T8136: IPSEC PPK Support #4930

giga1699 · 2026-01-02T01:07:25Z

Change summary

Adds support for IKEv2 post-quantum preshared keys

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Code style update (formatting, renaming)
Refactoring (no functional changes)
Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
Other (please describe):

Related Task(s)

https://vyos.dev/T8136

Related PR(s)

vyos/vyos-documentation#1733

How to test / Smoketest result

test_site_to_site_nist_800_77_cnsa_1_with_ppk (__main__.TestVPNIPsec.test_site_to_site_nist_800_77_cnsa_1_with_ppk) ... ok

----------------------------------------------------------------------
Ran 1 test in 3.671s

OK

Checklist:

I have read the CONTRIBUTING document
I have linked this PR to one or more Phabricator Task(s)
I have run the components SMOKETESTS if applicable
My commit headlines contain a valid Task id
My change requires a change to the documentation
I have updated the documentation accordingly

github-actions · 2026-01-02T01:07:37Z

👍
No issues in PR Title / Commit Title

sarthurdev

This is looking good, can you extend ipsec smoketests for the new use cases?

giga1699 · 2026-01-03T15:25:56Z

I was going to make an attempt to write a smoke test. It’ll be my first run at writing a smoketest.

I have already tested against known working strongSwan configs. I’ll take those tests to put into smoketest and update.

I’m also planning to put together the documentation PR. Just haven’t gotten to that yet.

I’ll update the initial PR comment to reflect these updates when complete, and take this out of draft.

giga1699 · 2026-01-03T20:28:33Z

Added relevant smoketest, and completed documentation update. I think this should be ready to go.

sarthurdev

Thanks for the smoketest.

Just needs couple extra steps for config validation and XML deduplication.

interface-definitions/vpn_ipsec.xml.in

giga1699 · 2026-01-10T00:40:59Z

Much appreciated for catching those items. It got me thinking about some additional error checking.

I added in that PPK IDs need to be unique, so it now checks that all IDs are unique. Since I had to gather all the IDs for that check, the verify() also confirms that a PPK ID used in a connection is actually defined in the authentication config.

It might be useful to replicate that check for PSKs. I'm happy to open a new task and take care of that if it would be helpful.

Branch was also rebased to current.

giga1699 · 2026-01-12T15:03:51Z

src/conf_mode/vpn_ipsec.py

+                for ppkID in ppk_config['id']:
+                    if ppkID in ppk_ids:
+                        raise ConfigError(f'Authentication PPK "{ppk}" has duplicate ID "{ppkID}" from another PPK. IDs should be unique.')


In my testing if you use the same ID for multiple PPKs, it seems like strongSwan will only use the last loaded PPK for that ID. That is why I put in a check. The ID needs not be an IP address, it is a string that is passed in the IKE phase 1 to let the other side know I'm using key XX. If the receiving side has a key with that same key ID, then it will use that secret to try and establish the SA.

giga1699 · 2026-01-12T15:17:20Z

Removed the check in the connection configurations to confirm that a PPK ID was defined in the authentication configuration. This allows an operator to define a wildcard match for the PPK ID, as referenced in the strongSwan example PPK configuration.

interface-definitions/include/ipsec/childless.xml.i

sever-sever

Add the ability to use PPK ID and secrets for IPsec connections

alexandr-san4ez

Please also fix linter errors for your changes.

src/conf_mode/vpn_ipsec.py

alexandr-san4ez

Post-quantum preshared key support well implemented and ready to merge.

vyos@vyos:~$ /usr/libexec/vyos/tests/smoke/cli/test_vpn_ipsec.py
...
test_site_to_site_nist_800_77_cnsa_1_with_ppk (__main__.TestVPNIPsec.test_site_to_site_nist_800_77_cnsa_1_with_ppk) ... ok
...
----------------------------------------------------------------------
Ran 20 tests in 101.409s
OK

github-actions · 2026-01-13T12:09:32Z

CI integration 👍 passed!

