forked from openvswitch/ovs
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
debian: Add support for GRE-over-IPsec
The ovs-monitor-ipsec daemon monitors the Interface table for GRE
entries. If an entry specifies other-config parameters "ipsec-local-ip"
and ("ipsec-psk" or "ipsec-cert"), it will create the appropriate
security associations so that all GRE traffic to the remote host will be
encrypted. In order for the two GRE tunnels to communicate, both sides
need to be configured for IPsec with appropriate authentication.
Currently, ovs-monitor-ipsec does not support certificate authentication
or ensure that an interface is actually attached to a bridge. Both of
these issues will be addressed in a forthcoming patch.
NB: While GRE-over-IPsec should work on any system with a relatively
recent racoon and setkey, it has only been tested on Debian. As such,
only Debian packaging has been provided.- Loading branch information
Justin Pettit
committed
Sep 23, 2010
1 parent
f10a033
commit a3acf0b
Showing
9 changed files
with
578 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| usr/share/openvswitch/scripts |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,184 @@ | ||
| #!/bin/sh | ||
| # | ||
| # Copyright (c) 2007, 2009 Javier Fernandez-Sanguino <[email protected]> | ||
| # | ||
| # This is free software; you may redistribute it and/or modify | ||
| # it under the terms of the GNU General Public License as | ||
| # published by the Free Software Foundation; either version 2, | ||
| # or (at your option) any later version. | ||
| # | ||
| # This is distributed in the hope that it will be useful, but | ||
| # WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
| # GNU General Public License for more details. | ||
| # | ||
| # You should have received a copy of the GNU General Public License with | ||
| # the Debian operating system, in /usr/share/common-licenses/GPL; if | ||
| # not, write to the Free Software Foundation, Inc., 59 Temple Place, | ||
| # Suite 330, Boston, MA 02111-1307 USA | ||
| # | ||
| ### BEGIN INIT INFO | ||
| # Provides: openvswitch-ipsec | ||
| # Required-Start: $network $local_fs $remote_fs | ||
| # Required-Stop: $remote_fs | ||
| # Default-Start: 2 3 4 5 | ||
| # Default-Stop: 0 1 6 | ||
| # Short-Description: Open vSwitch GRE-over-IPsec daemon | ||
| ### END INIT INFO | ||
|
|
||
| PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin | ||
|
|
||
| DAEMON=/usr/share/openvswitch/scripts/ovs-monitor-ipsec # Daemon's location | ||
| NAME=ovs-monitor-ipsec # Introduce the short server's name here | ||
| LOGDIR=/var/log/openvswitch # Log directory to use | ||
|
|
||
| PIDFILE=/var/run/openvswitch/$NAME.pid | ||
|
|
||
| test -x $DAEMON || exit 0 | ||
|
|
||
| . /lib/lsb/init-functions | ||
|
|
||
| DODTIME=10 # Time to wait for the server to die, in seconds | ||
| # If this value is set too low you might not | ||
| # let some servers to die gracefully and | ||
| # 'restart' will not work | ||
|
|
||
| set -e | ||
|
|
||
| running_pid() { | ||
| # Check if a given process pid's cmdline matches a given name | ||
| pid=$1 | ||
| name=$2 | ||
| [ -z "$pid" ] && return 1 | ||
| [ ! -d /proc/$pid ] && return 1 | ||
| cmd=`cat /proc/$pid/cmdline | tr "\000" " "|cut -d " " -f 2` | ||
| # Is this the expected server | ||
| [ "$cmd" != "$name" ] && return 1 | ||
| return 0 | ||
| } | ||
|
|
||
| running() { | ||
