UnknownSec Bypass 403

: /proc/self/root/snap/lxd/current/share/openvswitch/scripts/ [ drwxr-xr-x ]
name : ovs-monitor-ipsec #! /usr/bin/python3 # Copyright (c) 2017 Nicira, Inc. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. import argparse import copy import ipaddress import os import re import subprocess import sys from string import Template import ovs.daemon import ovs.db.idl import ovs.dirs import ovs.unixctl import ovs.unixctl.server import ovs.util import ovs.vlog FILE_HEADER = "# Generated by ovs-monitor-ipsec...do not modify by hand!\n\n" transp_tmpl = {"gre": Template("""\ conn $ifname-$version $auth_section leftprotoport=gre rightprotoport=gre """), "gre64": Template("""\ conn $ifname-$version $auth_section leftprotoport=gre rightprotoport=gre """), "geneve": Template("""\ conn $ifname-in-$version $auth_section leftprotoport=udp/6081 rightprotoport=udp conn $ifname-out-$version $auth_section leftprotoport=udp rightprotoport=udp/6081 """), "stt": Template("""\ conn $ifname-in-$version $auth_section leftprotoport=tcp/7471 rightprotoport=tcp conn $ifname-out-$version $auth_section leftprotoport=tcp rightprotoport=tcp/7471 """), "vxlan": Template("""\ conn $ifname-in-$version $auth_section leftprotoport=udp/4789 rightprotoport=udp conn $ifname-out-$version $auth_section leftprotoport=udp rightprotoport=udp/4789 """)} vlog = ovs.vlog.Vlog("ovs-monitor-ipsec") exiting = False monitor = None xfrm = None class XFRM(object): """This class is a simple wrapper around ip-xfrm (8) command line utility. We are using this class only for informational purposes so that ovs-monitor-ipsec could verify that IKE keying daemon has installed IPsec policies and security associations into kernel as expected.""" def __init__(self, ip_root_prefix): self.IP = ip_root_prefix + "/sbin/ip" def get_policies(self): """This function returns IPsec policies (from kernel) in a dictionary where <key> is destination IPv4 address and <value> is SELECTOR of the IPsec policy.""" policies = {} proc = subprocess.Popen([self.IP, 'xfrm', 'policy'], stdout=subprocess.PIPE) while True: line = proc.stdout.readline().strip().decode() if line == '': break a = line.split(" ") if len(a) >= 4 and a[0] == "src" and a[2] == "dst": dst = (a[3].split("/"))[0] if dst not in policies: policies[dst] = [] policies[dst].append(line) src = (a[3].split("/"))[0] if src not in policies: policies[src] = [] policies[src].append(line) return policies def get_securities(self): """This function returns IPsec security associations (from kernel) in a dictionary where <key> is destination IPv4 address and <value> is SELECTOR.""" securities = {} proc = subprocess.Popen([self.IP, 'xfrm', 'state'], stdout=subprocess.PIPE) while True: line = proc.stdout.readline().strip().decode() if line == '': break a = line.split(" ") if len(a) >= 4 and a[0] == "sel" \ and a[1] == "src" and a[3] == "dst": remote_ip = a[4].rstrip().split("/")[0] local_ip = a[2].rstrip().split("/")[0] if remote_ip not in securities: securities[remote_ip] = [] securities[remote_ip].append(line) if local_ip not in securities: securities[local_ip] = [] securities[local_ip].append(line) return securities class StrongSwanHelper(object): """This class does StrongSwan specific configurations.""" STRONGSWAN_CONF = """%s charon { plugins { kernel-netlink { set_proto_port_transport_sa = yes xfrm_ack_expires = 10 } gcm { load = yes } } load_modular = yes } """ % (FILE_HEADER) CONF_HEADER = """%s config setup uniqueids=yes conn %%default keyingtries=%%forever type=transport keyexchange=ikev2 auto=route ike=aes256gcm16-sha256-modp2048 esp=aes256gcm16-modp2048 """ % (FILE_HEADER) CA_SECTION = """ca ca_auth cacert=%s """ SHUNT_POLICY = """conn prevent_unencrypted_gre type=drop leftprotoport=gre mark={0} conn prevent_unencrypted_geneve type=drop leftprotoport=udp/6081 mark={0} conn prevent_unencrypted_stt type=drop leftprotoport=tcp/7471 mark={0} conn prevent_unencrypted_vxlan type=drop leftprotoport=udp/4789 mark={0} """ auth_tmpl = {"psk": Template("""\ left=%any right=$remote_ip authby=psk"""), "pki_remote": Template("""\ left=%any right=$remote_ip leftid=$local_name rightid=$remote_name leftcert=$certificate rightcert=$remote_cert"""), "pki_ca": Template("""\ left=%any right=$remote_ip leftid=$local_name rightid=$remote_name leftcert=$certificate""")} def __init__(self, root_prefix): self.CHARON_CONF = root_prefix + "/etc/strongswan.d/ovs.conf" self.IPSEC = root_prefix + "/usr/sbin/ipsec" self.IPSEC_CONF = root_prefix + "/etc/ipsec.conf" self.IPSEC_SECRETS = root_prefix + "/etc/ipsec.secrets" self.conf_file = None self.secrets_file = None def restart_ike_daemon(self): """This function restarts StrongSwan.""" f = open(self.CHARON_CONF, "w") f.write(self.STRONGSWAN_CONF) f.close() f = open(self.IPSEC_CONF, "w") f.write(self.CONF_HEADER) f.close() f = open(self.IPSEC_SECRETS, "w") f.write(FILE_HEADER) f.close() vlog.info("Restarting StrongSwan") subprocess.call([self.IPSEC, "restart"]) def get_active_conns(self): """This function parses output from 'ipsec status' command. It returns dictionary where <key> is interface name (as in OVSDB) and <value> is another dictionary. This another dictionary uses strongSwan connection name as <key> and more detailed sample line from the parsed outpus as <value>. """ conns = {} proc = subprocess.Popen([self.IPSEC, 'status'], stdout=subprocess.PIPE) while True: line = proc.stdout.readline().strip().decode() if line == '': break tunnel_name = line.split(":") if len(tunnel_name) < 2: continue m = re.match(r"(.*)(-in-\d+|-out-\d+|-\d+).*", tunnel_name[0]) if not m: continue ifname = m.group(1) if ifname not in conns: conns[ifname] = {} (conns[ifname])[tunnel_name[0]] = line return conns def config_init(self): self.conf_file = open(self.IPSEC_CONF, "w") self.secrets_file = open(self.IPSEC_SECRETS, "w") self.conf_file.write(self.CONF_HEADER) self.secrets_file.write(FILE_HEADER) def config_global(self, monitor): """Configure the global state of IPsec tunnels.""" needs_refresh = False if monitor.conf_in_use != monitor.conf: monitor.conf_in_use = copy.deepcopy(monitor.conf) needs_refresh = True # Configure the shunt policy if monitor.conf_in_use["skb_mark"]: skb_mark = monitor.conf_in_use["skb_mark"] self.conf_file.write(self.SHUNT_POLICY.format(skb_mark)) # Configure the CA cert if monitor.conf_in_use["pki"]["ca_cert"]: cacert = monitor.conf_in_use["pki"]["ca_cert"] self.conf_file.write(self.CA_SECTION % cacert) return needs_refresh def config_tunnel(self, tunnel): if tunnel.conf["psk"]: self.secrets_file.write('%%any %s : PSK "%s"\n' % (tunnel.conf["remote_ip"], tunnel.conf["psk"])) auth_section = self.auth_tmpl["psk"].substitute(tunnel.conf) else: self.secrets_file.write("%%any %s : RSA %s\n" % (tunnel.conf["remote_ip"], tunnel.conf["private_key"])) if tunnel.conf["remote_cert"]: tmpl = self.auth_tmpl["pki_remote"] auth_section = tmpl.substitute(tunnel.conf) else: tmpl = self.auth_tmpl["pki_ca"] auth_section = tmpl.substitute(tunnel.conf) if "custom_options" in tunnel.conf: for key, value in tunnel.conf["custom_options"].items(): auth_section += "\n " + key + "=" + value vals = tunnel.conf.copy() vals["auth_section"] = auth_section vals["version"] = tunnel.version conf_text = transp_tmpl[tunnel.conf["tunnel_type"]].substitute(vals) self.conf_file.write(conf_text) def config_fini(self): self.secrets_file.close() self.conf_file.close() self.secrets_file = None self.conf_file = None def refresh(self, monitor): """This functions refreshes strongSwan configuration. Behind the scenes this function calls: 1. once "ipsec update" command that tells strongSwan to load all new tunnels from "ipsec.conf"; and 2. once "ipsec rereadsecrets" command that tells strongswan to load secrets from "ipsec.conf" file 3. for every removed tunnel "ipsec stroke down-nb <tunnel>" command that removes old tunnels. Once strongSwan vici bindings will be distributed with major Linux distributions this function could be simplified.""" vlog.info("Refreshing StrongSwan configuration") proc = subprocess.Popen([self.IPSEC, "update"], stdout=subprocess.PIPE, stderr=subprocess.PIPE) outs, errs = proc.communicate() if proc.returncode != 0: vlog.err("StrongSwan failed to update configuration:\n" "%s \n %s" % (str(outs), str(errs))) subprocess.call([self.IPSEC, "rereadsecrets"]) # "ipsec update" command does not remove those tunnels that were # updated or that disappeared from the ipsec.conf file. So, we have # to manually remove them by calling "ipsec stroke down-nb <tunnel>" # command. We use <version> number to tell apart tunnels that # were just updated. # "ipsec down-nb" command is designed to be non-blocking (opposed # to "ipsec down" command). This means that we should not be concerned # about possibility of ovs-monitor-ipsec to block for each tunnel # while strongSwan sends IKE messages over Internet. conns_dict = self.get_active_conns() for ifname, conns in conns_dict.items(): tunnel = monitor.tunnels.get(ifname) for conn in conns: # IPsec "connection" names that we choose in strongswan # must start with Interface name if not conn.startswith(ifname): vlog.err("%s does not start with %s" % (conn, ifname)) continue # version number should be the first integer after # interface name in IPsec "connection" try: ver = int(re.findall(r'\d+', conn[len(ifname):])[0]) except IndexError: vlog.err("%s does not contain version number") continue except ValueError: vlog.err("%s does not contain version number") continue if not tunnel or tunnel.version != ver: vlog.info("%s is outdated %u" % (conn, ver)) subprocess.call([self.IPSEC, "stroke", "down-nb", conn]) class LibreSwanHelper(object): """This class does LibreSwan specific configurations.""" CONF_HEADER = """%s config setup uniqueids=yes conn %%default keyingtries=%%forever type=transport auto=route ike=aes_gcm256-sha2_256 esp=aes_gcm256 ikev2=insist """ % (FILE_HEADER) SHUNT_POLICY = """conn prevent_unencrypted_gre type=drop left=%defaultroute leftprotoport=gre mark={0} conn prevent_unencrypted_geneve type=drop left=%defaultroute leftprotoport=udp/6081 mark={0} conn prevent_unencrypted_stt type=drop left=%defaultroute leftprotoport=tcp/7471 mark={0} conn prevent_unencrypted_vxlan type=drop left=%defaultroute leftprotoport=udp/4789 mark={0} """ IPV6_CONN = """\ hostaddrfamily=ipv6 clientaddrfamily=ipv6 """ auth_tmpl = {"psk": Template("""\ left=$local_ip right=$remote_ip authby=secret"""), "pki_remote": Template("""\ left=$local_ip right=$remote_ip leftid=@$local_name rightid=@$remote_name leftcert="ovs_certkey_$local_name" rightcert="ovs_cert_$remote_name" leftrsasigkey=%cert"""), "pki_ca": Template("""\ left=$local_ip right=$remote_ip leftid=@$local_name rightid=@$remote_name leftcert="ovs_certkey_$local_name" leftrsasigkey=%cert rightca=%same""")} CERT_PREFIX = "ovs_cert_" CERTKEY_PREFIX = "ovs_certkey_" def __init__(self, libreswan_root_prefix, args): ipsec_conf = args.ipsec_conf if args.ipsec_conf else "/etc/ipsec.conf" ipsec_d = args.ipsec_d if args.ipsec_d else "/etc/ipsec.d" ipsec_secrets = (args.ipsec_secrets if args.ipsec_secrets else "/etc/ipsec.secrets") ipsec_ctl = (args.ipsec_ctl if args.ipsec_ctl else "/run/pluto/pluto.ctl") self.IPSEC = libreswan_root_prefix + "/usr/sbin/ipsec" self.IPSEC_CONF = libreswan_root_prefix + ipsec_conf self.IPSEC_SECRETS = libreswan_root_prefix + ipsec_secrets self.IPSEC_D = "sql:" + libreswan_root_prefix + ipsec_d self.IPSEC_CTL = libreswan_root_prefix + ipsec_ctl self.conf_file = None self.secrets_file = None vlog.dbg("Using: " + self.IPSEC) vlog.dbg("Configuration file: " + self.IPSEC_CONF) vlog.dbg("Secrets file: " + self.IPSEC_SECRETS) vlog.dbg("ipsec.d: " + self.IPSEC_D) vlog.dbg("Pluto socket: " + self.IPSEC_CTL) def restart_ike_daemon(self): """This function restarts LibreSwan.""" # Remove the stale information from the NSS database self._nss_clear_database() f = open(self.IPSEC_CONF, "w") f.write(self.CONF_HEADER) f.close() f = open(self.IPSEC_SECRETS, "w") f.write(FILE_HEADER) f.close() vlog.info("Restarting LibreSwan") subprocess.call([self.IPSEC, "restart"]) def config_init(self): self.conf_file = open(self.IPSEC_CONF, "w") self.secrets_file = open(self.IPSEC_SECRETS, "w") self.conf_file.write(self.CONF_HEADER) self.secrets_file.write(FILE_HEADER) def config_global(self, monitor): """Configure the global state of IPsec tunnels.""" needs_refresh = False if monitor.conf_in_use["pki"] != monitor.conf["pki"]: # Clear old state if monitor.conf_in_use["pki"]["certificate"]: local_name = monitor.conf_in_use["pki"]["local_name"] self._nss_delete_cert_and_key(self.CERTKEY_PREFIX + local_name) if monitor.conf_in_use["pki"]["ca_cert"]: self._nss_delete_cert(self.CERT_PREFIX + "cacert") # Load new state if monitor.conf["pki"]["certificate"]: cert = monitor.conf["pki"]["certificate"] key = monitor.conf["pki"]["private_key"] name = monitor.conf["pki"]["local_name"] name = self.CERTKEY_PREFIX + name self._nss_import_cert_and_key(cert, key, name) if monitor.conf["pki"]["ca_cert"]: self._nss_import_cert(monitor.conf["pki"]["ca_cert"], self.CERT_PREFIX + "cacert", 'CT,,') monitor.conf_in_use["pki"] = copy.deepcopy(monitor.conf["pki"]) needs_refresh = True # Configure the shunt policy if monitor.conf["skb_mark"]: skb_mark = monitor.conf["skb_mark"] self.conf_file.write(self.SHUNT_POLICY.format(skb_mark)) # Will update conf_in_use later in the 'refresh' method if monitor.conf_in_use["skb_mark"] != monitor.conf["skb_mark"]: needs_refresh = True return needs_refresh def config_tunnel(self, tunnel): if tunnel.conf["psk"]: self.secrets_file.write('%%any %s : PSK "%s"\n' % (tunnel.conf["remote_ip"], tunnel.conf["psk"])) auth_section = self.auth_tmpl["psk"].substitute(tunnel.conf) elif tunnel.conf["remote_cert"]: auth_section = self.auth_tmpl["pki_remote"].substitute(tunnel.conf) self._nss_import_cert(tunnel.conf["remote_cert"], self.CERT_PREFIX + tunnel.conf["remote_name"], 'P,P,P') else: auth_section = self.auth_tmpl["pki_ca"].substitute(tunnel.conf) if tunnel.conf["address_family"] == "IPv6": auth_section = self.IPV6_CONN + auth_section if "custom_options" in tunnel.conf: for key, value in tunnel.conf["custom_options"].items(): auth_section += "\n " + key + "=" + value vals = tunnel.conf.copy() vals["auth_section"] = auth_section