Add VRRP authentication to prevent VIP hijacking

Generate 8-char VRRP password in crypto.py, add authentication block
to keepalived.conf.tpl, pass as env var through docker-compose and
container.py. Prevents accidental or malicious VRRP advertisement
from claiming the cluster VIP.

Closes #91

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: szachovy

CHANGELOG.md

@@ -15,6 +15,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 * Dependabot updates for `github-actions` and `terraform` ecosystems. (#29)
 * CI workflow to build and push service images to GitHub Container Registry on master merge. (#97)
 * Pull-first with local build fallback for container images during deployment. (#97)
+* VRRP authentication to prevent VIP hijacking from L2 segment. (#91)
 
 ### Changed
 

services/mysql-mgmt/docker_compose.yml

@@ -86,6 +86,7 @@ services:
       - "VIRTUAL_NETWORK=${VIRTUAL_NETWORK}"
       - "STATE=${STATE}"
       - "PRIORITY=${PRIORITY}"
+      - "VRRP_PASSWORD=${VRRP_PASSWORD}"
       - "MYSQL_TEST_LOGIN_FILE=/opt/.mylogin.cnf"
     volumes:
       - "default_generated:/opt/default"

services/mysql-mgmt/keepalived.conf.tpl

@@ -19,6 +19,10 @@ vrrp_instance virtual_instance {
     advert_int 1
     nopreempt
     garp_master_delay 2
+    authentication {
+        auth_type PASS
+        auth_pass ${VRRP_PASSWORD}
+    }
     track_script {
         status
     }

src/container.py

@@ -281,7 +281,8 @@ def run_mysql_mgmt(
             secondary_first_mysql_node: str,
             secondary_second_mysql_node: str,
             state: str,
-            priority: str) -> None:
+            priority: str,
+            vrrp_password: str = '') -> None:
 
         class MySQLMgmt(ContainerInstance):
             # pylint: disable=too-many-arguments
@@ -327,6 +328,7 @@ def setup_env(self) -> None:
                 os.environ["HEALTHCHECK_RETRIES"] = str(self.healthcheck_retries)
                 os.environ["STATE"] = state
                 os.environ["PRIORITY"] = priority
+                os.environ["VRRP_PASSWORD"] = vrrp_password
 
             def run(self) -> None:
                 self.setup_env()

src/crypto.py

@@ -63,6 +63,10 @@ class OpenSSL:
     def generate_mysql_root_password() -> str:
         return base64.b64encode(os.urandom(16)).decode('utf-8')
 
+    @staticmethod
+    def generate_vrrp_password() -> str:
+        return base64.b64encode(os.urandom(6)).decode('utf-8')[:8]
+
     @staticmethod
     def generate_mysql_superset_password() -> str:
         return "".join(random.choice(string.ascii_lowercase) for _ in range(12))

src/initialize.py

@@ -125,6 +125,7 @@ def credentials(self) -> None:
         self.mysql_root_password = self.cert_manager.generate_mysql_root_password()
         self.mysql_superset_password = self.cert_manager.generate_mysql_superset_password()
         self.superset_secret_key = self.cert_manager.generate_superset_secret_key()
+        self.vrrp_password = self.cert_manager.generate_vrrp_password()
         for node in list(itertools.chain(self.mysql_nodes, self.mgmt_nodes)):
             node.key = self.cert_manager.generate_private_key()
             node.csr = self.cert_manager.generate_csr(f'Superset-Cluster-{node.node}', node.key)
@@ -235,15 +236,17 @@ def start_mysql_mgmt(self, node: remote.RemoteConnection, state: str, priority:
                 '{secondary_first_mysql_node}', \
                 '{secondary_second_mysql_node}', \
                 '{state}', \
-                '{priority}' \
+                '{priority}', \
+                '{vrrp_password}' \
             )".format(virtual_ip_address=self.virtual_ip_address,
                       virtual_network_mask=self.virtual_network_mask,
                       virtual_network_interface=self.virtual_network_interface,
                       primary_mysql_node=self.mysql_nodes[0].node,
                       secondary_first_mysql_node=self.mysql_nodes[1].node,
                       secondary_second_mysql_node=self.mysql_nodes[2].node,
                       state=state,
-                      priority=priority)
+                      priority=priority,
+                      vrrp_password=self.vrrp_password)
         )
 
     def start_superset(self) -> None: