Current File : //snap/lxd/current/share/openvswitch/scripts/ovs-monitor-ipsec
#! /usr/bin/python3
# Copyright (c) 2017 Nicira, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at:
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
import argparse
import copy
import ipaddress
import os
import re
import subprocess
import sys
from string import Template
import ovs.daemon
import ovs.db.idl
import ovs.dirs
import ovs.unixctl
import ovs.unixctl.server
import ovs.util
import ovs.vlog
FILE_HEADER = "# Generated by ovs-monitor-ipsec...do not modify by hand!\n\n"
transp_tmpl = {"gre": Template("""\
conn $ifname-$version
$auth_section
leftprotoport=gre
rightprotoport=gre
"""), "gre64": Template("""\
conn $ifname-$version
$auth_section
leftprotoport=gre
rightprotoport=gre
"""), "geneve": Template("""\
conn $ifname-in-$version
$auth_section
leftprotoport=udp/6081
rightprotoport=udp
conn $ifname-out-$version
$auth_section
leftprotoport=udp
rightprotoport=udp/6081
"""), "stt": Template("""\
conn $ifname-in-$version
$auth_section
leftprotoport=tcp/7471
rightprotoport=tcp
conn $ifname-out-$version
$auth_section
leftprotoport=tcp
rightprotoport=tcp/7471
"""), "vxlan": Template("""\
conn $ifname-in-$version
$auth_section
leftprotoport=udp/4789
rightprotoport=udp
conn $ifname-out-$version
$auth_section
leftprotoport=udp
rightprotoport=udp/4789
""")}
vlog = ovs.vlog.Vlog("ovs-monitor-ipsec")
exiting = False
monitor = None
xfrm = None
class XFRM(object):
"""This class is a simple wrapper around ip-xfrm (8) command line
utility. We are using this class only for informational purposes
so that ovs-monitor-ipsec could verify that IKE keying daemon has
installed IPsec policies and security associations into kernel as
expected."""
def __init__(self, ip_root_prefix):
self.IP = ip_root_prefix + "/sbin/ip"
def get_policies(self):
"""This function returns IPsec policies (from kernel) in a dictionary
where <key> is destination IPv4 address and <value> is SELECTOR of
the IPsec policy."""
policies = {}
proc = subprocess.Popen([self.IP, 'xfrm', 'policy'],
stdout=subprocess.PIPE)
while True:
line = proc.stdout.readline().strip().decode()
if line == '':
break
a = line.split(" ")
if len(a) >= 4 and a[0] == "src" and a[2] == "dst":
dst = (a[3].split("/"))[0]
if dst not in policies:
policies[dst] = []
policies[dst].append(line)
src = (a[3].split("/"))[0]
if src not in policies:
policies[src] = []
policies[src].append(line)
return policies
def get_securities(self):
"""This function returns IPsec security associations (from kernel)
in a dictionary where <key> is destination IPv4 address and <value>
is SELECTOR."""
securities = {}
proc = subprocess.Popen([self.IP, 'xfrm', 'state'],
stdout=subprocess.PIPE)
while True:
line = proc.stdout.readline().strip().decode()
if line == '':
break
a = line.split(" ")
if len(a) >= 4 and a[0] == "sel" \
and a[1] == "src" and a[3] == "dst":
remote_ip = a[4].rstrip().split("/")[0]
local_ip = a[2].rstrip().split("/")[0]
if remote_ip not in securities:
securities[remote_ip] = []
securities[remote_ip].append(line)
if local_ip not in securities:
securities[local_ip] = []
securities[local_ip].append(line)
return securities
class StrongSwanHelper(object):
"""This class does StrongSwan specific configurations."""
STRONGSWAN_CONF = """%s
charon {
plugins {
kernel-netlink {
set_proto_port_transport_sa = yes
xfrm_ack_expires = 10
}
gcm {
load = yes
}
}
load_modular = yes
}
""" % (FILE_HEADER)
CONF_HEADER = """%s
config setup
uniqueids=yes
conn %%default
keyingtries=%%forever
type=transport
keyexchange=ikev2
auto=route
ike=aes256gcm16-sha256-modp2048
esp=aes256gcm16-modp2048
""" % (FILE_HEADER)
CA_SECTION = """ca ca_auth
cacert=%s
"""
SHUNT_POLICY = """conn prevent_unencrypted_gre
type=drop
leftprotoport=gre
mark={0}
conn prevent_unencrypted_geneve
type=drop
leftprotoport=udp/6081
mark={0}
conn prevent_unencrypted_stt
type=drop
leftprotoport=tcp/7471
mark={0}
conn prevent_unencrypted_vxlan
type=drop
leftprotoport=udp/4789
mark={0}
"""
auth_tmpl = {"psk": Template("""\
left=%any
right=$remote_ip
authby=psk"""),
"pki_remote": Template("""\
left=%any
right=$remote_ip
leftid=$local_name
rightid=$remote_name
leftcert=$certificate
rightcert=$remote_cert"""),
"pki_ca": Template("""\
left=%any
right=$remote_ip
leftid=$local_name
rightid=$remote_name
leftcert=$certificate""")}
def __init__(self, root_prefix):
self.CHARON_CONF = root_prefix + "/etc/strongswan.d/ovs.conf"
self.IPSEC = root_prefix + "/usr/sbin/ipsec"
self.IPSEC_CONF = root_prefix + "/etc/ipsec.conf"
self.IPSEC_SECRETS = root_prefix + "/etc/ipsec.secrets"
self.conf_file = None
self.secrets_file = None
def restart_ike_daemon(self):
"""This function restarts StrongSwan."""
f = open(self.CHARON_CONF, "w")
f.write(self.STRONGSWAN_CONF)
f.close()
f = open(self.IPSEC_CONF, "w")
f.write(self.CONF_HEADER)
f.close()
f = open(self.IPSEC_SECRETS, "w")
f.write(FILE_HEADER)
f.close()
vlog.info("Restarting StrongSwan")
subprocess.call([self.IPSEC, "restart"])
def get_active_conns(self):
"""This function parses output from 'ipsec status' command.
