Skip to content

Commit 5a3f479

Browse files
swillswill
committed
merging jayapalu and swill's strongswan vpn changes into a single commit
1 parent 40d12ad commit 5a3f479

File tree

7 files changed

+52
-50
lines changed

7 files changed

+52
-50
lines changed

‎server/src/com/cloud/network/vpn/Site2SiteVpnManagerImpl.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -517,7 +517,7 @@ public boolean deleteVpnConnection(DeleteVpnConnectionCmd cmd) throws ResourceUn
517517

518518
_accountMgr.checkAccess(caller, null, false, conn);
519519

520-
if (conn.getState() == State.Connected) {
520+
if (conn.getState() != State.Pending) {
521521
stopVpnConnection(id);
522522
}
523523
_vpnConnectionDao.remove(id);
@@ -531,8 +531,8 @@ private void stopVpnConnection(Long id) throws ResourceUnavailableException {
531531
throw new CloudRuntimeException("Unable to acquire lock on " + conn);
532532
}
533533
try {
534-
if (conn.getState() != State.Connected && conn.getState() != State.Error) {
535-
throw new InvalidParameterValueException("Site to site VPN connection with specified id is not in correct state(connected) to process disconnect!");
534+
if (conn.getState() == State.Pending) {
535+
throw new InvalidParameterValueException("Site to site VPN connection with specified id is currently Pending, unable to Disconnect!");
536536
}
537537

538538
conn.setState(State.Disconnected);

‎systemvm/patches/debian/config/opt/cloud/bin/checks2svpn.sh‎

Lines changed: 2 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -22,18 +22,9 @@ then
2222
exit 1
2323
fi
2424

25-
ipsec auto --status | grep vpn-$1 > /tmp/vpn-$1.status
25+
ipsec status vpn-$1 > /tmp/vpn-$1.status
2626

27-
cat /tmp/vpn-$1.status | grep "ISAKMP SA established" > /dev/null
28-
isakmpok=$?
29-
if [ $isakmpok -ne 0 ]
30-
then
31-
echo -n "ISAKMP SA NOT found but checking IPsec;"
32-
else
33-
echo -n "ISAKMP SA found;"
34-
fi
35-
36-
cat /tmp/vpn-$1.status | grep "IPsec SA established" > /dev/null
27+
cat /tmp/vpn-$1.status | grep "ESTABLISHED" > /dev/null
3728
ipsecok=$?
3829
if [ $ipsecok -ne 0 ]
3930
then

‎systemvm/patches/debian/config/opt/cloud/bin/configure.py‎

Lines changed: 33 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -471,13 +471,13 @@ def process(self):
471471

472472
def deletevpn(self, ip):
473473
logging.info("Removing VPN configuration for %s", ip)
474-
CsHelper.execute("ipsec auto --down vpn-%s" % ip)
475-
CsHelper.execute("ipsec auto --delete vpn-%s" % ip)
474+
CsHelper.execute("ipsec down vpn-%s" % ip)
475+
CsHelper.execute("ipsec down vpn-%s" % ip)
476476
vpnconffile = "%s/ipsec.vpn-%s.conf" % (self.VPNCONFDIR, ip)
477477
vpnsecretsfile = "%s/ipsec.vpn-%s.secrets" % (self.VPNCONFDIR, ip)
478478
os.remove(vpnconffile)
479479
os.remove(vpnsecretsfile)
480-
CsHelper.execute("ipsec auto --rereadall")
480+
CsHelper.execute("ipsec reload")
481481

