ipsec: T7594: Rename `respond` connection-type in IPSec peer settings to `trap`

The previous 'connection-type respond' option in IPsec site-to-site peers
was misleading - instead of passively waiting for peer initiation, it would
initiate negotiation when matching traffic appeared, potentially causing
SA duplication and renegotiation loops.

1 files changed, 33 insertions, 0 deletions

diff --git a/src/migration-scripts/ipsec/13-to-14 b/src/migration-scripts/ipsec/13-to-14
new file mode 100644
index 000000000..f676a09be
--- /dev/null
+++ b/src/migration-scripts/ipsec/13-to-14
@@ -0,0 +1,33 @@
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# Rename connection-type 'respond' to 'trap' (T7594):
+#   vpn ipsec site-to-site peer <name> connection-type respond -> trap
+
+from vyos.configtree import ConfigTree
+
+base = ['vpn', 'ipsec', 'site-to-site']
+
+def migrate(config: ConfigTree) -> None:
+    # If IPsec config does not exist, nothing to do
+    if not config.exists(base):
+        return
+
+    # Iterate through defined peers
+    for peer in config.list_nodes(base + ['peer']):
+        path = base + ['peer', peer, 'connection-type']
+        if config.value_exists(path, 'respond'):
+            # Replace old behavior with explicit passive type
+            config.set(path, 'trap', replace=True)