Skip to content

Commit 13bfdd7

Browse files
karuturikaruturi
committed
Merge pull request #1741 from swill/strongswanvpn
Updated StrongSwan VPN ImplementationThis PR is a merge of @jayapalu changes in #872 and the changes I had to make to get the functionality working. I have done pretty extensive testing of this code so far and we are looking to be in pretty good shape. One thing to note is that a `Diffie-Hellman` group **is required** in order for this feature to work correctly. It is not highlighted in the tests below, but I have shown that the `PFS` is not required for this feature to work. In #872 I have shown a more exhaustive set of tests of this code, but I have limited this set of tests to a recommended `IKE` and `ESP` configuration in order to reduce the noise and test the other areas of functionality. **Test Results** I am testing this functionality by creating two VPCs with VMs in each and creating a S2S VPN connection between the two VPCs. Then I SSH into a VM in one VPC and I ping the private IP of a VM in the other VPC. Then I tear it down and try a different configuration. _Setup_ ``` VPC 1 VPC 2 ===== ===== VPN Gateway VPN Gateway VPN Customer Gateway VPN Customer Gateway VPN Connection <---> VPN Connection - Passive = True - Passive = False ``` _Legend_ `SKIP` => At least one of the VPN Connections did not come up, so no test was run. `OK` => The ping test was successful over the S2S VPN connection. `FAIL` => The ping test failed over the S2S VPN connection. `Passive` => Specifies if either the `<vpc_1> : <vpc_2>` sides of the VPN Connection is set to passive. `Conn State` => Specifies the connection status of the `<vpc_1> : <vpc_2>` VPN Connection in the UI. `Requires Reset` => If the ping test does not result in an `OK`, then a VPN Connection Reset is performed on either `<vpc_1> : <vpc_2>` sides of the VPN Connection based on which side is not showing `Connected`. The results in the `Status` column is the final result after the reset is performed. _Results_ ``` +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | Status | IKE & ESP | DPD | Encap | IKE Life | ESP Life | Passive | Conn State | Requires Reset | +========+======================+=======+=======+==========+==========+===============+=============================+================+ | OK | aes128-sha1;modp1536 | True | False | 86400 | 3600 | True : False | Disconnected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | True | 86400 | 3600 | True : False | Disconnected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | False | | 3600 | True : False | Disconnected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | False | 86400 | | True : False | Disconnected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | False | | | True : False | Disconnected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | False | 86400 | 3600 | False : False | Connected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | False | 86400 | 3600 | True : True | Disconnected : Disconnected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | True | False | 86400 | 3600 | False : True | Connected : Disconnected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | False | False | 86400 | 3600 | False : False | Connected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | False | False | 86400 | 3600 | True : False | Disconnected : Connected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | False | False | 86400 | 3600 | True : True | Disconnected : Disconnected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | OK | aes128-sha1;modp1536 | False | False | 86400 | 3600 | False : True | Connected : Disconnected | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | SKIP | aes128-sha1 | True | False | 86400 | 3600 | True : False | Disconnected : Error | True : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | SKIP | aes128-sha1 | False | False | 86400 | 3600 | True : False | Disconnected : Error | True : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | FAIL | aes128-sha1 | True | False | 86400 | 3600 | True : True | Disconnected : Disconnected | True : True | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ | SKIP | aes128-sha1 | True | False | 86400 | 3600 | False : False | Connected : Error | False : False | +--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+ ``` * pr/1741: complete implementation of the StrongSwan VPN feature Signed-off-by: Rajani Karuturi <rajani.karuturi@accelerite.com>
2 parents 2aeca0d + f045d65 commit 13bfdd7

