Skip to content

CLOUDSTACK-10010: Fixed the negotiation of S2S VPN connections #2190

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
swill wants to merge 6 commits into from
Closed

CLOUDSTACK-10010: Fixed the negotiation of S2S VPN connections #2190

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
c013324
fixing s2s vpn connection negotiation
swill Jul 20, 2017
66d9705
fixed the vpn status check logic
swill Jul 24, 2017
ffce547
added additional testing of s2s vpn to do a more complete set of tests
swill Jul 24, 2017
5ab7f33
changed the tests to run with an account and domain instead of a project
swill Jul 26, 2017
85d1b8d
changed domain id format and removed the vpcid from the create vm call
swill Jul 27, 2017
30792fb
fixed a type that got introduced
swill Jul 31, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 13 additions & 2 deletions systemvm/patches/debian/config/opt/cloud/bin/configure.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -566,7 +566,7 @@ def configure_ipsec(self, obj):
file.addeq(" lifetime=%s" % self.convert_sec_to_h(obj['esp_lifetime']))
file.addeq(" pfs=%s" % pfs)
file.addeq(" keyingtries=2")
file.addeq(" auto=start")
file.addeq(" auto=route")
if 'encap' not in obj:
obj['encap']=False
file.addeq(" forceencaps=%s" % CsHelper.bool_to_yn(obj['encap']))
Expand All @@ -582,10 +582,21 @@ def configure_ipsec(self, obj):
logging.info("Configured vpn %s %s", leftpeer, rightpeer)
CsHelper.execute("ipsec rereadsecrets")

# This will load the new config and start the connection when needed since auto=start in the config
# This will load the new config
CsHelper.execute("ipsec reload")
os.chmod(vpnsecretsfile, 0400)

# Check that the ipsec config is ready
for i in range(2):
result = CsHelper.execute('ipsec status vpn-%s | grep "%s"' % (rightpeer, peerlist.split(",", 1)[0]))
if len(result) > 0:
break
time.sleep(1)

# With 'auto=route', connections are established with an attempt to communicate over the S2S VPN
# Attempt to ping the other side to initialize the connection of the S2S VPN configuration
CsHelper.execute("timeout 0.5 ping -c 1 %s" % (peerlist.split("/", 1)[0]))
Copy link
Member

@yadvr yadvr Dec 2, 2017 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here the timeout maybe too small and the ping IP may be something like 10.0.0.0 (for a peer cidr of 10.0.0.0/16) instead of say 10.1.1.1. It's better to ping right peer or ping the peerlist cidr replacing .0 with .1?


def convert_sec_to_h(self, val):
hrs = int(val) / 3600
return "%sh" % hrs
Expand Down
Loading