FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

make the VPN feature work more reliable and secure by remibergsma · Pull Request #54 · apache/cloudstack · GitHub

/ cloudstack Public

make the VPN feature work more reliable and secure #54

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
asfgit merged 6 commits into from
Dec 9, 2014
Conversation 0 Commits 6 Checks 0 Files changed
Merged

make the VPN feature work more reliable and secure #54

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
8b412ce
remove biglock usage from ipsectunnel.sh
remibergsma Dec 8, 2014
8b2563a
renamed $leftgw to $leftnexthop to make clear what it does
remibergsma Dec 8, 2014
b95addd
starting the tunnel will make it keep trying until it connects
remibergsma Dec 8, 2014
f8d718e
add a flag -c whether or not to check the VPN on create
remibergsma Dec 8, 2014
7f33f7c
prevent CloudStack from removing the VPN connection
remibergsma Dec 8, 2014
ef3b4bb
made iptables for the VPN connection more secure
remibergsma Dec 8, 2014
File filter

Filter by extension

Filter by extension .sh  (1) All 1 file type selected
Viewed files
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Unified
Split
Hide whitespace
Diff view
Unified
Split
Hide whitespace
55 changes: 32 additions & 23 deletions systemvm/patches/debian/config/opt/cloud/bin/ipsectunnel.sh
Show comments
View file
Open in desktop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Original file line number Diff line number Diff line change
Expand Up @@ -18,19 +18,12 @@

source /root/func.sh

lock="biglock"
locked=$(getLockFile $lock)
if [ "$locked" != "1" ]
then
exit 1
fi

vpnconfdir="/etc/ipsec.d"
vpnoutmark="0x525"
vpninmark="0x524"

usage() {
printf "Usage: %s: (-A|-D) -l <left-side vpn peer> -n <left-side guest cidr> -g <left-side gateway> -r <right-side vpn peer> -N <right-side private subnets> -e <esp policy> -i <ike policy> -t <ike lifetime> -T <esp lifetime> -s <pre-shared secret> -d <dpd 0 or 1> [ -p <passive or not> ]\n" $(basename $0) >&2
printf "Usage: %s: (-A|-D) -l <left-side vpn peer> -n <left-side guest cidr> -g <left-side next hop> -r <right-side vpn peer> -N <right-side private subnets> -e <esp policy> -i <ike policy> -t <ike lifetime> -T <esp lifetime> -s <pre-shared secret> -d <dpd 0 or 1> [ -p <passive or not> -c <check if up on creation> -S <disable vpn ports iptables> ]\n" $(basename $0) >&2
}

#set -x
Expand Down Expand Up @@ -68,13 +61,16 @@ enable_iptables_subnets() {
return 0
}

#
# Add the right side here to close the gap, so we're sure no one else comes in
# also double check the default behaviour of ipsec to drop if wrong....
check_and_enable_iptables() {
sudo iptables-save | grep "A INPUT -i $outIf -p udp -m udp --dport 500 -j ACCEPT"
if [ $? -ne 0 ]
then
sudo iptables -A INPUT -i $outIf -p udp -m udp --dport 500 -j ACCEPT
sudo iptables -A INPUT -i $outIf -p udp -m udp --dport 4500 -j ACCEPT
sudo iptables -A INPUT -i $outIf -p 50 -j ACCEPT
sudo iptables -A INPUT -i $outIf -p udp -m udp --dport 500 $iptables_secure -j ACCEPT
sudo iptables -A INPUT -i $outIf -p udp -m udp --dport 4500 $iptables_secure -j ACCEPT
sudo iptables -A INPUT -i $outIf -p 50 $iptables_secure -j ACCEPT
# Prevent NAT on "marked" VPN traffic, so need to be the first one on POSTROUTING chain
sudo iptables -t nat -I POSTROUTING -t nat -o $outIf -m mark --mark $vpnoutmark -j ACCEPT
fi
Expand All @@ -97,9 +93,9 @@ check_and_disable_iptables() {
if [ $? -ne 0 ]
then
#Nobody else use s2s vpn now, so delete the iptables rules
sudo iptables -D INPUT -i $outIf -p udp -m udp --dport 500 -j ACCEPT
sudo iptables -D INPUT -i $outIf -p udp -m udp --dport 4500 -j ACCEPT
sudo iptables -D INPUT -i $outIf -p 50 -j ACCEPT
sudo iptables -D INPUT -i $outIf -p udp -m udp --dport 500 $iptables_secure -j ACCEPT
sudo iptables -D INPUT -i $outIf -p udp -m udp --dport 4500 $iptables_secure -j ACCEPT
sudo iptables -D INPUT -i $outIf -p 50 $iptables_secure -j ACCEPT
sudo iptables -t nat -D POSTROUTING -t nat -o $outIf -m mark --mark $vpnoutmark -j ACCEPT
fi
return 0
Expand Down Expand Up @@ -136,7 +132,7 @@ ipsec_tunnel_add() {
local vpnsecretsfile=$vpnconfdir/ipsec.vpn-$rightpeer.secrets

