You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by re...@apache.org on 2015/08/14 13:06:42 UTC
[1/6] git commit: updated refs/heads/master to 05a29f0
Repository: cloudstack
Updated Branches:
refs/heads/master 0fcc7297e -> 05a29f01b
CLOUDSTACK-8710: Fixed applying iptables rules for s2s vpn
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/da9e757b
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/da9e757b
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/da9e757b
Branch: refs/heads/master
Commit: da9e757b8e48c54a4ecbd3bdb027b573ac5a3314
Parents: 8fcc76e
Author: Jayapal <ja...@apache.org>
Authored: Thu Aug 13 14:07:12 2015 +0530
Committer: Jayapal <ja...@apache.org>
Committed: Thu Aug 13 14:07:12 2015 +0530
----------------------------------------------------------------------
systemvm/patches/debian/config/opt/cloud/bin/configure.py | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/da9e757b/systemvm/patches/debian/config/opt/cloud/bin/configure.py
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/opt/cloud/bin/configure.py b/systemvm/patches/debian/config/opt/cloud/bin/configure.py
index 2f3235e..2caaf3c 100755
--- a/systemvm/patches/debian/config/opt/cloud/bin/configure.py
+++ b/systemvm/patches/debian/config/opt/cloud/bin/configure.py
@@ -678,9 +678,6 @@ def main(argv):
red = CsRedundant(config)
red.set()
- nf = CsNetfilters()
- nf.compare(config.get_fw())
-
vpns = CsSite2SiteVpn("site2sitevpn", config)
vpns.process()
@@ -693,6 +690,9 @@ def main(argv):
mon = CsMonitor("monitorservice", config)
mon.process()
+ nf = CsNetfilters()
+ nf.compare(config.get_fw())
+
# Save iptables configuration - will be loaded on reboot by the iptables-restore that is configured on /etc/rc.local
CsHelper.save_iptables("iptables-save", "/etc/iptables/router_rules.v4")
CsHelper.save_iptables("ip6tables-save", "/etc/iptables/router_rules.v6")
[4/6] git commit: updated refs/heads/master to 05a29f0
Posted by re...@apache.org.
do not log sensitive site-to-site VPN PSK
Logging before:
2015-08-12 16:30:07,126 Searching for 192.168.23.6 and replacing with 192.168.23.6 192.168.23.5: PSK "preSharedKey"
Logging after:
2015-08-12 16:30:07,126 Searching for 192.168.23.6 and replacing with 192.168.23.6 192.168.23.5: PSK "****"
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/4f8ab51f
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/4f8ab51f
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/4f8ab51f
Branch: refs/heads/master
Commit: 4f8ab51f7f2a1d8b78e754981d92c3904408fb30
Parents: 9b97719
Author: Remi Bergsma <gi...@remi.nl>
Authored: Fri Aug 14 09:07:25 2015 +0200
Committer: Remi Bergsma <gi...@remi.nl>
Committed: Fri Aug 14 09:07:25 2015 +0200
----------------------------------------------------------------------
systemvm/patches/debian/config/opt/cloud/bin/cs/CsFile.py | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/4f8ab51f/systemvm/patches/debian/config/opt/cloud/bin/cs/CsFile.py
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/opt/cloud/bin/cs/CsFile.py b/systemvm/patches/debian/config/opt/cloud/bin/cs/CsFile.py
index 28d4413..1cbf971 100755
--- a/systemvm/patches/debian/config/opt/cloud/bin/cs/CsFile.py
+++ b/systemvm/patches/debian/config/opt/cloud/bin/cs/CsFile.py
@@ -114,7 +114,10 @@ class CsFile:
def search(self, search, replace):
found = False
- logging.debug("Searching for %s and replacing with %s" % (search, replace))
+ replace_filtered = replace
+ if re.search("PSK \"", replace):
+ replace_filtered = re.sub(r'".*"', '"****"', replace)
+ logging.debug("Searching for %s and replacing with %s" % (search, replace_filtered))
for index, line in enumerate(self.new_config):
if line.lstrip().startswith("#"):
continue
[3/6] git commit: updated refs/heads/master to 05a29f0
Posted by re...@apache.org.
