From 2dc91c0a96c3d3212387be02b80c58fce7c68bd8 Mon Sep 17 00:00:00 2001 From: Oleksandr Kuchmystyi Date: Fri, 28 Nov 2025 17:52:59 +0300 Subject: ipsec: T7594: Rename `respond` connection-type in IPSec peer settings to `trap` The previous 'connection-type respond' option in IPsec site-to-site peers was misleading - instead of passively waiting for peer initiation, it would initiate negotiation when matching traffic appeared, potentially causing SA duplication and renegotiation loops. --- src/migration-scripts/ipsec/13-to-14 | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 src/migration-scripts/ipsec/13-to-14 (limited to 'src/migration-scripts/ipsec') diff --git a/src/migration-scripts/ipsec/13-to-14 b/src/migration-scripts/ipsec/13-to-14 new file mode 100644 index 000000000..f676a09be --- /dev/null +++ b/src/migration-scripts/ipsec/13-to-14 @@ -0,0 +1,33 @@ +# Copyright VyOS maintainers and contributors +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public License +# along with this library. If not, see . + +# Rename connection-type 'respond' to 'trap' (T7594): +# vpn ipsec site-to-site peer connection-type respond -> trap + +from vyos.configtree import ConfigTree + +base = ['vpn', 'ipsec', 'site-to-site'] + +def migrate(config: ConfigTree) -> None: + # If IPsec config does not exist, nothing to do + if not config.exists(base): + return + + # Iterate through defined peers + for peer in config.list_nodes(base + ['peer']): + path = base + ['peer', peer, 'connection-type'] + if config.value_exists(path, 'respond'): + # Replace old behavior with explicit passive type + config.set(path, 'trap', replace=True) -- cgit v1.2.3