From 202238d8cec799a44f00bd8c95474e1f0653f822 Mon Sep 17 00:00:00 2001 From: xTITUSMAXIMUSX Date: Wed, 23 Sep 2026 19:06:40 -0500 Subject: ipsec: T9303: use ipsec-acceleration for VPP algo check T8262 renamed "vpp settings ipsec" to "vpp settings ipsec-acceleration". get_config() still probed the old path, so vpp_ipsec_exists was always False and incompatible IKE/ESP algorithms were accepted. Check the current CLI node and add a smoketest that 3des (ESP) and serpent128 (IKE) fail commit when VPP IPsec acceleration is enabled. --- src/conf_mode/vpn_ipsec.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'src') diff --git a/src/conf_mode/vpn_ipsec.py b/src/conf_mode/vpn_ipsec.py index be8eeca13..e1709f5f6 100755 --- a/src/conf_mode/vpn_ipsec.py +++ b/src/conf_mode/vpn_ipsec.py @@ -212,7 +212,8 @@ def get_config(config=None): _, vti = get_interface_dict(conf, ['interfaces', 'vti'], vti_interface) ipsec['vti_interface_dicts'][vti_interface] = vti - ipsec['vpp_ipsec_exists'] = conf.exists(['vpp', 'settings', 'ipsec']) + # T8262 renamed 'vpp settings ipsec' to 'vpp settings ipsec-acceleration' + ipsec['vpp_ipsec_exists'] = conf.exists(['vpp', 'settings', 'ipsec-acceleration']) return ipsec -- cgit v1.2.3