This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree".
The branch, next has been updated via 18b6da69b6e8ecddf86d0f824a28b0f3e37df2cb (commit) via 3fbf7bed797f32062ef2cff0ec7240b327b10f6b (commit) via 4aef53d50dd2152601bc88cc22157d3289206e38 (commit) via 1857244ea44a872265b05222f7f94a93b2d964b1 (commit) from 8fa523e028ecfa8acb33bac7d48f2fe9cb60a86e (commit)
Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.
- Log ----------------------------------------------------------------- commit 18b6da69b6e8ecddf86d0f824a28b0f3e37df2cb Author: Jonatan Schlag jonatan.schlag@ipfire.org Date: Thu Dec 29 20:37:34 2016 +0100
core109: Ship network bridge changes
Signed-off-by: Jonatan Schlag jonatan.schlag@ipfire.org Signed-off-by: Michael Tremer michael.tremer@ipfire.org
commit 3fbf7bed797f32062ef2cff0ec7240b327b10f6b Author: Jonatan Schlag jonatan.schlag@ipfire.org Date: Thu Dec 29 20:37:33 2016 +0100
network: Rename MACVTAP script
This script is creating common bridges now, too and therefore needs a more generic name.
Signed-off-by: Jonatan Schlag jonatan.schlag@ipfire.org Signed-off-by: Michael Tremer michael.tremer@ipfire.org
commit 4aef53d50dd2152601bc88cc22157d3289206e38 Author: Jonatan Schlag jonatan.schlag@ipfire.org Date: Thu Dec 29 20:37:32 2016 +0100
network: Support bridge mode for zones
This bridge mode is supposed to be used for virtual environments to create a network zone as a bridge and have virtual machines inside it. Other physical interfaces can also be added to the bridge.
This is very similar to the MACVTAP bridge feature but still works when the link of any (or all) physical interfaces is down.
Fixes: #11252
Signed-off-by: Jonatan Schlag jonatan.schlag@ipfire.org Signed-off-by: Michael Tremer michael.tremer@ipfire.org
commit 1857244ea44a872265b05222f7f94a93b2d964b1 Author: Jonatan Schlag jonatan.schlag@ipfire.org Date: Thu Dec 29 20:37:31 2016 +0100
udev: Do not use MACVTAP for any wireless devices
Fixes #11179
Signed-off-by: Jonatan Schlag jonatan.schlag@ipfire.org Signed-off-by: Michael Tremer michael.tremer@ipfire.org
-----------------------------------------------------------------------
Summary of changes: config/rootfiles/common/udev | 2 +- config/rootfiles/core/109/filelists/files | 3 + config/rootfiles/core/109/update.sh | 2 + config/udev/60-net.rules | 4 +- config/udev/network-hotplug-bridges | 114 ++++++++++++++++++++++++++++++ config/udev/network-hotplug-macvtap | 46 ------------ config/udev/network-hotplug-rename | 24 +++++-- lfs/udev | 4 +- 8 files changed, 143 insertions(+), 56 deletions(-) create mode 100644 config/udev/network-hotplug-bridges delete mode 100644 config/udev/network-hotplug-macvtap
Difference in files: diff --git a/config/rootfiles/common/udev b/config/rootfiles/common/udev index e1f4bd5..1ba82d0 100644 --- a/config/rootfiles/common/udev +++ b/config/rootfiles/common/udev @@ -28,7 +28,7 @@ lib/udev #lib/udev/hwdb.d/60-keyboard.hwdb #lib/udev/init-net-rules.sh #lib/udev/mtd_probe -#lib/udev/network-hotplug-macvtap +#lib/udev/network-hotplug-bridges #lib/udev/network-hotplug-rename #lib/udev/network-hotplug-vlan #lib/udev/rule_generator.functions diff --git a/config/rootfiles/core/109/filelists/files b/config/rootfiles/core/109/filelists/files index ca49b1b..7c1cc3f 100644 --- a/config/rootfiles/core/109/filelists/files +++ b/config/rootfiles/core/109/filelists/files @@ -1,3 +1,6 @@ etc/system-release etc/issue +lib/udev/rules.d/60-net.rules +lib/udev/network-hotplug-bridges +lib/udev/network-hotplug-rename usr/local/bin/syslogdctrl diff --git a/config/rootfiles/core/109/update.sh b/config/rootfiles/core/109/update.sh index c601654..1143890 100644 --- a/config/rootfiles/core/109/update.sh +++ b/config/rootfiles/core/109/update.sh @@ -50,6 +50,8 @@ ldconfig /etc/init.d/squid start /etc/init.d/snort start
