| Message ID | 20180718212302.3080-1-qiuyu.xiao.qyx@gmail.com |
|---|---|
| Headers | show
Return-Path: <ovs-dev-bounces@openvswitch.org> X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=openvswitch.org (client-ip=140.211.169.12; helo=mail.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=<UNKNOWN>) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="gzncuBvp"; dkim-atps=neutral Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 41W9B04PpYz9s1R for <incoming@patchwork.ozlabs.org>; Thu, 19 Jul 2018 07:23:35 +1000 (AEST) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id 1E385C77; Wed, 18 Jul 2018 21:23:33 +0000 (UTC) X-Original-To: ovs-dev@openvswitch.org Delivered-To: ovs-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 38A5B4A3 for <ovs-dev@openvswitch.org>; Wed, 18 Jul 2018 21:23:31 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.7.6 Received: from mail-pg1-f193.google.com (mail-pg1-f193.google.com [209.85.215.193]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id D9F237B4 for <ovs-dev@openvswitch.org>; Wed, 18 Jul 2018 21:23:30 +0000 (UTC) Received: by mail-pg1-f193.google.com with SMTP id f1-v6so2555098pgq.12 for <ovs-dev@openvswitch.org>; Wed, 18 Jul 2018 14:23:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=96jST2u8dc6qJWq2MWuuUXhAvB4hH0E/oUc40SPmYkY=; b=gzncuBvpF10r2V5TiLbX+BQr0o0wjd0P0xbgQkpgTre+ypyMR04CW8HCvFakay26pw UUHyC+5QZgPHr4stEHeyMkdL7VYIb52pzijpraY+0RNs8/WkS/9q1qTL9KI/PaLqYUKq 9Wd9MHE1JBRuwAemmBN7tS8DAwk9ka5Tl7FHkC/sjTGmBF9SQfwx/KKR6LYubCz/i/Hh WcI0INYzG0td9zVP3eGyOXfe+D01RDwwFnxV8jE7il9lE5TXiBRCRvHCJzJQEP1wPTZz 7aJXKQBLWSWYO36Q6q7BBeXqJoG6MTduRDq88FncsV2Ieb4UQDYWzxY7s1/Ta1Jw/Rdf +Q5w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=96jST2u8dc6qJWq2MWuuUXhAvB4hH0E/oUc40SPmYkY=; b=r56BMvieAf4rKY2ad5Q+iaQ/qfNb31CZWUOTnd58HApqhDo9om+XSxj7Cenp86OW5k lBs+Zj+nXBIin1lTFSTLjTo/xzEj840CS++BmAZUeVsIlbueuQPunNGWCuFSDddeNkon ui6iYrS0tpltseCq2Y1SF+P77atdsQ+rgGdYD9Hi3Aj/hdg2g8GfrMm4Il6p1Bha2WkY d4ui1aY59VKS8uMH5Ge1JRPRua5PpxmahAukqovwiXoJhg435MR7jyN3p5LqghOGd3Xb RYhJ3dLVY6ygQvtxshB05Lvz9KWChShrRU6jkUU7qsHfloeslalsuGrtorfiNqeCoIhK L0lw== X-Gm-Message-State: AOUpUlGrYhePlydM3OGYYJ7EwPnW3SdQLc7lCLscuo8xO4uPANItve9d vj19nKXmn+utzWG76YiZKa44Ng== X-Google-Smtp-Source: AAOMgpeFUuzN1BfpO+pnempkpkOLWUTgWcpz0jiL23b5hEnf9YBm6OI0wyJwSCuIHWojRksS7aD7vA== X-Received: by 2002:a65:58c8:: with SMTP id e8-v6mr7215196pgu.96.1531949010289; Wed, 18 Jul 2018 14:23:30 -0700 (PDT) Received: from vm1.eng.vmware.com ([66.170.99.1]) by smtp.gmail.com with ESMTPSA id z123-v6sm6126277pfz.16.2018.07.18.14.23.29 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 18 Jul 2018 14:23:29 -0700 (PDT) From: Qiuyu Xiao <qiuyu.xiao.qyx@gmail.com> To: ovs-dev@openvswitch.org Date: Wed, 18 Jul 2018 14:22:58 -0700 Message-Id: <20180718212302.3080-1-qiuyu.xiao.qyx@gmail.com> X-Mailer: git-send-email 2.18.0 X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: [ovs-dev] [PATCH v2 0/4] IPsec support for tunneling X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: <ovs-dev.openvswitch.org> List-Unsubscribe: <https://mail.openvswitch.org/mailman/options/ovs-dev>, <mailto:ovs-dev-request@openvswitch.org?subject=unsubscribe> List-Archive: <http://mail.openvswitch.org/pipermail/ovs-dev/> List-Post: <mailto:ovs-dev@openvswitch.org> List-Help: <mailto:ovs-dev-request@openvswitch.org?subject=help> List-Subscribe: <https://mail.openvswitch.org/mailman/listinfo/ovs-dev>, <mailto:ovs-dev-request@openvswitch.org?subject=subscribe> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: ovs-dev-bounces@openvswitch.org Errors-To: ovs-dev-bounces@openvswitch.org |
| Series |
IPsec support for tunneling
|
expand
|
This patch series reintroduce IPsec support for OVS tunneling and enable OVN to use IPsec tunnels. GRE, VXLAN, GENEVE, and STT IPsec tunnels are supported. StrongSwan and LibreSwan IKE daemons are supported. Changes from v1 to v2: 1) Merged the ovs-monitor-ipsec code to a single patch. Added LibreSwan IKE daemon support. 2) Use openssl to extract CN from certificate so that users don't need to specify the CN information in the configuration interface. 3) Improved documentations as suggested. Qiuyu Xiao (4): datapath: add transport ports in route lookup to enable IPsec policy match. ipsec: reintroduce IPsec support for tunneling ovs-pki: generate x.509 v3 certificate OVN: native support for tunnel encryption Documentation/automake.mk | 1 + Documentation/howto/index.rst | 1 + Documentation/howto/ipsec.rst | 256 +++++++ Makefile.am | 1 + NEWS | 3 + datapath/linux/compat/geneve.c | 29 +- datapath/linux/compat/stt.c | 15 +- datapath/linux/compat/vxlan.c | 14 +- debian/automake.mk | 3 + debian/control | 21 + debian/openvswitch-ipsec.dirs | 1 + debian/openvswitch-ipsec.init | 189 +++++ debian/openvswitch-ipsec.install | 1 + ipsec/automake.mk | 10 + ipsec/ovs-monitor-ipsec | 1152 ++++++++++++++++++++++++++++++ ovn/controller/encaps.c | 33 +- ovn/controller/encaps.h | 7 +- ovn/controller/ovn-controller.c | 4 +- ovn/northd/ovn-northd.c | 8 +- ovn/ovn-architecture.7.xml | 39 + ovn/ovn-nb.ovsschema | 7 +- ovn/ovn-nb.xml | 6 + ovn/ovn-sb.ovsschema | 7 +- ovn/ovn-sb.xml | 6 + utilities/ovs-pki.in | 18 +- vswitchd/vswitch.xml | 124 +++- 26 files changed, 1913 insertions(+), 43 deletions(-) create mode 100644 Documentation/howto/ipsec.rst create mode 100644 debian/openvswitch-ipsec.dirs create mode 100644 debian/openvswitch-ipsec.init create mode 100644 debian/openvswitch-ipsec.install create mode 100644 ipsec/automake.mk create mode 100755 ipsec/ovs-monitor-ipsec