You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by da...@apache.org on 2014/12/09 11:29:06 UTC
[1/7] git commit: updated refs/heads/master to 1a99c39
Repository: cloudstack
Updated Branches:
refs/heads/master bca015306 -> 1a99c39da
remove biglock usage from ipsectunnel.sh
Biglock breaks creating VPN's when other scripts run at the
same time that also use the same biglock. These other scripts
do nothing that could harm our deployment and even multiple
vpn's can safely be created simultaniously.
(cherry picked from commit 8b412ce194eaf195dc77531379687de43e14a088)
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/bf7cd8a9
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/bf7cd8a9
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/bf7cd8a9
Branch: refs/heads/master
Commit: bf7cd8a9f0de150e5c320354cb35d9977d6e3117
Parents: 016d009
Author: Remi Bergsma <rb...@schubergphilis.com>
Authored: Mon Dec 8 18:53:18 2014 +0100
Committer: Daan Hoogland <da...@onecht.net>
Committed: Tue Dec 9 11:18:10 2014 +0100
----------------------------------------------------------------------
.../patches/debian/config/opt/cloud/bin/ipsectunnel.sh | 13 +++----------
1 file changed, 3 insertions(+), 10 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/bf7cd8a9/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh b/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh
index e20c10f..9aa3f89 100755
--- a/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh
+++ b/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh
@@ -18,13 +18,6 @@
source /root/func.sh
-lock="biglock"
-locked=$(getLockFile $lock)
-if [ "$locked" != "1" ]
-then
- exit 1
-fi
-
vpnconfdir="/etc/ipsec.d"
vpnoutmark="0x525"
vpninmark="0x524"
@@ -262,7 +255,7 @@ do
p) passive=1
;;
?) usage
- unlock_exit 2 $lock $locked
+ exit 2
;;
esac
done
@@ -301,7 +294,7 @@ then
ret=$?
else
printf "Invalid action specified, must choose -A or -D to add/del tunnels\n" >&2
- unlock_exit 5 $lock $locked
+ exit 5
fi
-unlock_exit $ret $lock $locked
+exit $ret
[3/7] git commit: updated refs/heads/master to 1a99c39
Posted by da...@apache.org.
starting the tunnel will make it keep trying until it connects
Changed 'auto=add' to 'auto=start' to make sure the tunnel starts.
When both sides are there they will connect. This resolves the
issue that there is only a small time frame in which the VPN
would connect.
(cherry picked from commit b95addd3efb45f61b129584ade49bad7bbaa16f8)
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/e89f09aa
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/e89f09aa
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/e89f09aa
Branch: refs/heads/master
Commit: e89f09aa516ec06dcd2cced38de70f1bde9f0aaa
Parents: 08ab9a3
Author: Remi Bergsma <rb...@schubergphilis.com>
Authored: Mon Dec 8 18:55:35 2014 +0100
Committer: Daan Hoogland <da...@onecht.net>
Committed: Tue Dec 9 11:19:07 2014 +0100
----------------------------------------------------------------------
systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/e89f09aa/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh b/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh
index cfee6d1..d30a9ca 100755
--- a/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh
+++ b/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh
@@ -151,7 +151,7 @@ ipsec_tunnel_add() {
sudo echo " salifetime=${esplifetime}s" >> $vpnconffile &&
sudo echo " pfs=$pfs" >> $vpnconffile &&
sudo echo " keyingtries=2" >> $vpnconffile &&
- sudo echo " auto=add" >> $vpnconffile &&
+ sudo echo " auto=start" >> $vpnconffile &&
sudo echo "$leftpeer $rightpeer: PSK \"$secret\"" > $vpnsecretsfile &&
sudo chmod 0400 $vpnsecretsfile
[5/7] git commit: updated refs/heads/master to 1a99c39
Posted by da...@apache.org.
prevent CloudStack from removing the VPN connection
If connecting the VPN takes some time, for example because
the other end is not (yet) up, CloudStack will delete
the VPN because the ipsectunnel.sh does not return in time.
The VPN connection then enters the Error state.
This change makes sure ipsectunnel.sh returns in time,
and lets ipsec connect in the background. If it all fails,
the connection enters Disconnected.
