[ovs-dev] [PATCH v2] ovs-monitor-ipsec: Add support for tunnel 'local_ip'
Mark Gray
mark.d.gray at redhat.com
Thu Dec 24 12:57:01 UTC 2020
In the libreswan case, 'ovs-monitor-ipsec' sets
'left' to '%defaultroute' which will use the local address
of the default route interface as the source IP address. In
multihomed environments, this may not be correct if the user
wants to specify what the source IP address is. In OVS, this
can be set for tunnel ports using the 'local_ip' option. This
patch also uses that option to populate the 'ipsec.conf'
configuration. If the 'local_ip' option is not present, it
will default to the previous behaviour of using '%defaultroute'
Reported-at: https://bugzilla.redhat.com/show_bug.cgi?id=1906280
Signed-off-by: Mark Gray <mark.d.gray at redhat.com>
Acked-by: Eelco Chaudron <echaudro at redhat.com>
---
v2: Added "Reported-at" tag and updated documentation's command
output as suggested by Eelco
Documentation/tutorials/ipsec.rst | 1 +
ipsec/ovs-monitor-ipsec.in | 8 +++++---
2 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/Documentation/tutorials/ipsec.rst b/Documentation/tutorials/ipsec.rst
index ebc0ae429c19..3b3e42c59a2a 100644
--- a/Documentation/tutorials/ipsec.rst
+++ b/Documentation/tutorials/ipsec.rst
@@ -300,6 +300,7 @@ For example::
Otherwise, error message will
be provided
Tunnel Type: gre
+ Local IP: %defaultroute
Remote IP: 2.2.2.2
SKB mark: None
Local cert: None
diff --git a/ipsec/ovs-monitor-ipsec.in b/ipsec/ovs-monitor-ipsec.in
index b84608a55d8a..7b1d94593636 100755
--- a/ipsec/ovs-monitor-ipsec.in
+++ b/ipsec/ovs-monitor-ipsec.in
@@ -416,11 +416,11 @@ conn prevent_unencrypted_vxlan
"""
auth_tmpl = {"psk": Template("""\
- left=%defaultroute
+ left=$local_ip
right=$remote_ip
authby=secret"""),
"pki_remote": Template("""\
- left=%defaultroute
+ left=$local_ip
right=$remote_ip
leftid=@$local_name
rightid=@$remote_name
@@ -428,7 +428,7 @@ conn prevent_unencrypted_vxlan
rightcert="$remote_name"
leftrsasigkey=%cert"""),
"pki_ca": Template("""\
- left=%defaultroute
+ left=$local_ip
right=$remote_ip
leftid=@$local_name
rightid=@$remote_name
@@ -750,6 +750,7 @@ class IPsecTunnel(object):
unixctl_config_tmpl = Template("""\
Tunnel Type: $tunnel_type
+ Local IP: $local_ip
Remote IP: $remote_ip
SKB mark: $skb_mark
Local cert: $certificate
@@ -790,6 +791,7 @@ class IPsecTunnel(object):
new_conf = {
"ifname": self.name,
"tunnel_type": row.type,
+ "local_ip": options.get("local_ip", "%defaultroute"),
"remote_ip": options.get("remote_ip"),
"skb_mark": monitor.conf["skb_mark"],
"certificate": monitor.conf["pki"]["certificate"],
--
2.26.2
More information about the dev
mailing list