ipsec: Allow to configure tunnel src & dst ports

Signed-off-by: Milan Lenco <milan.lenco@pantheon.tech>
ligato · Jul 21, 2020 · d9d463c · d9d463c
1 parent faf9478
commit d9d463c
Show file tree

Hide file tree

Showing 3 changed files with 96 additions and 65 deletions.
diff --git a/plugins/vpp/ipsecplugin/vppcalls/vpp2005/ipsec_vppcalls.go b/plugins/vpp/ipsecplugin/vppcalls/vpp2005/ipsec_vppcalls.go
@@ -224,6 +224,15 @@ func (h *IPSecVppHandler) sadAddDelEntry(sa *ipsec.SecurityAssociation, isAdd bo
 			return err
 		}
 	}
+	const undefinedPort = ^uint16(0)
+	udpSrcPort := undefinedPort
+	if sa.TunnelSrcPort != 0 {
+		udpSrcPort = uint16(sa.TunnelSrcPort)
+	}
+	udpDstPort := undefinedPort
+	if sa.TunnelDstPort != 0 {
+		udpDstPort = uint16(sa.TunnelDstPort)
+	}
 
 	req := &vpp_ipsec.IpsecSadEntryAddDel{
 		IsAdd: isAdd,
@@ -244,8 +253,8 @@ func (h *IPSecVppHandler) sadAddDelEntry(sa *ipsec.SecurityAssociation, isAdd bo
 			TunnelSrc:  tunnelSrc,
 			TunnelDst:  tunnelDst,
 			Flags:      flags,
-			UDPSrcPort: ^uint16(0),
-			UDPDstPort: ^uint16(0),
+			UDPSrcPort: udpSrcPort,
+			UDPDstPort: udpDstPort,
 		},
 	}
 	reply := &vpp_ipsec.IpsecSadEntryAddDelReply{}

diff --git a/proto/ligato/vpp/ipsec/ipsec.pb.go b/proto/ligato/vpp/ipsec/ipsec.pb.go
diff --git a/proto/ligato/vpp/ipsec/ipsec.proto b/proto/ligato/vpp/ipsec/ipsec.proto
@@ -93,6 +93,9 @@ message SecurityAssociation {
     string tunnel_dst_addr = 11;
 
     bool enable_udp_encap = 12;     /* Enable UDP encapsulation for NAT traversal */
+
+    uint32 tunnel_src_port = 13;
+    uint32 tunnel_dst_port = 14;
 }
 
 // TunnelProtection allows enabling IPSec tunnel protection on an existing interface