File tree

15 files changed

+200
-114
lines changed

15 files changed

+200
-114
lines changed

‎server/src/com/cloud/network/vpn/Site2SiteVpnManagerImpl.java‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -190,10 +190,10 @@ public Site2SiteCustomerGateway createCustomerGateway(CreateVpnCustomerGatewayCm
190190
String ipsecPsk = cmd.getIpsecPsk();
191191
String ikePolicy = cmd.getIkePolicy();
192192
String espPolicy = cmd.getEspPolicy();
193-
if (!NetUtils.isValidS2SVpnPolicy(ikePolicy)) {
194-
throw new InvalidParameterValueException("The customer gateway IKE policy " + ikePolicy + " is invalid!");
193+
if (!NetUtils.isValidS2SVpnPolicy("ike", ikePolicy)) {
194+
throw new InvalidParameterValueException("The customer gateway IKE policy " + ikePolicy + " is invalid! Verify the required Diffie Hellman (DH) group is specified.");
195195
}
196-
if (!NetUtils.isValidS2SVpnPolicy(espPolicy)) {
196+
if (!NetUtils.isValidS2SVpnPolicy("esp", espPolicy)) {
197197
throw new InvalidParameterValueException("The customer gateway ESP policy " + espPolicy + " is invalid!");
198198
}
199199
Long ikeLifetime = cmd.getIkeLifetime();
@@ -444,10 +444,10 @@ public Site2SiteCustomerGateway updateCustomerGateway(UpdateVpnCustomerGatewayCm
444444
String ipsecPsk = cmd.getIpsecPsk();
445445
String ikePolicy = cmd.getIkePolicy();
446446
String espPolicy = cmd.getEspPolicy();
447-
if (!NetUtils.isValidS2SVpnPolicy(ikePolicy)) {
448-
throw new InvalidParameterValueException("The customer gateway IKE policy" + ikePolicy + " is invalid!");
447+
if (!NetUtils.isValidS2SVpnPolicy("ike", ikePolicy)) {
448+
throw new InvalidParameterValueException("The customer gateway IKE policy" + ikePolicy + " is invalid! Verify the required Diffie Hellman (DH) group is specified.");
449449
}
450-
if (!NetUtils.isValidS2SVpnPolicy(espPolicy)) {
450+
if (!NetUtils.isValidS2SVpnPolicy("esp", espPolicy)) {
451451
throw new InvalidParameterValueException("The customer gateway ESP policy" + espPolicy + " is invalid!");
452452
}
453453
Long ikeLifetime = cmd.getIkeLifetime();
@@ -517,7 +517,7 @@ public boolean deleteVpnConnection(DeleteVpnConnectionCmd cmd) throws ResourceUn
517517

518518
_accountMgr.checkAccess(caller, null, false, conn);
519519

520-
if (conn.getState() == State.Connected) {
520+
if (conn.getState() != State.Pending) {
521521
stopVpnConnection(id);
522522
}
523523
_vpnConnectionDao.remove(id);
@@ -531,8 +531,8 @@ private void stopVpnConnection(Long id) throws ResourceUnavailableException {
531531
throw new CloudRuntimeException("Unable to acquire lock on " + conn);
532532
}
533533
try {
534-
if (conn.getState() != State.Connected && conn.getState() != State.Error) {
535-
throw new InvalidParameterValueException("Site to site VPN connection with specified id is not in correct state(connected) to process disconnect!");
534+
if (conn.getState() == State.Pending) {
535+
throw new InvalidParameterValueException("Site to site VPN connection with specified id is currently Pending, unable to Disconnect!");
536536
}
537537

538538
conn.setState(State.Disconnected);

‎systemvm/patches/debian/config/etc/logrotate.conf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,14 @@
11
# rotate log files daily
22
daily
3-
# keep 5 days worth
4-
rotate 5
3+
# keep 3 days worth
4+
rotate 3
55
# create new (empty) log files after rotating old ones
66
create
77
# use date as a suffix of the rotated file
88
#dateext
99
# max size 50M
1010
size 50M
11+
compress
1112
# RPM packages drop log rotation information into this directory
1213
include /etc/logrotate.d
1314
# no packages own wtmp and btmp -- we'll rotate them here

‎systemvm/patches/debian/config/opt/cloud/bin/checks2svpn.sh‎

Lines changed: 2 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -22,18 +22,9 @@ then
2222
exit 1
2323
fi
2424

25-
ipsec auto --status | grep vpn-$1 > /tmp/vpn-$1.status
25+
ipsec status vpn-$1 > /tmp/vpn-$1.status
2626

