Merge pull request #4616 from hedrok/T7489-fix-output-ipsec-passthrough

T7489: Fix output state of ipsec passthrough child

1 files changed, 12 insertions, 3 deletions

diff --git a/src/op_mode/ipsec.py b/src/op_mode/ipsec.py
index 649e4d095..4ff035416 100755
--- a/src/op_mode/ipsec.py
+++ b/src/op_mode/ipsec.py
@@ -230,17 +230,25 @@ def _get_parent_sa_state(connection_name: str, data: list) -> str:
     return ike_state
 
 
-def _get_child_sa_state(connection_name: str, tunnel_name: str, data: list) -> str:
+def _get_child_sa_state(
+    connection_name: str, tunnel_name: str, data: list, mode: str
+) -> str:
     """Get child SA state by connection and tunnel name
 
     Args:
         connection_name (str): Connection name
         tunnel_name (str): Tunnel name
         data (list): List of current SAs from vici
+        mode (str): Mode of child from vici list_connections
 
     Returns:
-        str: `up` if child SA state is 'installed' otherwise `down`
+        str: `up` if child SA state is 'installed' or child is passthrough
+             otherwise `down`
     """
+    # passthrough child (trap mode) has 'PASS' mode and is always up,
+    # but has no sa, so is not present in list_sas (data)
+    if mode == 'PASS':
+        return 'up'
     child_sa = 'down'
     if not data:
         return child_sa
@@ -330,7 +338,8 @@ def _get_raw_data_connections(list_connections: list, list_sas: list) -> list:
             base_list['children'] = []
             children = conn_conf['children']
             for tunnel, tun_options in children.items():
-                state = _get_child_sa_state(connection, tunnel, list_sas)
+                mode = tun_options.get('mode')
+                state = _get_child_sa_state(connection, tunnel, list_sas, mode)
                 local_ts = tun_options.get('local-ts')
                 remote_ts = tun_options.get('remote-ts')
                 dpd_action = tun_options.get('dpd_action')