network March 2018

network@lists.ipfire.org

3 participants
7 discussions

[PATCH v2] IPsec: regenerate a swanctl config on connection startup if no config is found
by Jonatan Schlag 08 Mar '18

08 Mar '18

This is an easy way to forcing a regenration if we do not want to change any setting. Fixes: #11627 Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.ipsec | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/functions/functions.ipsec b/src/functions/functions.ipsec index 6f14c8e..d8206e0 100644 --- a/src/functions/functions.ipsec +++ b/src/functions/functions.ipsec @@ -526,6 +526,12 @@ ipsec_connection_up() { return ${EXIT_ERROR} fi + if ! [ -f "${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf" ]; then + log DEBUG "Could not find a swanctl config, generating swanctl config" + ipsec_connection_to_strongswan "${connection}" + ipsec_strongswan_load + fi + cmd swanctl --initiate --child "${connection}" } -- 2.6.3

2 1

[PATCH] IPsec: regenerate a swanctl config on connection startup if config is found
by Jonatan Schlag 08 Mar '18

08 Mar '18

1 0

[PATCH 1/5] ip-tunnel: add new function
by Jonatan Schlag 04 Mar '18

04 Mar '18

To be undependent from the IP protocol we use, when we use tunnel modes in our code, this function converts the modes to the modes the iproute2 tool uses which often depend on the IP protocol version. Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.ip-tunnel | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/src/functions/functions.ip-tunnel b/src/functions/functions.ip-tunnel index 7bb4e3f..550b0b3 100644 --- a/src/functions/functions.ip-tunnel +++ b/src/functions/functions.ip-tunnel @@ -21,6 +21,34 @@ IP_TUNNEL_MODES="gre sit vti" +# This function converts our modes into the type +# the iproute2 tool uses +ip_tunnel_convert_mode_to_iproute2_mode() { + local mode=${1} + local protocol=${2} + + if ! isset mode || ! isset protocol; then + log ERROR "Did not get mode and/or protocol" + return ${EXIT_ERROR} + fi + + if [[ "${protocol}" = "ipv4" ]]; then + # When we use IPv4 we can use our modes + echo "${mode}" + fi + + if [[ "${protocol}" = "ipv6" ]]; then + # When we use IPv6 we have to convert + case "${mode}" in + "vti") + echo "vti6" + ;; + "gre") + echo "ip6gre" + esac + fi +} + ip_tunnel_add() { local device=${1} shift -- 2.6.3

1 4

[PATCH] IPsec: Fix routing in tunnel mode
by Jonatan Schlag 04 Mar '18

04 Mar '18

Two syntax errors make the routing in tunnel mode non working Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/helpers/ipsec-updown | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/helpers/ipsec-updown b/src/helpers/ipsec-updown index 3764085..185c2c7 100644 --- a/src/helpers/ipsec-updown +++ b/src/helpers/ipsec-updown @@ -108,7 +108,7 @@ case "${PLUTO_VERB}" in fi else # Get the device which we use to peer with the other site. - ME_DEVICE = "$(device_get_by_ip_address "${PLUTO_ME}")" + ME_DEVICE="$(device_get_by_assigned_ip_address "${PLUTO_ME}")" # We can only go on if we found a device. if isset ME_DEVICE; then -- 2.6.3