It returns dictionary where <key> is interface name (as in OVSDB)
and <value> is another dictionary. This another dictionary
uses strongSwan connection name as <key> and more detailed
sample line from the parsed outpus as <value>. """
conns = {}
proc = subprocess.Popen([self.IPSEC, 'status'], stdout=subprocess.PIPE)
while True:
line = proc.stdout.readline().strip().decode()
if line == '':
break
tunnel_name = line.split(":")
if len(tunnel_name) < 2:
continue
m = re.match(r"(.*)(-in-\d+|-out-\d+|-\d+).*", tunnel_name[0])
if not m:
continue
ifname = m.group(1)
if ifname not in conns:
conns[ifname] = {}
(conns[ifname])[tunnel_name[0]] = line
return conns
def config_init(self):
self.conf_file = open(self.IPSEC_CONF, "w")
self.secrets_file = open(self.IPSEC_SECRETS, "w")
self.conf_file.write(self.CONF_HEADER)
self.secrets_file.write(FILE_HEADER)
def config_global(self, monitor):
"""Configure the global state of IPsec tunnels."""
needs_refresh = False
if monitor.conf_in_use != monitor.conf:
monitor.conf_in_use = copy.deepcopy(monitor.conf)
needs_refresh = True
# Configure the shunt policy
if monitor.conf_in_use["skb_mark"]:
skb_mark = monitor.conf_in_use["skb_mark"]
self.conf_file.write(self.SHUNT_POLICY.format(skb_mark))
# Configure the CA cert
if monitor.conf_in_use["pki"]["ca_cert"]:
cacert = monitor.conf_in_use["pki"]["ca_cert"]
self.conf_file.write(self.CA_SECTION % cacert)
return needs_refresh
def config_tunnel(self, tunnel):
if tunnel.conf["psk"]:
self.secrets_file.write('%%any %s : PSK "%s"\n' %
(tunnel.conf["remote_ip"], tunnel.conf["psk"]))
auth_section = self.auth_tmpl["psk"].substitute(tunnel.conf)
else:
self.secrets_file.write("%%any %s : RSA %s\n" %
(tunnel.conf["remote_ip"],
tunnel.conf["private_key"]))
if tunnel.conf["remote_cert"]:
tmpl = self.auth_tmpl["pki_remote"]
auth_section = tmpl.substitute(tunnel.conf)
else:
tmpl = self.auth_tmpl["pki_ca"]
auth_section = tmpl.substitute(tunnel.conf)
if "custom_options" in tunnel.conf:
for key, value in tunnel.conf["custom_options"].items():
auth_section += "\n " + key + "=" + value
vals = tunnel.conf.copy()
vals["auth_section"] = auth_section
vals["version"] = tunnel.version
conf_text = transp_tmpl[tunnel.conf["tunnel_type"]].substitute(vals)
self.conf_file.write(conf_text)
def config_fini(self):
self.secrets_file.close()
self.conf_file.close()
self.secrets_file = None
self.conf_file = None
def refresh(self, monitor):
"""This functions refreshes strongSwan configuration. Behind the
scenes this function calls:
1. once "ipsec update" command that tells strongSwan to load
all new tunnels from "ipsec.conf"; and
2. once "ipsec rereadsecrets" command that tells strongswan to load
secrets from "ipsec.conf" file
3. for every removed tunnel "ipsec stroke down-nb <tunnel>" command
that removes old tunnels.
Once strongSwan vici bindings will be distributed with major
Linux distributions this function could be simplified."""
vlog.info("Refreshing StrongSwan configuration")
proc = subprocess.Popen([self.IPSEC, "update"],
stdout=subprocess.PIPE,
stderr=subprocess.PIPE)
outs, errs = proc.communicate()
if proc.returncode != 0:
vlog.err("StrongSwan failed to update configuration:\n"
"%s \n %s" % (str(outs), str(errs)))
subprocess.call([self.IPSEC, "rereadsecrets"])
# "ipsec update" command does not remove those tunnels that were
# updated or that disappeared from the ipsec.conf file. So, we have
# to manually remove them by calling "ipsec stroke down-nb <tunnel>"
# command. We use <version> number to tell apart tunnels that
# were just updated.
# "ipsec down-nb" command is designed to be non-blocking (opposed
# to "ipsec down" command). This means that we should not be concerned
# about possibility of ovs-monitor-ipsec to block for each tunnel
# while strongSwan sends IKE messages over Internet.
conns_dict = self.get_active_conns()
for ifname, conns in conns_dict.items():
tunnel = monitor.tunnels.get(ifname)
for conn in conns:
# IPsec "connection" names that we choose in strongswan
# must start with Interface name
if not conn.startswith(ifname):
vlog.err("%s does not start with %s" % (conn, ifname))
continue
# version number should be the first integer after
# interface name in IPsec "connection"
try:
ver = int(re.findall(r'\d+', conn[len(ifname):])[0])
except IndexError:
vlog.err("%s does not contain version number")
continue
except ValueError:
vlog.err("%s does not contain version number")
continue
if not tunnel or tunnel.version != ver:
vlog.info("%s is outdated %u" % (conn, ver))
subprocess.call([self.IPSEC, "stroke", "down-nb", conn])
class LibreSwanHelper(object):
"""This class does LibreSwan specific configurations."""
