network August 2017

network@lists.ipfire.org

2 participants
24 discussions

[PATCH] dhclient-script: fix bound
by Jonatan Schlag 22 Jan '18

22 Jan '18

When we get a BOUND we should have only new_* variables set. So it is stated in the manpage. Apparently, also old_* variables are set so we never got into the block where the IP address was set. We now always set a new IP Address when we get a BOUND. Fixes: #11363 Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/dhclient-script | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/dhclient-script b/src/dhclient-script index c2e0678..ec990bf 100644 --- a/src/dhclient-script +++ b/src/dhclient-script @@ -197,7 +197,8 @@ case "${reason}" in BOUND|RENEW|REBIND|REBOOT) # Check if the IP address has changed. If so, delete all routes and stuff. - if [ -n "${old_ip_address}" -a "${old_ip_address}" != "${new_ip_address}" ]; then + if [ -n "${old_ip_address}" -a "${old_ip_address}" != "${new_ip_address}" ] || \ + [ "${reason}" = "BOUND" ]; then ipv4_flush_device ${interface} fi @@ -208,7 +209,8 @@ case "${reason}" in [ ! "${old_network_number}" = "${new_network_number}" ] || \ [ ! "${old_broadcast_address}" = "${new_broadcast_address}" ] || \ [ ! "${old_routers}" = "${new_routers}" ] || \ - [ ! "${old_interface_mtu}" = "${new_interface_mtu}" ]; then + [ ! "${old_interface_mtu}" = "${new_interface_mtu}" ] || \ + [ "${reason}" = "BOUND" ]; then # Calc the prefix from the subnet mask -- 2.6.3

2 3

[PATCH 1/2] ipsec: only accept valid options for a connection type
by Jonatan Schlag 07 Sep '17