Details

CI logs

CLI Smoketests 👍 passed
CLI Smoketests (interfaces only) 👍 passed
Config tests 👍 passed
RAID1 tests 👍 passed
CLI Smoketests VPP 👍 passed
Config tests VPP 👍 passed
TPM tests 👍 passed

sarthurdev

Requested changes addressed, code looks good, adds smoketest coverage. Locally verified CLI and resulting strongswan config/instance.

dmbaturin

The implementation seems sensible but I left a few suggestions.

dmbaturin · 2026-01-20T12:55:41Z

interface-definitions/include/ipsec/childless.xml.i

+<!-- include start from ipsec/childless.xml.i -->
+<leafNode name="childless">
+  <properties>
+    <help>Enable support for childless IKE_SA initiation</help>


Suggested change

<help>Enable support for childless IKE_SA initiation</help>

<help>Enable support for childless IKE SA initiation</help>

I don't think there should be an underscore here, just a space.

dmbaturin · 2026-01-20T12:56:00Z

interface-definitions/include/ipsec/childless.xml.i

+    </completionHelp>
+    <valueHelp>
+      <format>allow</format>
+      <description>Responder will allow childless IKE_SA, but initiator will not create childless connection</description>


Suggested change

<description>Responder will allow childless IKE_SA, but initiator will not create childless connection</description>

<description>Responder will allow childless IKE SA, but initiator will not create childless connections</description>

dmbaturin · 2026-01-20T12:56:23Z

interface-definitions/include/ipsec/childless.xml.i

+    </valueHelp>
+    <valueHelp>
+      <format>prefer</format>
+      <description>Responder will allow childless IKE_SA, and initiator will make childless connection if supported by responder</description>


Suggested change

<description>Responder will allow childless IKE_SA, and initiator will make childless connection if supported by responder</description>

<description>Responder will allow childless IKE SA, and initiator will make childless connections if supported by responder</description>

dmbaturin · 2026-01-20T12:56:35Z

interface-definitions/include/ipsec/childless.xml.i

+    </valueHelp>
+    <valueHelp>
+      <format>force</format>
+      <description>Require the use of childless IKE_SA</description>


Suggested change

<description>Require the use of childless IKE_SA</description>

<description>Require the use of childless IKE SA</description>

dmbaturin · 2026-01-20T12:56:53Z

interface-definitions/include/ipsec/childless.xml.i

+    </valueHelp>
+    <valueHelp>
+      <format>never</format>
+      <description>Disable support for childless IKE_SAs as responder</description>


Suggested change

<description>Disable support for childless IKE_SAs as responder</description>

<description>Disable support for childless IKE SAs as responder</description>

dmbaturin · 2026-01-20T13:07:19Z

src/conf_mode/vpn_ipsec.py

+                    ike = ra_conf['ike_group']
+                    if dict_search(f'ike_group.{ike}.key_exchange', ipsec) != 'ikev2':
+                        raise ConfigError(
+                            f'Post-quantum preshared keys must be used with IKEv2! IKEv2 key-exchange not set in ike-group "{ike}".'


Suggested change

f'Post-quantum preshared keys must be used with IKEv2! IKEv2 key-exchange not set in ike-group "{ike}".'

f'Incorrect configuration in IKE group "{ike}": post-quantum pre-shared keys are not supported for IKEv1.'

dmbaturin · 2026-01-20T13:08:27Z

src/conf_mode/vpn_ipsec.py

+                    ike = ra_conf['ike_group']
+                    if dict_search(f'ike_group.{ike}.key_exchange', ipsec) != 'ikev2':
+                        raise ConfigError(
+                            f'Childless IKE SAs be used with IKEv2! IKEv2 key-exchange not set in ike-group "{ike}".'


Suggested change

f'Childless IKE SAs be used with IKEv2! IKEv2 key-exchange not set in ike-group "{ike}".'

f'Incorrect configuration in IKE group "{ike}": childless IKE SAs can only be used with IKEv2.'

dmbaturin · 2026-01-20T13:36:35Z

src/conf_mode/vpn_ipsec.py

+                ike = peer_conf['ike_group']
+                if dict_search(f'ike_group.{ike}.key_exchange', ipsec) != 'ikev2':
+                    raise ConfigError(
+                        f'Post-quantum preshared keys must be used with IKEv2! IKEv2 key-exchange not set in ike-group "{ike}".'


