Skip to content

Commit a3acf0b

Browse files
author
Justin Pettit
committed
debian: Add support for GRE-over-IPsec
The ovs-monitor-ipsec daemon monitors the Interface table for GRE entries. If an entry specifies other-config parameters "ipsec-local-ip" and ("ipsec-psk" or "ipsec-cert"), it will create the appropriate security associations so that all GRE traffic to the remote host will be encrypted. In order for the two GRE tunnels to communicate, both sides need to be configured for IPsec with appropriate authentication. Currently, ovs-monitor-ipsec does not support certificate authentication or ensure that an interface is actually attached to a bridge. Both of these issues will be addressed in a forthcoming patch. NB: While GRE-over-IPsec should work on any system with a relatively recent racoon and setkey, it has only been tested on Debian. As such, only Debian packaging has been provided.
1 parent f10a033 commit a3acf0b

9 files changed

Lines changed: 578 additions & 1 deletion

debian/.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
/openvswitch-controller
1313
/openvswitch-datapath-source
1414
/openvswitch-dbg
15+
/openvswitch-ipsec
1516
/openvswitch-pki
1617
/openvswitch-pki-server
1718
/openvswitch-switch

debian/automake.mk

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,9 @@ EXTRA_DIST += \
2424
debian/openvswitch-datapath-source.copyright \
2525
debian/openvswitch-datapath-source.dirs \
2626
debian/openvswitch-datapath-source.install \
27+
debian/openvswitch-ipsec.dirs \
28+
debian/openvswitch-ipsec.init \
29+
debian/openvswitch-ipsec.install \
2730
debian/openvswitch-pki-server.apache2 \
2831
debian/openvswitch-pki-server.dirs \
2932
debian/openvswitch-pki-server.install \
@@ -39,6 +42,7 @@ EXTRA_DIST += \
3942
debian/openvswitch-switch.postrm \
4043
debian/openvswitch-switch.template \
4144
debian/ovs-bugtool \
45+
debian/ovs-monitor-ipsec \
4246
debian/python-openvswitch.dirs \
4347
debian/python-openvswitch.install \
4448
debian/rules \

debian/control

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,19 @@ Description: Open vSwitch switch implementations
4141
.
4242
Open vSwitch is a full-featured software-based Ethernet switch.
4343

44+
Package: openvswitch-ipsec
45+
Architecture: any
46+
Depends:
47+
${shlibs:Depends}, ${misc:Depends}, ${python:Depends}, ipsec-tools, racoon,
48+
openvswitch-common (= ${binary:Version}),
49+
openvswitch-switch (= ${binary:Version}),
50+
python-openvswitch (= ${binary:Version})
51+
Description: Open vSwitch GRE-over-IPsec support
52+
The ovs-monitor-ipsec script provides support for encrypting GRE
53+
tunnels with IPsec.
54+
.
55+
Open vSwitch is a full-featured software-based Ethernet switch.
56+
4457
Package: openvswitch-pki
4558
Architecture: all
4659
Depends:
@@ -90,13 +103,14 @@ Depends:
90103
${shlibs:Depends}, ${misc:Depends},
91104
openvswitch-common (= ${binary:Version}),
92105
openvswitch-controller (= ${binary:Version}),
106+
openvswitch-ipsec (= ${binary:Version}),
93107
openvswitch-switch (= ${binary:Version})
94108
Description: Debug symbols for Open vSwitch packages
95109
This package contains the debug symbols for all the other openvswitch-*
96110
packages. Install it to debug one of them or to examine a core dump
97111
produced by one of them.
98112

99-
Package: python-openvswitch
113+
Package: python-openvswitch
100114
Architecture: all
101115
Section: python
102116
Depends: ${python:Depends}, openvswitch-switch (= ${binary:Version})

debian/openvswitch-ipsec.dirs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
usr/share/openvswitch/scripts