CONF_HEADER = """%s
config setup
uniqueids=yes
conn %%default
keyingtries=%%forever
type=transport
auto=route
ike=aes_gcm256-sha2_256
esp=aes_gcm256
ikev2=insist
""" % (FILE_HEADER)
SHUNT_POLICY = """conn prevent_unencrypted_gre
type=drop
left=%defaultroute
leftprotoport=gre
mark={0}
conn prevent_unencrypted_geneve
type=drop
left=%defaultroute
leftprotoport=udp/6081
mark={0}
conn prevent_unencrypted_stt
type=drop
left=%defaultroute
leftprotoport=tcp/7471
mark={0}
conn prevent_unencrypted_vxlan
type=drop
left=%defaultroute
leftprotoport=udp/4789
mark={0}
"""
IPV6_CONN = """\
hostaddrfamily=ipv6
clientaddrfamily=ipv6
"""
auth_tmpl = {"psk": Template("""\
left=$local_ip
right=$remote_ip
authby=secret"""),
"pki_remote": Template("""\
left=$local_ip
right=$remote_ip
leftid=@$local_name
rightid=@$remote_name
leftcert="ovs_certkey_$local_name"
rightcert="ovs_cert_$remote_name"
leftrsasigkey=%cert"""),
"pki_ca": Template("""\
left=$local_ip
right=$remote_ip
leftid=@$local_name
rightid=@$remote_name
leftcert="ovs_certkey_$local_name"
leftrsasigkey=%cert
rightca=%same""")}
CERT_PREFIX = "ovs_cert_"
CERTKEY_PREFIX = "ovs_certkey_"
def __init__(self, libreswan_root_prefix, args):
ipsec_conf = args.ipsec_conf if args.ipsec_conf else "/etc/ipsec.conf"
ipsec_d = args.ipsec_d if args.ipsec_d else "/etc/ipsec.d"
ipsec_secrets = (args.ipsec_secrets if args.ipsec_secrets
else "/etc/ipsec.secrets")
ipsec_ctl = (args.ipsec_ctl if args.ipsec_ctl
else "/run/pluto/pluto.ctl")
self.IPSEC = libreswan_root_prefix + "/usr/sbin/ipsec"
self.IPSEC_CONF = libreswan_root_prefix + ipsec_conf
self.IPSEC_SECRETS = libreswan_root_prefix + ipsec_secrets
self.IPSEC_D = "sql:" + libreswan_root_prefix + ipsec_d
self.IPSEC_CTL = libreswan_root_prefix + ipsec_ctl
self.conf_file = None
self.secrets_file = None
vlog.dbg("Using: " + self.IPSEC)
vlog.dbg("Configuration file: " + self.IPSEC_CONF)
vlog.dbg("Secrets file: " + self.IPSEC_SECRETS)
vlog.dbg("ipsec.d: " + self.IPSEC_D)
vlog.dbg("Pluto socket: " + self.IPSEC_CTL)
def restart_ike_daemon(self):
"""This function restarts LibreSwan."""
# Remove the stale information from the NSS database
self._nss_clear_database()
f = open(self.IPSEC_CONF, "w")
f.write(self.CONF_HEADER)
f.close()
f = open(self.IPSEC_SECRETS, "w")
f.write(FILE_HEADER)
f.close()
vlog.info("Restarting LibreSwan")
subprocess.call([self.IPSEC, "restart"])
def config_init(self):
self.conf_file = open(self.IPSEC_CONF, "w")
self.secrets_file = open(self.IPSEC_SECRETS, "w")
self.conf_file.write(self.CONF_HEADER)
self.secrets_file.write(FILE_HEADER)
def config_global(self, monitor):
"""Configure the global state of IPsec tunnels."""
needs_refresh = False
if monitor.conf_in_use["pki"] != monitor.conf["pki"]:
# Clear old state
if monitor.conf_in_use["pki"]["certificate"]:
local_name = monitor.conf_in_use["pki"]["local_name"]
self._nss_delete_cert_and_key(self.CERTKEY_PREFIX + local_name)
if monitor.conf_in_use["pki"]["ca_cert"]:
self._nss_delete_cert(self.CERT_PREFIX + "cacert")
# Load new state
if monitor.conf["pki"]["certificate"]:
cert = monitor.conf["pki"]["certificate"]
key = monitor.conf["pki"]["private_key"]
name = monitor.conf["pki"]["local_name"]
name = self.CERTKEY_PREFIX + name
self._nss_import_cert_and_key(cert, key, name)
if monitor.conf["pki"]["ca_cert"]:
self._nss_import_cert(monitor.conf["pki"]["ca_cert"],
self.CERT_PREFIX + "cacert", 'CT,,')
monitor.conf_in_use["pki"] = copy.deepcopy(monitor.conf["pki"])
needs_refresh = True
# Configure the shunt policy
if monitor.conf["skb_mark"]:
skb_mark = monitor.conf["skb_mark"]
self.conf_file.write(self.SHUNT_POLICY.format(skb_mark))
# Will update conf_in_use later in the 'refresh' method
if monitor.conf_in_use["skb_mark"] != monitor.conf["skb_mark"]:
needs_refresh = True
return needs_refresh
def config_tunnel(self, tunnel):
if tunnel.conf["psk"]:
self.secrets_file.write('%%any %s : PSK "%s"\n' %
(tunnel.conf["remote_ip"], tunnel.conf["psk"]))
