network

network@lists.ipfire.org

108 discussions

[PATCH 1/2] raw: add command vpn-security-policy-exists
by Jonatan Schlag 04 Aug '17

04 Aug '17

Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/network | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/network b/src/network index 1c3e2c5..109c106 100644 --- a/src/network +++ b/src/network @@ -1325,6 +1325,9 @@ cli_raw() { list-zone-config-hids) zone_config_list_hids $@ ;; + vpn-security-policy-exists) + vpn_security_policy_exists $@ + ;; zone-name-is-valid) zone_name_is_valid $@ ;; -- 2.6.3

1 1

[PATCH] ipsec: add local address, dpd settings and start action settings
by Jonatan Schlag 03 Aug '17

03 Aug '17

Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.ipsec | 177 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 173 insertions(+), 4 deletions(-) diff --git a/src/functions/functions.ipsec b/src/functions/functions.ipsec index 1c05f57..d600105 100644 --- a/src/functions/functions.ipsec +++ b/src/functions/functions.ipsec @@ -19,16 +19,22 @@ # # ############################################################################### -IPSEC_CONNECTION_CONFIG_SETTINGS="AUTH_MODE INACTIVITY_TIMEOUT LOCAL_ID LOCAL_PREFIX" +IPSEC_CONNECTION_CONFIG_SETTINGS="AUTH_MODE DPD_ACTION DPD_DELAY DPD_TIMEOUT" +PSEC_CONNECTION_CONFIG_SETTINGS="INACTIVITY_TIMEOUT LOCAL_ADDRESS LOCAL_ID LOCAL_PREFIX" IPSEC_CONNECTION_CONFIG_SETTINGS="${IPSEC_CONNECTION_CONFIG_SETTINGS} MODE PEER PSK" IPSEC_CONNECTION_CONFIG_SETTINGS="${IPSEC_CONNECTION_CONFIG_SETTINGS} REMOTE_ID REMOTE_PREFIX" IPSEC_CONNECTION_CONFIG_SETTINGS="${IPSEC_CONNECTION_CONFIG_SETTINGS} SECURITY_POLICY" # Default values -IPSEC_DEFAULT_MODE="tunnel" IPSEC_DEFAULT_AUTH_MODE="PSK" +IPSEC_DEFAULT_DPD_ACTION="restart" +IPSEC_DEFAULT_DPD_DELAY="30" +IPSEC_DEFAULT_DPD_TIMEOUT="120" IPSEC_DEFAULT_INACTIVITY_TIMEOUT="0" +IPSEC_DEFAULT_MODE="tunnel" IPSEC_DEFAULT_SECURITY_POLICY="system" +IPSEC_DEFAULT_START_ACTION="on-demand" + IPSEC_VALID_MODES="gre-transport tunnel vti" IPSEC_VALID_AUTH_MODES="PSK" @@ -56,7 +62,7 @@ cli_ipsec_connection() { shift 2 case "${key}" in - authentication|inactivity_timeout|local|mode|peer|remote|security_policy) + authentication|dpd|inactivity_timeout|local|mode|peer|remote|security_policy|start_action) ipsec_connection_${key} ${connection} $@ ;; show) @@ -358,6 +364,119 @@ ipsec_connection_authentication_psk() { return ${EXIT_OK} } + +# Handle the cli after authentification +ipsec_connection_dpd() { + if [ ! $# -gt 1 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + + local connection=${1} + local cmd=${2} + shift 2 + + case ${cmd} in + action) + ipsec_connection_dpd_action "${connection}" $@ + ;; + delay) + ipsec_connection_dpd_delay "${connection}" $@ + ;; + timeout) + ipsec_connection_dpd_timeout "${connection}" $@ + ;; + *) + log ERROR "Unrecognized argument: ${cmd}" + return ${EXIT_ERROR} + ;; + esac +} + +# Set the default dpd action +ipsec_connection_dpd_action() { + if [ ! $# -eq 2 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local action=${2} + + if ! isoneof action "restart" "clear"; then + log ERROR "dpd action '${action}' is invalid" + return ${EXIT_ERROR} + fi + + if ! ipsec_connection_write_config_key "${connection}" "DPD_ACTION" ${action}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi +} + +# Set the dpd delay +ipsec_connection_dpd_delay() { + if [ ! $# -ge 2 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + + local connection=${1} + shift 1 + local value=$@ + + if ! isinteger value; then + value=$(parse_time $@) + if [ ! $? -eq 0 ]; then + log ERROR "Parsing the passed time was not sucessful please check the passed values." + return ${EXIT_ERROR} + fi + fi + + if [ ${value} -lt 0 ]; then + log ERROR "The passed time value must be in the sum greater or equal zero seconds." + return ${EXIT_ERROR} + fi + + if ! ipsec_connection_write_config_key "${connection}" "DPD_DELAY" ${value}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi + + return ${EXIT_OK} +} + +# Set the dpd timeout +ipsec_connection_dpd_timeout() { + if [ ! $# -ge 2 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + + local connection=${1} + shift 1 + local value=$@ + + if ! isinteger value; then + value=$(parse_time $@) + if [ ! $? -eq 0 ]; then + log ERROR "Parsing the passed time was not sucessful please check the passed values." + return ${EXIT_ERROR} + fi + fi + + if [ ${value} -le 0 ]; then + log ERROR "The passed time value must be in the sum greater or equal zero seconds." + return ${EXIT_ERROR} + fi + + if ! ipsec_connection_write_config_key "${connection}" "DPD_TIMEOUT" ${value}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi + + return ${EXIT_OK} +} + # Handle the cli after local ipsec_connection_local() { if [ ! $# -ge 2 ]; then @@ -370,6 +489,9 @@ ipsec_connection_local() { shift 2 case ${cmd} in + address) + ipsec_connection_local_address "${connection}" $@ + ;; id) ipsec_connection_id "${connection}" "LOCAL" $@ ;; @@ -407,6 +529,28 @@ ipsec_connection_mode() { return ${EXIT_OK} } +# Set the local address +ipsec_connection_local_address() { + if [ ! $# -eq 2 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local local_address=${2} + + if ! ipsec_connection_check_peer ${local_address}; then + log ERROR "Local address '${local_address}' is invalid" + return ${EXIT_ERROR} + fi + + if ! ipsec_connection_write_config_key "${connection}" "LOCAL_ADDRESS" ${local_address}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi + + return ${EXIT_OK} +} + # Set the peer to connect to ipsec_connection_peer() { if [ ! $# -eq 2 ]; then @@ -612,6 +756,25 @@ ipsec_connection_inactivity_timeout() { return ${EXIT_OK} } +# Set the default start action +ipsec_connection_start_action() { + if [ ! $# -eq 2 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local action=${2} + + if ! isoneof action "on-demand" "always-on"; then + log ERROR "Start action '${action}' is invalid" + return ${EXIT_ERROR} + fi + + if ! ipsec_connection_write_config_key "${connection}" "START_ACTION" ${action}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi +} # Set the security policy to use ipsec_connection_security_policy() { @@ -702,8 +865,14 @@ ipsec_connection_new() { local ${IPSEC_CONNECTION_CONFIG_SETTINGS} - MODE=${IPSEC_DEFAULT_MODE} AUTH_MODE=${IPSEC_DEFAULT_AUTH_MODE} + DPD_ACTION=${IPSEC_DEFAULT_DPD_ACTION} + DPD_DELAY=${IPSEC_DEFAULT_DPD_DELAY} + DPD_TIMEOUT=${IPSEC_DEFAULT_DPD_TIMEOUT} + MODE=${IPSEC_DEFAULT_MODE} + START_ACTION=${IPSEC_DEFAULT_START_ACTION} + + INACTIVITY_TIMEOUT=${IPSEC_DEFAULT_INACTIVITY_TIMEOUT} SECURITY_POLICY=${IPSEC_DEFAULT_SECURITY_POLICY} -- 2.6.3

