mirror of
https://github.com/apache/cloudstack.git
synced 2025-11-02 20:02:29 +01:00
291 lines
8.0 KiB
Bash
Executable File
291 lines
8.0 KiB
Bash
Executable File
# Copyright 2012 Citrix Systems, Inc. Licensed under the
|
|
# Apache License, Version 2.0 (the "License"); you may not use this
|
|
# file except in compliance with the License. Citrix Systems, Inc.
|
|
# reserves all rights not expressly granted by the License.
|
|
# You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
#!/usr/bin/env bash
|
|
source /root/func.sh
|
|
|
|
lock="biglock"
|
|
locked=$(getLockFile $lock)
|
|
if [ "$locked" != "1" ]
|
|
then
|
|
exit 1
|
|
fi
|
|
|
|
vpnconfdir="/etc/ipsec.d"
|
|
vpnoutmark="0x525"
|
|
vpninmark="0x524"
|
|
|
|
usage() {
|
|
printf "Usage: %s: (-A|-D) -l <left-side vpn peer> -n <left-side guest cidr> -g <left-side gateway> -r <right-side vpn peer> -N <right-side private subnets> -e <esp policy> -i <ike policy> -t <ike lifetime> -T <esp lifetime> -s <pre-shared secret> -d <dpd 0 or 1> \n" $(basename $0) >&2
|
|
}
|
|
|
|
#set -x
|
|
|
|
start_ipsec() {
|
|
service ipsec status > /dev/null
|
|
if [ $? -ne 0 ]
|
|
then
|
|
service ipsec start > /dev/null
|
|
#Wait until ipsec started, 5 seconds at most
|
|
for i in {1..5}
|
|
do
|
|
logger -t cloud "$(basename $0): waiting ipsec start..."
|
|
service ipsec status > /dev/null
|
|
result=$?
|
|
if [ $result -eq 0 ]
|
|
then
|
|
break
|
|
fi
|
|
sleep 1
|
|
done
|
|
fi
|
|
service ipsec status > /dev/null
|
|
return $?
|
|
}
|
|
|
|
enable_iptables_subnets() {
|
|
for net in $rightnets
|
|
do
|
|
sudo iptables -A FORWARD -t mangle -s $leftnet -d $net -j MARK --set-mark $vpnoutmark
|
|
sudo iptables -A OUTPUT -t mangle -s $leftnet -d $net -j MARK --set-mark $vpnoutmark
|
|
sudo iptables -A FORWARD -t mangle -s $net -d $leftnet -j MARK --set-mark $vpninmark
|
|
sudo iptables -A INPUT -t mangle -s $net -d $leftnet -j MARK --set-mark $vpninmark
|
|
done
|
|
return 0
|
|
}
|
|
|
|
check_and_enable_iptables() {
|
|
sudo iptables-save | grep "A INPUT -i $outIf -p udp -m udp --dport 500 -j ACCEPT"
|
|
if [ $? -ne 0 ]
|
|
then
|
|
sudo iptables -A INPUT -i $outIf -p udp -m udp --dport 500 -j ACCEPT
|
|
sudo iptables -A INPUT -i $outIf -p udp -m udp --dport 4500 -j ACCEPT
|
|
# Prevent NAT on "marked" VPN traffic, so need to be the first one on POSTROUTING chain
|
|
sudo iptables -t nat -I POSTROUTING -t nat -o $outIf -m mark --mark $vpnoutmark -j ACCEPT
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
disable_iptables_subnets() {
|
|
for net in $rightnets
|
|
do
|
|
sudo iptables -D FORWARD -t mangle -s $leftnet -d $net -j MARK --set-mark $vpnoutmark
|
|
sudo iptables -D OUTPUT -t mangle -s $leftnet -d $net -j MARK --set-mark $vpnoutmark
|
|
sudo iptables -D FORWARD -t mangle -s $net -d $leftnet -j MARK --set-mark $vpninmark
|
|
sudo iptables -D INPUT -t mangle -s $net -d $leftnet -j MARK --set-mark $vpninmark
|
|
done
|
|
return 0
|
|
}
|
|
|
|
check_and_disable_iptables() {
|
|
find $vpnconfdir -name "ipsec.vpn*.conf" | grep ipsec
|
|
if [ $? -ne 0 ]
|
|
then
|
|
#Nobody else use s2s vpn now, so delete the iptables rules