(cherry picked from commit 7f33f7c3969d3b217ad6977f01bb487ebeee665d)
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/85ba1f76
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/85ba1f76
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/85ba1f76
Branch: refs/heads/master
Commit: 85ba1f76a441e36e9998a0a5d40943889d5d8290
Parents: cbc4fa2
Author: Remi Bergsma <rb...@schubergphilis.com>
Authored: Mon Dec 8 19:00:59 2014 +0100
Committer: Daan Hoogland <da...@onecht.net>
Committed: Tue Dec 9 11:19:30 2014 +0100
----------------------------------------------------------------------
systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/85ba1f76/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh b/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh
index 809cb4d..a95c65e 100755
--- a/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh
+++ b/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh
@@ -173,7 +173,7 @@ ipsec_tunnel_add() {
if [ $passive -eq 0 ]
then
- sudo ipsec auto --up vpn-$rightpeer
+ sudo ipsec auto --up vpn-$rightpeer &
fi
if [ $checkup -eq 1 ]
then
[7/7] git commit: updated refs/heads/master to 1a99c39
Posted by da...@apache.org.
Merge remote-tracking branch 'origin/4.5'
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/1a99c39d
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/1a99c39d
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/1a99c39d
Branch: refs/heads/master
Commit: 1a99c39da12baeaffe8458b372c941a886a8aed9
Parents: bca0153 a592b01
Author: Daan Hoogland <da...@onecht.net>
Authored: Tue Dec 9 11:28:36 2014 +0100
Committer: Daan Hoogland <da...@onecht.net>
Committed: Tue Dec 9 11:28:36 2014 +0100
----------------------------------------------------------------------
----------------------------------------------------------------------
[2/7] git commit: updated refs/heads/master to 1a99c39
Posted by da...@apache.org.
renamed $leftgw to $leftnexthop to make clear what it does
(cherry picked from commit 8b2563a216b012ab1905e65f446c8b6b1435b983)
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/08ab9a37
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/08ab9a37
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/08ab9a37
Branch: refs/heads/master
Commit: 08ab9a37690e059768622de8b90967d9e0a0afdf
Parents: bf7cd8a
Author: Remi Bergsma <rb...@schubergphilis.com>
Authored: Mon Dec 8 18:54:27 2014 +0100
Committer: Daan Hoogland <da...@onecht.net>
Committed: Tue Dec 9 11:18:59 2014 +0100
----------------------------------------------------------------------
systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/08ab9a37/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh b/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh
index 9aa3f89..cfee6d1 100755
--- a/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh
+++ b/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh
@@ -23,7 +23,7 @@ vpnoutmark="0x525"
vpninmark="0x524"
usage() {
- printf "Usage: %s: (-A|-D) -l <left-side vpn peer> -n <left-side guest cidr> -g <left-side gateway> -r <right-side vpn peer> -N <right-side private subnets> -e <esp policy> -i <ike policy> -t <ike lifetime> -T <esp lifetime> -s <pre-shared secret> -d <dpd 0 or 1> [ -p <passive or not> ]\n" $(basename $0) >&2
+ printf "Usage: %s: (-A|-D) -l <left-side vpn peer> -n <left-side guest cidr> -g <left-side next hop> -r <right-side vpn peer> -N <right-side private subnets> -e <esp policy> -i <ike policy> -t <ike lifetime> -T <esp lifetime> -s <pre-shared secret> -d <dpd 0 or 1> [ -p <passive or not> ]\n" $(basename $0) >&2
}
#set -x
@@ -129,7 +129,7 @@ ipsec_tunnel_add() {
local vpnsecretsfile=$vpnconfdir/ipsec.vpn-$rightpeer.secrets
logger -t cloud "$(basename $0): creating configuration for ipsec tunnel: left peer=$leftpeer \
- left net=$leftnet left gateway=$leftgw right peer=$rightpeer right network=$rightnets phase1 policy=$ikepolicy \
+ left net=$leftnet left gateway=$leftnexthop right peer=$rightpeer right network=$rightnets phase1 policy=$ikepolicy \
phase2 policy=$esppolicy secret=$secret"
[ "$op" == "-A" ] && ipsec_tunnel_del
@@ -139,7 +139,7 @@ ipsec_tunnel_add() {
sudo echo "conn vpn-$rightpeer" > $vpnconffile &&
sudo echo " left=$leftpeer" >> $vpnconffile &&
sudo echo " leftsubnet=$leftnet" >> $vpnconffile &&
- sudo echo " leftnexthop=$leftgw" >> $vpnconffile &&
+ sudo echo " leftnexthop=$leftnexthop" >> $vpnconffile &&
sudo echo " right=$rightpeer" >> $vpnconffile &&
sudo echo " rightsubnets={$rightnets}" >> $vpnconffile &&
sudo echo " type=tunnel" >> $vpnconffile &&
@@ -226,7 +226,7 @@ do
leftnet="$OPTARG"
;;
g) gflag=1
- leftgw="$OPTARG"
+ leftnexthop="$OPTARG"
;;
r) rflag=1
rightpeer="$OPTARG"
[6/7] git commit: updated refs/heads/master to 1a99c39
Posted by da...@apache.org.
