Implement the CE_IPSEC_FORCEENCAPS flag
This tells the connection to force UDP encapsulation, IPSEC will
negotiate between the ends so the other endpoint will know that
encapsulation is to be used.
@@ -59,11 +59,13 @@ type libreswan struct {
defaultNATTPort int32
debug bool
+ forceUDPEncapsulation bool
}
type specification struct {
- PSK string
Debug bool
+ ForceEncaps bool
+ PSK string
LogFile string
NATTPort string `default:"4500"`
}
@@ -100,6 +102,7 @@ func NewLibreswan(localEndpoint types.SubmarinerEndpoint, localCluster types.Sub
defaultNATTPort: int32(defaultNATTPort),
localEndpoint: localEndpoint,
connections: []subv1.Connection{},
+ forceUDPEncapsulation: ipSecSpec.ForceEncaps,
}, nil
}
@@ -340,7 +343,7 @@ func (i *libreswan) bidirectionalConnectToEndpoint(connectionName string, endpoi
args := []string{}
args = append(args, "--psk", "--encrypt")
- if endpointInfo.UseNAT {
+ if endpointInfo.UseNAT || i.forceUDPEncapsulation {
args = append(args, "--forceencaps")
}
@@ -387,7 +390,7 @@ func (i *libreswan) serverConnectToEndpoint(connectionName string, endpointInfo
args := []string{}
args = append(args, "--psk", "--encrypt")
- if endpointInfo.UseNAT {
+ if endpointInfo.UseNAT || i.forceUDPEncapsulation {
args = append(args, "--forceencaps")
}
@@ -427,7 +430,7 @@ func (i *libreswan) clientConnectToEndpoint(connectionName string, endpointInfo
args := []string{}
args = append(args, "--psk", "--encrypt")
- if endpointInfo.UseNAT {
+ if endpointInfo.UseNAT || i.forceUDPEncapsulation {
args = append(args, "--forceencaps")
}
