Skip to content
  • Mark Gray's avatar
    34beb215
    geneve: add transport ports in route lookup for geneve · 34beb215
    Mark Gray authored
    
    
    This patch adds transport ports information for route lookup so that
    IPsec can select Geneve tunnel traffic to do encryption. This is
    needed for OVS/OVN IPsec with encrypted Geneve tunnels.
    
    This can be tested by configuring a host-host VPN using an IKE
    daemon and specifying port numbers. For example, for an
    Openswan-type configuration, the following parameters should be
    configured on both hosts and IPsec set up as-per normal:
    
    $ cat /etc/ipsec.conf
    
    conn in
    ...
    left=$IP1
    right=$IP2
    ...
    leftprotoport=udp/6081
    rightprotoport=udp
    ...
    conn out
    ...
    left=$IP1
    right=$IP2
    ...
    leftprotoport=udp
    rightprotoport=udp/6081
    ...
    
    The tunnel can then be setup using "ip" on both hosts (but
    changing the relevant IP addresses):
    
    $ ip link add tun type geneve id 1000 remote $IP2
    $ ip addr add 192.168.0.1/24 dev tun
    $ ip link set tun up
    
    This can then be tested by pinging from $IP1:
    
    $ ping 192.168.0.2
    
    Without this patch the traffic is unencrypted on the wire.
    
    Fixes: 2d07dc79 ("geneve: add initial netdev driver for GENEVE tunnels")
    Signed-off-by: default avatarQiuyu Xiao <qiuyu.xiao.qyx@gmail.com>
    Signed-off-by: default avatarMark Gray <mark.d.gray@redhat.com>
    Reviewed-by: default avatarGreg Rose <gvrose8192@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    34beb215
    geneve: add transport ports in route lookup for geneve
    Mark Gray authored
    
    
    This patch adds transport ports information for route lookup so that
    IPsec can select Geneve tunnel traffic to do encryption. This is
    needed for OVS/OVN IPsec with encrypted Geneve tunnels.
    
    This can be tested by configuring a host-host VPN using an IKE
    daemon and specifying port numbers. For example, for an
    Openswan-type configuration, the following parameters should be
    configured on both hosts and IPsec set up as-per normal:
    
    $ cat /etc/ipsec.conf
    
    conn in
    ...
    left=$IP1
    right=$IP2
    ...
    leftprotoport=udp/6081
    rightprotoport=udp
    ...
    conn out
    ...
    left=$IP1
    right=$IP2
    ...
    leftprotoport=udp
    rightprotoport=udp/6081
    ...
    
    The tunnel can then be setup using "ip" on both hosts (but
    changing the relevant IP addresses):
    
    $ ip link add tun type geneve id 1000 remote $IP2
    $ ip addr add 192.168.0.1/24 dev tun
    $ ip link set tun up
    
    This can then be tested by pinging from $IP1:
    
    $ ping 192.168.0.2
    
    Without this patch the traffic is unencrypted on the wire.
    
    Fixes: 2d07dc79 ("geneve: add initial netdev driver for GENEVE tunnels")
    Signed-off-by: default avatarQiuyu Xiao <qiuyu.xiao.qyx@gmail.com>
    Signed-off-by: default avatarMark Gray <mark.d.gray@redhat.com>
    Reviewed-by: default avatarGreg Rose <gvrose8192@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Loading