openstack/neutron-vpnaas
Code Issues Proposed changes

Merge "Add dialect map to support AEAD algorithms with Libreswan"

Browse Source
This commit is contained in:
Zuul
2025-10-13 08:47:32 +00:00
committed by Gerrit Code Review
parent 1eefd50e30 310ecf6cda
commit da12cdc6c1
2 changed files with 38 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
neutron_vpnaas/services/vpn/device_drivers/libreswan_ipsec.py
View File

@@ -25,8 +25,41 @@ class LibreSwanProcess(ipsec.OpenSwanProcess):
"""
IPSEC_CONF_NAT_TRAVERSAL = None
DIALECT_MAP = dict(ipsec.BaseSwanProcess.DIALECT_MAP)
# pylint: disable=useless-super-delegation
def __init__(self, conf, process_id, vpnservice, namespace):
dialect_map_update = {
# ENCR_AES_CTR
'aes-128-ctr': 'aes_ctr128',
'aes-192-ctr': 'aes_ctr192',
'aes-256-ctr': 'aes_ctr256',
# ENCR_AES_CCM_8
'aes-128-ccm-8': 'aes_ccm_a128',
'aes-192-ccm-8': 'aes_ccm_a192',
'aes-256-ccm-8': 'aes_ccm_a256',
# ENCR_AES_CCM_12
'aes-128-ccm-12': 'aes_ccm_b128',
'aes-192-ccm-12': 'aes_ccm_b192',
'aes-256-ccm-12': 'aes_ccm_b256',
# ENCR_AES_CCM_16
'aes-128-ccm-16': 'aes_ccm_c128',
'aes-192-ccm-16': 'aes_ccm_c192',
'aes-256-ccm-16': 'aes_ccm_c256',
# ENCR_AES_GCM_8
'aes-128-gcm-8': 'aes_gcm_a128',
'aes-192-gcm-8': 'aes_gcm_a192',
'aes-256-gcm-8': 'aes_gcm_a256',
# ENCR_AES_GCM_12
'aes-128-gcm-12': 'aes_gcm_b128',
'aes-192-gcm-12': 'aes_gcm_b192',
'aes-256-gcm-12': 'aes_gcm_b256',
# ENCR_AES_GCM_16
'aes-128-gcm-16': 'aes_gcm_c128',
'aes-192-gcm-16': 'aes_gcm_c192',
'aes-256-gcm-16': 'aes_gcm_c256'
}
self.DIALECT_MAP.update(dialect_map_update)
self._rootwrap_cfg = self._get_rootwrap_config()
super().__init__(conf, process_id, vpnservice, namespace)

5
releasenotes/notes/add-missing-dialect-map-libreswan-aead-ciphers-23fca20ad7da7214.yaml Normal file
View File

@@ -0,0 +1,5 @@
---
fixes:
- |
The required dialect map has been added to allow for usage of the
new AEAD ciphers with Libreswan.