vals["version"] = tunnel.version conf_text = transp_tmpl[tunnel.conf["tunnel_type"]].substitute(vals) self.conf_file.write(conf_text) def config_fini(self): self.secrets_file.close() self.conf_file.close() self.secrets_file = None self.conf_file = None def clear_tunnel_state(self, tunnel): if tunnel.conf["remote_cert"]: name = self.CERT_PREFIX + tunnel.conf["remote_name"] self._nss_delete_cert(name) def refresh(self, monitor): vlog.info("Refreshing LibreSwan configuration") subprocess.call([self.IPSEC, "auto", "--ctlsocket", self.IPSEC_CTL, "--config", self.IPSEC_CONF, "--rereadsecrets"]) tunnels = set(monitor.tunnels.keys()) # Delete old connections conns_dict = self.get_active_conns() for ifname, conns in conns_dict.items(): tunnel = monitor.tunnels.get(ifname) for conn in conns: # IPsec "connection" names must start with Interface name if not conn.startswith(ifname): vlog.err("%s does not start with %s" % (conn, ifname)) continue # version number should be the first integer after # interface name in IPsec "connection" try: ver = int(re.findall(r'\d+', conn[len(ifname):])[0]) except ValueError: vlog.err("%s does not contain version number") continue except IndexError: vlog.err("%s does not contain version number") continue if not tunnel or tunnel.version != ver: vlog.info("%s is outdated %u" % (conn, ver)) subprocess.call([self.IPSEC, "auto", "--ctlsocket", self.IPSEC_CTL, "--config", self.IPSEC_CONF, "--delete", conn]) elif ifname in tunnels: tunnels.remove(ifname) # Activate new connections for name in tunnels: ver = monitor.tunnels[name].version if monitor.tunnels[name].conf["tunnel_type"] == "gre": conn = "%s-%s" % (name, ver) self._start_ipsec_connection(conn) else: conn_in = "%s-in-%s" % (name, ver) conn_out = "%s-out-%s" % (name, ver) self._start_ipsec_connection(conn_in) self._start_ipsec_connection(conn_out) # Update shunt policy if changed if monitor.conf_in_use["skb_mark"] != monitor.conf["skb_mark"]: if monitor.conf["skb_mark"]: subprocess.call([self.IPSEC, "auto", "--config", self.IPSEC_CONF, "--ctlsocket", self.IPSEC_CTL, "--add", "--asynchronous", "prevent_unencrypted_gre"]) subprocess.call([self.IPSEC, "auto", "--config", self.IPSEC_CONF, "--ctlsocket", self.IPSEC_CTL, "--add", "--asynchronous", "prevent_unencrypted_geneve"]) subprocess.call([self.IPSEC, "auto", "--config", self.IPSEC_CONF, "--ctlsocket", self.IPSEC_CTL, "--add", "--asynchronous", "prevent_unencrypted_stt"]) subprocess.call([self.IPSEC, "auto", "--config", self.IPSEC_CONF, "--ctlsocket", self.IPSEC_CTL, "--add", "--asynchronous", "prevent_unencrypted_vxlan"]) else: subprocess.call([self.IPSEC, "auto", "--config", self.IPSEC_CONF, "--ctlsocket", self.IPSEC_CTL, "--delete", "--asynchronous", "prevent_unencrypted_gre"]) subprocess.call([self.IPSEC, "auto", "--config", self.IPSEC_CONF, "--ctlsocket", self.IPSEC_CTL, "--delete", "--asynchronous", "prevent_unencrypted_geneve"]) subprocess.call([self.IPSEC, "auto", "--config", self.IPSEC_CONF, "--ctlsocket", self.IPSEC_CTL, "--delete", "--asynchronous", "prevent_unencrypted_stt"]) subprocess.call([self.IPSEC, "auto", "--config", self.IPSEC_CONF, "--ctlsocket", self.IPSEC_CTL, "--delete", "--asynchronous", "prevent_unencrypted_vxlan"]) monitor.conf_in_use["skb_mark"] = monitor.conf["skb_mark"] def get_active_conns(self): """This function parses output from 'ipsec status' command. It returns dictionary where <key> is interface name (as in OVSDB) and <value> is another dictionary. This another dictionary uses LibreSwan connection name as <key> and more detailed sample line from the parsed outpus as <value>. """ conns = {} proc = subprocess.Popen([self.IPSEC, 'status', '--ctlsocket', self.IPSEC_CTL], stdout=subprocess.PIPE) while True: line = proc.stdout.readline().strip().decode() if line == '': break m = re.search(r"#\d+: \"(.*)\".*", line) if not m: continue conn = m.group(1) m = re.match(r"(.*)(-in-\d+|-out-\d+)", conn) if not m: # GRE connections have format <iface>-<ver> m = re.match(r"(.*)(-\d+)", conn) if not m: continue ifname = m.group(1) if ifname not in conns: conns[ifname] = {} (conns[ifname])[conn] = line return conns def _start_ipsec_connection(self, conn): # In a corner case, LibreSwan daemon restarts for some reason and # the "ipsec auto --start" command is lost. Just retry to make sure # the command is received by LibreSwan. while True: proc = subprocess.Popen([self.IPSEC, "auto", "--config", self.IPSEC_CONF, "--ctlsocket", self.IPSEC_CTL, "--start", "--asynchronous", conn], stdout=subprocess.PIPE, stderr=subprocess.PIPE) perr = str(proc.stderr.read()) pout = str(proc.stdout.read()) if not re.match(r".*Connection refused.*", perr) and \ not re.match(r".*need --listen.*", pout): break if re.match(r".*[F|f]ailed to initiate connection.