482482
def configure_iptables(self, dev, obj):
483483
self.fw.append(["", "front", "-A INPUT -i %s -p udp -m udp --dport 500 -s %s -d %s -j ACCEPT" % (dev, obj['peer_gateway_ip'], obj['local_public_ip'])])
@@ -500,46 +500,53 @@ def configure_ipsec(self, obj):
500500
peerlist = obj['peer_guest_cidr_list'].lstrip().rstrip().replace(',', ' ')
501501
vpnconffile = "%s/ipsec.vpn-%s.conf" % (self.VPNCONFDIR, rightpeer)
502502
vpnsecretsfile = "%s/ipsec.vpn-%s.secrets" % (self.VPNCONFDIR, rightpeer)
503+
ikepolicy=obj['ike_policy'].replace(';','-')
504+
esppolicy=obj['esp_policy'].replace(';','-')
505+
506+
pfs='no'
507+
if 'modp' in esppolicy:
508+
pfs='yes'
509+
503510
if rightpeer in self.confips:
504511
self.confips.remove(rightpeer)
505512
file = CsFile(vpnconffile)
513+
file.add("#conn for vpn-%s" % rightpeer, 0)
506514
file.search("conn ", "conn vpn-%s" % rightpeer)
507515
file.addeq(" left=%s" % leftpeer)
508516
file.addeq(" leftsubnet=%s" % obj['local_guest_cidr'])
509517
file.addeq(" leftnexthop=%s" % obj['local_public_gateway'])
510518
file.addeq(" right=%s" % rightpeer)
511-
file.addeq(" rightsubnets={%s}" % peerlist)
519+
file.addeq(" rightsubnet=%s" % peerlist)
512520
file.addeq(" type=tunnel")
513521
file.addeq(" authby=secret")
514522
file.addeq(" keyexchange=ike")
515-
file.addeq(" ike=%s" % obj['ike_policy'])
523+
file.addeq(" ike=%s" % ikepolicy)
516524
file.addeq(" ikelifetime=%s" % self.convert_sec_to_h(obj['ike_lifetime']))
517-
file.addeq(" esp=%s" % obj['esp_policy'])
518-
file.addeq(" salifetime=%s" % self.convert_sec_to_h(obj['esp_lifetime']))
519-
if "modp" in obj['esp_policy']:
520-
file.addeq(" pfs=yes")
521-
else:
522-
file.addeq(" pfs=no")
525+
file.addeq(" esp=%s" % esppolicy)
526+
file.addeq(" lifetime=%s" % self.convert_sec_to_h(obj['esp_lifetime']))
527+
file.addeq(" pfs=%s" % pfs)
523528
file.addeq(" keyingtries=2")
524529
file.addeq(" auto=start")
525530
if 'encap' not in obj:
526531
obj['encap']=False
527532
file.addeq(" forceencaps=%s" % CsHelper.bool_to_yn(obj['encap']))
528533
if obj['dpd']:
529-
file.addeq(" dpddelay=30")
530-
file.addeq(" dpdtimeout=120")
531-
file.addeq(" dpdaction=restart")
534+
file.addeq(" dpddelay=30")
535+
file.addeq(" dpdtimeout=120")
536+
file.addeq(" dpdaction=restart")
532537
secret = CsFile(vpnsecretsfile)
533-
secret.search("%s " % leftpeer, "%s %s: PSK \"%s\"" % (leftpeer, rightpeer, obj['ipsec_psk']))
538+
secret.search("%s " % leftpeer, "%s %s : PSK \"%s\"" % (leftpeer, rightpeer, obj['ipsec_psk']))
534539
if secret.is_changed() or file.is_changed():
535540
secret.commit()
536541
file.commit()
537542
logging.info("Configured vpn %s %s", leftpeer, rightpeer)
538-
CsHelper.execute("ipsec auto --rereadall")
539-
CsHelper.execute("ipsec auto --add vpn-%s" % rightpeer)
540-
if not obj['passive']:
541-
CsHelper.execute("ipsec auto --up vpn-%s" % rightpeer)
542-
os.chmod(vpnsecretsfile, 0o400)
543+
CsHelper.execute("ipsec rereadsecrets")
544+
545+
CsHelper.execute("ipsec reload")
546+
if not obj['passive']:
547+
CsHelper.execute("sudo nohup ipsec down vpn-%s" % rightpeer)
548+
CsHelper.execute("sudo nohup ipsec up vpn-%s &" % rightpeer)
549+
os.chmod(vpnsecretsfile, 0400)
543550

544551
def convert_sec_to_h(self, val):
545552
hrs = int(val) / 3600
@@ -628,25 +635,25 @@ def process(self):
628635
logging.debug("Remote accessvpn data bag %s", self.dbag)
629636
self.remoteaccessvpn_iptables(public_ip, self.dbag[public_ip])
630637

