From e8611801c7f36d7942ed367c5cf0b0dfd08083d2 Mon Sep 17 00:00:00 2001 From: Kyrylo Yatsenko Date: Sat, 20 Jun 2026 09:37:42 +0300 Subject: T8097: strongswan: add CLI for ESN Add CLI commands: set vpn ipsec ike-group MyIKEGroup proposal 1 esn ESN-VALUE set vpn ipsec esp-group MyESPGroup proposal 1 esn ESN-VALUE Where ESN-VALUE can be one of: * required: only establish connection using ESN * optional: try using ESN, but if not available, accept non-ESN * disabled (default): don't use ESN StrongSwan 6.0.6 doesn't allow connections between proposal with '-noesn' and without '-esn'/'-noesn'. To make it work as expected, use two proposals for 'optional' and 'disabled': * required: PROPOSAL-esn * optional: PROPOSAL-esn-noesn,PROPOSAL * disabled: PROPOSAL-noesn,PROPOSAL --- python/vyos/template.py | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'python') diff --git a/python/vyos/template.py b/python/vyos/template.py index 8a624d989..91ef1baa8 100755 --- a/python/vyos/template.py +++ b/python/vyos/template.py @@ -527,6 +527,17 @@ def get_esp_ike_cipher(group_config, ike_group=None): group = get_first_ike_dh_group(ike_group) tmp += '-' + pfs_lut[group] + # For 'optional' and 'disabled' we need two values as + # proposal without '-esn'/'-noesn' is incompatible with + # proposals with any of them. + if 'esn' in proposal: + if proposal['esn'] == 'required': + tmp += '-esn' + elif proposal['esn'] == 'optional': + ciphers.append(tmp + '-esn-noesn') + elif proposal['esn'] == 'disabled': + ciphers.append(tmp + '-noesn') + ciphers.append(tmp) return ciphers -- cgit v1.2.3