ipsec over vxlan tunnel support.

using ip xfrm and autogenerated simmetric keys between any two VTEPs

Change-Id: I94de7202c1616710882db3ded184ae0a56d9dad6
Signed-off-by: Ariel <ariel.waizel@hpe.com>

diff --git a/jjb/integration/include-raw-integration-deploy-openstack-run-test.sh b/jjb/integration/include-raw-integration-deploy-openstack-run-test.sh
index a273ac5b317cd6c2585a84d01f0f88b1efd0735c..703e8f6aef414b0582a165e22b4fe25c292b358f 100644 (file)
--- a/jjb/integration/include-raw-integration-deploy-openstack-run-test.sh
+++ b/jjb/integration/include-raw-integration-deploy-openstack-run-test.sh
@@ -669,6 +669,38 @@ do
     ${SSH} $ip "sudo ovs-vsctl --may-exist add-br $PUBLIC_BRIDGE -- set bridge $PUBLIC_BRIDGE other-config:disable-in-band=true other_config:hwaddr=f6:00:00:ff:01:0$((devstack_index++))"
 done
 
+# ipsec support
+if [ "${IPSEC_VXLAN_TUNNELS_ENABLED}" == "yes" ]; then
+    ALL_NODES=(${OPENSTACK_CONTROL_NODE_IP} ${COMPUTE_IPS[*]})
+    for ((inx_ip1=0; inx_ip1<$((${#ALL_NODES[@]} - 1)); inx_ip1++))
+    do
+        for ((inx_ip2=$((inx_ip1 + 1)); inx_ip2<${#ALL_NODES[@]}; inx_ip2++))
+        do
+            KEY1=0x$(dd if=/dev/urandom count=32 bs=1 2> /dev/null| xxd -p -c 64)
+            KEY2=0x$(dd if=/dev/urandom count=32 bs=1 2> /dev/null| xxd -p -c 64)
+            ID=0x$(dd if=/dev/urandom count=4 bs=1 2> /dev/null| xxd -p -c 8)
+            ip1=${ALL_NODES[$inx_ip1]}
+            ip2=${ALL_NODES[$inx_ip2]}
+            ${SSH} $ip1 "sudo ip xfrm state add src $ip1 dst $ip2 proto esp spi $ID reqid $ID mode transport auth sha256 $KEY1 enc aes $KEY2"
+            ${SSH} $ip1 "sudo ip xfrm state add src $ip2 dst $ip1 proto esp spi $ID reqid $ID mode transport auth sha256 $KEY1 enc aes $KEY2"
+            ${SSH} $ip1 "sudo ip xfrm policy add src $ip1 dst $ip2 proto udp dir out tmpl src $ip1 dst $ip2 proto esp reqid $ID mode transport"
+            ${SSH} $ip1 "sudo ip xfrm policy add src $ip2 dst $ip1 proto udp dir in tmpl src $ip2 dst $ip1 proto esp reqid $ID mode transport"
+
+            ${SSH} $ip2 "sudo ip xfrm state add src $ip2 dst $ip1 proto esp spi $ID reqid $ID mode transport auth sha256 $KEY1 enc aes $KEY2"
+            ${SSH} $ip2 "sudo ip xfrm state add src $ip1 dst $ip2 proto esp spi $ID reqid $ID mode transport auth sha256 $KEY1 enc aes $KEY2"
+            ${SSH} $ip2 "sudo ip xfrm policy add src $ip2 dst $ip1 proto udp dir out tmpl src $ip2 dst $ip1 proto esp reqid $ID mode transport"
+            ${SSH} $ip2 "sudo ip xfrm policy add src $ip1 dst $ip2 proto udp dir in tmpl src $ip1 dst $ip2 proto esp reqid $ID mode transport"
+        done
+    done
+
+    for ip in ${OPENSTACK_CONTROL_NODE_IP} ${COMPUTE_IPS[*]}
+    do
+        echo "ip xfrm configuration for node $ip:"
+        ${SSH} $ip "sudo ip xfrm policy list"
+        ${SSH} $ip "sudo ip xfrm state list"
+    done
+fi
+
 # Control Node - PUBLIC_BRIDGE will act as the external router
 GATEWAY_IP="10.10.10.250" # FIXME this should be a parameter, also shared with integration-test
 ${SSH} ${OPENSTACK_CONTROL_NODE_IP} "sudo ip link add link ${PUBLIC_BRIDGE} name  ${PUBLIC_BRIDGE}.167 type vlan id 167"

diff --git a/jjb/integration/integration-templates.yaml b/jjb/integration/integration-templates.yaml
index 9e36e097c42e4ff88192970aeaf40a28913485a4..e8c00bb247016214b9ae1eba61fecbe1d9d3b79a 100644 (file)
--- a/jjb/integration/integration-templates.yaml
+++ b/jjb/integration/integration-templates.yaml
@@ -1034,6 +1034,10 @@
           name: ODL_ENABLE_L3_FWD
           default: '{odl-enable-l3}'
           description: 'Enable L3 FWD in ODL for createing br-ex'
+      - string:
+          name: IPSEC_VXLAN_TUNNELS_ENABLED
+          default: '{ipsec-vxlan-tunnels-enabled}'
+          description: 'Enable ipsec over vxlan support for all controllers and computes'
       - string:
           name: PUBLIC_BRIDGE
           default: '{public-bridge}'
@@ -1202,6 +1206,10 @@
           name: ODL_ENABLE_L3_FWD
           default: '{odl-enable-l3}'
           description: 'Enable L3 FWD in ODL for createing br-ex'
+      - string:
+          name: IPSEC_VXLAN_TUNNELS_ENABLED
+          default: '{ipsec-vxlan-tunnels-enabled}'
+          description: 'Enable ipsec over vxlan support for all controllers and computes'
       - string:
           name: PUBLIC_BRIDGE
           default: '{public-bridge}'

diff --git a/jjb/releng-defaults.yaml b/jjb/releng-defaults.yaml
index 843129a33e57bc038c29a1b524949dd4056b51e1..4367a42dae13dba813d70fa7d7046373b0be268b 100644 (file)
--- a/jjb/releng-defaults.yaml
+++ b/jjb/releng-defaults.yaml
@@ -17,6 +17,7 @@
     devstack-lbaas-plugin-repo: 'https://github.com/openstack/neutron-lbaas'
     server-name: 'OpenDaylight'
     git-url: 'ssh://jenkins-$SILO@git.opendaylight.org:29418'
+    ipsec-vxlan-tunnels-enabled: 'no'
 
     public-bridge: 'br-physnet1'
     public-physical-network: 'physnet1'