From 7897f8d216295b32626dc4d5604349812c592921 Mon Sep 17 00:00:00 2001
From: Viacheslav Hletenko <v.gletenko@vyos.io>
Date: Fri, 14 Feb 2025 15:59:59 +0000
Subject: T7168: Add IPsec XFRM netlink plugin and CLI

Add linux-xfrm-nl plugin
Add configuration commands for VPP IPsec

```
set vpp settings ipsec interface-type 'ipsec'
set vpp settings ipsec netlink batch-delay-ms '250'
set vpp settings ipsec netlink batch-size '150'
set vpp settings ipsec netlink rx-buffer-size '1024'
```
---
 data/templates/vpp/startup.conf.j2 | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

(limited to 'data')

diff --git a/data/templates/vpp/startup.conf.j2 b/data/templates/vpp/startup.conf.j2
index 5cab34a97..cf10b6ce5 100644
--- a/data/templates/vpp/startup.conf.j2
+++ b/data/templates/vpp/startup.conf.j2
@@ -104,7 +104,15 @@ plugins {
     plugin geneve_plugin.so { enable }
     plugin gre_plugin.so { enable }
     plugin vxlan_plugin.so { enable }
-    plugin wireguard_plugin.so { enable }
+    # Secure
+    # plugin ikev2_plugin.so { enable }
+    # plugin dns_plugin.so { enable } # Probably required for FQDN peers
+{% if ipsec is vyos_defined %}
+    plugin crypto_ipsecmb_plugin.so { enable }
+    plugin crypto_native_plugin.so { enable }
+    plugin crypto_openssl_plugin.so { enable }
+{% endif %}
+    # plugin wireguard_plugin.so { enable }
 }
 
 linux-cp {
@@ -179,3 +187,19 @@ dpdk {
 {% endfor %}
     uio-bind-force
 }
+
+{% if ipsec is vyos_defined %}
+linux-xfrm-nl {
+     enable-route-mode-ipsec
+     interface {{ ipsec.interface_type }}
+{%     if ipsec.netlink.batch_delay_ms is vyos_defined %}
+     nl-batch-delay-ms {{ ipsec.netlink.batch_delay_ms }}
+{%     endif %}
+{%     if ipsec.netlink.batch_size is vyos_defined %}
+     nl-batch-size {{ ipsec.netlink.batch_size }}
+{%     endif %}
+{%     if ipsec.netlink.rx_buffer_size is vyos_defined %}
+     nl-rx-buffer-size {{ ipsec.netlink.rx_buffer_size }}
+{%     endif %}
+}
+{% endif %}
-- 
cgit v1.2.3