auth_section = self.auth_tmpl["psk"].substitute(tunnel.conf)
elif tunnel.conf["remote_cert"]:
auth_section = self.auth_tmpl["pki_remote"].substitute(tunnel.conf)
self._nss_import_cert(tunnel.conf["remote_cert"],
self.CERT_PREFIX + tunnel.conf["remote_name"],
'P,P,P')
else:
auth_section = self.auth_tmpl["pki_ca"].substitute(tunnel.conf)
if tunnel.conf["address_family"] == "IPv6":
auth_section = self.IPV6_CONN + auth_section
if "custom_options" in tunnel.conf:
for key, value in tunnel.conf["custom_options"].items():
auth_section += "\n " + key + "=" + value
vals = tunnel.conf.copy()
vals["auth_section"] = auth_section
vals["version"] = tunnel.version
conf_text = transp_tmpl[tunnel.conf["tunnel_type"]].substitute(vals)
self.conf_file.write(conf_text)
def config_fini(self):
self.secrets_file.close()
self.conf_file.close()
self.secrets_file = None
self.conf_file = None
def clear_tunnel_state(self, tunnel):
if tunnel.conf["remote_cert"]:
name = self.CERT_PREFIX + tunnel.conf["remote_name"]
self._nss_delete_cert(name)
def refresh(self, monitor):
vlog.info("Refreshing LibreSwan configuration")
subprocess.call([self.IPSEC, "auto", "--ctlsocket", self.IPSEC_CTL,
"--config", self.IPSEC_CONF, "--rereadsecrets"])
tunnels = set(monitor.tunnels.keys())
# Delete old connections
conns_dict = self.get_active_conns()
for ifname, conns in conns_dict.items():
tunnel = monitor.tunnels.get(ifname)
for conn in conns:
# IPsec "connection" names must start with Interface name
if not conn.startswith(ifname):
vlog.err("%s does not start with %s" % (conn, ifname))
continue
# version number should be the first integer after
# interface name in IPsec "connection"
try:
ver = int(re.findall(r'\d+', conn[len(ifname):])[0])
except ValueError:
vlog.err("%s does not contain version number")
continue
except IndexError:
vlog.err("%s does not contain version number")
continue
if not tunnel or tunnel.version != ver:
vlog.info("%s is outdated %u" % (conn, ver))
subprocess.call([self.IPSEC, "auto", "--ctlsocket",
self.IPSEC_CTL, "--config",
self.IPSEC_CONF, "--delete", conn])
elif ifname in tunnels:
tunnels.remove(ifname)
# Activate new connections
for name in tunnels:
ver = monitor.tunnels[name].version
if monitor.tunnels[name].conf["tunnel_type"] == "gre":
conn = "%s-%s" % (name, ver)
self._start_ipsec_connection(conn)
else:
conn_in = "%s-in-%s" % (name, ver)
conn_out = "%s-out-%s" % (name, ver)
self._start_ipsec_connection(conn_in)
self._start_ipsec_connection(conn_out)
# Update shunt policy if changed
if monitor.conf_in_use["skb_mark"] != monitor.conf["skb_mark"]:
if monitor.conf["skb_mark"]:
subprocess.call([self.IPSEC, "auto",
"--config", self.IPSEC_CONF,
"--ctlsocket", self.IPSEC_CTL,
"--add",
"--asynchronous", "prevent_unencrypted_gre"])
subprocess.call([self.IPSEC, "auto",
"--config", self.IPSEC_CONF,
"--ctlsocket", self.IPSEC_CTL,
"--add",
"--asynchronous", "prevent_unencrypted_geneve"])
subprocess.call([self.IPSEC, "auto",
"--config", self.IPSEC_CONF,
"--ctlsocket", self.IPSEC_CTL,
"--add",
"--asynchronous", "prevent_unencrypted_stt"])
subprocess.call([self.IPSEC, "auto",
"--config", self.IPSEC_CONF,
"--ctlsocket", self.IPSEC_CTL,
"--add",
"--asynchronous", "prevent_unencrypted_vxlan"])
else:
subprocess.call([self.IPSEC, "auto",
"--config", self.IPSEC_CONF,
"--ctlsocket", self.IPSEC_CTL,
"--delete",
"--asynchronous", "prevent_unencrypted_gre"])
subprocess.call([self.IPSEC, "auto",
"--config", self.IPSEC_CONF,
"--ctlsocket", self.IPSEC_CTL,
"--delete",
"--asynchronous", "prevent_unencrypted_geneve"])
subprocess.call([self.IPSEC, "auto",
"--config", self.IPSEC_CONF,
"--ctlsocket", self.IPSEC_CTL,
"--delete",
"--asynchronous", "prevent_unencrypted_stt"])
subprocess.call([self.IPSEC, "auto",
"--config", self.IPSEC_CONF,
"--ctlsocket", self.IPSEC_CTL,
"--delete",
"--asynchronous", "prevent_unencrypted_vxlan"])
monitor.conf_in_use["skb_mark"] = monitor.conf["skb_mark"]
def get_active_conns(self):
"""This function parses output from 'ipsec status' command.