made iptables for the VPN connection more secure
Added destination and source definition. Flag -S can be used
to ignore this. It's the new default as it is more secure
and does not impact the way things work (backwords compatible).
(cherry picked from commit ef3b4bb4e3342f166489034fa7149540d2ef1383)
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/a592b010
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/a592b010
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/a592b010
Branch: refs/heads/master
Commit: a592b010350296d06fef987b5bd6b21f7cfca8a8
Parents: 85ba1f7
Author: Remi Bergsma <rb...@schubergphilis.com>
Authored: Mon Dec 8 19:06:55 2014 +0100
Committer: Daan Hoogland <da...@onecht.net>
Committed: Tue Dec 9 11:19:43 2014 +0100
----------------------------------------------------------------------
.../debian/config/opt/cloud/bin/ipsectunnel.sh | 26 ++++++++++++++------
1 file changed, 18 insertions(+), 8 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/a592b010/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh b/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh
index a95c65e..e0af6a2 100755
--- a/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh
+++ b/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh
@@ -23,7 +23,7 @@ vpnoutmark="0x525"
vpninmark="0x524"
usage() {
- printf "Usage: %s: (-A|-D) -l <left-side vpn peer> -n <left-side guest cidr> -g <left-side next hop> -r <right-side vpn peer> -N <right-side private subnets> -e <esp policy> -i <ike policy> -t <ike lifetime> -T <esp lifetime> -s <pre-shared secret> -d <dpd 0 or 1> [ -p <passive or not> -c <check if up on creation ]\n" $(basename $0) >&2
+ printf "Usage: %s: (-A|-D) -l <left-side vpn peer> -n <left-side guest cidr> -g <left-side next hop> -r <right-side vpn peer> -N <right-side private subnets> -e <esp policy> -i <ike policy> -t <ike lifetime> -T <esp lifetime> -s <pre-shared secret> -d <dpd 0 or 1> [ -p <passive or not> -c <check if up on creation> -S <disable vpn ports iptables> ]\n" $(basename $0) >&2
}
#set -x
@@ -61,13 +61,16 @@ enable_iptables_subnets() {
return 0
}
+#
+# Add the right side here to close the gap, so we're sure no one else comes in
+# also double check the default behaviour of ipsec to drop if wrong....
check_and_enable_iptables() {
sudo iptables-save | grep "A INPUT -i $outIf -p udp -m udp --dport 500 -j ACCEPT"
if [ $? -ne 0 ]
then
- sudo iptables -A INPUT -i $outIf -p udp -m udp --dport 500 -j ACCEPT
- sudo iptables -A INPUT -i $outIf -p udp -m udp --dport 4500 -j ACCEPT
- sudo iptables -A INPUT -i $outIf -p 50 -j ACCEPT
+ sudo iptables -A INPUT -i $outIf -p udp -m udp --dport 500 $iptables_secure -j ACCEPT
+ sudo iptables -A INPUT -i $outIf -p udp -m udp --dport 4500 $iptables_secure -j ACCEPT
+ sudo iptables -A INPUT -i $outIf -p 50 $iptables_secure -j ACCEPT
# Prevent NAT on "marked" VPN traffic, so need to be the first one on POSTROUTING chain
sudo iptables -t nat -I POSTROUTING -t nat -o $outIf -m mark --mark $vpnoutmark -j ACCEPT
fi
@@ -90,9 +93,9 @@ check_and_disable_iptables() {
if [ $? -ne 0 ]
then
#Nobody else use s2s vpn now, so delete the iptables rules
- sudo iptables -D INPUT -i $outIf -p udp -m udp --dport 500 -j ACCEPT
- sudo iptables -D INPUT -i $outIf -p udp -m udp --dport 4500 -j ACCEPT
- sudo iptables -D INPUT -i $outIf -p 50 -j ACCEPT
