diff options
| author | Nataliia Solomko <natalirs1985@gmail.com> | 2026-09-17 16:25:14 +0300 |
|---|---|---|
| committer | Nataliia Solomko <natalirs1985@gmail.com> | 2026-09-17 17:50:20 +0300 |
| commit | 5fbfd47c8a43d1836d064226f0ffb8ec91406cce (patch) | |
| tree | c3afcb0d2a40947a262b2206b3e47c96359450b3 /smoketest/scripts/cli | |
| parent | c91d7eb13252306629243d9699c92e38a5a12a71 (diff) | |
| download | vyos-1x-5fbfd47c8a43d1836d064226f0ffb8ec91406cce.tar.gz vyos-1x-5fbfd47c8a43d1836d064226f0ffb8ec91406cce.zip | |
ipsec: T9320: Add deprecation warning for IKEv1 key-exchange
Diffstat (limited to 'smoketest/scripts/cli')
| -rwxr-xr-x | smoketest/scripts/cli/test_vpn_ipsec.py | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/smoketest/scripts/cli/test_vpn_ipsec.py b/smoketest/scripts/cli/test_vpn_ipsec.py index 314287df4..744486022 100755 --- a/smoketest/scripts/cli/test_vpn_ipsec.py +++ b/smoketest/scripts/cli/test_vpn_ipsec.py @@ -946,7 +946,11 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): # Passing the 'unique = never' for StrongSwan's `connections.<conn>.unique` parameter self.cli_set(base_path + ['disable-uniqreqids']) - self.cli_commit() + # T9320: an explicit IKEv1 key-exchange must raise a deprecation warning + out = self.cli_commit() + self.assertIn( + f'DEPRECATION WARNING: IKE group "{ike_group}" uses deprecated IKEv1', out + ) swanctl_conf = read_file(swanctl_file) self.assertConfigLine(swanctl_conf, 'proposals = aes256-sha1-prfsha1-modp1024') @@ -995,7 +999,14 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): self.cli_set(peer_base_path + ['vti', 'bind', vti]) self.cli_set(peer_base_path + ['vti', 'esp-group', esp_group]) - self.cli_commit() + # T9320: an in-use IKE group without a key-exchange still accepts + # incoming IKEv1 and must raise a deprecation warning + out = self.cli_commit() + self.assertIn( + f'DEPRECATION WARNING: IKE group "{ike_group}" has no key-exchange set\n' + 'and will still accept incoming deprecated IKEv1 connections.', + out, + ) swanctl_conf = read_file(swanctl_file) tmp = peer_ip.replace('.', '-') |