+# Remove old MACVTAP script +rm -vf /lib/udev/network-hotplug-macvtap
# This update need a reboot... #touch /var/run/need_reboot diff --git a/config/udev/60-net.rules b/config/udev/60-net.rules index e031e7a..fff7513 100644 --- a/config/udev/60-net.rules +++ b/config/udev/60-net.rules @@ -6,5 +6,5 @@ ACTION=="add", SUBSYSTEM=="net", PROGRAM="/lib/udev/network-hotplug-rename", RES # that has just come up. ACTION=="add", SUBSYSTEM=="net", RUN+="/lib/udev/network-hotplug-vlan"
-# Call a script that will set up macvtap interfaces -ACTION=="add", SUBSYSTEM=="net", RUN+="/lib/udev/network-hotplug-macvtap" +# Call a script that will set up zones as bridges +ACTION=="add", SUBSYSTEM=="net", RUN+="/lib/udev/network-hotplug-bridges" diff --git a/config/udev/network-hotplug-bridges b/config/udev/network-hotplug-bridges new file mode 100644 index 0000000..ff6d20a --- /dev/null +++ b/config/udev/network-hotplug-bridges @@ -0,0 +1,114 @@ +#!/bin/bash +############################################################################ +# # +# This file is part of the IPFire Firewall. # +# # +# IPFire is free software; you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation; either version 2 of the License, or # +# (at your option) any later version. # +# # +# IPFire is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with IPFire; if not, write to the Free Software # +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # +# # +# Copyright (C) 2016 IPFire Team info@ipfire.org # +# # +############################################################################ + +[ -n "${INTERFACE}" ] || exit 2 + +eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) + +detect_zone() { + local intf="${INTERFACE%0*}" + intf="${intf^^}" + + local zone + for zone in GREEN BLUE ORANGE RED; do + # Try to find if INTERFACE is the *phys version of a zone + if [ "${intf}" = "${zone}" ]; then + echo "${zone}" + return 0 + fi + + # Try to find out if this INTERFACE is a slave of a zone + local slave + for slave in $(get_value "${zone}_SLAVES"); do + if [ "${INTERFACE}" = "${slave}" ]; then + echo "${zone}" + return 0 + fi + done + done + + return 1 +} + +get_value() { + echo "${!1}" +} + +random_mac_address() { + local address="02" + + for i in $(seq 5); do + printf -v address "${address}:%02x" "$(( RANDOM % 256 ))" + done + + echo "${address}" +} + +# Try to detect which zone we are operating on +ZONE=$(detect_zone) + +# Cannot proceed if we could not find a zone +if [ -z "${ZONE}" ]; then + exit 0 +fi + +# Determine the mode of this zone +MODE="$(get_value "${ZONE}_MODE")" + +# The name of the virtual bridge +BRIDGE="$(get_value "${ZONE}_DEV")" + +case "${MODE}" in + bridge) + ADDRESS="$(get_value "${ZONE}_MACADDR")" + [ -n "${ADDRESS}" ] || ADDRESS="$(random_mac_address)" + + # We need to create the bridge if it doesn't exist, yet + if [ ! -d "/sys/class/net/${BRIDGE}" ]; then + ip link add "${BRIDGE}" address "${ADDRESS}" type bridge + #ip link set "${BRIDGE}" up + fi + + # Attach the physical device + ip link set dev "${INTERFACE}" master "${BRIDGE}" + ip link set dev "${INTERFACE}" up + ;; + + macvtap) + ADDRESS="$(</sys/class/net/${INTERFACE}/address)" + GENERATED_ADDRESS=$(random_mac_address) + + ip link add link "${INTERFACE}" "${BRIDGE}" address "${ADDRESS}" type macvlan mode bridge + ip link set "${INTERFACE}" address "${GENERATED_ADDRESS}" + ip link set "${INTERFACE}" up + ;; + + "") + exit 0 + ;; + + *) + logger -t "network" "Unhandled mode '${MODE}' for '${ZONE}' (${INTERFACE})" + exit 1 + ;; +esac diff --git a/config/udev/network-hotplug-macvtap b/config/udev/network-hotplug-macvtap deleted file mode 100644 index 7f5da12..0000000 --- a/config/udev/network-hotplug-macvtap +++ /dev/null @@ -1,46 +0,0 @@ -#!