ipsec: T4126: Ability to set priorities for installed policy

[sever-sever]

Change Summary

Add priority for policy-based IPSec VPN tunnels
If 2 tunnels have the same pair of local and remote traffic
selectors (prefixes) it allows setting more preferable install
policy from required peer
The lowest priority is more preferable

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

• https://phabricator.vyos.net/T4126

Component(s) name

ipsec

Proposed changes

How to test

Set the same pair "local and remote prefixes"
Add the lowest priority for one peer

set vpn ipsec site-to-site peer 192.0.2.14 tunnel 0 local prefix '172.16.0.0/24'
set vpn ipsec site-to-site peer 192.0.2.14 tunnel 0 priority '100'
set vpn ipsec site-to-site peer 192.0.2.14 tunnel 0 remote prefix '10.0.0.0/24'

set vpn ipsec site-to-site peer 203.0.113.14 tunnel 0 local prefix '172.16.0.0/24'
set vpn ipsec site-to-site peer 203.0.113.14 tunnel 0 priority '1'
set vpn ipsec site-to-site peer 203.0.113.14 tunnel 0 remote prefix '10.0.0.0/24'

Expected route 10.0.0.0/24 from peer 203.0.113.14:

vyos@r11-roll# run show ip route table 220
Codes: K - kernel route, C - connected, S - static, R - RIP,

VRF default table 220:
K>* 10.0.0.0/24 [0/0] via 203.0.113.14, eth1, src 172.16.0.1, 00:19:39

Check IPSec policy, expected priority 1

vyos@r11-roll# run show vpn ipsec policy 
src 172.16.0.0/24 dst 10.0.0.0/24 
        dir out priority 1 ptype main 
        tmpl src 203.0.113.1 dst 203.0.113.14
                proto esp spi 0xcc6a38dc reqid 1 mode tunnel
src 10.0.0.0/24 dst 172.16.0.0/24 
        dir fwd priority 1 ptype main 
        tmpl src 203.0.113.14 dst 203.0.113.1
                proto esp reqid 1 mode tunnel
src 10.0.0.0/24 dst 172.16.0.0/24 
        dir in priority 1 ptype main 
        tmpl src 203.0.113.14 dst 203.0.113.1
                proto esp reqid 1 mode tunnel

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[c-po]

Interesting, did not know this existed.