1 0

[PATCH] IPsec: Fix routing
by Jonatan Schlag 01 Mar '18

01 Mar '18

Based on the examples found in strongswan we need to specific the source IP for our routes through an IPsec VPN. If we have no source IP (a router can route packages which do not belong to the network assigned to our zones) we set no routes, but clients can still use the tunnel. For IPsec VPNs in tunnel mode we also need the device which has the ${PLUTO_ME} IP address asigned. The source IP is determined ip_get_assigned_addresses_from_net() the device is determined by the device_get_by_ip_address() function. For tunnel mode see: https://www.strongswan.org/testing/testresults/ipv6-stroke/net2net-ip4-in-i… Fixes: #11629 Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/helpers/ipsec-updown | 46 +++++++++++++++++++++++++++++++++++++++------- 1 file changed, 39 insertions(+), 7 deletions(-) diff --git a/src/helpers/ipsec-updown b/src/helpers/ipsec-updown index 12ead03..3764085 100644 --- a/src/helpers/ipsec-updown +++ b/src/helpers/ipsec-updown @@ -86,13 +86,45 @@ case "${PLUTO_VERB}" in ;; esac - # Set routes - if isset INTERFACE; then - cmd ip route add "${PLUTO_PEER_CLIENT}" \ - dev "${INTERFACE}" - else - cmd ip route add "${PLUTO_PEER_CLIENT}" \ - via "${PLUTO_PEER}" + #Get sources IP for routes + SRC_IP=($(ip_get_assigned_addresses_from_net \ + "${PLUTO_MY_CLIENT}" "permanent")) + + # Set routes if we have a source IP. + # If not the machine does not has a leg on the net + # and we can go on without routes. + if isset SRC_IP; then + # We take the lowest source IP we found, + # which is ugly because the value is unpredictable. + SRC_IP=${SRC_IP[0]} + + if isset INTERFACE; then + if ! cmd ip route add \ + "${PLUTO_PEER_CLIENT}" \ + dev "${INTERFACE}" \ + src "${SRC_IP}"; then + log ERROR \ + "Could not set routes for ${PLUTO_PEER_CLIENT}" + fi + else + # Get the device which we use to peer with the other site. + ME_DEVICE = "$(device_get_by_ip_address "${PLUTO_ME}")" + + # We can only go on if we found a device. + if isset ME_DEVICE; then + if ! cmd ip route add \ + "${PLUTO_PEER_CLIENT}" \ + dev "${ME_DEVICE}" \ + proto static \ + src "${SRC_IP}" \ + table 220; then + log ERROR \ + "Could not set routes for ${PLUTO_PEER_CLIENT}" + fi + else + log ERROR "Could not get device for ${PLUTO_ME}" + fi + fi fi ;; -- 2.6.3

2 1

[PATCH v2] Add new function ip_get__assigned_addresses_from_net()
by Jonatan Schlag 01 Mar '18

01 Mar '18

This function is neede by IPsec to set the routes correctly. We can now now find a source IP for a given net. This way is ugly because the source IP is unpredictable if we get multiple IPs. Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.ip | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/src/functions/functions.ip b/src/functions/functions.ip index 3b43da7..70bd92c 100644 --- a/src/functions/functions.ip +++ b/src/functions/functions.ip @@ -205,3 +205,31 @@ ip_address_del() { return ${EXIT_OK} } + +# Get all currently assigned addresse for a given network +ip_get_assigned_addresses_from_net() { + local net=${1} + shift + local args="$@" + + if ! ip_net_is_valid ${net}; then + log ERROR "IP net ${net} is invalid" + return ${EXIT_ERROR} + fi + + local line + local addresses + + # We read the output of $(ip addr show to ${net} ${args}) + while read -r line; do + # We are only interested in lines which start with inet or inet6 + [[ "${line}" =~ ^(inet6 |inet ) ]] || continue + + # We need the second word the line + line=(${line}) + list_append "addresses" "$(ip_split_prefix "${line[1]}")" + done <<< "$(ip addr show to "${net}" ${args})" + + # We sort the list to get the lowest IP as first item + list_sort ${addresses} +} -- 2.6.3

2 2

[network] Patch notification: 2 patches updated
by Patchwork 01 Mar '18

01 Mar '18

Hello, The following patches (submitted by you) have been updated in Patchwork: * network: [1/3] Add new function: device_get_by_assigned_ip_address() - http://patchwork.ipfire.org/patch/1671/ - for: network was: New now: Accepted * network: [3/3] IPsec: Log the content of all PLUTO variables in debug mode - http://patchwork.ipfire.org/patch/1673/ - for: network was: New now: Accepted This email is a notification only - you do not need to respond. Happy patchworking. -- This is an automated mail sent by the Patchwork system at patchwork.ipfire.org. To stop receiving these notifications, edit your mail settings at: http://patchwork.ipfire.org/mail/

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

network March 2018