631-
CsHelper.execute("ipsec auto --rereadall")
638+
CsHelper.execute("ipsec down L2TP-PSK")
639+
CsHelper.execute("ipsec update")
632640
CsHelper.execute("service xl2tpd stop")
633641
CsHelper.execute("service xl2tpd start")
634-
CsHelper.execute("ipsec auto --rereadsecrets")
635-
CsHelper.execute("ipsec auto --replace L2TP-PSK")
642+
CsHelper.execute("ipsec rereadsecrets")
636643
else:
637644
logging.debug("Disabling remote access vpn .....")
638645
#disable remote access vpn
639-
CsHelper.execute("ipsec auto --down L2TP-PSK")
646+
CsHelper.execute("ipsec down L2TP-PSK")
640647
CsHelper.execute("service xl2tpd stop")
641648

642649

643650
def configure_l2tpIpsec(self, left, obj):
644-
vpnconffile="%s/l2tp.conf" % (self.VPNCONFDIR)
651+
l2tpconffile="%s/l2tp.conf" % (self.VPNCONFDIR)
645652
vpnsecretfilte="%s/ipsec.any.secrets" % (self.VPNCONFDIR)
646653
xl2tpdconffile="/etc/xl2tpd/xl2tpd.conf"
647654
xl2tpoptionsfile='/etc/ppp/options.xl2tpd'
648655

649-
file = CsFile(vpnconffile)
656+
file = CsFile(l2tpconffile)
650657
localip=obj['local_ip']
651658
localcidr=obj['local_cidr']
652659
publicIface=obj['public_interface']

‎systemvm/patches/debian/vpn/etc/ipsec.conf‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,8 @@
1-
# Manual: ipsec.conf.5
2-
version 2.0
1+
# ipsec.conf - strongSwan IPsec configuration file
32

43
config setup
54
nat_traversal=yes
6-
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
7-
protostack=auto
8-
5+
charonstart=yes
6+
plutostart=yes
7+
98
include /etc/ipsec.d/*.conf

‎systemvm/patches/debian/vpn/etc/ipsec.d/l2tp.conf‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,14 @@
1+
#ipsec remote access vpn configuration
12
conn L2TP-PSK
2-
authby=secret
3+
authby=psk
34
pfs=no
45
rekey=no
56
keyingtries=3
7+
keyexchange=ikev1
8+
forceencaps=yes
9+
leftfirewall=yes
10+
leftnexthop=%defaultroute
11+
type=transport
612
#
713
# ----------------------------------------------------------
814
# The VPN server.
@@ -30,4 +36,5 @@ conn L2TP-PSK
3036
# ----------------------------------------------------------
3137
# Change 'ignore' to 'add' to enable this configuration.
3238
#
39+
rightsubnetwithin=0.0.0.0/0
3340
auto=add

‎systemvm/patches/debian/vpn/etc/ipsec.secrets‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
include /var/lib/openswan/ipsec.secrets.inc
1+
include /var/lib/strongswan/ipsec.conf.inc
22
include /etc/ipsec.d/ipsec.*.secrets

‎tools/appliance/definitions/systemvmtemplate/install_systemvm_packages.sh‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,6 @@ function install_packages() {
6363
nfs-common \
6464
samba-common cifs-utils \
6565
xl2tpd bcrelay ppp ipsec-tools tdb-tools \
66-
openswan=1:2.6.37-3+deb7u1 \
6766
xenstore-utils libxenstore3.0 \
6867
conntrackd ipvsadm libnetfilter-conntrack3 libnl-3-200 libnl-genl-3-200 \
6968
ipcalc \
@@ -76,9 +75,8 @@ function install_packages() {
7675
sharutils
7776

7877
${apt_get} -t wheezy-backports install keepalived irqbalance open-vm-tools qemu-guest-agent
78+
${apt_get} -t wheezy-backports install strongswan libcharon-extra-plugins libstrongswan-extra-plugins
7979

80-
# hold on installed openswan version, upgrade rest of the packages (if any)
81-
apt-mark hold openswan
8280
apt-get update
8381
apt-get -y --force-yes upgrade
8482

0 commit comments

Comments
 (0)