27-
cat /tmp/vpn-$1.status | grep "ISAKMP SA established" > /dev/null
28-
isakmpok=$?
29-
if [ $isakmpok -ne 0 ]
30-
then
31-
echo -n "ISAKMP SA NOT found but checking IPsec;"
32-
else
33-
echo -n "ISAKMP SA found;"
34-
fi
35-
36-
cat /tmp/vpn-$1.status | grep "IPsec SA established" > /dev/null
27+
cat /tmp/vpn-$1.status | grep "ESTABLISHED" > /dev/null
3728
ipsecok=$?
3829
if [ $ipsecok -ne 0 ]
3930
then

‎systemvm/patches/debian/config/opt/cloud/bin/configure.py‎

Lines changed: 34 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -471,13 +471,13 @@ def process(self):
471471

472472
def deletevpn(self, ip):
473473
logging.info("Removing VPN configuration for %s", ip)
474-
CsHelper.execute("ipsec auto --down vpn-%s" % ip)
475-
CsHelper.execute("ipsec auto --delete vpn-%s" % ip)
474+
CsHelper.execute("ipsec down vpn-%s" % ip)
475+
CsHelper.execute("ipsec down vpn-%s" % ip)
476476
vpnconffile = "%s/ipsec.vpn-%s.conf" % (self.VPNCONFDIR, ip)
477477
vpnsecretsfile = "%s/ipsec.vpn-%s.secrets" % (self.VPNCONFDIR, ip)
478478
os.remove(vpnconffile)
479479
os.remove(vpnsecretsfile)
480-
CsHelper.execute("ipsec auto --rereadall")
480+
CsHelper.execute("ipsec reload")
481481

482482
def configure_iptables(self, dev, obj):
483483
self.fw.append(["", "front", "-A INPUT -i %s -p udp -m udp --dport 500 -s %s -d %s -j ACCEPT" % (dev, obj['peer_gateway_ip'], obj['local_public_ip'])])
@@ -497,49 +497,56 @@ def configure_iptables(self, dev, obj):
497497
def configure_ipsec(self, obj):
498498
leftpeer = obj['local_public_ip']
499499
rightpeer = obj['peer_gateway_ip']
500-
peerlist = obj['peer_guest_cidr_list'].lstrip().rstrip().replace(',', ' ')
500+
peerlist = obj['peer_guest_cidr_list'].replace(' ', '')
501501
vpnconffile = "%s/ipsec.vpn-%s.conf" % (self.VPNCONFDIR, rightpeer)
502502
vpnsecretsfile = "%s/ipsec.vpn-%s.secrets" % (self.VPNCONFDIR, rightpeer)
503+
ikepolicy=obj['ike_policy'].replace(';','-')
504+
esppolicy=obj['esp_policy'].replace(';','-')
505+
506+
pfs='no'
507+
if 'modp' in esppolicy:
508+
pfs='yes'
509+
503510
if rightpeer in self.confips:
504511
self.confips.remove(rightpeer)
505512
file = CsFile(vpnconffile)
513+
file.add("#conn for vpn-%s" % rightpeer, 0)
506514
file.search("conn ", "conn vpn-%s" % rightpeer)
507515
file.addeq(" left=%s" % leftpeer)
508516
file.addeq(" leftsubnet=%s" % obj['local_guest_cidr'])
509517
file.addeq(" leftnexthop=%s" % obj['local_public_gateway'])
510518
file.addeq(" right=%s" % rightpeer)
511-
file.addeq(" rightsubnets={%s}" % peerlist)
519+
file.addeq(" rightsubnet=%s" % peerlist)
512520
file.addeq(" type=tunnel")
513521
file.addeq(" authby=secret")
514522
file.addeq(" keyexchange=ike")
515-
file.addeq(" ike=%s" % obj['ike_policy'])
523+
file.addeq(" ike=%s" % ikepolicy)
516524
file.addeq(" ikelifetime=%s" % self.convert_sec_to_h(obj['ike_lifetime']))
517-
file.addeq(" esp=%s" % obj['esp_policy'])
518-
file.addeq(" salifetime=%s" % self.convert_sec_to_h(obj['esp_lifetime']))
519-
if "modp" in obj['esp_policy']:
520-
file.addeq(" pfs=yes")
521-
else:
522-
file.addeq(" pfs=no")
525+
file.addeq(" esp=%s" % esppolicy)
526+
file.addeq(" lifetime=%s" % self.convert_sec_to_h(obj['esp_lifetime']))
527+
file.addeq(" pfs=%s" % pfs)
523528
file.addeq(" keyingtries=2")
524529
file.addeq(" auto=start")
525530
if 'encap' not in obj:
526531
obj['encap']=False
527532
file.addeq(" forceencaps=%s" % CsHelper.bool_to_yn(obj['encap']))
528533
if obj['dpd']:
529-
file.addeq(" dpddelay=30")
530-
file.addeq(" dpdtimeout=120")
531-
file.addeq(" dpdaction=restart")
534+
file.addeq(" dpddelay=30")
535+
file.addeq(" dpdtimeout=120")
536+
file.addeq(" dpdaction=restart")
532537
secret = CsFile(vpnsecretsfile)
533-
secret.search("%s " % leftpeer, "%s %s: PSK \"%s\"" % (leftpeer, rightpeer, obj['ipsec_psk']))
538+
secret.search("%s " % leftpeer, "%s %s : PSK \"%s\"" % (leftpeer, rightpeer, obj['ipsec_psk']))
534539
if secret.is_changed() or file.is_changed():
535540
secret.commit()
536541
file.commit()
537542
logging.info("Configured vpn %s %s", leftpeer, rightpeer)
538-
CsHelper.execute("ipsec auto --rereadall")
539-
CsHelper.execute("ipsec auto --add vpn-%s" % rightpeer)
540-
if not obj['passive']:
541-
CsHelper.execute("ipsec auto --up vpn-%s" % rightpeer)
542-
os.chmod(vpnsecretsfile, 0o400)
543+
CsHelper.execute("ipsec rereadsecrets")
544+
545+
CsHelper.execute("ipsec reload")
546+
if not obj['passive']:
547+
CsHelper.execute("sudo nohup ipsec down vpn-%s" % rightpeer)
548+
CsHelper.execute("sudo nohup ipsec up vpn-%s &" % rightpeer)
549+
os.chmod(vpnsecretsfile, 0400)
543550