*", pout): vlog.err('Failed to initiate connection through' ' Interface %s.\n' % (conn.split('-')[0])) vlog.err(pout) def _nss_clear_database(self): """Remove all OVS IPsec related state from the NSS database""" try: proc = subprocess.Popen(['certutil', '-L', '-d', self.IPSEC_D], stdout=subprocess.PIPE, stderr=subprocess.PIPE, universal_newlines=True) lines = proc.stdout.readlines() for line in lines: s = line.strip().split() if len(s) < 1: continue name = s[0] if name.startswith(self.CERT_PREFIX): self._nss_delete_cert(name) elif name.startswith(self.CERTKEY_PREFIX): self._nss_delete_cert_and_key(name) except Exception as e: vlog.err("Failed to clear NSS database.\n" + str(e)) def _nss_import_cert(self, cert, name, cert_type): """Cert_type is 'CT,,' for the CA certificate and 'P,P,P' for the normal certificate.""" try: proc = subprocess.Popen(['certutil', '-A', '-a', '-i', cert, '-d', self.IPSEC_D, '-n', name, '-t', cert_type], stdout=subprocess.PIPE, stderr=subprocess.PIPE) proc.wait() if proc.returncode: raise Exception(proc.stderr.read()) except Exception as e: vlog.err("Failed to import certificate into NSS.\n" + str(e)) def _nss_delete_cert(self, name): try: proc = subprocess.Popen(['certutil', '-D', '-d', self.IPSEC_D, '-n', name], stdout=subprocess.PIPE, stderr=subprocess.PIPE) proc.wait() if proc.returncode: raise Exception(proc.stderr.read()) except Exception as e: vlog.err("Failed to delete certificate from NSS.\n" + str(e)) def _nss_import_cert_and_key(self, cert, key, name): try: # Avoid deleting other files path = os.path.abspath('/tmp/%s.p12' % name) if not path.startswith('/tmp/'): raise Exception("Illegal certificate name!") # Create p12 file from pem files proc = subprocess.Popen(['openssl', 'pkcs12', '-export', '-in', cert, '-inkey', key, '-out', path, '-name', name, '-passout', 'pass:'], stdout=subprocess.PIPE, stderr=subprocess.PIPE) proc.wait() if proc.returncode: raise Exception(proc.stderr.read()) # Load p12 file to the database proc = subprocess.Popen(['pk12util', '-i', path, '-d', self.IPSEC_D, '-W', ''], stdout=subprocess.PIPE, stderr=subprocess.PIPE) proc.wait() if proc.returncode: raise Exception(proc.stderr.read()) except Exception as e: vlog.err("Import cert and key failed.\n" + str(e)) os.remove(path) def _nss_delete_cert_and_key(self, name): try: # Delete certificate and private key proc = subprocess.Popen(['certutil', '-F', '-d', self.IPSEC_D, '-n', name], stdout=subprocess.PIPE, stderr=subprocess.PIPE) proc.wait() if proc.returncode: raise Exception(proc.stderr.read()) except Exception as e: vlog.err("Delete cert and key failed.\n" + str(e)) class IPsecTunnel(object): """This is the base class for IPsec tunnel.""" unixctl_config_tmpl = Template("""\ Tunnel Type: $tunnel_type Local IP: $local_ip Remote IP: $remote_ip Address Family: $address_family SKB mark: $skb_mark Local cert: $certificate Local name: $local_name Local key: $private_key Remote cert: $remote_cert Remote name: $remote_name CA cert: $ca_cert PSK: $psk Custom Options: $custom_options """) unixctl_status_tmpl = Template("""\ Ofport: $ofport CFM state: $cfm_state """) def __init__(self, name, row): self.name = name # 'name' will not change because it is key in OVSDB self.version = 0 # 'version' is increased on configuration changes self.last_refreshed_version = -1 self.state = "INIT" self.conf = {} self.status = {} self.update_conf(row) def update_conf(self, row): """This function updates IPsec tunnel configuration by using 'row' from OVSDB interface table. If configuration was actually changed in OVSDB then this function returns True. Otherwise, it returns False.""" ret = False options = row.options remote_cert = options.get("remote_cert") remote_name = options.get("remote_name") if remote_cert: remote_name = monitor._get_cn_from_cert(remote_cert) new_conf = { "ifname": self.name, "tunnel_type": row.type, "local_ip": options.get("local_ip", "%defaultroute"), "remote_ip": options.get("remote_ip"), "address_family": self._get_conn_address_family( options.get("remote_ip"), options.get("local_ip")), "skb_mark": monitor.conf["skb_mark"], "certificate": monitor.conf["pki"]["certificate"], "private_key": monitor.conf["pki"]["private_key"], "ca_cert": monitor.conf["pki"]["ca_cert"], "remote_cert": remote_cert, "remote_name": remote_name, "local_name": monitor.conf["pki"]["local_name"], "psk": options.get("psk"), "custom_options": {}} # add custom ipsec options to the connection for key, value in options.items(): if key.startswith("ipsec_"): new_conf["custom_options"][key[len("ipsec_"):]] = value if self.conf != new_conf: # Configuration was updated in OVSDB. Validate it and figure # out what to do next with this IPsec tunnel. Also, increment # version number