tighten security of site-to-site VPN
It was like this in 4.4 and 4.5
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/9b97719c
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/9b97719c
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/9b97719c
Branch: refs/heads/master
Commit: 9b97719c5c7839215fa4ff4392995af28055f803
Parents: 3824583
Author: Remi Bergsma <gi...@remi.nl>
Authored: Fri Aug 14 09:05:59 2015 +0200
Committer: Remi Bergsma <gi...@remi.nl>
Committed: Fri Aug 14 09:05:59 2015 +0200
----------------------------------------------------------------------
systemvm/patches/debian/config/opt/cloud/bin/configure.py | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/9b97719c/systemvm/patches/debian/config/opt/cloud/bin/configure.py
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/opt/cloud/bin/configure.py b/systemvm/patches/debian/config/opt/cloud/bin/configure.py
index 154f0c9..9f7ffb7 100755
--- a/systemvm/patches/debian/config/opt/cloud/bin/configure.py
+++ b/systemvm/patches/debian/config/opt/cloud/bin/configure.py
@@ -425,9 +425,9 @@ class CsSite2SiteVpn(CsDataBag):
CsHelper.execute("ipsec auto --rereadall")
def configure_iptables(self, dev, obj):
- self.fw.append(["", "front", "-A INPUT -i %s -p udp -m udp --dport 500 -j ACCEPT" % dev])
- self.fw.append(["", "front", "-A INPUT -i %s -p udp -m udp --dport 4500 -j ACCEPT" % dev])
- self.fw.append(["", "front", "-A INPUT -i %s -p esp -j ACCEPT" % dev])
+ self.fw.append(["", "front", "-A INPUT -i %s -p udp -m udp --dport 500 -s %s -d %s -j ACCEPT" % (dev, obj['peer_gateway_ip'], obj['local_public_ip'])])
+ self.fw.append(["", "front", "-A INPUT -i %s -p udp -m udp --dport 4500 -s %s -d %s -j ACCEPT" % (dev, obj['peer_gateway_ip'], obj['local_public_ip'])])
+ self.fw.append(["", "front", "-A INPUT -i %s -p esp -s %s -d %s -j ACCEPT" % (dev, obj['peer_gateway_ip'], obj['local_public_ip'])])
self.fw.append(["nat", "front", "-A POSTROUTING -t nat -o %s -m mark --mark 0x525 -j ACCEPT" % dev])
for net in obj['peer_guest_cidr_list'].lstrip().rstrip().split(','):
self.fw.append(["mangle", "front",
[6/6] git commit: updated refs/heads/master to 05a29f0
Posted by re...@apache.org.
Merge pull request #693 from remibergsma/s2svpn-fixes
Fix site-to-site VPN featureThis is work done together with @jayapalu on fixing the site2site VPN. The first part was done in PR #690 by @jayapalu. On top of that, some other fixes were needed and those are added in this PR. It made sense to make a new PR which includes all fixes so we can actually test it.
The original PR #690 is already merged into this one, so can be closed. Since the commit ids are kept the same, merging this will close both.
I closely compared the 4.4/4.5 implementation with the new 4.6 one. I did not only make it work, but also added some security improvements (some of which were also in 4.4/4.5). I noticed the pre shared key was being logged, so removed that as well.
This is how I tested and verified it:
https://github.com/schubergphilis/MCT-shared/tree/master/helper_scripts/cloudstack/vpn_tests
When I have some time available, I'll write a Marvin test for it that we can include in the repo.
It now works(tm) with one manual step due to CLOUDSTACK-8685:
We need a default gateway before site-to-site VPN will actually work. It will connect, but not forward packets. The reason for this, is due to the iptables setup. VM1 has router1 as gateway, but router1 does not know the route to VM2 so it will give up. With a default gateway, the packets are about to be forwarded to the default gateway but when they reach eth1 the public nic, iptables kicks in, does some magic and forwards it through the ipsec tunnel. So, you need a default gw set to upstream.
Workaround for now is setting the route manually:
``route add default gw 1.2.3.4`` or ``ip route add default via 1.2.3.4``
In other words, we need to fix CLOUDSTACK-8685 soon, too.
Thanks to @snuf @jayapalu!
@jayapalu @snuf could you please review this?
* pr/693:
do not log sensitive site-to-site VPN PSK
tighten security of site-to-site VPN
CLOUDSTACK-8730: fix s2s iptables rules and ipsec config
CLOUDSTACK-8710: Fixed applying iptables rules for s2s vpn
Signed-off-by: Remi Bergsma <gi...@remi.nl>
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/05a29f01
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/05a29f01
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/05a29f01
Branch: refs/heads/master
Commit: 05a29f01b4de0e88e2f0fb99886573a25c87fea6
Parents: 0fcc729 7ddec66
Author: Remi Bergsma <gi...@remi.nl>
Authored: Fri Aug 14 13:05:53 2015 +0200
Committer: Remi Bergsma <gi...@remi.nl>
Committed: Fri Aug 14 13:05:53 2015 +0200
----------------------------------------------------------------------
.../debian/config/opt/cloud/bin/configure.py | 18 +++++++++---------
.../debian/config/opt/cloud/bin/cs/CsFile.py | 5 ++++-
2 files changed, 13 insertions(+), 10 deletions(-)
----------------------------------------------------------------------
[2/6] git commit: updated refs/heads/master to 05a29f0
Posted by re...@apache.org.
