From 673ec335b885ae1de8391dd8c48a5fe16b282db5 Mon Sep 17 00:00:00 2001
From: Giga Murphy <giga1699@gmail.com>
Date: Fri, 2 Jan 2026 01:04:38 +0000
Subject: T8136: IPSEC PPK Support

---
 .../include/ipsec/childless.xml.i                  | 29 ++++++++++++++
 interface-definitions/include/ipsec/ppk.xml.i      | 24 +++++++++++
 interface-definitions/vpn_ipsec.xml.in             | 46 +++++++++++++++++++++-
 3 files changed, 97 insertions(+), 2 deletions(-)
 create mode 100644 interface-definitions/include/ipsec/childless.xml.i
 create mode 100644 interface-definitions/include/ipsec/ppk.xml.i

(limited to 'interface-definitions')

diff --git a/interface-definitions/include/ipsec/childless.xml.i b/interface-definitions/include/ipsec/childless.xml.i
new file mode 100644
index 000000000..76ba8d548
--- /dev/null
+++ b/interface-definitions/include/ipsec/childless.xml.i
@@ -0,0 +1,29 @@
+<!-- include start from ipsec/childless.xml.i -->
+<leafNode name="childless">
+  <properties>
+    <help>Enable support for childless IKE SA initiation</help>
+    <completionHelp>
+      <list>allow prefer force never</list>
+    </completionHelp>
+    <valueHelp>
+      <format>allow</format>
+      <description>Accept childless IKE SA in responder mode. Create regular IKE SA in initiator mode</description>
+    </valueHelp>
+    <valueHelp>
+      <format>prefer</format>
+      <description>In both responder and initiator modes, accept and create childless IKE SA correspondingly</description>
+    </valueHelp>
+    <valueHelp>
+      <format>force</format>
+      <description>Require the use of childless IKE SA in both responder and initiator modes</description>
+    </valueHelp>
+    <valueHelp>
+      <format>never</format>
+      <description>Disable support for childless IKE SAs when acting as a responder</description>
+    </valueHelp>
+    <constraint>
+      <regex>(allow|prefer|force|never)</regex>
+    </constraint>
+  </properties>
+</leafNode>
+<!-- include end -->
diff --git a/interface-definitions/include/ipsec/ppk.xml.i b/interface-definitions/include/ipsec/ppk.xml.i
new file mode 100644
index 000000000..bd420766c
--- /dev/null
+++ b/interface-definitions/include/ipsec/ppk.xml.i
@@ -0,0 +1,24 @@
+<!-- include start from ipsec/ppk.xml.i -->
+<node name="ppk">
+  <properties>
+    <help>Post-quantum preshared key</help>
+  </properties>
+  <children>
+    <leafNode name="id">
+      <properties>
+        <help>Post-quantum preshared key for this connection</help>
+        <valueHelp>
+          <format>txt</format>
+          <description>ID used for PPK</description>
+        </valueHelp>
+      </properties>
+    </leafNode>
+    <leafNode name="required">
+      <properties>
+        <help>Require a valid PPK for connection to establish</help>
+        <valueless/>
+      </properties>
+    </leafNode>
+  </children>
+</node>
+<!-- include end -->
diff --git a/interface-definitions/vpn_ipsec.xml.in b/interface-definitions/vpn_ipsec.xml.in
index a2721e2a1..ffdfeaedf 100644
--- a/interface-definitions/vpn_ipsec.xml.in
+++ b/interface-definitions/vpn_ipsec.xml.in
@@ -45,10 +45,48 @@
                     <properties>
                       <help>Secret type</help>
                       <completionHelp>
-                        <list>base64 plaintext</list>
+                        <list>base64 hex plaintext</list>
                       </completionHelp>
                       <constraint>
-                        <regex>(base64|plaintext)</regex>
+                        <regex>(base64|hex|plaintext)</regex>
+                      </constraint>
+                    </properties>
+                    <defaultValue>plaintext</defaultValue>
+                  </leafNode>
+                </children>
+              </tagNode>
+              <tagNode name="ppk">
+                <properties>
+                  <help>Post-quantum preshared key name</help>
+                </properties>
+                <children>
+                  <leafNode name="id">
+                    <properties>
+                      <help>ID for PPK</help>
+                      <valueHelp>
+                        <format>txt</format>
+                        <description>ID used for PPK</description>
+                      </valueHelp>
+                      <multi/>
+                    </properties>
+                  </leafNode>
+                  <leafNode name="secret">
+                    <properties>
+                      <help>Post-quantum preshared secret key</help>
+                      <valueHelp>
+                        <format>txt</format>
+                        <description>Post-quantum preshared secret key</description>
+                      </valueHelp>
+                    </properties>
+                  </leafNode>
+                  <leafNode name="secret-type">
+                    <properties>
+                      <help>Secret type</help>
+                      <completionHelp>
+                        <list>base64 hex plaintext</list>
+                      </completionHelp>
+                      <constraint>
+                        <regex>(base64|hex|plaintext)</regex>
                       </constraint>
                     </properties>
                     <defaultValue>plaintext</defaultValue>
@@ -896,9 +934,11 @@
                         </properties>
                         <defaultValue>x509</defaultValue>
                       </leafNode>
+                      #include <include/ipsec/ppk.xml.i>
                       #include <include/ipsec/authentication-pre-shared-secret.xml.i>
                     </children>
                   </node>
+                  #include <include/ipsec/childless.xml.i>
                   #include <include/generic-description.xml.i>
                   #include <include/generic-disable-node.xml.i>
                   #include <include/ipsec/esp-group.xml.i>
@@ -1113,6 +1153,7 @@
                     </properties>
                     <children>
                       #include <include/ipsec/authentication-id.xml.i>
+                      #include <include/ipsec/ppk.xml.i>
                       #include <include/ipsec/authentication-rsa.xml.i>
                       #include <include/ipsec/authentication-x509.xml.i>
                       <leafNode name="mode">
@@ -1156,6 +1197,7 @@
                       </leafNode>
                     </children>
                   </node>
+                  #include <include/ipsec/childless.xml.i>
                   <leafNode name="connection-type">
                     <properties>
                       <help>Connection type</help>
-- 
cgit v1.2.3