From 5fbfd47c8a43d1836d064226f0ffb8ec91406cce Mon Sep 17 00:00:00 2001 From: Nataliia Solomko Date: Thu, 17 Sep 2026 16:25:14 +0300 Subject: ipsec: T9320: Add deprecation warning for IKEv1 key-exchange --- smoketest/scripts/cli/test_vpn_ipsec.py | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) (limited to 'smoketest/scripts/cli') diff --git a/smoketest/scripts/cli/test_vpn_ipsec.py b/smoketest/scripts/cli/test_vpn_ipsec.py index 314287df4..744486022 100755 --- a/smoketest/scripts/cli/test_vpn_ipsec.py +++ b/smoketest/scripts/cli/test_vpn_ipsec.py @@ -946,7 +946,11 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): # Passing the 'unique = never' for StrongSwan's `connections..unique` parameter self.cli_set(base_path + ['disable-uniqreqids']) - self.cli_commit() + # T9320: an explicit IKEv1 key-exchange must raise a deprecation warning + out = self.cli_commit() + self.assertIn( + f'DEPRECATION WARNING: IKE group "{ike_group}" uses deprecated IKEv1', out + ) swanctl_conf = read_file(swanctl_file) self.assertConfigLine(swanctl_conf, 'proposals = aes256-sha1-prfsha1-modp1024') @@ -995,7 +999,14 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): self.cli_set(peer_base_path + ['vti', 'bind', vti]) self.cli_set(peer_base_path + ['vti', 'esp-group', esp_group]) - self.cli_commit() + # T9320: an in-use IKE group without a key-exchange still accepts + # incoming IKEv1 and must raise a deprecation warning + out = self.cli_commit() + self.assertIn( + f'DEPRECATION WARNING: IKE group "{ike_group}" has no key-exchange set\n' + 'and will still accept incoming deprecated IKEv1 connections.', + out, + ) swanctl_conf = read_file(swanctl_file) tmp = peer_ip.replace('.', '-') -- cgit v1.2.3