vswitch: Use "ipsec_gre" vport instead of "gre" with "other_config"
authorJustin Pettit <jpettit@nicira.com>
Thu, 2 Dec 2010 01:23:33 +0000 (17:23 -0800)
committerJustin Pettit <jpettit@nicira.com>
Tue, 28 Dec 2010 22:30:36 +0000 (14:30 -0800)
commite16a28b5854823e2d67099d49f7690235162b555
tree85366fe0f7c33b7bbed60f9266fec6dcb7f336d9
parent4c2fa71d662cde318940c4cd555aacd687538510
vswitch: Use "ipsec_gre" vport instead of "gre" with "other_config"

Previously, a GRE-over-IPsec tunnel was created as an interface with a
"type" of "gre" and the "other_config" column with "ipsec_cert" or
"ipsec_psk" set.  This could lead to a potential security problem if a user
intended to create a GRE-over-IPsec tunnel, but misconfigured the
"ipsec_*" config and created an unencrypted GRE tunnel.

This commit defines an "ipsec_gre" tunnel type, which should prevent
users from inadvertently establishing insecure tunnels.
debian/ovs-monitor-ipsec
include/openvswitch/tunnel.h
lib/dpif-linux.c
lib/netdev-vport.c
lib/odp-util.c
vswitchd/vswitch.xml