From e8611801c7f36d7942ed367c5cf0b0dfd08083d2 Mon Sep 17 00:00:00 2001
From: Kyrylo Yatsenko <hedrok@gmail.com>
Date: Sat, 20 Jun 2026 09:37:42 +0300
Subject: T8097: strongswan: add CLI for ESN

Add CLI commands:

set vpn ipsec ike-group MyIKEGroup proposal 1 esn ESN-VALUE
set vpn ipsec esp-group MyESPGroup proposal 1 esn ESN-VALUE

Where ESN-VALUE can be one of:

* required: only establish connection using ESN
* optional: try using ESN, but if not available, accept non-ESN
* disabled (default): don't use ESN

StrongSwan 6.0.6 doesn't allow connections between proposal with
'-noesn' and without '-esn'/'-noesn'. To make it work as expected, use
two proposals for 'optional' and 'disabled':

* required: PROPOSAL-esn
* optional: PROPOSAL-esn-noesn,PROPOSAL
* disabled: PROPOSAL-noesn,PROPOSAL
---
 interface-definitions/include/vpn-ipsec-esn.xml.i | 26 +++++++++++++++++++++++
 interface-definitions/vpn_ipsec.xml.in            |  2 ++
 2 files changed, 28 insertions(+)
 create mode 100644 interface-definitions/include/vpn-ipsec-esn.xml.i

(limited to 'interface-definitions')

diff --git a/interface-definitions/include/vpn-ipsec-esn.xml.i b/interface-definitions/include/vpn-ipsec-esn.xml.i
new file mode 100644
index 000000000..b4faa25d5
--- /dev/null
+++ b/interface-definitions/include/vpn-ipsec-esn.xml.i
@@ -0,0 +1,26 @@
+<!-- include start from vpn-ipsec-esn.xml.i -->
+<leafNode name="esn">
+  <properties>
+    <help>Extended Sequence Number (ESN)</help>
+    <completionHelp>
+      <list>optional required disabled</list>
+    </completionHelp>
+    <valueHelp>
+      <format>optional</format>
+      <description>Prefer ESN, but allow 32-bit sequence numbers</description>
+    </valueHelp>
+    <valueHelp>
+      <format>required</format>
+      <description>ESN enabled, accept 64-bit sequence numbers only</description>
+    </valueHelp>
+    <valueHelp>
+      <format>disabled</format>
+      <description>ESN disabled, accept 32-bit sequence numbers only</description>
+    </valueHelp>
+    <constraint>
+      <regex>(optional|required|disabled)</regex>
+    </constraint>
+  </properties>
+  <defaultValue>disabled</defaultValue>
+</leafNode>
+<!-- include end -->
diff --git a/interface-definitions/vpn_ipsec.xml.in b/interface-definitions/vpn_ipsec.xml.in
index ee8340a74..5ae9a8d64 100644
--- a/interface-definitions/vpn_ipsec.xml.in
+++ b/interface-definitions/vpn_ipsec.xml.in
@@ -294,6 +294,7 @@
                 <children>
                   #include <include/vpn-ipsec-encryption.xml.i>
                   #include <include/vpn-ipsec-hash.xml.i>
+                  #include <include/vpn-ipsec-esn.xml.i>
                 </children>
               </tagNode>
             </children>
@@ -598,6 +599,7 @@
                   </leafNode>
                   #include <include/vpn-ipsec-encryption.xml.i>
                   #include <include/vpn-ipsec-hash.xml.i>
+                  #include <include/vpn-ipsec-esn.xml.i>
                 </children>
               </tagNode>
             </children>
-- 
cgit v1.2.3