|
|
sudo iptables -D INPUT -i $outIf -p udp -m udp --dport 500 -j ACCEPT
|
|
sudo iptables -D INPUT -i $outIf -p udp -m udp --dport 4500 -j ACCEPT
|
|
sudo iptables -t nat -D POSTROUTING -t nat -o $outIf -m mark --mark $vpnoutmark -j ACCEPT
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
ipsec_tunnel_del() {
|
|
disable_iptables_subnets
|
|
sudo ipsec auto --down vpn-$rightpeer
|
|
sudo ipsec auto --delete vpn-$rightpeer
|
|
outIp=$leftpeer
|
|
local vpnconffile=$vpnconfdir/ipsec.vpn-$rightpeer.conf
|
|
local vpnsecretsfile=$vpnconfdir/ipsec.vpn-$rightpeer.secrets
|
|
logger -t cloud "$(basename $0): removing configuration for ipsec tunnel to $rightpeer"
|
|
sudo rm -f $vpnconffile
|
|
sudo rm -f $vpnsecretsfile
|
|
sudo ipsec auto --rereadall
|
|
check_and_disable_iptables
|
|
return 0
|
|
}
|
|
|
|
ipsec_tunnel_add() {
|
|
#need to unify with remote access VPN
|
|
start_ipsec
|
|
|
|
if [ $? -ne 0 ]
|
|
then
|
|
logger -t cloud "$(basename $0): Failed to start ipsec service!"
|
|
return 1
|
|
fi
|
|
|
|
outIp=$leftpeer
|
|
sudo mkdir -p $vpnconfdir
|
|
local vpnconffile=$vpnconfdir/ipsec.vpn-$rightpeer.conf
|
|
local vpnsecretsfile=$vpnconfdir/ipsec.vpn-$rightpeer.secrets
|
|
|
|
logger -t cloud "$(basename $0): creating configuration for ipsec tunnel: left peer=$leftpeer \
|
|
left net=$leftnet left gateway=$leftgw right peer=$rightpeer right network=$rightnets phase1 policy=$ikepolicy \
|
|
phase2 policy=$esppolicy secret=$secret"
|
|
|
|
[ "$op" == "-A" ] && ipsec_tunnel_del
|
|
|
|
check_and_enable_iptables
|
|
|
|
sudo echo "conn vpn-$rightpeer" > $vpnconffile &&
|
|
sudo echo " left=$leftpeer" >> $vpnconffile &&
|
|
sudo echo " leftsubnet=$leftnet" >> $vpnconffile &&
|
|
sudo echo " leftnexthop=$leftgw" >> $vpnconffile &&
|
|
sudo echo " right=$rightpeer" >> $vpnconffile &&
|
|
sudo echo " rightsubnets={$rightnets}" >> $vpnconffile &&
|
|
sudo echo " type=tunnel" >> $vpnconffile &&
|
|
sudo echo " authby=secret" >> $vpnconffile &&
|
|
sudo echo " keyexchange=ike" >> $vpnconffile &&
|
|
sudo echo " ike=$ikepolicy" >> $vpnconffile &&
|
|
sudo echo " ikelifetime=${ikelifetime}s" >> $vpnconffile &&
|
|
sudo echo " esp=$esppolicy" >> $vpnconffile &&
|
|
sudo echo " salifetime=${esplifetime}s" >> $vpnconffile &&
|
|
sudo echo " pfs=$pfs" >> $vpnconffile &&
|
|
sudo echo " keyingtries=2" >> $vpnconffile &&
|
|
sudo echo " auto=add" >> $vpnconffile &&
|
|
sudo echo "$leftpeer $rightpeer: PSK \"$secret\"" > $vpnsecretsfile &&
|
|
sudo chmod 0400 $vpnsecretsfile
|
|
|
|
if [ $dpd -ne 0 ]
|
|
then
|
|
sudo echo " dpddelay=30" >> $vpnconffile &&
|
|
sudo echo " dpdtimeout=120" >> $vpnconffile &&
|
|
sudo echo " dpdaction=restart" >> $vpnconffile
|
|
fi
|
|
|
|
enable_iptables_subnets
|
|
|
|
sudo ipsec auto --rereadall
|
|
sudo ipsec auto --add vpn-$rightpeer
|
|
sudo ipsec auto --up vpn-$rightpeer
|
|
|
|
logger -t cloud "$(basename $0): done ipsec tunnel entry for right peer=$rightpeer right networks=$rightnets"
|
|
|
|
#5 seconds for checking if it's ready
|
|
for i in {1..5}
|
|
do
|
|
logger -t cloud "$(basename $0): checking connection status..."