It returns dictionary where <key> is interface name (as in OVSDB)
and <value> is another dictionary. This another dictionary
uses LibreSwan connection name as <key> and more detailed
sample line from the parsed outpus as <value>. """
conns = {}
proc = subprocess.Popen([self.IPSEC, 'status', '--ctlsocket',
self.IPSEC_CTL], stdout=subprocess.PIPE)
while True:
line = proc.stdout.readline().strip().decode()
if line == '':
break
m = re.search(r"#\d+: \"(.*)\".*", line)
if not m:
continue
conn = m.group(1)
m = re.match(r"(.*)(-in-\d+|-out-\d+)", conn)
if not m:
# GRE connections have format <iface>-<ver>
m = re.match(r"(.*)(-\d+)", conn)
if not m:
continue
ifname = m.group(1)
if ifname not in conns:
conns[ifname] = {}
(conns[ifname])[conn] = line
return conns
def _start_ipsec_connection(self, conn):
# In a corner case, LibreSwan daemon restarts for some reason and
# the "ipsec auto --start" command is lost. Just retry to make sure
# the command is received by LibreSwan.
while True:
proc = subprocess.Popen([self.IPSEC, "auto",
"--config", self.IPSEC_CONF,
"--ctlsocket", self.IPSEC_CTL,
"--start",
"--asynchronous", conn],
stdout=subprocess.PIPE,
stderr=subprocess.PIPE)
perr = str(proc.stderr.read())
pout = str(proc.stdout.read())
if not re.match(r".*Connection refused.*", perr) and \
not re.match(r".*need --listen.*", pout):
break
if re.match(r".*[F|f]ailed to initiate connection.*", pout):
vlog.err('Failed to initiate connection through'
' Interface %s.\n' % (conn.split('-')[0]))
vlog.err(pout)
def _nss_clear_database(self):
"""Remove all OVS IPsec related state from the NSS database"""
try:
proc = subprocess.Popen(['certutil', '-L', '-d',
self.IPSEC_D],
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
universal_newlines=True)
lines = proc.stdout.readlines()
for line in lines:
s = line.strip().split()
if len(s) < 1:
continue
name = s[0]
if name.startswith(self.CERT_PREFIX):
self._nss_delete_cert(name)
elif name.startswith(self.CERTKEY_PREFIX):
self._nss_delete_cert_and_key(name)
except Exception as e:
vlog.err("Failed to clear NSS database.\n" + str(e))
def _nss_import_cert(self, cert, name, cert_type):
"""Cert_type is 'CT,,' for the CA certificate and 'P,P,P' for the
normal certificate."""
try:
proc = subprocess.Popen(['certutil', '-A', '-a', '-i', cert,
'-d', self.IPSEC_D, '-n',
name, '-t', cert_type],
stdout=subprocess.PIPE,
stderr=subprocess.PIPE)
proc.wait()
if proc.returncode:
raise Exception(proc.stderr.read())
except Exception as e:
vlog.err("Failed to import certificate into NSS.\n" + str(e))
def _nss_delete_cert(self, name):
try:
proc = subprocess.Popen(['certutil', '-D', '-d',
self.IPSEC_D, '-n', name],
stdout=subprocess.PIPE,
stderr=subprocess.PIPE)
proc.wait()
if proc.returncode:
raise Exception(proc.stderr.read())
except Exception as e:
vlog.err("Failed to delete certificate from NSS.\n" + str(e))
def _nss_import_cert_and_key(self, cert, key, name):
try:
# Avoid deleting other files
path = os.path.abspath('/tmp/%s.p12' % name)
if not path.startswith('/tmp/'):
raise Exception("Illegal certificate name!")
# Create p12 file from pem files
proc = subprocess.Popen(['openssl', 'pkcs12', '-export',
'-in', cert, '-inkey', key, '-out',
path, '-name', name, '-passout', 'pass:'],
stdout=subprocess.PIPE,
stderr=subprocess.PIPE)
proc.wait()
if proc.returncode:
raise Exception(proc.stderr.read())
# Load p12 file to the database
proc = subprocess.Popen(['pk12util', '-i', path, '-d',
self.IPSEC_D, '-W', ''],
stdout=subprocess.PIPE,
stderr=subprocess.PIPE)
proc.wait()
if proc.returncode:
raise Exception(proc.stderr.read())
except Exception as e:
vlog.err("Import cert and key failed.\n" + str(e))
os.remove(path)
def _nss_delete_cert_and_key(self, name):
try:
# Delete certificate and private key
proc = subprocess.Popen(['certutil', '-F', '-d',
self.IPSEC_D, '-n', name],
stdout=subprocess.PIPE,
stderr=subprocess.PIPE)
proc.wait()
if proc.returncode:
raise Exception(proc.stderr.read())
except Exception as e:
vlog.err("Delete cert and key failed.\n" + str(e))
class IPsecTunnel(object):
"""This is the base class for IPsec tunnel."""
unixctl_config_tmpl = Template("""\
Tunnel Type: $tunnel_type
Local IP: $local_ip
Remote IP: $remote_ip
Address Family: $address_family
SKB mark: $skb_mark
Local cert: $certificate
Local name: $local_name
Local key: $private_key
Remote cert: $remote_cert
Remote name: $remote_name
CA cert: $ca_cert
PSK: $psk
Custom Options: $custom_options
""")
unixctl_status_tmpl = Template("""\
Ofport: $ofport
CFM state: $cfm_state
""")
def __init__(self, name, row):
self.name = name # 'name' will not change because it is key in OVSDB
self.version = 0 # 'version' is increased on configuration changes
self.last_refreshed_version = -1
self.state = "INIT"
self.conf = {}
self.status = {}
self.update_conf(row)
def update_conf(self, row):
"""This function updates IPsec tunnel configuration by using 'row'
from OVSDB interface table. If configuration was actually changed
in OVSDB then this function returns True. Otherwise, it returns
False."""
