T8027: vpn: adding config for swanctl "send-cert always"

This setting seems to be required for various Apple clients to
connect to the IKEv2 IPSec VPN.

1 files changed, 17 insertions, 4 deletions

diff --git a/smoketest/scripts/cli/test_vpn_ipsec.py b/smoketest/scripts/cli/test_vpn_ipsec.py
index 4cb23fbc0..637e854a2 100755
--- a/smoketest/scripts/cli/test_vpn_ipsec.py
+++ b/smoketest/scripts/cli/test_vpn_ipsec.py
@@ -1151,10 +1151,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase):
         for line in swanctl_lines:
             self.assertIn(line, swanctl_conf)
 
-        swanctl_unexpected_lines = [
-            f'auth = eap-',
-            f'eap_id'
-        ]
+        swanctl_unexpected_lines = [f'auth = eap-', f'eap_id', f'send_cert =']
         for unexpected_line in swanctl_unexpected_lines:
             self.assertNotIn(unexpected_line, swanctl_conf)
 
@@ -1171,6 +1168,22 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase):
         self.assertTrue(os.path.exists(os.path.join(CA_PATH, f'{int_ca_name}.pem')))
         self.assertTrue(os.path.exists(os.path.join(CERT_PATH, f'{peer_name}.pem')))
 
+        # Add the always-send-cert config and observe the change
+        self.cli_set(
+            base_path
+            + [
+                'remote-access',
+                'connection',
+                conn_name,
+                'authentication',
+                'always-send-cert',
+            ]
+        )
+        self.cli_commit()
+
+        swanctl_conf = read_file(swanctl_file)
+        self.assertIn(f'send_cert = always', swanctl_conf)
+
         self.tearDownPKI()
 
     def test_remote_access_dhcp_fail_handling(self):