debian: Don't require ipsec_local_ip to configure IPsec

Commit e97a103 (Open vSwitch: ovs-monitor-ipsec: Add ability to traverse
NATs) removed the requirement that the "ipsec_local_ip" key must be set
to use IPsec, but other code and documentation was not updated to
reflect this.  This commit does that.

diff --git a/lib/netdev-vport.c b/lib/netdev-vport.c
index 55662890f86a4ca4ea94936924311df5339c9d1c..13b1d930c371f7ff84d38b75e741caaf21e1cba3 100644 (file)
--- a/lib/netdev-vport.c
+++ b/lib/netdev-vport.c
@@ -436,7 +436,6 @@ parse_tunnel_config(const struct netdev_dev *dev, const struct shash *args,
     bool is_gre = !strcmp(type, "gre");
     struct tnl_port_config config;
     struct shash_node *node;
-    bool ipsec_ip_set = false;
     bool ipsec_mech_set = false;
 
     memset(&config, 0, sizeof config);
@@ -502,8 +501,6 @@ parse_tunnel_config(const struct netdev_dev *dev, const struct shash *args,
             if (!strcmp(node->data, "false")) {
                 config.flags &= ~TNL_F_HDR_CACHE;
             }
-        } else if (!strcmp(node->name, "ipsec_local_ip")) {
-            ipsec_ip_set = true;
         } else if (!strcmp(node->name, "ipsec_cert")
                    || !strcmp(node->name, "ipsec_psk")) {
             ipsec_mech_set = true;
@@ -515,7 +512,7 @@ parse_tunnel_config(const struct netdev_dev *dev, const struct shash *args,
 
    /* IPsec doesn't work when header caching is enabled.  Disable it if the
     * IPsec local IP address and authentication mechanism have been defined. */
-    if (ipsec_ip_set && ipsec_mech_set) {
+    if (ipsec_mech_set) {
         VLOG_INFO("%s: header caching disabled due to use of IPsec", name);
         config.flags &= ~TNL_F_HDR_CACHE;
     }

diff --git a/vswitchd/vswitch.xml b/vswitchd/vswitch.xml
index b3f00752a52c9f4e5bf4dc66ced7a15290ee8f8b..f78a579455e7fa161f7c97101a973fa5aaba98af 100644 (file)
--- a/vswitchd/vswitch.xml
+++ b/vswitchd/vswitch.xml
@@ -991,22 +991,15 @@
 
       <column name="other_config">
         Key-value pairs for rarely used interface features.  Currently,
-        the only keys are for configuring GRE-over-IPsec, which is only
+        the only key is for configuring GRE-over-IPsec, which is only
         available through the <code>openvswitch-ipsec</code> package for
-        Debian.  The currently defined key-value pairs are:
+        Debian.  The currently defined key-value pair is:
         <dl>
-          <dt><code>ipsec_local_ip</code></dt>
-          <dd>Required key for GRE-over-IPsec interfaces.  Additionally,
-            the <ref column="type"/> must be <code>gre</code> and the
-            <code>ipsec_psk</code> <ref column="other_config"/> key must
-            be set.  The <code>in_key</code>, <code>out_key</code>, and
-            <code>key</code> <ref column="options"/> must not be
-            set.</dd>
           <dt><code>ipsec_psk</code></dt>
           <dd>Required key for GRE-over-IPsec interfaces.  Specifies a
             pre-shared key for authentication that must be identical on
             both sides of the tunnel.  Additionally, the
-            <code>ipsec_local_ip</code> key must also be set.</dd>
+            <ref column="type"/> must be <code>gre</code>.</dd>
         </dl>
       </column>