ret = False
options = row.options
remote_cert = options.get("remote_cert")
remote_name = options.get("remote_name")
if remote_cert:
remote_name = monitor._get_cn_from_cert(remote_cert)
new_conf = {
"ifname": self.name,
"tunnel_type": row.type,
"local_ip": options.get("local_ip", "%defaultroute"),
"remote_ip": options.get("remote_ip"),
"address_family": self._get_conn_address_family(
options.get("remote_ip"),
options.get("local_ip")),
"skb_mark": monitor.conf["skb_mark"],
"certificate": monitor.conf["pki"]["certificate"],
"private_key": monitor.conf["pki"]["private_key"],
"ca_cert": monitor.conf["pki"]["ca_cert"],
"remote_cert": remote_cert,
"remote_name": remote_name,
"local_name": monitor.conf["pki"]["local_name"],
"psk": options.get("psk"),
"custom_options": {}}
# add custom ipsec options to the connection
for key, value in options.items():
if key.startswith("ipsec_"):
new_conf["custom_options"][key[len("ipsec_"):]] = value
if self.conf != new_conf:
# Configuration was updated in OVSDB. Validate it and figure
# out what to do next with this IPsec tunnel. Also, increment
# version number of this IPsec tunnel so that we could tell
# apart old and new tunnels in "ipsec status" output.
self.version += 1
ret = True
self.conf = new_conf
if self._is_valid_tunnel_conf():
self.state = "CONFIGURED"
else:
vlog.warn("%s contains invalid configuration%s" %
(self.name, self.invalid_reason))
self.state = "INVALID"
new_status = {
"cfm_state": "Up" if row.cfm_fault == [False] else
"Down" if row.cfm_fault == [True] else
"Disabled",
"ofport": "Not assigned" if (row.ofport in [[], [-1]]) else
row.ofport[0]}
if self.status != new_status:
# Tunnel has become unhealthy or ofport changed. Simply log this.
vlog.dbg("%s changed status from %s to %s" %
(self.name, str(self.status), str(new_status)))
self.status = new_status
return ret
def mark_for_removal(self):
"""This function marks tunnel for removal."""
self.version += 1
self.state = "REMOVED"
def show(self, policies, securities, conns):
state = self.state
if self.state == "INVALID":
state += self.invalid_reason
header = "Interface name: %s v%u (%s)\n" % (self.name, self.version,
state)
conf = self.unixctl_config_tmpl.substitute(self.conf)
status = self.unixctl_status_tmpl.substitute(self.status)
spds = "Kernel policies installed:\n"
remote_ip = self.conf["remote_ip"]
if remote_ip in policies:
for line in policies[remote_ip]:
spds += " " + line + "\n"
sas = "Kernel security associations installed:\n"
if remote_ip in securities:
for line in securities[remote_ip]:
sas += " " + line + "\n"
cons = "IPsec connections that are active:\n"
if self.name in conns:
for tname in conns[self.name]:
cons += " " + conns[self.name][tname] + "\n"
return header + conf + status + spds + sas + cons + "\n"
def _get_conn_address_family(self, remote_ip, local_ip):
remote = address_family(remote_ip)
local = address_family(local_ip)
if local is None:
return remote
elif local != remote:
return None
else:
return remote
def _is_valid_tunnel_conf(self):
"""This function verifies if IPsec tunnel has valid configuration
set in 'conf'. If it is valid, then it returns True. Otherwise,
it returns False and sets the reason why configuration was considered
as invalid.
This function could be improved in future to also verify validness
of certificates themselves so that ovs-monitor-ipsec would not
pass malformed configuration to IKE daemon."""
self.invalid_reason = None
if not self.conf["remote_ip"]:
self.invalid_reason = ": 'remote_ip' is not set"
return False
if self.conf["psk"]:
if self.conf["certificate"] or self.conf["private_key"] \
or self.conf["ca_cert"] or self.conf["remote_cert"] \
or self.conf["remote_name"]:
self.invalid_reason = ": 'certificate', 'private_key', "\
"'ca_cert', 'remote_cert', and "\
"'remote_name' must be unset with PSK"
return False
# If configuring authentication with CA-signed certificate or
# self-signed certificate, the 'remote_name' should be specified at
# this point. When using CA-signed certificate, the 'remote_name' is
# read from interface's options field. When using self-signed
# certificate, the 'remote_name' is extracted from the 'remote_cert'
# file.
elif self.conf["remote_name"]:
if not self.conf["certificate"]:
self.invalid_reason = ": must set 'certificate' as local"\
" certificate when using CA-signed"\
" certificate or self-signed"\
" certificate to authenticate peers"
return False
elif not self.conf["private_key"]:
self.invalid_reason = ": must set 'private_key' as local"\
" private key when using CA-signed"\
" certificate or self-signed"\
" certificate to authenticate peers"
return False
if not self.conf["remote_cert"] and not self.conf["ca_cert"]:
self.invalid_reason = ": must set 'remote_cert' when using"\
" self-signed certificate"\
" authentication or 'ca_cert' when"\
" using CA-signed certificate"\
" authentication"
return False
else:
self.invalid_reason = ": must choose a authentication method"
return False
return True
class IPsecMonitor(object):
"""This class monitors and configures IPsec tunnels"""
def __init__(self, root_prefix, ike_daemon, restart, args):
self.IPSEC = root_prefix + "/usr/sbin/ipsec"
self.tunnels = {}
# Global configuration shared by all tunnels
self.conf = {
"pki": {
"private_key": None,
"certificate": None,
"ca_cert": None,
"local_name": None
},
"skb_mark": None
}
self.conf_in_use = copy.deepcopy(self.conf)
# Choose to either use StrongSwan or LibreSwan as IKE daemon
if ike_daemon == "strongswan":
self.ike_helper = StrongSwanHelper(root_prefix)
elif ike_daemon == "libreswan":
self.ike_helper = LibreSwanHelper(root_prefix, args)
else:
vlog.err("The IKE daemon should be strongswan or libreswan.")