of this IPsec tunnel so that we could tell # apart old and new tunnels in "ipsec status" output. self.version += 1 ret = True self.conf = new_conf if self._is_valid_tunnel_conf(): self.state = "CONFIGURED" else: vlog.warn("%s contains invalid configuration%s" % (self.name, self.invalid_reason)) self.state = "INVALID" new_status = { "cfm_state": "Up" if row.cfm_fault == [False] else "Down" if row.cfm_fault == [True] else "Disabled", "ofport": "Not assigned" if (row.ofport in [[], [-1]]) else row.ofport[0]} if self.status != new_status: # Tunnel has become unhealthy or ofport changed. Simply log this. vlog.dbg("%s changed status from %s to %s" % (self.name, str(self.status), str(new_status))) self.status = new_status return ret def mark_for_removal(self): """This function marks tunnel for removal.""" self.version += 1 self.state = "REMOVED" def show(self, policies, securities, conns): state = self.state if self.state == "INVALID": state += self.invalid_reason header = "Interface name: %s v%u (%s)\n" % (self.name, self.version, state) conf = self.unixctl_config_tmpl.substitute(self.conf) status = self.unixctl_status_tmpl.substitute(self.status) spds = "Kernel policies installed:\n" remote_ip = self.conf["remote_ip"] if remote_ip in policies: for line in policies[remote_ip]: spds += " " + line + "\n" sas = "Kernel security associations installed:\n" if remote_ip in securities: for line in securities[remote_ip]: sas += " " + line + "\n" cons = "IPsec connections that are active:\n" if self.name in conns: for tname in conns[self.name]: cons += " " + conns[self.name][tname] + "\n" return header + conf + status + spds + sas + cons + "\n" def _get_conn_address_family(self, remote_ip, local_ip): remote = address_family(remote_ip) local = address_family(local_ip) if local is None: return remote elif local != remote: return None else: return remote def _is_valid_tunnel_conf(self): """This function verifies if IPsec tunnel has valid configuration set in 'conf'. If it is valid, then it returns True. Otherwise, it returns False and sets the reason why configuration was considered as invalid. This function could be improved in future to also verify validness of certificates themselves so that ovs-monitor-ipsec would not pass malformed configuration to IKE daemon.""" self.invalid_reason = None if not self.conf["remote_ip"]: self.invalid_reason = ": 'remote_ip' is not set" return False if self.conf["psk"]: if self.conf["certificate"] or self.conf["private_key"] \ or self.conf["ca_cert"] or self.conf["remote_cert"] \ or self.conf["remote_name"]: self.invalid_reason = ": 'certificate', 'private_key', "\ "'ca_cert', 'remote_cert', and "\ "'remote_name' must be unset with PSK" return False # If configuring authentication with CA-signed certificate or # self-signed certificate, the 'remote_name' should be specified at # this point. When using CA-signed certificate, the 'remote_name' is # read from interface's options field. When using self-signed # certificate, the 'remote_name' is extracted from the 'remote_cert' # file. elif self.conf["remote_name"]: if not self.conf["certificate"]: self.invalid_reason = ": must set 'certificate' as local"\ " certificate when using CA-signed"\ " certificate or self-signed"\ " certificate to authenticate peers" return False elif not self.conf["private_key"]: self.invalid_reason = ": must set 'private_key' as local"\ " private key when using CA-signed"\ " certificate or self-signed"\ " certificate to authenticate peers" return False if not self.conf["remote_cert"] and not self.conf["ca_cert"]: self.invalid_reason = ": must set 'remote_cert' when using"\ " self-signed certificate"\ " authentication or 'ca_cert' when"\ " using CA-signed certificate"\ " authentication" return False else: self.invalid_reason = ": must choose a authentication method" return False return True class IPsecMonitor(object): """This class monitors and configures IPsec tunnels""" def __init__(self, root_prefix, ike_daemon, restart, args): self.IPSEC = root_prefix + "/usr/sbin/ipsec" self.tunnels = {} # Global configuration shared by all tunnels self.conf = { "pki": { "private_key": None, "certificate": None, "ca_cert": None, "local_name": None }, "skb_mark": None } self.conf_in_use = copy.deepcopy(self.conf) # Choose to either use StrongSwan or LibreSwan as IKE daemon if ike_daemon == "strongswan": self.ike_helper = StrongSwanHelper(root_prefix) elif ike_daemon == "libreswan": self.ike_helper = LibreSwanHelper(root_prefix, args) else: vlog.err("The IKE daemon should be strongswan or libreswan.") sys.exit(1) # Check whether ipsec command is available if not os.path.isfile(self.IPSEC) or \ not os.access(self.IPSEC, os.X_OK): vlog.err("IKE daemon is not installed in the system.") if