Skip to content

Fix site-to-site VPN feature #693

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Aug 14, 2015
Merged

Fix site-to-site VPN feature #693

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
da9e757
CLOUDSTACK-8710: Fixed applying iptables rules for s2s vpn
Aug 13, 2015
3824583
CLOUDSTACK-8730: fix s2s iptables rules and ipsec config
remibergsma Aug 13, 2015
9b97719
tighten security of site-to-site VPN
remibergsma Aug 14, 2015
4f8ab51
do not log sensitive site-to-site VPN PSK
remibergsma Aug 14, 2015
7ddec66
Merge pull request #690 from jayapalu/vpn
remibergsma Aug 14, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 9 additions & 9 deletions systemvm/patches/debian/config/opt/cloud/bin/configure.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -425,10 +425,10 @@ def deletevpn(self, ip):
CsHelper.execute("ipsec auto --rereadall")

def configure_iptables(self, dev, obj):
self.fw.append(["", "front", "-A INPUT -i %s -p udp -m udp --dport 500 -j ACCEPT" % dev])
self.fw.append(["", "front", "-A INPUT -i %s -p udp -m udp --dport 4500 -j ACCEPT" % dev])
self.fw.append(["", "front", "-A INPUT -i %s -p esp -j ACCEPT" % dev])
self.fw.append(["nat", "front", "-A POSTROUTING -t nat -o %s-m mark --set-xmark 0x525/0xffffffff -j ACCEPT" % dev])
self.fw.append(["", "front", "-A INPUT -i %s -p udp -m udp --dport 500 -s %s -d %s -j ACCEPT" % (dev, obj['peer_gateway_ip'], obj['local_public_ip'])])
self.fw.append(["", "front", "-A INPUT -i %s -p udp -m udp --dport 4500 -s %s -d %s -j ACCEPT" % (dev, obj['peer_gateway_ip'], obj['local_public_ip'])])
self.fw.append(["", "front", "-A INPUT -i %s -p esp -s %s -d %s -j ACCEPT" % (dev, obj['peer_gateway_ip'], obj['local_public_ip'])])
self.fw.append(["nat", "front", "-A POSTROUTING -t nat -o %s -m mark --mark 0x525 -j ACCEPT" % dev])
for net in obj['peer_guest_cidr_list'].lstrip().rstrip().split(','):
self.fw.append(["mangle", "front",
"-A FORWARD -s %s -d %s -j MARK --set-xmark 0x525/0xffffffff" % (obj['local_guest_cidr'], net)])
Expand All @@ -453,7 +453,7 @@ def configure_ipsec(self, obj):
file.addeq(" leftsubnet=%s" % obj['local_guest_cidr'])
file.addeq(" leftnexthop=%s" % obj['local_public_gateway'])
file.addeq(" right=%s" % rightpeer)
file.addeq(" rightsubnets=%s" % peerlist)
file.addeq(" rightsubnets={%s}" % peerlist)
file.addeq(" type=tunnel")
file.addeq(" authby=secret")
file.addeq(" keyexchange=ike")
Expand All @@ -463,7 +463,7 @@ def configure_ipsec(self, obj):
file.addeq(" salifetime=%s" % self.convert_sec_to_h(obj['esp_lifetime']))
file.addeq(" pfs=%s" % CsHelper.bool_to_yn(obj['dpd']))
file.addeq(" keyingtries=2")
file.addeq(" auto=add")
file.addeq(" auto=start")
if obj['dpd']:
file.addeq(" dpddelay=30")
file.addeq(" dpdtimeout=120")
Expand Down Expand Up @@ -678,9 +678,6 @@ def main(argv):
red = CsRedundant(config)
red.set()

nf = CsNetfilters()
nf.compare(config.get_fw())

vpns = CsSite2SiteVpn("site2sitevpn", config)
vpns.process()

Expand All @@ -693,6 +690,9 @@ def main(argv):
mon = CsMonitor("monitorservice", config)
mon.process()

nf = CsNetfilters()
nf.compare(config.get_fw())

# Save iptables configuration - will be loaded on reboot by the iptables-restore that is configured on /etc/rc.local
CsHelper.save_iptables("iptables-save", "/etc/iptables/router_rules.v4")
CsHelper.save_iptables("ip6tables-save", "/etc/iptables/router_rules.v6")
Expand Down
5 changes: 4 additions & 1 deletion systemvm/patches/debian/config/opt/cloud/bin/cs/CsFile.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,10 @@ def greplace(self, search, replace):

def search(self, search, replace):
found = False
logging.debug("Searching for %s and replacing with %s" % (search, replace))
replace_filtered = replace
if re.search("PSK \"", replace):
replace_filtered = re.sub(r'".*"', '"****"', replace)
logging.debug("Searching for %s and replacing with %s" % (search, replace_filtered))
Copy link
Contributor

@DaanHoogland DaanHoogland Aug 14, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"Searching for %s and replacing the value following it with %s" would be closer to the truth

for index, line in enumerate(self.new_config):
if line.lstrip().startswith("#"):
continue
Expand Down