/bin/bash -############################################################################ -# # -# This file is part of the IPFire Firewall. # -# # -# IPFire is free software; you can redistribute it and/or modify # -# it under the terms of the GNU General Public License as published by # -# the Free Software Foundation; either version 2 of the License, or # -# (at your option) any later version. # -# # -# IPFire is distributed in the hope that it will be useful, # -# but WITHOUT ANY WARRANTY; without even the implied warranty of # -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # -# GNU General Public License for more details. # -# # -# You should have received a copy of the GNU General Public License # -# along with IPFire; if not, write to the Free Software # -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # -# # -# Copyright (C) 2016 IPFire Team info@ipfire.org # -# # -############################################################################ - -[ -n "${INTERFACE}" ] || exit 2 - -PHYSICAL_INTERFACE="${INTERFACE}" -VIRTUAL_INTERFACE="${INTERFACE%phys}" -#VIRTUAL_INTERFACE="${VIRTUAL_INTERFACE}0" - -# Do nothing if the physical interface does not end with "phys" -case "${PHYSICAL_INTERFACE}" in - *phys) - ;; - *) - exit 0 - ;; -esac - -ADDRESS="$(</sys/class/net/${PHYSICAL_INTERFACE}/address)" -rand="$(</proc/sys/kernel/random/uuid)" -rand="${rand//-/}" -GENERATED_ADDRESS=$(echo "02:${rand:0:2}:${rand:2:2}:${rand:4:2}:${rand:6:2}:${rand:8:2}") - -ip link add link "${PHYSICAL_INTERFACE}" "${VIRTUAL_INTERFACE}" address "${ADDRESS}" type macvlan mode bridge -ip link set "${PHYSICAL_INTERFACE}" address "${GENERATED_ADDRESS}" -ip link set "${PHYSICAL_INTERFACE}" up diff --git a/config/udev/network-hotplug-rename b/config/udev/network-hotplug-rename index aaae641..294bb78 100644 --- a/config/udev/network-hotplug-rename +++ b/config/udev/network-hotplug-rename @@ -67,11 +67,25 @@ for zone in ${ZONES}; do
# If a matching interface has been found we will # print the name to which udev will rename it. - if [ "${!mode}" = "macvtap" ]; then - echo "${!device}phys" - else - echo "${!device}" - fi + case "${!mode}" in + bridge) + echo "${!device}phys" + ;; + + macvtap) + # MACVTAP mode doesn't work for WiFi devices + if [ -d "/sys/class/net/${INTERFACE}/phy80211" ]; then + logger -t network "MACVTAP mode is not supported for wireless devices" + echo "${!device}" + else + echo "${!device}phys" + fi + ;; + + *) + echo "${!device}" + ;; + esac
exit 0 done diff --git a/lfs/udev b/lfs/udev index 61bd337..320f272 100644 --- a/lfs/udev +++ b/lfs/udev @@ -109,8 +109,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) /lib/udev/network-hotplug-rename install -v -m 755 $(DIR_SRC)/config/udev/network-hotplug-vlan \ /lib/udev/network-hotplug-vlan - install -v -m 755 $(DIR_SRC)/config/udev/network-hotplug-macvtap \ - /lib/udev/network-hotplug-macvtap + install -v -m 755 $(DIR_SRC)/config/udev/network-hotplug-bridges \ + /lib/udev/network-hotplug-bridges install -v -m 644 $(DIR_SRC)/config/udev/60-net.rules \ /lib/udev/rules.d
hooks/post-receive -- IPFire 2.x development tree