07 Sep '17

The valid options for a host-to-net ipsec connection and a net-to-net are different so we nedd to check if we get a valid option for the connection type. Fixes: #11444 Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.ipsec | 129 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 129 insertions(+) diff --git a/src/functions/functions.ipsec b/src/functions/functions.ipsec index 6f14c8e..11a1d9a 100644 --- a/src/functions/functions.ipsec +++ b/src/functions/functions.ipsec @@ -54,6 +54,46 @@ IPSEC_DEFAULT_TYPE="net-to-net" IPSEC_VALID_MODES="gre-transport tunnel vti" IPSEC_VALID_AUTH_MODES="PSK" +# Valid options for all types of connetions +IPSEC_ALL_VALID_OPTIONS="\ + authentication \ + down \ + disable \ + dpd \ + enable \ + inactivity_timeout \ + local \ + mode \ + remote \ + security_policy \ + start_action \ + up \ + color \ + description \ + show" + +# Valid options for net-to-net +IPSEC_NET_TOT_NET_VALID_OPTIONS="${IPSEC_ALL_VALID_OPTIONS} \ + peer" + +# Valid options for RW +IPSEC_RW_VALID_OPTIONS="${IPSEC_ALL_VALID_OPTIONS} \ + pool" + +# Valid dpd options for all types of connetions +IPSEC_DPD_ALL_VALID_OPTIONS="\ + delay \ + timeout" + +# Valid dpd options for net-to-net +IPSEC_DPD_NET_TOT_NET_VALID_OPTIONS="${IPSEC_DPD_ALL_VALID_OPTIONS} \ + action" + +# Valid dpd options for RW +IPSEC_DPD_RW_VALID_OPTIONS="${IPSEC_DPD_ALL_VALID_OPTIONS}" + + + cli_ipsec() { local action=${1} shift 1 @@ -79,6 +119,10 @@ cli_ipsec_connection() { key=${key//-/_} shift 2 + if ! ipsec_connection_check_option "${connection}" "first" "${key}"; then + return ${EXITR_ERROR} + fi + case "${key}" in authentication|down|disable|dpd|enable|inactivity_timeout|local|mode|peer|pool|remote|security_policy|start_action|up) ipsec_connection_${key} ${connection} "$@" @@ -148,6 +192,67 @@ ipsec_connection_get_description_title() { description_title_read $(description_format_filename "ipsec-connection" "${name}") } +# This functions returns all options which are valid for this type of connection +ipsec_get_valid_options() { + assert [ $# -eq 2 ] + + local connection="${1}" + local type="${2}" + + local con_type=$(ipsec_connection_get_type "${connection}") + assert isset con_type + + case ${con_type} in + host-to-net) + case ${type} in + first) + echo "${IPSEC_RW_VALID_OPTIONS}" + ;; + dpd) + echo "${IPSEC_DPD_RW_VALID_OPTIONS}" + ;; + esac + ;; + net-to-net) + case ${type} in + first) + echo "${IPSEC_NET_TOT_NET_VALID_OPTIONS}" + ;; + dpd) + echo "${IPSEC_DPD_NET_TOT_NET_VALID_OPTIONS}" + ;; + esac + ;; + esac +} + +# This Function checks if a option is valid for a given type +ipsec_connection_check_option() { + assert [ $# -eq 3 ] + + local connection="${1}" + local type="${2}" + local key="${3}" + + local con_type=$(ipsec_connection_get_type "${connection}") + assert isset con_type + + case ${con_type} in + host-to-net) + if ! isoneof key $(ipsec_get_valid_options "${connection}" "${type}"); then + log ERROR "Invalid Argument: ${key}" + return ${EXIT_ERROR} + fi + ;; + net-to-net) + if ! isoneof key $(ipsec_get_valid_options "${connection}" "${type}"); then + log ERROR "Invalid Argument: ${key}" + return ${EXIT_ERROR} + fi + ;; + esac +} + cli_ipsec_connection_show() { local connection="${1}" @@ -443,6 +548,26 @@ ipsec_reload() { ipsec_strongswan_load } +# Returns the type of a connection +ipsec_connection_get_type() { + assert [ $# -eq 1 ] + + local connection=${1} + + if ! ipsec_connection_exists "${connection}"; then + log ERROR "No such VPN ipsec connection: ${connection}" + return ${EXIT_ERROR} + fi + + local TYPE + + if ! ipsec_connection_read_config "${connection}" TYPE; then + return ${EXIT_ERROR} + fi + + echo ${TYPE} +} + # Handle the cli after authentification ipsec_connection_authentication() { if [ ! $# -gt 1 ]; then @@ -551,6 +676,10 @@ ipsec_connection_dpd() { local cmd=${2} shift 2 + if ! ipsec_connection_check_option "${connection}" "dpd" "${cmd}"; then + return ${EXITR_ERROR} + fi + case ${cmd} in action) ipsec_connection_dpd_action "${connection}" "$@" -- 2.6.3

2 4

[PATCH] wireless-network: add enable and disable commands
by Jonatan Schlag 24 Aug '17

