Add doc section for /etc/default/snf-network

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Fix typo in docs

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Do not set default value for IFUP_EXTRA_SCRIPT

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
arptables do not support -m comment

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Drop packets with different src IP in routed mode

In routed setup do not allow packets coming from a
TAP to have different source IP that the one that they
suppose to have.

This reduces chances for udp attacks originating
inside the datacenter.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Save ip commands as well

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Add verbose logging during all stages

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Bump version to 0.16rc1
Bump version to 0.16rc1
Merge branch 'release-0.16' into debian-release-0.16
Bump version to 0.16~rc1-1~wheezy

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Bump version to 0.16rc2
Add kerberos authentication support for nsupdate

Up until now snf-network used nsupdate with a keyfile to
dynamically update DNS entries on an external nameserver
(bind9). This patch adds support for authenticating against an
AD controller using Kerberos.

Specifically we use "k5start -H" to ensure there is a happy ticket,
otherwise use a keytab containing the password to obtain a ticket
automatically. Finally, we use nsupdate in GSS-TSIG mode (with -g option
and with KRB5CCNAME environment variable pointing to the ticket
obtained previously by k5start) to update AD-integrated DNS server.

The keytab file can be added with:

 # ktutil -v add -V 1 -e aes256-cts -p PRINCIPAL

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Add doc section wrt kerberos authentication

..that explains how to configure snf-network in order to use
it for dynamic DNS update against an AD controller.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Some minor refactor in snf-network-dnshook

Let it run only after certain opcodes (instance-add, instance-modify,
instance-remove, instance-rename).

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
docs: Rewrite snf-network-dnshook

Mention correctly when it runs and be more informative wrt
nsupdate authentication methods supported (TSIG for bind9
and GSS-TSIG for AD).

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Use AUTHENTICATION_METHOD setting

The valid authentication methods are:

 - plain (nsupdate)
 - bind9 (nsupdate -k)
 - kerberos (nsupdate -g)

The plain method assumes that the server allows updates without
authentication (e.g. allow-update { 192.0.2.1;};). The bind9 method
uses the -k option and requires a keyfile. The kerberos method uses
the -g option and requires a principal and a keytab. For backwards
compatibility if AUTHENTICATION_METHOD setting is missing in
defaults file we use bind9.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
docs: Update docs for AUTHENTICATION_METHOD

Mention AUTHENTICATION_METHOD setting in docs and update
configure section with all missing settings included in
/etc/default/snf-network.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Add Changelog file

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Add kerberos related settings in defaults

KERBEROS_PRINCIPAL is the service principal used with:
 # k5util -v add -p

KERBEROS_KEYTAB is by default /etc/krb5.keytab

KERBEROS_KSTART_ARGS defaults to "-H 1 -l 1h" (i.e. checks
for a happy ticket and sets the ticket lifetime upon renewal)

KERBEROS_TICKET is the snf-network-kerberos.tkt file and stored
under STATE_DIR (/var/lib/snf-network).

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>