ligang/vpp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ipsec: change wildcard value for any protocol of spd policy

Browse Source 
Currently 0 has been used as the wildcard representing ANY type of
protocol. However 0 is valid value of ip protocol (HOPOPT) and therefore
it should not be used as a wildcard. Instead 255 is used which is
guaranteed by IANA to be reserved and not used as a protocol id.

Type: improvement
Signed-off-by: Piotr Bronowski <piotrx.bronowski@intel.com>
Change-Id: I2320bae6fe380cb999dc5a9187beb68fda2d31eb
This commit is contained in:
Piotr Bronowski
2022-06-09 09:09:28 +00:00
committed by Fan Zhang
parent 5b4b4c05ff
commit 815c6a4fbc
13 changed files with 323 additions and 81 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
test/test_ipsec_ah.py
View File

@ -213,7 +213,7 @@ class ConfigIpsecAH(TemplateIpsec):
remote_tun_if_host,
self.pg1.remote_addr[addr_type],
self.pg1.remote_addr[addr_type],
0,
socket.IPPROTO_RAW,
priority=10,
policy=e.IPSEC_API_SPD_ACTION_PROTECT,
is_outbound=0,
@ -226,7 +226,7 @@ class ConfigIpsecAH(TemplateIpsec):
self.pg1.remote_addr[addr_type],
remote_tun_if_host,
remote_tun_if_host,
0,
socket.IPPROTO_RAW,
policy=e.IPSEC_API_SPD_ACTION_PROTECT,
priority=10,
)
@ -238,7 +238,7 @@ class ConfigIpsecAH(TemplateIpsec):
remote_tun_if_host,
self.pg0.local_addr[addr_type],
self.pg0.local_addr[addr_type],
0,
socket.IPPROTO_RAW,
priority=20,
policy=e.IPSEC_API_SPD_ACTION_PROTECT,
is_outbound=0,
@ -251,7 +251,7 @@ class ConfigIpsecAH(TemplateIpsec):
self.pg0.local_addr[addr_type],
remote_tun_if_host,
remote_tun_if_host,
0,
socket.IPPROTO_RAW,
policy=e.IPSEC_API_SPD_ACTION_PROTECT,
priority=20,
)
@ -341,7 +341,7 @@ class ConfigIpsecAH(TemplateIpsec):
self.tra_if.local_addr[addr_type],
self.tra_if.remote_addr[addr_type],
self.tra_if.remote_addr[addr_type],
0,
socket.IPPROTO_RAW,
priority=10,
policy=e.IPSEC_API_SPD_ACTION_PROTECT,
is_outbound=0,
@ -356,7 +356,7 @@ class ConfigIpsecAH(TemplateIpsec):
self.tra_if.local_addr[addr_type],
self.tra_if.remote_addr[addr_type],
self.tra_if.remote_addr[addr_type],
0,
socket.IPPROTO_RAW,
policy=e.IPSEC_API_SPD_ACTION_PROTECT,
priority=10,
)