544551
def convert_sec_to_h(self, val):
545552
hrs = int(val) / 3600
@@ -628,25 +635,25 @@ def process(self):
628635
logging.debug("Remote accessvpn data bag %s", self.dbag)
629636
self.remoteaccessvpn_iptables(public_ip, self.dbag[public_ip])
630637

631-
CsHelper.execute("ipsec auto --rereadall")
638+
CsHelper.execute("ipsec down L2TP-PSK")
639+
CsHelper.execute("ipsec update")
632640
CsHelper.execute("service xl2tpd stop")
633641
CsHelper.execute("service xl2tpd start")
634-
CsHelper.execute("ipsec auto --rereadsecrets")
635-
CsHelper.execute("ipsec auto --replace L2TP-PSK")
642+
CsHelper.execute("ipsec rereadsecrets")
636643
else:
637644
logging.debug("Disabling remote access vpn .....")
638645
#disable remote access vpn
639-
CsHelper.execute("ipsec auto --down L2TP-PSK")
646+
CsHelper.execute("ipsec down L2TP-PSK")
640647
CsHelper.execute("service xl2tpd stop")
641648

642649

643650
def configure_l2tpIpsec(self, left, obj):
644-
vpnconffile="%s/l2tp.conf" % (self.VPNCONFDIR)
651+
l2tpconffile="%s/l2tp.conf" % (self.VPNCONFDIR)
645652
vpnsecretfilte="%s/ipsec.any.secrets" % (self.VPNCONFDIR)
646653
xl2tpdconffile="/etc/xl2tpd/xl2tpd.conf"
647654
xl2tpoptionsfile='/etc/ppp/options.xl2tpd'
648655