| # Check if the process is running looking at /proc | ||
| # (works for all users) | ||
|
|
||
| # No pidfile, probably no daemon present | ||
| [ ! -f "$PIDFILE" ] && return 1 | ||
| pid=`cat $PIDFILE` | ||
| running_pid $pid $DAEMON || return 1 | ||
| return 0 | ||
| } | ||
|
|
||
| start_server() { | ||
| PYTHONPATH=/usr/share/openvswitch/python \ | ||
| /usr/share/openvswitch/scripts/ovs-monitor-ipsec \ | ||
| --pidfile-name=$PIDFILE --detach --monitor \ | ||
| unix:/var/run/openvswitch/db.sock | ||
|
|
||
| return 0 | ||
| } | ||
|
|
||
| stop_server() { | ||
| if [ -e $PIDFILE ]; then | ||
| kill `cat $PIDFILE` | ||
| fi | ||
|
|
||
| return 0 | ||
| } | ||
|
|
||
| force_stop() { | ||
| # Force the process to die killing it manually | ||
| [ ! -e "$PIDFILE" ] && return | ||
| if running ; then | ||
| kill -15 $pid | ||
| # Is it really dead? | ||
| sleep "$DIETIME"s | ||
| if running ; then | ||
| kill -9 $pid | ||
| sleep "$DIETIME"s | ||
| if running ; then | ||
| echo "Cannot kill $NAME (pid=$pid)!" | ||
| exit 1 | ||
| fi | ||
| fi | ||
| fi | ||
| rm -f $PIDFILE | ||
| } | ||
|
|
||
|
|
||
| case "$1" in | ||
| start) | ||
| log_daemon_msg "Starting $NAME" | ||
| # Check if it's running first | ||
| if running ; then | ||
| log_progress_msg "apparently already running" | ||
| log_end_msg 0 | ||
| exit 0 | ||
| fi | ||
| if start_server && running ; then | ||
| # It's ok, the server started and is running | ||
| log_end_msg 0 | ||
| else | ||
| # Either we could not start it or it is not running | ||
| # after we did | ||
| # NOTE: Some servers might die some time after they start, | ||
| # this code does not try to detect this and might give | ||
| # a false positive (use 'status' for that) | ||
| log_end_msg 1 | ||
| fi | ||
| ;; | ||
| stop) | ||
| log_daemon_msg "Stopping $NAME" | ||
| if running ; then | ||
| # Only stop the server if we see it running | ||
| stop_server | ||
| log_end_msg $? | ||
| else | ||
| # If it's not running don't do anything | ||
| log_progress_msg "apparently not running" | ||
| log_end_msg 0 | ||
| exit 0 | ||
| fi | ||
| ;; | ||
| force-stop) | ||
| # First try to stop gracefully the program | ||
| $0 stop | ||
| if running; then | ||
| # If it's still running try to kill it more forcefully | ||
| log_daemon_msg "Stopping (force) $NAME" | ||
| force_stop | ||
| log_end_msg $? | ||
| fi | ||
| ;; | ||
| restart|force-reload) | ||
| log_daemon_msg "Restarting $NAME" | ||
| stop_server | ||
| # Wait some sensible amount, some server need this | ||
| [ -n "$DIETIME" ] && sleep $DIETIME | ||
| start_server | ||
| running | ||
| log_end_msg $? | ||
| ;; | ||
| status) | ||
| log_daemon_msg "Checking status of $NAME" | ||
| if running ; then | ||
| log_progress_msg "running" | ||
| log_end_msg 0 | ||
| else | ||
| log_progress_msg "apparently not running" | ||
| log_end_msg 1 | ||
| exit 1 | ||
| fi | ||
| ;; | ||
| # Use this if the daemon cannot reload | ||
| reload) | ||
| log_warning_msg "Reloading $NAME daemon: not implemented, as the daemon" | ||
| log_warning_msg "cannot re-read the config file (use restart)." | ||
| ;; | ||
| *) | ||
| N=/etc/init.d/openvswitch-ipsec | ||
| echo "Usage: $N {start|stop|force-stop|restart|force-reload|status}" >&2 | ||
| exit 1 | ||
| ;; | ||
| esac | ||
|
|
||
| exit 0 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| debian/ovs-monitor-ipsec usr/share/openvswitch/scripts |
Oops, something went wrong.