24 Aug '17

Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.wireless-networks | 33 +++++++++++++++++++++++++++++-- 1 file changed, 31 insertions(+), 2 deletions(-) diff --git a/src/functions/functions.wireless-networks b/src/functions/functions.wireless-networks index 4fedcb9..b1d65f9 100644 --- a/src/functions/functions.wireless-networks +++ b/src/functions/functions.wireless-networks @@ -24,7 +24,7 @@ WIRELESS_NETWORK_SUPPORTED_PSK_MODES="WPA2-PSK-SHA256 WPA2-PSK WPA-PSK-SHA256 WP WIRELESS_NETWORK_SUPPORTED_MODES="${WIRELESS_NETWORK_SUPPORTED_PSK_MODES} \ 802.1X WPA-EAP NONE" -WIRELESS_NETWORK_CONFIG_SETTINGS="ANONYMOUS_IDENTITY EAP_MODES HIDDEN \ +WIRELESS_NETWORK_CONFIG_SETTINGS="ANONYMOUS_IDENTITY EAP_MODES ENABLED HIDDEN \ IDENTITY MODES PASSWORD PRIORITY PSK SSID" cli_wireless_network() { @@ -49,7 +49,7 @@ cli_wireless_network() { local handle="$(wireless_network_hash "${ssid}")" case "${key}" in - modes|pre_shared_key|priority) + disable|enable|modes|pre_shared_key|priority) wireless_network_${key} "${handle}" "$@" ;; show) @@ -220,6 +220,7 @@ wireless_network_new() { fi local ${WIRELESS_NETWORK_CONFIG_SETTINGS} + ENABLED="true" MODES="${WIRELESS_NETWORK_SUPPORTED_MODES}" SSID="${ssid}" PRIORITY=0 @@ -251,6 +252,34 @@ wireless_network_destroy() { return ${EXIT_OK} } +wireless_network_enable() { + if [ ! $# -eq 1 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + + local handle="${1}" + + if ! wireless_network_write_config_key "${handle}" "ENABLED" "true"; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi +} + +wireless_network_disable() { + if [ ! $# -eq 1 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + + local handle="${1}" + + if ! wireless_network_write_config_key "${handle}" "ENABLED" "false"; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi +} + wireless_networks_mode_is_valid() { assert [ $# -eq 1 ] local mode=${1} -- 2.6.3

1 0

[PATCH 1/2] network reset: destroy all IPsec pools
by Jonatan Schlag 24 Aug '17

24 Aug '17

Fixes: #11432 Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.ipsec-pool | 9 +++++++++ src/network | 5 +++++ 2 files changed, 14 insertions(+) diff --git a/src/functions/functions.ipsec-pool b/src/functions/functions.ipsec-pool index 4eb0e4e..fb7e7da 100644 --- a/src/functions/functions.ipsec-pool +++ b/src/functions/functions.ipsec-pool @@ -420,3 +420,12 @@ ipsec_pool_to_strongswan() { fi ) > ${path} } + +# List all IPsec pools +ipsec_list_pools() { + local pool + for pool in ${NETWORK_IPSEC_POOLS_DIR}/*; do + [ -d ${pool} ] || continue + basename ${pool} + done +} diff --git a/src/network b/src/network index bc4210c..71b0cde 100644 --- a/src/network +++ b/src/network @@ -1154,6 +1154,11 @@ cli_reset() { ipsec_connection_destroy "${connection}" done + local pool + for pool in $(ipsec_list_pools); do + ipsec_pool_destroy "${pool}" + done + # Stop strongswan ipsec_strongswan_autostart -- 2.6.3

2 1

[PATCH 2/2] wireless-networks: add hidden command
by Jonatan Schlag 24 Aug '17

24 Aug '17

Fixes: #11475 Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.wireless-networks | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/src/functions/functions.wireless-networks b/src/functions/functions.wireless-networks index 4fedcb9..58256b9 100644 --- a/src/functions/functions.wireless-networks +++ b/src/functions/functions.wireless-networks @@ -49,7 +49,7 @@ cli_wireless_network() { local handle="$(wireless_network_hash "${ssid}")" case "${key}" in - modes|pre_shared_key|priority) + hidden|modes|pre_shared_key|priority) wireless_network_${key} "${handle}" "$@" ;; show) @@ -364,6 +364,26 @@ wireless_network_modes() { fi } +wireless_network_hidden() { + if [ ! $# -eq 2 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + + local handle=${1} + local hidden=${2} + + if ! isbool hidden; then + log ERROR "Invalid value '${hidden}'" + return ${EXIT_ERROR} + fi + + if ! wireless_network_write_config_key "${handle}" "HIDDEN" "${hidden}"; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi +} + wireless_network_pre_shared_key() { if [ ! $# -eq 2 ]; then log ERROR "Not enough arguments" -- 2.6.3

