search

netsec-ethz / scionlab

SCIONLab user interface and administration
https://www.scionlab.org
Apache License 2.0
9 stars 15 forks source link

openvpn@client / openvpn@server not part of scionlab.target #190

Open mkowalski opened 4 years ago

mkowalski commented 4 years ago

Currently when doing systemctl list-dependencies scionlab.target neither openvpn@client.service not openvpn@server.service are visible (respectively on the client and AP).

The main issue in here is the fact that membership in a target is defined in the source service, not in the target itself. Therefore what requires a modification is /lib/systemd/system/openvpn@.service which is shipped by openvpn package.

This is strictly forbidden for us to modify this file directly, but we can use systemd killer feature of drop-ins, i.e. create /etc/systemd/system/openvpn@client.service.d/override.conf(or ... @server.service.d ... for the AP) with the content as follows

[Install]
WantedBy=scionlab.target

Not to be so easy, there is a caveat with this - as we are using super old Ubuntu 16.04 with super old systemd there, we cannot override [Install] section in the drop-in file. The following commit in systemd enables overriding this section -- https://github.com/systemd/systemd/commit/caa45f5b4e712ae85cf3703b554bf6a61636692d, however Ubuntu 16.04 does not seem to backport this.

TLDR; Ubuntu 16.04 + systemd 229 do not allow solving this issue in an elegant way

Linked-issue: https://gitlab.inf.ethz.ch/OU-PERRIG/scionlab/scion-builder/issues/13

mkowalski commented 4 years ago

I have tested and Ubuntu 18.04 + systemd 237 allow to properly override [Install] section

mkowalski commented 4 years ago

This task is unblocked now, we are running with systemd which supports overriding [Install] directive.

mkowalski commented 4 years ago 
BindsTo=sys-devices-virtual-net-lan0.device
After=sys-devices-virtual-net-lan0.device

This adds dependency on the network interface lan0. Please note it should be added in the scionlab.target thus the change should be done in the scion-builder repository