diff options
| -rw-r--r-- | interface-definitions/include/vpn-ipsec-esn.xml.i | 26 | ||||
| -rw-r--r-- | interface-definitions/vpn_ipsec.xml.in | 2 | ||||
| -rwxr-xr-x | python/vyos/template.py | 11 |
3 files changed, 39 insertions, 0 deletions
diff --git a/interface-definitions/include/vpn-ipsec-esn.xml.i b/interface-definitions/include/vpn-ipsec-esn.xml.i new file mode 100644 index 000000000..b4faa25d5 --- /dev/null +++ b/interface-definitions/include/vpn-ipsec-esn.xml.i @@ -0,0 +1,26 @@ +<!-- include start from vpn-ipsec-esn.xml.i --> +<leafNode name="esn"> + <properties> + <help>Extended Sequence Number (ESN)</help> + <completionHelp> + <list>optional required disabled</list> + </completionHelp> + <valueHelp> + <format>optional</format> + <description>Prefer ESN, but allow 32-bit sequence numbers</description> + </valueHelp> + <valueHelp> + <format>required</format> + <description>ESN enabled, accept 64-bit sequence numbers only</description> + </valueHelp> + <valueHelp> + <format>disabled</format> + <description>ESN disabled, accept 32-bit sequence numbers only</description> + </valueHelp> + <constraint> + <regex>(optional|required|disabled)</regex> + </constraint> + </properties> + <defaultValue>disabled</defaultValue> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/vpn_ipsec.xml.in b/interface-definitions/vpn_ipsec.xml.in index ee8340a74..5ae9a8d64 100644 --- a/interface-definitions/vpn_ipsec.xml.in +++ b/interface-definitions/vpn_ipsec.xml.in @@ -294,6 +294,7 @@ <children> #include <include/vpn-ipsec-encryption.xml.i> #include <include/vpn-ipsec-hash.xml.i> + #include <include/vpn-ipsec-esn.xml.i> </children> </tagNode> </children> @@ -598,6 +599,7 @@ </leafNode> #include <include/vpn-ipsec-encryption.xml.i> #include <include/vpn-ipsec-hash.xml.i> + #include <include/vpn-ipsec-esn.xml.i> </children> </tagNode> </children> diff --git a/python/vyos/template.py b/python/vyos/template.py index 8a624d989..91ef1baa8 100755 --- a/python/vyos/template.py +++ b/python/vyos/template.py @@ -527,6 +527,17 @@ def get_esp_ike_cipher(group_config, ike_group=None): group = get_first_ike_dh_group(ike_group) tmp += '-' + pfs_lut[group] + # For 'optional' and 'disabled' we need two values as + # proposal without '-esn'/'-noesn' is incompatible with + # proposals with any of them. + if 'esn' in proposal: + if proposal['esn'] == 'required': + tmp += '-esn' + elif proposal['esn'] == 'optional': + ciphers.append(tmp + '-esn-noesn') + elif proposal['esn'] == 'disabled': + ciphers.append(tmp + '-noesn') + ciphers.append(tmp) return ciphers |