1 0

[PATCH] ipsec-pool: do not delete a pool when this pool is used by a connection
by Jonatan Schlag 24 Aug '17

24 Aug '17

Fixes: #11448 Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.ipsec-pool | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/src/functions/functions.ipsec-pool b/src/functions/functions.ipsec-pool index e5da518..f7d73f6 100644 --- a/src/functions/functions.ipsec-pool +++ b/src/functions/functions.ipsec-pool @@ -219,6 +219,27 @@ ipsec_pool_new() { fi } +ipsec_pool_is_in_use() { + [ $# -eq 1 ] + local pool="${1}" + + for connection in $(ipsec_list_connections); do + local POOLS + + if ! ipsec_connection_read_config "${connection}" "POOLS"; then + log WARNING "Could not read configuration" + continue + fi + + if list_match "${pool}" ${POOLS}; then + return ${EXIT_TRUE} + break + fi + done + + return ${EXIT_FALSE} +} + # Function that deletes based on the passed parameters # one ore more vpn ipsec pools ipsec_pool_destroy() { @@ -229,6 +250,11 @@ ipsec_pool_destroy() { continue fi + if ipsec_pool_is_in_use "${pool}"; then + log ERROR "The VPN IPsec pool is in use an can thats why not deleted" + return ${EXIT_ERROR} + fi + if [ -f "${NETWORK_IPSEC_SWANCTL_POOLS_DIR}/${pool}.conf" ]; then if ! file_delete "${NETWORK_IPSEC_SWANCTL_POOLS_DIR}/${pool}.conf"; then # We going on here to delete at least the configuration directory -- 2.6.3

1 0

[PATCH] wireless-networks: change encryption-mode to modes
by Jonatan Schlag 24 Aug '17

24 Aug '17

We also use now our great +/- syntax. Fixes: #11471 Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.wireless-networks | 104 ++++++++++++++++++++++++++---- 1 file changed, 91 insertions(+), 13 deletions(-) diff --git a/src/functions/functions.wireless-networks b/src/functions/functions.wireless-networks index c1cf06a..feca20d 100644 --- a/src/functions/functions.wireless-networks +++ b/src/functions/functions.wireless-networks @@ -49,7 +49,7 @@ cli_wireless_network() { local handle="$(wireless_network_hash "${ssid}")" case "${key}" in - encryption_mode|pre_shared_key|priority) + modes|pre_shared_key|priority) wireless_network_${key} "${handle}" "$@" ;; show) @@ -251,16 +251,29 @@ wireless_network_destroy() { return ${EXIT_OK} } -wireless_network_encryption_mode() { - if [ ! $# -eq 2 ]; then +wireless_networks_mode_is_valid() { + assert [ $# -eq 1 ] + local mode=${1} + + if isoneof mode ${WIRELESS_NETWORK_SUPPORTED_MODES}; then + return ${EXIT_TRUE} + else + return ${EXIT_FALSE} + fi + +} + +# WIRELESS_NETWORK_SUPPORTED_MODES +wireless_network_modes() { + if [ ! $# -ge 2 ]; then log ERROR "Not enough arguments" return ${EXIT_ERROR} fi local handle="${1}" - local mode="${2}" + shift - if ! isoneof mode ${WIRELESS_VALID_ENCRYPTION_MODES}; then - log ERROR "Encryption mode '${mode}' is invalid" + if [ $# -eq 0 ]; then + log ERROR "You must pass at least one value after mode" return ${EXIT_ERROR} fi @@ -270,15 +283,80 @@ wireless_network_encryption_mode() { return ${EXIT_ERROR} fi - # Validate the PSK when changing mode and reset if needed - if isset PSK && [ "${mode}" != "NONE" ] && \ - ! wireless_pre_shared_key_is_valid "${mode}" "${PSK}"; then - log WARNING "The configured pre-shared-key is incompatible with this encryption mode and has been reset" - PSK="" + # Remove duplicated entries to proceed the list safely + MODES="$(list_unique ${MODES})" + + local modes_added + local modes_removed + local modes_set + + while [ $# -gt 0 ]; do + local arg="${1}" + + case "${arg}" in + +*) + list_append modes_added "${arg:1}" + ;; + -*) + list_append modes_removed "${arg:1}" + ;; + [A-Z0-9]*) + list_append modes_set "${arg}" + ;; + *) + error "Invalid argument: ${arg}" + return ${EXIT_ERROR} + ;; + esac + shift + done + + # Check if the user is trying a mixed operation + if ! list_is_empty modes_set && (! list_is_empty modes_added || ! list_is_empty modes_removed); then + error "You cannot reset the modes list and add or remove modes at the same time" + return ${EXIT_ERROR} fi - # Save new encryption mode - ENCRYPTION_MODE="${mode}" + # Set new modes list + if ! list_is_empty modes_set; then + # Check if all modes are valid + local mode + for mode in ${modes_set}; do + if ! wireless_networks_mode_is_valid ${mode}; then + error "Unsupported mode: ${mode}" + return ${EXIT_ERROR} + fi + done + + MODES="${modes_set}" + + # Perform incremental updates + else + local modes + + # Perform all removals + for mode in ${modes_removed}; do + if ! list_remove MODES ${mode}; then + warning "${mode} was not on the list and could not be removed" + fi + done + + for mode in ${modes_added}; do + if wireless_networks_mode_is_valid ${mode}; then + if ! list_append_unique MODES ${mode}; then + warning "${mode} is already on the modes list" + fi + else + warning "${mode} is unknown or unsupported and could not be added" + fi + done + fi + + # Check if the list contain at least one valid mode + if list_is_empty MODES; then + error "Cannot save an empty mode list" + return ${EXIT_ERROR} + fi if ! wireless_network_write_config "${handle}"; then log ERROR "Could not write configuration settings" -- 2.6.3