sys.exit(1)
# Check whether ipsec command is available
if not os.path.isfile(self.IPSEC) or \
not os.access(self.IPSEC, os.X_OK):
vlog.err("IKE daemon is not installed in the system.")
if restart:
vlog.info("Restarting IKE daemon")
self.ike_helper.restart_ike_daemon()
def is_tunneling_type_supported(self, tunnel_type):
"""Returns True if we know how to configure IPsec for these
types of tunnels. Otherwise, returns False."""
return tunnel_type in ["gre", "geneve", "vxlan", "stt"]
def is_ipsec_required(self, options_column):
"""Return True if tunnel needs to be encrypted. Otherwise,
returns False."""
return "psk" in options_column or \
"remote_name" in options_column or \
"remote_cert" in options_column
def add_tunnel(self, name, row):
"""Adds a new tunnel that monitor will provision with 'name'."""
vlog.info("Tunnel %s appeared in OVSDB" % (name))
self.tunnels[name] = IPsecTunnel(name, row)
def update_tunnel(self, name, row):
"""Updates configuration of already existing tunnel with 'name'."""
tunnel = self.tunnels[name]
if tunnel.update_conf(row):
vlog.info("Tunnel's '%s' configuration changed in OVSDB to %u" %
(tunnel.name, tunnel.version))
def del_tunnel(self, name):
"""Deletes tunnel by 'name'."""
vlog.info("Tunnel %s disappeared from OVSDB" % (name))
self.tunnels[name].mark_for_removal()
def update_conf(self, pki, skb_mark):
"""Update the global configuration for IPsec tunnels"""
self.conf["pki"]["certificate"] = pki[0]
self.conf["pki"]["private_key"] = pki[1]
self.conf["pki"]["ca_cert"] = pki[2]
self.conf["pki"]["local_name"] = pki[3]
# Update skb_mark used in IPsec policies.
self.conf["skb_mark"] = skb_mark
def read_ovsdb_open_vswitch_table(self, data):
"""This functions reads IPsec relevant configuration from Open_vSwitch
table."""
pki = [None, None, None, None]
skb_mark = None
is_valid = False
for row in data["Open_vSwitch"].rows.values():
pki[0] = row.other_config.get("certificate")
pki[1] = row.other_config.get("private_key")
pki[2] = row.other_config.get("ca_cert")
skb_mark = row.other_config.get("ipsec_skb_mark")
# Test whether it's a valid configration
if pki[0] and pki[1]:
pki[3] = self._get_cn_from_cert(pki[0])
if pki[3]:
is_valid = True
elif not pki[0] and not pki[1] and not pki[2]:
is_valid = True
if not is_valid:
vlog.warn("The cert and key configuration is not valid. "
"The valid configuations are 1): certificate, private_key "
"and ca_cert are not set; or 2): certificate and "
"private_key are all set.")
else:
self.update_conf(pki, skb_mark)
def read_ovsdb_interface_table(self, data):
"""This function reads the IPsec relevant configuration from Interface
table."""
ifaces = set()
for row in data["Interface"].rows.values():
if not self.is_tunneling_type_supported(row.type):
continue
if not self.is_ipsec_required(row.options):
continue
if row.name in self.tunnels:
self.update_tunnel(row.name, row)
else:
self.add_tunnel(row.name, row)
ifaces.add(row.name)
# Mark for removal those tunnels that just disappeared from OVSDB
for tunnel in self.tunnels.keys():
if tunnel not in ifaces:
self.del_tunnel(tunnel)
def read_ovsdb(self, data):
"""This function reads all configuration from OVSDB that
ovs-monitor-ipsec is interested in."""
self.read_ovsdb_open_vswitch_table(data)
self.read_ovsdb_interface_table(data)
def show(self, unix_conn, policies, securities):
"""This function prints all tunnel state in 'unix_conn'.
It uses 'policies' and securities' received from Linux Kernel
to show if tunnels were actually configured by the IKE deamon."""
if not self.tunnels:
unix_conn.reply("No tunnels configured with IPsec")
return
s = ""
conns = self.ike_helper.get_active_conns()
for name, tunnel in self.tunnels.items():
s += tunnel.show(policies, securities, conns)
unix_conn.reply(s)
def run(self):
"""This function runs state machine that represents whole
IPsec configuration (i.e. merged together from individual
tunnel state machines). It creates configuration files and
tells IKE daemon to update configuration."""
needs_refresh = False
removed_tunnels = []
self.ike_helper.config_init()
if self.ike_helper.config_global(self):
needs_refresh = True
for name, tunnel in self.tunnels.items():
if tunnel.last_refreshed_version != tunnel.version:
tunnel.last_refreshed_version = tunnel.version
needs_refresh = True
if tunnel.state == "REMOVED" or tunnel.state == "INVALID":
removed_tunnels.append(name)
elif tunnel.state == "CONFIGURED":
self.ike_helper.config_tunnel(self.tunnels[name])
self.ike_helper.config_fini()
for name in removed_tunnels:
# LibreSwan needs to clear state from database
if hasattr(self.ike_helper, "clear_tunnel_state"):
self.ike_helper.clear_tunnel_state(self.tunnels[name])
del self.tunnels[name]
if needs_refresh:
self.ike_helper.refresh(self)
def _get_cn_from_cert(self, cert):
try:
proc = subprocess.Popen(['openssl', 'x509', '-noout', '-subject',
'-nameopt', 'RFC2253', '-in', cert],
stdout=subprocess.PIPE,
stderr=subprocess.PIPE)
proc.wait()
if proc.returncode:
raise Exception(proc.stderr.read())
m = re.search(r"CN=(.+?),", proc.stdout.readline().decode())
if not m:
raise Exception("No CN in the certificate subject.")
