delta/openvswitch.git/ipsec, branch master

ovs-monitor-ipsec: Allow custom options per tunnel.

2022-05-04T14:30:21+00:00

Tunnels in LibreSwan and OpenSwan allow for many options to be set on a
per tunnel basis. Pass through any options starting with ipsec_ to the
connection in the configuration file. Administrators are responsible for
picking valid key/value pairs.

Signed-off-by: Andreas Karis 
Acked-by: Mike Pattrick 
Signed-off-by: Ilya Maximets

ovs-monitor-ipsec: Add list-commands command.

2022-03-07T12:19:54+00:00

Currently ovs-python unixctl implement the list-commands
operation as 'help' command which doesn't match the ovs-appctl
man page and that can confuse the end-users who want to check
the supported operations of the ovs-monitor-ipsec.

This patch adds a list-commands alias name to 'help' operation.

Acked-by: Mike Pattrick 
Signed-off-by: Mohammad Heib 
Signed-off-by: Ilya Maximets

ipsec: StrongSwan report connection update failures to ovs logs.

2022-03-04T19:11:04+00:00

Currently when the user adds an IPsec tunnel port to the
ovs bridge the ovs-monitor-ipsec script will add this tunnel
IPsec-related configuration to the appropriate file and
submit a request to start the IPsec connection for this port
and ignores the request output which can contain an error message.

This patch captures the request output and prints
the error message to the ovs logs.

Acked-by: Mike Pattrick 
Signed-off-by: Mohammad Heib 
Signed-off-by: Ilya Maximets

ipsec: Libreswan report connection failures to ovs logs.

2022-03-04T19:07:15+00:00

Currently when the user adds an IPsec tunnel port to the
ovs bridge the ovs-monitor-ipsec script will submit a request
to start the IPsec connection for this port and ignores
the request output which can contain an error message.

This patch captures the request output and prints
the error message to the ovs logs.

Signed-off-by: Mohammad Heib 
Acked-by: Mike Pattrick 
Signed-off-by: Ilya Maximets

ovs-monitor-ipsec: Fix generated strongSwan ipsec.conf for IPv6.

2022-01-21T17:45:23+00:00

Setting the local address to 0.0.0.0 (v4 address) while setting the
remote address to a v6 address results in an invalid configuration.

See https://github.com/strongswan/strongswan/discussions/821

Signed-off-by: Antonin Bas 
Acked-by: Mike Pattrick 
Signed-off-by: Ilya Maximets

ipsec: Update ordering of imports.

2021-04-01T17:13:31+00:00

Signed-off-by: Mark Gray 
Acked-by: Flavio Leitner 
Acked-by: Aaron Conole 
Acked-by: Eelco Chaudron 
Signed-off-by: Ilya Maximets

ipsec: Allow custom file locations.

2021-04-01T17:13:31+00:00

"ovs_monitor_ipsec" assumes certain file locations for a number
of Libreswan objects. This patch allows these locations to be
configurable at startup in the Libreswan case.

This additional flexibility enables system testing for
OVS IPsec.

Signed-off-by: Mark Gray 
Acked-by: Flavio Leitner 
Acked-by: Aaron Conole 
Acked-by: Eelco Chaudron 
Signed-off-by: Ilya Maximets

ipsec: Fix IPv6 default route support for Libreswan.

2021-04-01T17:12:52+00:00

When configuring IPsec, "ovs-monitor-ipsec" honours
the 'local_ip' option in the 'Interface' table by configuring
the 'left' side of the Libreswan connection with 'local_ip'.
If 'local_ip' is not specified, "ovs-monitor-ipsec" sets
'left' to '%defaultroute' which is interpreted as the IP
address of the default gateway interface.

However, when 'remote_ip' is an IPv6 address, Libreswan
still interprets '%defaultroute' as the IPv4 address on the
default gateway interface (see:
https://github.com/libreswan/libreswan/issues/416) giving
an "address family inconsistency" error.

This patch resolves this issue by specifying the
connection as IPv6 when the 'remote_ip' is IPv6 and
'local_ip' has not been set.

Fixes: 22c5eafb6efa ("ipsec: reintroduce IPsec support for tunneling")
Signed-off-by: Mark Gray 
Acked-by: Flavio Leitner 
Acked-by: Aaron Conole 
Acked-by: Eelco Chaudron 
Signed-off-by: Ilya Maximets

ovs-monitor-ipsec: Add option to not restart IKE daemon.

2021-01-06T11:04:45+00:00

Signed-off-by: Mark Gray 
Acked-by: Eelco Chaudron 
Acked-by: Flavio Leitner 
Signed-off-by: Ilya Maximets

ovs-monitor-ipsec: Allow exit of ipsec daemon maintaining state.

2021-01-06T11:03:04+00:00

When 'ovs-monitor-ipsec' exits, it clears all persistent state (i.e.
active ipsec connections, /etc/ipsec.conf, certs/keys). In some
use-cases, we may want to exit and maintain state so that ipsec
connectivity is maintained. One example of this is during an
upgrade. This will require the caller to clear this persistent
state when appropriate (e.g. before 'ovs-monitor-ipsec') is restarted.

Signed-off-by: Mark Gray 
Acked-by: Eelco Chaudron 
Acked-by: Flavio Leitner 
Signed-off-by: Ilya Maximets