1 0

[PATCH 1/2] util: add normalize function
by Jonatan Schlag 18 Aug '17

18 Aug '17

This function remove all non alpha numerical characters from a string and substitute this characters with one - So HELLO%%/$&/)%$%(&&HH becomes hello-hh Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.util | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/functions/functions.util b/src/functions/functions.util index 24e3e66..8df0d86 100644 --- a/src/functions/functions.util +++ b/src/functions/functions.util @@ -845,3 +845,13 @@ copy() { return ${EXIT_ERROR} fi } + + +normalize() { + assert [ $# -eq 1 ] + + local string="${1}" + + string="${string,,}" + tr -sc [:alnum:] "-" < <(printf "%s" "${string}") +} -- 2.6.3

1 1

[PATCH] network reset: destroy all IPsec pools
by Jonatan Schlag 17 Aug '17

17 Aug '17

2 1

[PATCH 1/2] ipsec-pool: delete on destroy also the swanctl configuration file
by Jonatan Schlag 16 Aug '17

16 Aug '17

Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.ipsec-pool | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/functions/functions.ipsec-pool b/src/functions/functions.ipsec-pool index fb7e7da..86ba81d 100644 --- a/src/functions/functions.ipsec-pool +++ b/src/functions/functions.ipsec-pool @@ -229,6 +229,13 @@ ipsec_pool_destroy() { continue fi + if [ -f "${NETWORK_IPSEC_SWANCTL_POOLS_DIR}/${pool}.conf" ]; then + if ! file_delete "${NETWORK_IPSEC_SWANCTL_POOLS_DIR}/${pool}.conf"; then + # We going on here to delete at least the configuration directory + log ERROR "Could not delete ${NETWORK_IPSEC_SWANCTL_POOLS_DIR}/${pool}.conf" + fi + fi + log DEBUG "Deleting VPN IPsec pool ${pool}" if ! rm -rf "${NETWORK_IPSEC_POOLS_DIR}/${pool}"; then -- 2.6.3

1 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

network August 2017