649-
file = CsFile(vpnconffile)
656+
file = CsFile(l2tpconffile)
650657
localip=obj['local_ip']
651658
localcidr=obj['local_cidr']
652659
publicIface=obj['public_interface']

‎systemvm/patches/debian/config/opt/cloud/bin/cs_ip.py‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -15,21 +15,20 @@
1515
# KIND, either express or implied. See the License for the
1616
# specific language governing permissions and limitations
1717
# under the License.
18-
from pprint import pprint
19-
from netaddr import *
2018

19+
from netaddr import *
2120

2221
def merge(dbag, ip):
23-
added = False
2422
nic_dev_id = None
23+
index = -1 # a non-valid array index
2524
for dev in dbag:
2625
if dev == "id":
2726
continue
28-
for address in dbag[dev]:
27+
for i, address in enumerate(dbag[dev]):
2928
if address['public_ip'] == ip['public_ip']:
3029
if 'nic_dev_id' in address:
3130
nic_dev_id = address['nic_dev_id']
32-
dbag[dev].remove(address)
31+
index = i
3332

3433
ipo = IPNetwork(ip['public_ip'] + '/' + ip['netmask'])
3534
if 'nic_dev_id' in ip:
@@ -44,8 +43,11 @@ def merge(dbag, ip):
4443
else:
4544
ip['nw_type'] = ip['nw_type'].lower()
4645
if ip['nw_type'] == 'control':
47-
dbag['eth' + str(nic_dev_id)] = [ip]
46+
dbag[ip['device']] = [ip]
4847
else:
49-
dbag.setdefault('eth' + str(nic_dev_id), []).append(ip)
48+
if index != -1:
49+
dbag[ip['device']][index] = ip
50+
else:
51+
dbag.setdefault(ip['device'], []).append(ip)
5052

5153
return dbag

‎systemvm/patches/debian/vpn/etc/ipsec.conf‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,5 @@
1-
# Manual: ipsec.conf.5
2-
version 2.0
1+
# ipsec.conf - strongSwan IPsec configuration file
32

43
config setup
5-
nat_traversal=yes
6-
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
7-
protostack=auto
8-
4+
95
include /etc/ipsec.d/*.conf

‎systemvm/patches/debian/vpn/etc/ipsec.d/l2tp.conf‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,14 @@
1+
#ipsec remote access vpn configuration
12
conn L2TP-PSK
2-
authby=secret
3+
authby=psk
34
pfs=no
45
rekey=no
56
keyingtries=3
7+
keyexchange=ikev1
8+
forceencaps=yes
9+
leftfirewall=yes
10+
leftnexthop=%defaultroute
11+
type=transport
612
#
713
# ----------------------------------------------------------
814
# The VPN server.
@@ -30,4 +36,5 @@ conn L2TP-PSK
3036
# ----------------------------------------------------------
3137
# Change 'ignore' to 'add' to enable this configuration.
3238
#
39+
rightsubnetwithin=0.0.0.0/0
3340
auto=add

‎systemvm/patches/debian/vpn/etc/ipsec.secrets‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
include /var/lib/openswan/ipsec.secrets.inc
1+
include /var/lib/strongswan/ipsec.conf.inc
22
include /etc/ipsec.d/ipsec.*.secrets

‎test/integration/component/maint/test_vpc.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -177,7 +177,7 @@ def __init__(self):
177177
},
178178
"vpn_customer_gw": {
179179
"ipsecpsk": "s2svpn",
180-
"ikepolicy": "3des-md5",
180+
"ikepolicy": "3des-md5;modp1536",
181181
"ikelifetime": "86400",
182182
"esppolicy": "3des-md5",
183183
"esplifetime": "3600",

‎test/integration/component/test_vpc.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -186,7 +186,7 @@ def __init__(self):
186186
},
187187
"vpn_customer_gw": {
188188
"ipsecpsk": "s2svpn",
189-
"ikepolicy": "3des-md5",
189+
"ikepolicy": "3des-md5;modp1536",
190190
"ikelifetime": "86400",
191191
"esppolicy": "3des-md5",
192192
"esplifetime": "3600",

0 commit comments

Comments
 (0)