Page MenuHomeDevCentral

Configure strongSwan as IPsec implementation
Needs ReviewPublic

Authored by Duranzed on Mon, Mar 2, 19:29.
Tags
None
Referenced Files
F25007841: D3988.id10517.diff
Tue, Mar 24, 22:50
F25007840: D3988.id10514.diff
Tue, Mar 24, 22:50
F25007838: D3988.id10520.diff
Tue, Mar 24, 22:50
F25007837: D3988.id10518.diff
Tue, Mar 24, 22:50
F25007836: D3988.id10513.diff
Tue, Mar 24, 22:50
F25007835: D3988.id10519.diff
Tue, Mar 24, 22:50
F25007834: D3988.id10515.diff
Tue, Mar 24, 22:50
F25007236: D3988.id10453.diff
Tue, Mar 24, 21:53
Subscribers
None

Details

Diff Detail

Repository
rOPS Nasqueron Operations
Lint
Lint Passed
Unit
No Test Coverage
Branch
GRE-tunnel
Build Status
Buildable 6491
Build 6775: arc lint + arc unit

Event Timeline

There are a very large number of changes, so older changes are hidden. Show Older Changes
  • Added an init.sls pour strongswan

No link to a task in description?

dereckson retitled this revision from IPsec strongswan configuration to Configure strongSwan as IPsec implementation.Wed, Mar 4, 06:49
dereckson edited the summary of this revision. (Show Details)
dereckson requested changes to this revision.Wed, Mar 4, 07:14

Service part OK.

Configuration needs a better strategy to allow to provision per machine.

_modules/credentials.py
304 ↗(On Diff #10353)

That's handled in D3987.

Perhaps you want to do an arc diff HEAD^ --update D3988 ?

pillar/core/network.sls
58 ↗(On Diff #10353)

We can use the banner format here, to be coherent with the repository style.

73 ↗(On Diff #10353)

You can provision them as a follow-up change, uncommented instead.

93 ↗(On Diff #10353)

That comment can be safely removed: the pillar name and the ike_ esp_ keys make that clear what is it.

roles/core/strongswan/config.sls
21 ↗(On Diff #10353)

Jinja syntax allows to use dots as separator to access dictionary keys.

We can use it, but in that case, it's really coherent to use it everywhere.

22 ↗(On Diff #10353)

Won't really work beyond the scope of a test tunnel between those two links. You need a more flexible way to pass the info according the node.

Besides, if you deploy this on both router-002 and router-003 you would get twice the config router-002 to router-003 it seems.

roles/core/strongswan/files/swanctl.conf
1 ↗(On Diff #10353)
roles/core/strongswan/init.sls
1 ↗(On Diff #10353)

Header missing

4 ↗(On Diff #10353)

That one doesn't exist in the change it seems

This revision now requires changes to proceed.Wed, Mar 4, 07:14

Updated strongswan config files and using a for loop for a more readable code

Duranzed marked 4 inline comments as done.

Modified Ysul IP adress in network.sls

Updated config files to use node.resolve_gre_tunnels

Improved configuration files and headers

Added software.sls and modified init.sls

dereckson requested changes to this revision.Thu, Mar 12, 21:59
dereckson added inline comments.
roles/core/strongswan/files/swanctl.conf
50 ↗(On Diff #10401)
This revision now requires changes to proceed.Thu, Mar 12, 21:59

Test to deploy this final version on Complector with a test=True to see if it's still no-op.

  • Modified to create tunnels from router-003
  • Roles: update network pillar

using for loop to create GRE tunnel on router-002 and 003

Added IP canonical IP addresses to router-002 and router-003

Duranzed marked an inline comment as done.

Removed cloudhugger

pillar/core/network.sls
37 ↗(On Diff #10513)

We can use explicit variable names.

One letter variables is an historical artefact, from the era where the maximal length for a specific code line was fixed.

See for example for COBOL this IBM documentation:
https://www.ibm.com/docs/en/developer-for-zos/15.0.x?topic=editing-setting-language-specific-maximum-line-length

Nowadays, best practice is to use clear variable name to facilitate reading the code.

9 ↗(On Diff #10453)

What's the role of the router? I think it's to get public IP for that node.

testing list format for routers

removed canonical ipv4 from network.sls and corrected node function