On 05/24/2013 11:46 AM, Eleouet Francois wrote:
Hi,
Thank you very much, great tip!
You're welcome.
The only issue in openstack context is that it usually has to work
with distro packages... Anyway, providing a strongswan driver
alongside with your ./configure suggestion could definitively be a
solution.
OK I see.
I did not test it, but you could maybe write a small launcher
application that does a similar directory remaping as "ip netns exec".
Just take your inspiration from iproute2 function
ip/ipnetns.c:netns_exec(), and remap the directory
/etc/netns/<netnsname>/run to /var/run. (warning, I don't know if some
libraries used by charon read information from /var/run).
Best Regards,
Christophe.
Regards,
Francois.
2013/5/24 Christophe Gouault <[email protected]
<mailto:[email protected]>>
Hi François,
If you use netns created by "ip netns add <netnsname>" and start
charon with "ip netns exec <netnsname> ipsec start", then there is
a solution (that we successfully used here to perform IKE tests
with a single machine:
"ip netns exec netns1" enables to start the application in netns
netns1, but also, if the /etc/netns/netns1 directory exists, the
files and sub-directories will be remapped in /etc for the
application (provided a file or directory with the same name
already exists in /etc).
So, you just have to store your configuration files in this
directory and the pid and socket files in a sub-directory. To do
that, you must chose a different piddir when compiling strongswan:
Example for netns1 and netns2:
create netns and directories
----------------------------
ip netns add netns1
ip netns add netns2
mkdir -p /etc/run
mkdir -p /etc/netns/netns1/run
mkdir -p /etc/netns/netns2/run
generate strongswan
-------------------
./configure --sysconfdir=/etc --with-piddir=/etc/run make
make install
configure and run strongswan instances
--------------------------------------
Then, you can store configurations files for each charon instance
in the /etc/netns/<netnsname> directory, and start each instance
of charon with:
ip netns exec <netnsname> ipsec start
The pid and unix socket files will be stored in
/etc/netns/<netnsname>/run directory instead of the default /var/run.
(From the application point of view, the configuration files are
in /etc, pid and socket files are in /etc/run directories, but
they are actually stored in /etc/netns/<netnsname> and
/etc/netns/<netnsname>/run directories)
Enjoy
Best Regards,
Christophe
On 05/22/2013 10:16 PM, Eleouet Francois wrote:
Hi,
I'm actually investigating how to run multiple IPsec damons
within several network namespaces.
In the openstack project (an open source cloud computing
platform), we intend to extend virtual networks to the outside
world using IPsec. Current implentation leverages netns to
provide routing (with support of overlapping IPs) between
different projects/customers/virtual networks.
As a consequence, we have to start multiple IPsec daemons (one
within each namespace), so that they bind sockets and set-up
IPsec SA & SPD in the right netns. I managed to set up this kind
of configuration using pluto as config, pid and control socket
files location can be specified as comand line options
(using --ctlbase --ipsecdir --secretsfile --config...)
Anyway, these variables seems to be hard coded in charon (at
./configure time). As IKEv2 support is really required, I was
wondering if I missed something. Is there any way to change these
parameters on a per-process basis? Or maybe have you plan to make
charon netns aware?
Thanks in advance,
Francois Eleouet.
_______________________________________________
Users mailing list
[email protected] <mailto:[email protected]>
https://lists.strongswan.org/mailman/listinfo/users
_______________________________________________
Users mailing list
[email protected]
https://lists.strongswan.org/mailman/listinfo/users