logger -t cloud "$(basename $0): creating configuration for ipsec tunnel: left peer=$leftpeer \
left net=$leftnet left gateway=$leftgw right peer=$rightpeer right network=$rightnets phase1 policy=$ikepolicy \
left net=$leftnet left gateway=$leftnexthop right peer=$rightpeer right network=$rightnets phase1 policy=$ikepolicy \
phase2 policy=$esppolicy secret=$secret"

[ "$op" == "-A" ] && ipsec_tunnel_del
Expand All @@ -146,7 +142,7 @@ ipsec_tunnel_add() {
sudo echo "conn vpn-$rightpeer" > $vpnconffile &&
sudo echo " left=$leftpeer" >> $vpnconffile &&
sudo echo " leftsubnet=$leftnet" >> $vpnconffile &&
sudo echo " leftnexthop=$leftgw" >> $vpnconffile &&
sudo echo " leftnexthop=$leftnexthop" >> $vpnconffile &&
sudo echo " right=$rightpeer" >> $vpnconffile &&
sudo echo " rightsubnets={$rightnets}" >> $vpnconffile &&
sudo echo " type=tunnel" >> $vpnconffile &&
Expand All @@ -158,7 +154,7 @@ ipsec_tunnel_add() {
sudo echo " salifetime=${esplifetime}s" >> $vpnconffile &&
sudo echo " pfs=$pfs" >> $vpnconffile &&
sudo echo " keyingtries=2" >> $vpnconffile &&
sudo echo " auto=add" >> $vpnconffile &&
sudo echo " auto=start" >> $vpnconffile &&
sudo echo "$leftpeer $rightpeer: PSK \"$secret\"" > $vpnsecretsfile &&
sudo chmod 0400 $vpnsecretsfile

Expand All @@ -180,7 +176,10 @@ ipsec_tunnel_add() {

if [ $passive -eq 0 ]
then
sudo ipsec auto --up vpn-$rightpeer
sudo ipsec auto --up vpn-$rightpeer &
fi
if [ $checkup -eq 1 ]
then

#5 seconds for checking if it's ready
for i in {1..5}
Expand Down Expand Up @@ -216,8 +215,10 @@ Iflag=
sflag=
passive=0
op=""
checkup=0
secure=1

while getopts 'ADpl:n:g:r:N:e:i:t:T:s:d:' OPTION
while getopts 'ADSpcl:n:g:r:N:e:i:t:T:s:d:' OPTION
do
case $OPTION in
A) opflag=1
Expand All @@ -233,7 +234,7 @@ do
leftnet="$OPTARG"
;;
g) gflag=1
leftgw="$OPTARG"
leftnexthop="$OPTARG"
;;
r) rflag=1
rightpeer="$OPTARG"
Expand Down Expand Up @@ -261,13 +262,21 @@ do
;;
p) passive=1
;;
c) checkup=1
;;
S) secure=0
;;
?) usage
unlock_exit 2 $lock $locked
exit 2
;;
esac
done

logger -t cloud "$(basename $0): parameters $*"
if [ $secure -eq 1 ]
then
iptables_secure=" -s $rightpeer -d $leftpeer "
fi

# get interface for public ip
ip link|grep BROADCAST|grep -v eth0|cut -d ":" -f 2 > /tmp/iflist
Expand Down Expand Up @@ -301,7 +310,7 @@ then
ret=$?
else
printf "Invalid action specified, must choose -A or -D to add/del tunnels\n" >&2
unlock_exit 5 $lock $locked
exit 5
fi

unlock_exit $ret $lock $locked
exit $ret
Back | FazBrowse Home | New Git URL