Re: [ovs-dev] [PATCH] ipsec: Do not allow ipsec_gre tunnel traffic to exit unencrypted

2016-09-01 Thread Ansis Atteka
On 30 August 2016 at 02:21, Jesse Gross wrote: > On Mon, Aug 29, 2016 at 11:57 AM, Ansis Atteka wrote: > > If ipsec_gre tunnel configuration is changed in OVSDB, > > then GRE packets may sometimes exit unencrypted until > > per-tunnel IPsec policies are installed by ovs-monitor-ipsec > > daemon.

Re: [ovs-dev] [PATCH] ipsec: Do not allow ipsec_gre tunnel traffic to exit unencrypted

2016-08-29 Thread Jesse Gross
On Mon, Aug 29, 2016 at 11:57 AM, Ansis Atteka wrote: > If ipsec_gre tunnel configuration is changed in OVSDB, > then GRE packets may sometimes exit unencrypted until > per-tunnel IPsec policies are installed by ovs-monitor-ipsec > daemon. > > This patch fixes this issue by installing single, low

[ovs-dev] [PATCH] ipsec: Do not allow ipsec_gre tunnel traffic to exit unencrypted

2016-08-29 Thread Ansis Atteka
If ipsec_gre tunnel configuration is changed in OVSDB, then GRE packets may sometimes exit unencrypted until per-tunnel IPsec policies are installed by ovs-monitor-ipsec daemon. This patch fixes this issue by installing single, low priority IPsec block policy that drops all GRE packets coming out