+ sudo iptables -D INPUT -i $outIf -p udp -m udp --dport 500 $iptables_secure -j ACCEPT
+ sudo iptables -D INPUT -i $outIf -p udp -m udp --dport 4500 $iptables_secure -j ACCEPT
+ sudo iptables -D INPUT -i $outIf -p 50 $iptables_secure -j ACCEPT
sudo iptables -t nat -D POSTROUTING -t nat -o $outIf -m mark --mark $vpnoutmark -j ACCEPT
fi
return 0
@@ -213,8 +216,9 @@ sflag=
passive=0
op=""
checkup=0
+secure=1
-while getopts 'ADpcl:n:g:r:N:e:i:t:T:s:d:' OPTION
+while getopts 'ADSpcl:n:g:r:N:e:i:t:T:s:d:' OPTION
do
case $OPTION in
A) opflag=1
@@ -260,6 +264,8 @@ do
;;
c) checkup=1
;;
+ S) secure=0
+ ;;
?) usage
exit 2
;;
@@ -267,6 +273,10 @@ do
done
logger -t cloud "$(basename $0): parameters $*"
+if [ $secure -eq 1 ]
+then
+ iptables_secure=" -s $rightpeer -d $leftpeer "
+fi
# get interface for public ip
ip link|grep BROADCAST|grep -v eth0|cut -d ":" -f 2 > /tmp/iflist
[4/7] git commit: updated refs/heads/master to 1a99c39
Posted by da...@apache.org.
add a flag -c whether or not to check the VPN on create
Changed default to no, as the other side may not be up yet.
If this check fails, the VPN enters Error state and will not
work. It's safe to just let it connect on its own so it will
connect when it can.
(cherry picked from commit f8d718e3e31ad517969663d24647fcbd9b50cc3d)
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/cbc4fa2e
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/cbc4fa2e
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/cbc4fa2e
Branch: refs/heads/master
Commit: cbc4fa2e9c88bada9faaf1574930b3875f6a5ca3
Parents: e89f09a
Author: Remi Bergsma <rb...@schubergphilis.com>
Authored: Mon Dec 8 18:59:16 2014 +0100
Committer: Daan Hoogland <da...@onecht.net>
Committed: Tue Dec 9 11:19:20 2014 +0100
----------------------------------------------------------------------
.../patches/debian/config/opt/cloud/bin/ipsectunnel.sh | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/cbc4fa2e/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh b/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh
index d30a9ca..809cb4d 100755
--- a/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh
+++ b/systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh
@@ -23,7 +23,7 @@ vpnoutmark="0x525"
vpninmark="0x524"
usage() {
- printf "Usage: %s: (-A|-D) -l <left-side vpn peer> -n <left-side guest cidr> -g <left-side next hop> -r <right-side vpn peer> -N <right-side private subnets> -e <esp policy> -i <ike policy> -t <ike lifetime> -T <esp lifetime> -s <pre-shared secret> -d <dpd 0 or 1> [ -p <passive or not> ]\n" $(basename $0) >&2
+ printf "Usage: %s: (-A|-D) -l <left-side vpn peer> -n <left-side guest cidr> -g <left-side next hop> -r <right-side vpn peer> -N <right-side private subnets> -e <esp policy> -i <ike policy> -t <ike lifetime> -T <esp lifetime> -s <pre-shared secret> -d <dpd 0 or 1> [ -p <passive or not> -c <check if up on creation ]\n" $(basename $0) >&2
}
#set -x
@@ -174,6 +174,9 @@ ipsec_tunnel_add() {
if [ $passive -eq 0 ]
then
sudo ipsec auto --up vpn-$rightpeer
+ fi
+ if [ $checkup -eq 1 ]
+ then
#5 seconds for checking if it's ready
for i in {1..5}
@@ -209,8 +212,9 @@ Iflag=
sflag=
passive=0
op=""
+checkup=0
-while getopts 'ADpl:n:g:r:N:e:i:t:T:s:d:' OPTION
+while getopts 'ADpcl:n:g:r:N:e:i:t:T:s:d:' OPTION
do
case $OPTION in
A) opflag=1
@@ -254,6 +258,8 @@ do
;;
p) passive=1
;;
+ c) checkup=1
+ ;;
?) usage
exit 2
;;