From 0db7521a96f3d314ec4914c72932cfbcced2dc98 Mon Sep 17 00:00:00 2001 From: rockfish-vyos <321823801+rockfish-vyos@users.noreply.github.com> Date: Mon, 14 Sep 2026 08:17:41 +0000 Subject: ipsec: T9254: split get_esp_ike_cipher() into get_esp_cipher() / get_ike_cipher() get_esp_ike_cipher() took an esn flag defaulting to True (ESP/CHILD_SA semantics), and every IKE_SA call site had to remember to pass esn=False. Nothing enforced that, so a future call site could reintroduce the ESN-in-IKE bug this task fixed. Following review feedback from hedrok, split it into two public filters: get_esp_cipher(group_config, ike_group=None) ESP/CHILD_SA, esn=True get_ike_cipher(group_config) IKE_SA, esn=False always The shared implementation moves to _get_esp_ike_cipher() (no register_filter), so a template can no longer call it directly and skip picking one of the two entry points. Updated call sites: peer.j2, profile.j2, remote_access.j2, l2tp.j2 (proposals -> get_ike_cipher, esp_proposals -> get_esp_cipher), and test_template.py. --- src/tests/test_template.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/tests/test_template.py b/src/tests/test_template.py index e2548602d..7ac396b68 100644 --- a/src/tests/test_template.py +++ b/src/tests/test_template.py @@ -184,11 +184,11 @@ class TestVyOSTemplate(TestCase): } for group_name, group_config in data['esp_group'].items(): - ciphers = vyos.template.get_esp_ike_cipher(group_config) + ciphers = vyos.template.get_esp_cipher(group_config) self.assertIn(ESP_DEFAULT, ','.join(ciphers)) for group_name, group_config in data['ike_group'].items(): - ciphers = vyos.template.get_esp_ike_cipher(group_config) + ciphers = vyos.template.get_ike_cipher(group_config) self.assertIn(IKEv2_DEFAULT, ','.join(ciphers)) def test_get_default_port(self): -- cgit v1.2.3