE_SA call site had to remember to pass
esn=False. Nothing enforced that, so a future call site could reintroduce
the ESN-in-IKE bug this task fixed.

Following review feedback from hedrok, split it into two public filters:

  get_esp_cipher(group_config, ike_group=None)  ESP/CHILD_SA, esn=True
  get_ike_cipher(group_config)                  IKE_SA, esn=False always

The shared implementation moves to _get_esp_ike_cipher() (no
register_filter), so a template can no longer call it directly and
skip picking one of the two entry points.

Updated call sites: peer.j2, profile.j2, remote_access.j2, l2tp.j2
(proposals -> get_ike_cipher, esp_proposals -> get_esp_cipher), and
test_template.py.

1 files changed, 22 insertions, 2 deletions

diff --git a/python/vyos/template.py b/python/vyos/template.py
index 1233710f2..8d861096b 100755
--- a/python/vyos/template.py
+++ b/python/vyos/template.py
@@ -482,8 +482,7 @@ def get_first_ike_dh_group(ike_group):
                 return 'dh-group' + proposal['dh_group']
     return 'dh-group2' # Fallback on dh-group2
 
-@register_filter('get_esp_ike_cipher')
-def get_esp_ike_cipher(group_config, ike_group=None, esn=True):
+def _get_esp_ike_cipher(group_config, ike_group=None, esn=True):
     """Render strongSwan proposal strings.
 
     esn=True  : ESP/CHILD_SA proposals, where ESN transforms are meaningful
@@ -492,6 +491,10 @@ def get_esp_ike_cipher(group_config, ike_group=None, esn=True):
                 IKE_SA proposal. Emitting it there breaks interoperability
                 with implementations that reject the malformed payload
                 without replying at all (observed with Cisco FTD, T9254).
+
+    Not registered as a filter directly: callers must go through
+    get_esp_cipher() or get_ike_cipher() so esn can't be left at its
+    default where an IKE cipher is needed.
     """
     pfs_lut = {
         'dh-group1'  : 'modp768',
@@ -555,6 +558,23 @@ def get_esp_ike_cipher(group_config, ike_group=None, esn=True):
             ciphers.append(tmp)
     return ciphers
 
+
+@register_filter('get_esp_cipher')
+def get_esp_cipher(group_config, ike_group=None):
+    """ESP/CHILD_SA proposals, where ESN transforms are meaningful."""
+    return _get_esp_ike_cipher(group_config, ike_group=ike_group, esn=True)
+
+
+@register_filter('get_ike_cipher')
+def get_ike_cipher(group_config):
+    """IKE_SA proposals. ESN is a CHILD_SA transform (RFC 7296 section
+    3.3.2, Transform Type 5) and has no meaning in an IKE_SA proposal.
+    Emitting it there breaks interoperability with implementations that
+    reject the malformed payload without replying at all (observed with
+    Cisco FTD, T9254).
+    """
+    return _get_esp_ike_cipher(group_config, esn=False)
+
 @register_filter('get_uuid')
 def get_uuid(seed):
     """ Get interface IP addresses"""