ipsec: T9320: Add deprecation warning for IKEv1 key-exchange

1 files changed, 42 insertions, 1 deletions

diff --git a/src/conf_mode/vpn_ipsec.py b/src/conf_mode/vpn_ipsec.py
index be8eeca13..24220c435 100755
--- a/src/conf_mode/vpn_ipsec.py
+++ b/src/conf_mode/vpn_ipsec.py
@@ -25,6 +25,7 @@ from ipaddress import ip_address
 from netaddr import IPNetwork
 from netaddr import IPRange
 
+from vyos.base import DeprecationWarning
 from vyos.config import Config
 from vyos.config import config_dict_merge
 from vyos.configdep import set_dependents
@@ -298,7 +299,47 @@ def verify(ipsec):
     # need to use a pseudo-random function (PRF) with an authenticated encryption algorithm.
     # If a hash algorithm is defined then it will be mapped to an equivalent PRF
     if 'ike_group' in ipsec:
-        for _, ike_config in ipsec['ike_group'].items():
+        # T9320: IKEv1 is deprecated and will be removed in a future StrongSwan
+        # release. Collect the IKE groups actually bound to a connection so we
+        # can also warn about groups without an explicit key-exchange: those
+        # propose IKEv2 when initiating but still accept IKEv1 when acting as a
+        # responder.
+        used_ike_groups = set()
+
+        l2tp_ike_group = dict_search('l2tp.ike_group', ipsec)
+        if l2tp_ike_group:
+            used_ike_groups.add(l2tp_ike_group)
+
+        for profile_conf in (ipsec.get('profile') or {}).values():
+            if 'ike_group' in profile_conf:
+                used_ike_groups.add(profile_conf['ike_group'])
+
+        for ra_conf in (dict_search('remote_access.connection', ipsec) or {}).values():
+            if 'ike_group' in ra_conf:
+                used_ike_groups.add(ra_conf['ike_group'])
+
+        for peer_conf in (dict_search('site_to_site.peer', ipsec) or {}).values():
+            if 'ike_group' in peer_conf:
+                used_ike_groups.add(peer_conf['ike_group'])
+
+        for ike_name, ike_config in ipsec['ike_group'].items():
+            # T9320: warn about the upcoming IKEv1 removal in StrongSwan.
+            key_exchange = ike_config.get('key_exchange')
+            if key_exchange == 'ikev1':
+                # Explicit IKEv1: the connection will stop working once
+                # StrongSwan removes IKEv1 support.
+                DeprecationWarning(
+                    f'IKE group "{ike_name}" uses deprecated IKEv1, which will be '
+                    'removed in the future. Please migrate this configuration to IKEv2.'
+                )
+            elif key_exchange is None and ike_name in used_ike_groups:
+                # T9320: without an explicit key-exchange the group still
+                # accepts incoming IKEv1 connections when acting as a responder.
+                DeprecationWarning(
+                    f'IKE group "{ike_name}" has no key-exchange set and will still '
+                    'accept incoming deprecated IKEv1 connections. IKEv1 will be '
+                    'removed in the future; please set key-exchange to IKEv2.'
+                )
             for proposal, proposal_config in ike_config.get('proposal', {}).items():
                 if 'encryption' in proposal_config and 'prf' not in proposal_config:
                     # list of hash algorithms that cannot be mapped to an equivalent PRF