debian/openvswitch-ipsec.init

Lines changed: 184 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
#!/bin/sh
2+
#
3+
# Copyright (c) 2007, 2009 Javier Fernandez-Sanguino <jfs@debian.org>
4+
#
5+
# This is free software; you may redistribute it and/or modify
6+
# it under the terms of the GNU General Public License as
7+
# published by the Free Software Foundation; either version 2,
8+
# or (at your option) any later version.
9+
#
10+
# This is distributed in the hope that it will be useful, but
11+
# WITHOUT ANY WARRANTY; without even the implied warranty of
12+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13+
# GNU General Public License for more details.
14+
#
15+
# You should have received a copy of the GNU General Public License with
16+
# the Debian operating system, in /usr/share/common-licenses/GPL; if
17+
# not, write to the Free Software Foundation, Inc., 59 Temple Place,
18+
# Suite 330, Boston, MA 02111-1307 USA
19+
#
20+
### BEGIN INIT INFO
21+
# Provides: openvswitch-ipsec
22+
# Required-Start: $network $local_fs $remote_fs
23+
# Required-Stop: $remote_fs
24+
# Default-Start: 2 3 4 5
25+
# Default-Stop: 0 1 6
26+
# Short-Description: Open vSwitch GRE-over-IPsec daemon
27+
### END INIT INFO
28+
29+
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
30+
31+
DAEMON=/usr/share/openvswitch/scripts/ovs-monitor-ipsec # Daemon's location
32+
NAME=ovs-monitor-ipsec # Introduce the short server's name here
33+
LOGDIR=/var/log/openvswitch # Log directory to use
34+
35+
PIDFILE=/var/run/openvswitch/$NAME.pid
36+
37+
test -x $DAEMON || exit 0
38+
39+
. /lib/lsb/init-functions
40+
41+
DODTIME=10 # Time to wait for the server to die, in seconds
42+
# If this value is set too low you might not
43+
# let some servers to die gracefully and
44+
# 'restart' will not work
45+
46+
set -e
47+
48+
running_pid() {
49+
# Check if a given process pid's cmdline matches a given name
50+
pid=$1
51+
name=$2
52+
[ -z "$pid" ] && return 1
53+
[ ! -d /proc/$pid ] && return 1
54+
cmd=`cat /proc/$pid/cmdline | tr "\000" " "|cut -d " " -f 2`
55+
# Is this the expected server
56+
[ "$cmd" != "$name" ] && return 1
57+
return 0
58+
}
59+
60+
running() {
61+
# Check if the process is running looking at /proc
62+
# (works for all users)
63+
64+
# No pidfile, probably no daemon present
65+
[ ! -f "$PIDFILE" ] && return 1
66+
pid=`cat $PIDFILE`
67+
running_pid $pid $DAEMON || return 1
68+
return 0
69+
}
70+
71+
start_server() {
72+
PYTHONPATH=/usr/share/openvswitch/python \
73+
/usr/share/openvswitch/scripts/ovs-monitor-ipsec \
74+
--pidfile-name=$PIDFILE --detach --monitor \
75+
unix:/var/run/openvswitch/db.sock
76+
77+
return 0
78+
}
79+
80+
stop_server() {
81+
if [ -e $PIDFILE ]; then
82+
kill `cat $PIDFILE`
83+
fi
84+
85+
return 0
86+
}
87+
88+
force_stop() {
89+
# Force the process to die killing it manually
90+
[ ! -e "$PIDFILE" ] && return
91+
if running ; then
92+
kill -15 $pid
93+
# Is it really dead?
94+
sleep "$DIETIME"s
95+
if running ; then
96+
kill -9 $pid
97+
sleep "$DIETIME"s
98+
if running ; then
99+
echo "Cannot kill $NAME (pid=$pid)!"
100+
exit 1
101+
fi
102+
fi
103+
fi
104+
rm -f $PIDFILE
105+
}
106+
107+
108+
case "$1" in
109+
start)
110+
log_daemon_msg "Starting $NAME"
111+
# Check if it's running first
112+
if running ; then
113+
log_progress_msg "apparently already running"
114+
log_end_msg 0
115+
exit 0
116+
fi
117+
if start_server && running ; then
118+
# It's ok, the server started and is running
119+
log_end_msg 0
120+
else
121+
# Either we could not start it or it is not running
122+
# after we did
123+
# NOTE: Some servers might die some time after they start,
124+
# this code does not try to detect this and might give
125+
# a false positive (use 'status' for that)
126+
log_end_msg 1
127+
fi
128+
;;
129+
stop)
130+
log_daemon_msg "Stopping $NAME"
131+
if running ; then
132+
# Only stop the server if we see it running
133+
stop_server
134+
log_end_msg $?
135+
else
136+
# If it's not running don't do anything
137+
log_progress_msg "apparently not running"
138+
log_end_msg 0
139+
exit 0
140+
fi
141+
;;
142+
force-stop)
143+
# First try to stop gracefully the program
144+
$0 stop
145+
if running; then
146+
# If it's still running try to kill it more forcefully
147+
log_daemon_msg "Stopping (force) $NAME"
148+
force_stop
149+
log_end_msg $?
150+
fi
151+
;;
152+
restart|force-reload)
153+
log_daemon_msg "Restarting $NAME"
154+
stop_server
155+
# Wait some sensible amount, some server need this
156+
[ -n "$DIETIME" ] && sleep $DIETIME
157+
start_server
158+
running
159+
log_end_msg $?
160+
;;
161+
status)
162+
log_daemon_msg "Checking status of $NAME"
163+
if running ; then
164+
log_progress_msg "running"
165+
log_end_msg 0
166+
else
167+
log_progress_msg "apparently not running"
168+
log_end_msg 1
169+
exit 1
170+
fi
171+
;;
172+
# Use this if the daemon cannot reload
173+
reload)
174+
log_warning_msg "Reloading $NAME daemon: not implemented, as the daemon"
175+
log_warning_msg "cannot re-read the config file (use restart)."
176+
;;
177+
*)
178+
N=/etc/init.d/openvswitch-ipsec
179+
echo "Usage: $N {start|stop|force-stop|restart|force-reload|status}" >&2
180+
exit 1
181+
;;
182+
esac
183+
184+
exit 0

debian/openvswitch-ipsec.install

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
debian/ovs-monitor-ipsec usr/share/openvswitch/scripts

0 commit comments

Comments
 (0)