|
|
/opt/cloud/bin/checks2svpn.sh $rightpeer
|
|
result=$?
|
|
if [ $result -eq 0 ]
|
|
then
|
|
break
|
|
fi
|
|
sleep 1
|
|
done
|
|
if [ $result -eq 0 ]
|
|
then
|
|
logger -t cloud "$(basename $0): connect to remote successful"
|
|
else
|
|
logger -t cloud "$(basename $0): fail to connect to remote, status code: $result"
|
|
logger -t cloud "$(basename $0): would stop site-to-site VPN connection"
|
|
ipsec_tunnel_del
|
|
fi
|
|
return $result
|
|
}
|
|
|
|
rflag=
|
|
pflag=
|
|
eflag=
|
|
Eflag=
|
|
lflag=
|
|
iflag=
|
|
Iflag=
|
|
sflag=
|
|
op=""
|
|
|
|
while getopts 'ADl:n:g:r:N:e:i:t:T:s:d:' OPTION
|
|
do
|
|
case $OPTION in
|
|
A) opflag=1
|
|
op="-A"
|
|
;;
|
|
D) opflag=2
|
|
op="-D"
|
|
;;
|
|
l) lflag=1
|
|
leftpeer="$OPTARG"
|
|
;;
|
|
n) nflag=1
|
|
leftnet="$OPTARG"
|
|
;;
|
|
g) gflag=1
|
|
leftgw="$OPTARG"
|
|
;;
|
|
r) rflag=1
|
|
rightpeer="$OPTARG"
|
|
;;
|
|
N) Nflag=1
|
|
rightnets="$OPTARG"
|
|
;;
|
|
e) eflag=1
|
|
esppolicy="$OPTARG"
|
|
;;
|
|
i) iflag=1
|
|
ikepolicy="$OPTARG"
|
|
;;
|
|
t) tflag=1
|
|
ikelifetime="$OPTARG"
|
|
;;
|
|
T) Tflag=1
|
|
esplifetime="$OPTARG"
|
|
;;
|
|
s) sflag=1
|
|
secret="$OPTARG"
|
|
;;
|
|
d) dflag=1
|
|
dpd="$OPTARG"
|
|
;;
|
|
?) usage
|
|
unlock_exit 2 $lock $locked
|
|
;;
|
|
esac
|
|
done
|
|
|
|
logger -t cloud "$(basename $0): parameters $*"
|
|
|
|
# get interface for public ip
|
|
ip link|grep BROADCAST|grep -v eth0|cut -d ":" -f 2 > /tmp/iflist
|
|
while read i
|
|
do
|
|
ip addr show $i|grep "$leftpeer"
|
|
if [ $? -eq 0 ]
|
|
then
|
|
outIf=$i
|
|
break
|
|
fi
|
|
done < /tmp/iflist
|
|
|
|
rightnets=${rightnets//,/ }
|
|
pfs="no"
|
|
echo "$esppolicy" | grep "modp" > /dev/null
|
|
if [ $? -eq 0 ]
|
|
then
|
|
pfs="yes"
|
|
fi
|
|
|
|
ret=0
|
|
#Firewall ports for one-to-one/static NAT
|
|
if [ "$opflag" == "1" ]
|
|
then
|
|
ipsec_tunnel_add
|
|
ret=$?
|
|
elif [ "$opflag" == "2" ]
|
|
then
|
|
ipsec_tunnel_del
|
|
ret=$?
|
|
else
|
|
printf "Invalid action specified, must choose -A or -D to add/del tunnels\n" >&2
|
|
unlock_exit 5 $lock $locked
|
|
fi
|
|
|
|
unlock_exit $ret $lock $locked
|