except Exception as e:
vlog.warn(str(e))
return None
return m.group(1)
def address_family(address):
try:
ip = ipaddress.ip_address(address)
ipstr = str(type(ip))
# ipaddress has inconsistencies with what exceptions are raised:
# https://mail.openvswitch.org/pipermail/ovs-dev/2021-April/381696.html
except (ValueError, ipaddress.AddressValueError):
return None
if ipstr.find('v6') != -1:
return "IPv6"
return "IPv4"
def unixctl_xfrm_policies(conn, unused_argv, unused_aux):
global xfrm
policies = xfrm.get_policies()
conn.reply(str(policies))
def unixctl_xfrm_state(conn, unused_argv, unused_aux):
global xfrm
securities = xfrm.get_securities()
conn.reply(str(securities))
def unixctl_ipsec_status(conn, unused_argv, unused_aux):
global monitor
conns = monitor.ike_helper.get_active_conns()
conn.reply(str(conns))
def unixctl_show(conn, unused_argv, unused_aux):
global monitor
global xfrm
policies = xfrm.get_policies()
securities = xfrm.get_securities()
monitor.show(conn, policies, securities)
def unixctl_refresh(conn, unused_argv, unused_aux):
global monitor
monitor.ike_helper.refresh(monitor)
conn.reply(None)
def unixctl_exit(conn, argv, unused_aux):
global monitor
global exiting
ret = None
exiting = True
cleanup = True
for arg in argv:
if arg == "--no-cleanup":
cleanup = False
else:
cleanup = False
exiting = False
ret = str("unrecognized parameter: %s" % arg)
if cleanup:
# Make sure persistent global states are cleared
monitor.update_conf([None, None, None, None], None)
# Make sure persistent tunnel states are cleared
for tunnel in monitor.tunnels.keys():
monitor.del_tunnel(tunnel)
monitor.run()
conn.reply(ret)
def main():
parser = argparse.ArgumentParser()
parser.add_argument("database", metavar="DATABASE",
help="A socket on which ovsdb-server is listening.")
parser.add_argument("--root-prefix", metavar="DIR",
help="Use DIR as alternate root directory"
" (for testing).")
parser.add_argument("--ike-daemon", metavar="IKE-DAEMON",
help="The IKE daemon used for IPsec tunnels"
" (either libreswan or strongswan).")
parser.add_argument("--no-restart-ike-daemon", action='store_true',
help="Don't restart the IKE daemon on startup.")
parser.add_argument("--ipsec-conf", metavar="IPSEC-CONF",
help="Use DIR/IPSEC-CONF as location for "
" ipsec.conf (libreswan only).")
parser.add_argument("--ipsec-d", metavar="IPSEC-D",
help="Use DIR/IPSEC-D as location for "
" ipsec.d (libreswan only).")
parser.add_argument("--ipsec-secrets", metavar="IPSEC-SECRETS",
help="Use DIR/IPSEC-SECRETS as location for "
" ipsec.secrets (libreswan only).")
parser.add_argument("--ipsec-ctl", metavar="IPSEC-CTL",
help="Use DIR/IPSEC-CTL as location for "
" pluto ctl socket (libreswan only).")
ovs.vlog.add_args(parser)
ovs.daemon.add_args(parser)
args = parser.parse_args()
ovs.vlog.handle_args(args)
ovs.daemon.handle_args(args)
global monitor
global xfrm
root_prefix = args.root_prefix if args.root_prefix else ""
xfrm = XFRM(root_prefix)
monitor = IPsecMonitor(root_prefix, args.ike_daemon,
not args.no_restart_ike_daemon, args)
remote = args.database
schema_helper = ovs.db.idl.SchemaHelper()
schema_helper.register_columns("Interface",
["name", "type", "options", "cfm_fault",
"ofport"])
schema_helper.register_columns("Open_vSwitch", ["other_config"])
idl = ovs.db.idl.Idl(remote, schema_helper)
ovs.daemon.daemonize()
ovs.unixctl.command_register("list-commands", "", 0, 0,
ovs.unixctl._unixctl_help, None)
ovs.unixctl.command_register("xfrm/policies", "", 0, 0,
unixctl_xfrm_policies, None)
ovs.unixctl.command_register("xfrm/state", "", 0, 0,
unixctl_xfrm_state, None)
ovs.unixctl.command_register("ipsec/status", "", 0, 0,
unixctl_ipsec_status, None)
ovs.unixctl.command_register("tunnels/show", "", 0, 0,
unixctl_show, None)
ovs.unixctl.command_register("refresh", "", 0, 0, unixctl_refresh, None)
ovs.unixctl.command_register("exit", "[--no-cleanup]", 0, 1,
unixctl_exit, None)
error, unixctl_server = ovs.unixctl.server.UnixctlServer.create(None)
if error:
ovs.util.ovs_fatal(error, "could not create unixctl server", vlog)
# Sequence number when OVSDB was processed last time
seqno = idl.change_seqno
while True:
unixctl_server.run()
if exiting:
break
idl.run()
if seqno != idl.change_seqno:
monitor.read_ovsdb(idl.tables)
seqno = idl.change_seqno
monitor.run()
poller = ovs.poller.Poller()
unixctl_server.wait(poller)
idl.wait(poller)
poller.block()
unixctl_server.close()
idl.close()
if __name__ == '__main__':
try:
main()
except SystemExit:
# Let system.exit() calls complete normally
raise
except:
vlog.exception("traceback")
sys.exit(ovs.daemon.RESTART_EXIT_CODE)
Mini Shell