diff options
| author | Kyrylo Yatsenko <hedrok@gmail.com> | 2026-06-20 09:37:42 +0300 |
|---|---|---|
| committer | Kyrylo Yatsenko <hedrok@gmail.com> | 2026-06-20 09:59:00 +0300 |
| commit | e8611801c7f36d7942ed367c5cf0b0dfd08083d2 (patch) | |
| tree | 763f3bcf6f7a8820083575893891629fd9954f32 /python | |
| parent | 6c0fd99099a6251a12bc2287d5ba2ab115cd8015 (diff) | |
| download | vyos-1x-e8611801c7f36d7942ed367c5cf0b0dfd08083d2.tar.gz vyos-1x-e8611801c7f36d7942ed367c5cf0b0dfd08083d2.zip | |
T8097: strongswan: add CLI for ESN
Add CLI commands:
set vpn ipsec ike-group MyIKEGroup proposal 1 esn ESN-VALUE
set vpn ipsec esp-group MyESPGroup proposal 1 esn ESN-VALUE
Where ESN-VALUE can be one of:
* required: only establish connection using ESN
* optional: try using ESN, but if not available, accept non-ESN
* disabled (default): don't use ESN
StrongSwan 6.0.6 doesn't allow connections between proposal with
'-noesn' and without '-esn'/'-noesn'. To make it work as expected, use
two proposals for 'optional' and 'disabled':
* required: PROPOSAL-esn
* optional: PROPOSAL-esn-noesn,PROPOSAL
* disabled: PROPOSAL-noesn,PROPOSAL
Diffstat (limited to 'python')
| -rwxr-xr-x | python/vyos/template.py | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/python/vyos/template.py b/python/vyos/template.py index 8a624d989..91ef1baa8 100755 --- a/python/vyos/template.py +++ b/python/vyos/template.py @@ -527,6 +527,17 @@ def get_esp_ike_cipher(group_config, ike_group=None): group = get_first_ike_dh_group(ike_group) tmp += '-' + pfs_lut[group] + # For 'optional' and 'disabled' we need two values as + # proposal without '-esn'/'-noesn' is incompatible with + # proposals with any of them. + if 'esn' in proposal: + if proposal['esn'] == 'required': + tmp += '-esn' + elif proposal['esn'] == 'optional': + ciphers.append(tmp + '-esn-noesn') + elif proposal['esn'] == 'disabled': + ciphers.append(tmp + '-noesn') + ciphers.append(tmp) return ciphers |