restart: vlog.info("Restarting IKE daemon") self.ike_helper.restart_ike_daemon() def is_tunneling_type_supported(self, tunnel_type): """Returns True if we know how to configure IPsec for these types of tunnels. Otherwise, returns False.""" return tunnel_type in ["gre", "geneve", "vxlan", "stt"] def is_ipsec_required(self, options_column): """Return True if tunnel needs to be encrypted. Otherwise, returns False.""" return "psk" in options_column or \ "remote_name" in options_column or \ "remote_cert" in options_column def add_tunnel(self, name, row): """Adds a new tunnel that monitor will provision with 'name'.""" vlog.info("Tunnel %s appeared in OVSDB" % (name)) self.tunnels[name] = IPsecTunnel(name, row) def update_tunnel(self, name, row): """Updates configuration of already existing tunnel with 'name'.""" tunnel = self.tunnels[name] if tunnel.update_conf(row): vlog.info("Tunnel's '%s' configuration changed in OVSDB to %u" % (tunnel.name, tunnel.version)) def del_tunnel(self, name): """Deletes tunnel by 'name'.""" vlog.info("Tunnel %s disappeared from OVSDB" % (name)) self.tunnels[name].mark_for_removal() def update_conf(self, pki, skb_mark): """Update the global configuration for IPsec tunnels""" self.conf["pki"]["certificate"] = pki[0] self.conf["pki"]["private_key"] = pki[1] self.conf["pki"]["ca_cert"] = pki[2] self.conf["pki"]["local_name"] = pki[3] # Update skb_mark used in IPsec policies. self.conf["skb_mark"] = skb_mark def read_ovsdb_open_vswitch_table(self, data): """This functions reads IPsec relevant configuration from Open_vSwitch table.""" pki = [None, None, None, None] skb_mark = None is_valid = False for row in data["Open_vSwitch"].rows.values(): pki[0] = row.other_config.get("certificate") pki[1] = row.other_config.get("private_key") pki[2] = row.other_config.get("ca_cert") skb_mark = row.other_config.get("ipsec_skb_mark") # Test whether it's a valid configration if pki[0] and pki[1]: pki[3] = self._get_cn_from_cert(pki[0]) if pki[3]: is_valid = True elif not pki[0] and not pki[1] and not pki[2]: is_valid = True if not is_valid: vlog.warn("The cert and key configuration is not valid. " "The valid configuations are 1): certificate, private_key " "and ca_cert are not set; or 2): certificate and " "private_key are all set.") else: self.update_conf(pki, skb_mark) def read_ovsdb_interface_table(self, data): """This function reads the IPsec relevant configuration from Interface table.""" ifaces = set() for row in data["Interface"].rows.values(): if not self.is_tunneling_type_supported(row.type): continue if not self.is_ipsec_required(row.options): continue if row.name in self.tunnels: self.update_tunnel(row.name, row) else: self.add_tunnel(row.name, row) ifaces.add(row.name) # Mark for removal those tunnels that just disappeared from OVSDB for tunnel in self.tunnels.keys(): if tunnel not in ifaces: self.del_tunnel(tunnel) def read_ovsdb(self, data): """This function reads all configuration from OVSDB that ovs-monitor-ipsec is interested in.""" self.read_ovsdb_open_vswitch_table(data) self.read_ovsdb_interface_table(data) def show(self, unix_conn, policies, securities): """This function prints all tunnel state in 'unix_conn'. It uses 'policies' and securities' received from Linux Kernel to show if tunnels were actually configured by the IKE deamon.""" if not self.tunnels: unix_conn.reply("No tunnels configured with IPsec") return s = "" conns = self.ike_helper.get_active_conns() for name, tunnel in self.tunnels.items(): s += tunnel.show(policies, securities, conns) unix_conn.reply(s) def run(self): """This function runs state machine that represents whole IPsec configuration (i.e. merged together from individual tunnel state machines). It creates configuration files and tells IKE daemon to update configuration.""" needs_refresh = False removed_tunnels = [] self.ike_helper.config_init() if self.ike_helper.config_global(self): needs_refresh = True for name, tunnel in self.tunnels.items(): if tunnel.last_refreshed_version != tunnel.version: tunnel.last_refreshed_version = tunnel.version needs_refresh = True if tunnel.state == "REMOVED" or tunnel.state == "INVALID": removed_tunnels.append(name) elif tunnel.state == "CONFIGURED": self.ike_helper.config_tunnel(self.tunnels[name]) self.ike_helper.config_fini() for name in removed_tunnels: # LibreSwan needs to clear state from database if hasattr(self.ike_helper, "clear_tunnel_state"): self.ike_helper.clear_tunnel_state(self.tunnels[name]) del self.tunnels[name] if needs_refresh: self.ike_helper.refresh(self) def _get_cn_from_cert(self, cert): try: proc = subprocess.Popen(['openssl', 'x509', '-noout', '-subject', '-nameopt', 'RFC2253', '-in', cert], stdout=subprocess.PIPE, stderr=subprocess.PIPE) proc.wait() if proc.returncode: raise Exception(proc.stderr.read()) m = re.search(r"CN=(.