diff options
| author | rockfish-vyos <321823801+rockfish-vyos@users.noreply.github.com> | 2026-09-14 08:17:41 +0000 |
|---|---|---|
| committer | rockfish-vyos <321823801+rockfish-vyos@users.noreply.github.com> | 2026-09-14 08:19:12 +0000 |
| commit | 0db7521a96f3d314ec4914c72932cfbcced2dc98 (patch) | |
| tree | 1a8e2155f9de42c54c42148f4b44d0b2070b545e /src | |
| parent | 712c1520f8ebfecf3bc35d9aca21d73d7188f0c2 (diff) | |
| download | vyos-1x-0db7521a96f3d314ec4914c72932cfbcced2dc98.tar.gz vyos-1x-0db7521a96f3d314ec4914c72932cfbcced2dc98.zip | |
ipsec: T9254: split get_esp_ike_cipher() into get_esp_cipher() / get_ike_cipher()
get_esp_ike_cipher() took an esn flag defaulting to True (ESP/CHILD_SA
semantics), and every IKE_SA call site had to remember to pass
esn=False. Nothing enforced that, so a future call site could reintroduce
the ESN-in-IKE bug this task fixed.
Following review feedback from hedrok, split it into two public filters:
get_esp_cipher(group_config, ike_group=None) ESP/CHILD_SA, esn=True
get_ike_cipher(group_config) IKE_SA, esn=False always
The shared implementation moves to _get_esp_ike_cipher() (no
register_filter), so a template can no longer call it directly and
skip picking one of the two entry points.
Updated call sites: peer.j2, profile.j2, remote_access.j2, l2tp.j2
(proposals -> get_ike_cipher, esp_proposals -> get_esp_cipher), and
test_template.py.
Diffstat (limited to 'src')
| -rw-r--r-- | src/tests/test_template.py | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/tests/test_template.py b/src/tests/test_template.py index e2548602d..7ac396b68 100644 --- a/src/tests/test_template.py +++ b/src/tests/test_template.py @@ -184,11 +184,11 @@ class TestVyOSTemplate(TestCase): } for group_name, group_config in data['esp_group'].items(): - ciphers = vyos.template.get_esp_ike_cipher(group_config) + ciphers = vyos.template.get_esp_cipher(group_config) self.assertIn(ESP_DEFAULT, ','.join(ciphers)) for group_name, group_config in data['ike_group'].items(): - ciphers = vyos.template.get_esp_ike_cipher(group_config) + ciphers = vyos.template.get_ike_cipher(group_config) self.assertIn(IKEv2_DEFAULT, ','.join(ciphers)) def test_get_default_port(self): |