Do we actually need this error at all? IKEv2 is enabled by default, so it will be fine for initiating connections. Not setting key exchange to IKEv2 explicitly will enable the peer to respond to IKEv1 connections, but will that not fail automatically if the local side demands post-quantum key exchange?

github-actions bot assigned giga1699 Jan 2, 2026

github-actions bot added the current label Jan 2, 2026

giga1699 force-pushed the T8136 branch 3 times, most recently from cf026ea to 0f19483 Compare January 2, 2026 06:22

sarthurdev requested review from c-po, dmbaturin, natali-rs1985 and sever-sever January 3, 2026 10:44

sarthurdev reviewed Jan 3, 2026

View reviewed changes

giga1699 force-pushed the T8136 branch from 0f19483 to 95b46b8 Compare January 3, 2026 20:02

giga1699 mentioned this pull request Jan 3, 2026

T8136: IPSEC PPK Support vyos/vyos-documentation#1733

Open

1 task

giga1699 marked this pull request as ready for review January 3, 2026 20:27

giga1699 requested a review from sarthurdev January 9, 2026 01:46

sarthurdev requested changes Jan 9, 2026

View reviewed changes

giga1699 force-pushed the T8136 branch from 95b46b8 to d957153 Compare January 10, 2026 00:37

giga1699 requested a review from sarthurdev January 10, 2026 00:41

giga1699 commented Jan 12, 2026

View reviewed changes

giga1699 force-pushed the T8136 branch from d957153 to 500a791 Compare January 12, 2026 15:15

sever-sever reviewed Jan 12, 2026

View reviewed changes

interface-definitions/include/ipsec/childless.xml.i Outdated Show resolved Hide resolved

sever-sever approved these changes Jan 12, 2026

View reviewed changes

giga1699 force-pushed the T8136 branch 2 times, most recently from 117394b to a641609 Compare January 13, 2026 02:22

alexandr-san4ez suggested changes Jan 13, 2026

View reviewed changes

src/conf_mode/vpn_ipsec.py Outdated Show resolved Hide resolved

T8136: IPSEC PPK Support

7dc490e

giga1699 force-pushed the T8136 branch from a641609 to 7dc490e Compare January 13, 2026 10:33

giga1699 requested a review from alexandr-san4ez January 13, 2026 10:34

alexandr-san4ez approved these changes Jan 13, 2026

View reviewed changes

sever-sever requested a review from zdc January 13, 2026 12:26

sarthurdev approved these changes Jan 13, 2026

View reviewed changes

sever-sever added the bp/circinus Create automatic backport for circinus label Jan 20, 2026

dmbaturin requested changes Jan 20, 2026

View reviewed changes

	<help>Enable support for childless IKE_SA initiation</help>
	<help>Enable support for childless IKE SA initiation</help>

	<description>Responder will allow childless IKE_SA, but initiator will not create childless connection</description>
	<description>Responder will allow childless IKE SA, but initiator will not create childless connections</description>

	<description>Require the use of childless IKE_SA</description>
	<description>Require the use of childless IKE SA</description>

	<description>Disable support for childless IKE_SAs as responder</description>
	<description>Disable support for childless IKE SAs as responder</description>

	f'Post-quantum preshared keys must be used with IKEv2! IKEv2 key-exchange not set in ike-group "{ike}".'
	f'Incorrect configuration in IKE group "{ike}": post-quantum pre-shared keys are not supported for IKEv1.'

	f'Childless IKE SAs be used with IKEv2! IKEv2 key-exchange not set in ike-group "{ike}".'
	f'Incorrect configuration in IKE group "{ike}": childless IKE SAs can only be used with IKEv2.'

T8136: IPSEC PPK Support #4930

Are you sure you want to change the base?

T8136: IPSEC PPK Support #4930

Conversation

giga1699 commented Jan 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Change summary

Types of changes

Related Task(s)

Related PR(s)

How to test / Smoketest result

Checklist:

Uh oh!

github-actions bot commented Jan 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sarthurdev left a comment

Choose a reason for hiding this comment

Uh oh!

giga1699 commented Jan 3, 2026

Uh oh!

giga1699 commented Jan 3, 2026

Uh oh!

sarthurdev left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

giga1699 commented Jan 10, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

giga1699 commented Jan 12, 2026

Uh oh!

Uh oh!

sever-sever left a comment

Choose a reason for hiding this comment

Uh oh!

alexandr-san4ez left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

alexandr-san4ez left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Jan 13, 2026

Details

Uh oh!

sarthurdev left a comment

Choose a reason for hiding this comment

Uh oh!

dmbaturin left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

giga1699 commented Jan 2, 2026 •

edited

Loading

github-actions bot commented Jan 2, 2026 •

edited

Loading