ipsec: T8022: Fix invalid automatic dynamic prefix assignment for transport mode tunnels

[alexandr-san4ez]

Change summary

When ESP was configured in transport mode for GRE-based site-to-site tunnels, the default value dynamic was automatically injected into the configuration, even though prefixes must not be set in transport mode. This led to error "Local/remote prefix cannot be used with ESP transport mode" and commit failures.

This fix updates configuration logic to skip default prefix assignment for site-to-site peers using ESP transport mode tunnels.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

• https://vyos.dev/T8022

How to test / Smoketest result

Manual test:

conf
set interfaces tunnel tun10 address '10.0.0.1/30'
set interfaces tunnel tun10 encapsulation 'gre'
set interfaces tunnel tun10 remote '203.0.113.10'
set interfaces tunnel tun10 source-address '172.168.99.2'
set vpn ipsec authentication psk peer1 id '172.168.99.2'
set vpn ipsec authentication psk peer1 id '203.0.113.10'
set vpn ipsec authentication psk peer1 secret 'myStrongSecret123!'
set vpn ipsec esp-group ESP_POLICY3 lifetime '3600'
set vpn ipsec esp-group ESP_POLICY3 mode 'transport'
set vpn ipsec esp-group ESP_POLICY3 pfs 'dh-group14'
set vpn ipsec esp-group ESP_POLICY3 proposal 10 encryption 'aes256'
set vpn ipsec esp-group ESP_POLICY3 proposal 10 hash 'sha1'
set vpn ipsec ike-group IKE_POLICY2 close-action 'none'
set vpn ipsec ike-group IKE_POLICY2 dead-peer-detection action 'restart'
set vpn ipsec ike-group IKE_POLICY2 dead-peer-detection interval '10'
set vpn ipsec ike-group IKE_POLICY2 key-exchange 'ikev2'
set vpn ipsec ike-group IKE_POLICY2 lifetime '28800'
set vpn ipsec ike-group IKE_POLICY2 proposal 10 dh-group '5'
set vpn ipsec ike-group IKE_POLICY2 proposal 10 encryption 'aes256'
set vpn ipsec ike-group IKE_POLICY2 proposal 10 hash 'sha1'
set vpn ipsec interface 'eth1'
set vpn ipsec site-to-site peer peer1 authentication local-id '172.168.99.2'
set vpn ipsec site-to-site peer peer1 authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer peer1 authentication remote-id '203.0.113.10'
set vpn ipsec site-to-site peer peer1 connection-type 'initiate'
set vpn ipsec site-to-site peer peer1 default-esp-group 'ESP_POLICY3'
set vpn ipsec site-to-site peer peer1 ike-group 'IKE_POLICY2'
set vpn ipsec site-to-site peer peer1 local-address '172.168.99.2'
set vpn ipsec site-to-site peer peer1 remote-address '203.0.113.10'
set vpn ipsec site-to-site peer peer1 tunnel 10 protocol 'gre'
commit

Smoketest:

vyos@vyos:~$ /usr/libexec/vyos/tests/smoke/cli/test_vpn_ipsec.py -k site_to_site_gre_over_ipsec
test_site_to_site_gre_over_ipsec (__main__.TestVPNIPsec.test_site_to_site_gre_over_ipsec)
Test GRE over IPsec site‑to‑site configuration with transport mode ESP ... ok
----------------------------------------------------------------------
Ran 1 test in 10.632s
OK

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[github-actions]

👍
No issues in PR Title / Commit Title

[github-actions]

CI integration 👍 passed!

Details

CI logs

• CLI Smoketests (no interfaces) 👍 passed
• CLI Smoketests VPP 👍 passed
• CLI Smoketests (interfaces only) 👍 passed
• Config tests 👍 passed
• Config tests VPP 👍 passed
• RAID1 tests 👍 passed
• TPM tests 👍 passed