+?),", proc.stdout.readline().decode()) if not m: raise Exception("No CN in the certificate subject.") except Exception as e: vlog.warn(str(e)) return None return m.group(1) def address_family(address): try: ip = ipaddress.ip_address(address) ipstr = str(type(ip)) # ipaddress has inconsistencies with what exceptions are raised: # https://mail.openvswitch.org/pipermail/ovs-dev/2021-April/381696.html except (ValueError, ipaddress.AddressValueError): return None if ipstr.find('v6') != -1: return "IPv6" return "IPv4" def unixctl_xfrm_policies(conn, unused_argv, unused_aux): global xfrm policies = xfrm.get_policies() conn.reply(str(policies)) def unixctl_xfrm_state(conn, unused_argv, unused_aux): global xfrm securities = xfrm.get_securities() conn.reply(str(securities)) def unixctl_ipsec_status(conn, unused_argv, unused_aux): global monitor conns = monitor.ike_helper.get_active_conns() conn.reply(str(conns)) def unixctl_show(conn, unused_argv, unused_aux): global monitor global xfrm policies = xfrm.get_policies() securities = xfrm.get_securities() monitor.show(conn, policies, securities) def unixctl_refresh(conn, unused_argv, unused_aux): global monitor monitor.ike_helper.refresh(monitor) conn.reply(None) def unixctl_exit(conn, argv, unused_aux): global monitor global exiting ret = None exiting = True cleanup = True for arg in argv: if arg == "--no-cleanup": cleanup = False else: cleanup = False exiting = False ret = str("unrecognized parameter: %s" % arg) if cleanup: # Make sure persistent global states are cleared monitor.update_conf([None, None, None, None], None) # Make sure persistent tunnel states are cleared for tunnel in monitor.tunnels.keys(): monitor.del_tunnel(tunnel) monitor.run() conn.reply(ret) def main(): parser = argparse.ArgumentParser() parser.add_argument("database", metavar="DATABASE", help="A socket on which ovsdb-server is listening.") parser.add_argument("--root-prefix", metavar="DIR", help="Use DIR as alternate root directory" " (for testing).") parser.add_argument("--ike-daemon", metavar="IKE-DAEMON", help="The IKE daemon used for IPsec tunnels" " (either libreswan or strongswan).") parser.add_argument("--no-restart-ike-daemon", action='store_true', help="Don't restart the IKE daemon on startup.") parser.add_argument("--ipsec-conf", metavar="IPSEC-CONF", help="Use DIR/IPSEC-CONF as location for " " ipsec.conf (libreswan only).") parser.add_argument("--ipsec-d", metavar="IPSEC-D", help="Use DIR/IPSEC-D as location for " " ipsec.d (libreswan only).") parser.add_argument("--ipsec-secrets", metavar="IPSEC-SECRETS", help="Use DIR/IPSEC-SECRETS as location for " " ipsec.secrets (libreswan only).") parser.add_argument("--ipsec-ctl", metavar="IPSEC-CTL", help="Use DIR/IPSEC-CTL as location for " " pluto ctl socket (libreswan only).") ovs.vlog.add_args(parser) ovs.daemon.add_args(parser) args = parser.parse_args() ovs.vlog.handle_args(args) ovs.daemon.handle_args(args) global monitor global xfrm root_prefix = args.root_prefix if args.root_prefix else "" xfrm = XFRM(root_prefix) monitor = IPsecMonitor(root_prefix, args.ike_daemon, not args.no_restart_ike_daemon, args) remote = args.database schema_helper = ovs.db.idl.SchemaHelper() schema_helper.register_columns("Interface", ["name", "type", "options", "cfm_fault", "ofport"]) schema_helper.register_columns("Open_vSwitch", ["other_config"]) idl = ovs.db.idl.Idl(remote, schema_helper) ovs.daemon.daemonize() ovs.unixctl.command_register("list-commands", "", 0, 0, ovs.unixctl._unixctl_help, None) ovs.unixctl.command_register("xfrm/policies", "", 0, 0, unixctl_xfrm_policies, None) ovs.unixctl.command_register("xfrm/state", "", 0, 0, unixctl_xfrm_state, None) ovs.unixctl.command_register("ipsec/status", "", 0, 0, unixctl_ipsec_status, None) ovs.unixctl.command_register("tunnels/show", "", 0, 0, unixctl_show, None) ovs.unixctl.command_register("refresh", "", 0, 0, unixctl_refresh, None) ovs.unixctl.command_register("exit", "[--no-cleanup]", 0, 1, unixctl_exit, None) error, unixctl_server = ovs.unixctl.server.UnixctlServer.create(None) if error: ovs.util.ovs_fatal(error, "could not create unixctl server", vlog) # Sequence number when OVSDB was processed last time seqno = idl.change_seqno while True: unixctl_server.run() if exiting: break idl.run() if seqno != idl.change_seqno: monitor.read_ovsdb(idl.tables) seqno = idl.change_seqno monitor.run() poller = ovs.poller.Poller() unixctl_server.wait(poller) idl.wait(poller) poller.block() unixctl_server.close() idl.close() if __name__ == '__main__': try: main() except SystemExit: # Let system.exit() calls complete normally raise except: vlog.exception("traceback") sys.exit(ovs.daemon.RESTART_EXIT_CODE)