CLOUDSTACK-8730: fix s2s iptables rules and ipsec config
For site2site VPN to work, we need a default gateway to be set.
See CLOUDSTACK-8685
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/38245831
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/38245831
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/38245831
Branch: refs/heads/master
Commit: 382458317ead1ded0149b0fa43d41cd527d22e50
Parents: ff66175
Author: Remi Bergsma <gi...@remi.nl>
Authored: Thu Aug 13 21:35:44 2015 +0200
Committer: Remi Bergsma <gi...@remi.nl>
Committed: Fri Aug 14 09:02:21 2015 +0200
----------------------------------------------------------------------
systemvm/patches/debian/config/opt/cloud/bin/configure.py | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/38245831/systemvm/patches/debian/config/opt/cloud/bin/configure.py
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/opt/cloud/bin/configure.py b/systemvm/patches/debian/config/opt/cloud/bin/configure.py
index 2f3235e..154f0c9 100755
--- a/systemvm/patches/debian/config/opt/cloud/bin/configure.py
+++ b/systemvm/patches/debian/config/opt/cloud/bin/configure.py
@@ -428,7 +428,7 @@ class CsSite2SiteVpn(CsDataBag):
self.fw.append(["", "front", "-A INPUT -i %s -p udp -m udp --dport 500 -j ACCEPT" % dev])
self.fw.append(["", "front", "-A INPUT -i %s -p udp -m udp --dport 4500 -j ACCEPT" % dev])
self.fw.append(["", "front", "-A INPUT -i %s -p esp -j ACCEPT" % dev])
- self.fw.append(["nat", "front", "-A POSTROUTING -t nat -o %s-m mark --set-xmark 0x525/0xffffffff -j ACCEPT" % dev])
+ self.fw.append(["nat", "front", "-A POSTROUTING -t nat -o %s -m mark --mark 0x525 -j ACCEPT" % dev])
for net in obj['peer_guest_cidr_list'].lstrip().rstrip().split(','):
self.fw.append(["mangle", "front",
"-A FORWARD -s %s -d %s -j MARK --set-xmark 0x525/0xffffffff" % (obj['local_guest_cidr'], net)])
@@ -453,7 +453,7 @@ class CsSite2SiteVpn(CsDataBag):
file.addeq(" leftsubnet=%s" % obj['local_guest_cidr'])
file.addeq(" leftnexthop=%s" % obj['local_public_gateway'])
file.addeq(" right=%s" % rightpeer)
- file.addeq(" rightsubnets=%s" % peerlist)
+ file.addeq(" rightsubnets={%s}" % peerlist)
file.addeq(" type=tunnel")
file.addeq(" authby=secret")
file.addeq(" keyexchange=ike")
@@ -463,7 +463,7 @@ class CsSite2SiteVpn(CsDataBag):
file.addeq(" salifetime=%s" % self.convert_sec_to_h(obj['esp_lifetime']))
file.addeq(" pfs=%s" % CsHelper.bool_to_yn(obj['dpd']))
file.addeq(" keyingtries=2")
- file.addeq(" auto=add")
+ file.addeq(" auto=start")
if obj['dpd']:
file.addeq(" dpddelay=30")
file.addeq(" dpdtimeout=120")
[5/6] git commit: updated refs/heads/master to 05a29f0
Posted by re...@apache.org.
Merge pull request #690 from jayapalu/vpn
CLOUDSTACK-8710: Fixed applying iptables rules for s2s vpn
@remibergsma @wilderrodrigues
Moved applying iptables rules apply after vpn configuration so that vpn specific rules also get applied
* pr/690:
CLOUDSTACK-8710: Fixed applying iptables rules for s2s vpn
This closes #690
Signed-off-by: Remi Bergsma <gi...@remi.nl>
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/7ddec661
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/7ddec661
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/7ddec661
Branch: refs/heads/master
Commit: 7ddec661ca6d17fbf9ecbc0ee60e34d68f97a94d
Parents: 4f8ab51 da9e757
Author: Remi Bergsma <gi...@remi.nl>
Authored: Fri Aug 14 09:10:28 2015 +0200
Committer: Remi Bergsma <gi...@remi.nl>
Committed: Fri Aug 14 09:11:21 2015 +0200
----------------------------------------------------------------------
systemvm/patches/debian/config/opt/cloud/bin/configure.py | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/7ddec661/systemvm/patches/debian/config/opt/cloud/bin/configure.py
----------------------------------------------------------------------