1 0

[PATCH] bash-autocompletion: fix typos
by Jonatan Schlag 03 Aug '17

03 Aug '17

Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/bash-completion/network | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/bash-completion/network b/src/bash-completion/network index 4e392b9..5fd6191 100644 --- a/src/bash-completion/network +++ b/src/bash-completion/network @@ -410,7 +410,7 @@ _network_vpn_ipsec_connection_subcommands() { shift local words=( $@ ) - local commands="authentication inactivity-timout local mode peer remote security-policy show" + local commands="authentication inactivity-timeout local mode peer remote security-policy show" local cmd="$(_network_find_on_cmdline "${commands}")" if [[ -z "${cmd}" ]]; then COMPREPLY=( $(compgen -W "${commands}" -- "${cur}") ) @@ -430,7 +430,7 @@ _network_vpn_ipsec_connection_subcommands() { _network_vpn_ipsec_connection_subcommands_mode ${args} ;; remote) - _network-vpn_ipsec_connection_subcommands_local_remote ${connection} "remote" ${args} + _network_vpn_ipsec_connection_subcommands_local_remote ${connection} "remote" ${args} ;; security-policy) _network_vpn_ipsec_connection_subcommands_security_policy ${args} -- 2.6.3

1 0

[PATCH 1/6] ipsec: add new function ipsec_list_connections
by Jonatan Schlag 03 Aug '17

03 Aug '17

Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.ipsec | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/functions/functions.ipsec b/src/functions/functions.ipsec index ed889a6..a174a7f 100644 --- a/src/functions/functions.ipsec +++ b/src/functions/functions.ipsec @@ -729,3 +729,12 @@ ipsec_connection_destroy() { fi done } + +# List all ipsec connections +ipsec_list_connections() { + local connection + for connection in ${NETWORK_IPSEC_CONNS_DIR}/*; do + [ -d ${connection} ] || continue + basename ${connection} + done +} -- 2.6.3

1 5

[PATCH v2 1/2] ipsec: add new functions
by Jonatan Schlag 29 Jul '17

29 Jul '17

Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- Makefile.am | 1 + src/functions/functions.ipsec | 579 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 580 insertions(+) create mode 100644 src/functions/functions.ipsec diff --git a/Makefile.am b/Makefile.am index 761e849..2ce7a34 100644 --- a/Makefile.am +++ b/Makefile.am @@ -160,6 +160,7 @@ dist_network_SCRIPTS = \ src/functions/functions.usb \ src/functions/functions.util \ src/functions/functions.vlan \ + src/functions/functions.ipsec \ src/functions/functions.vpn-security-policies \ src/functions/functions.wireless \ src/functions/functions.wpa_supplicant \ diff --git a/src/functions/functions.ipsec b/src/functions/functions.ipsec new file mode 100644 index 0000000..5e9327b --- /dev/null +++ b/src/functions/functions.ipsec @@ -0,0 +1,579 @@ +#!/bin/bash +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2017 IPFire Network Development Team # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +IPSEC_CONNECTION_CONFIG_SETTINGS="AUTH_MODE INACTIVITY_TIMEOUT LOCAL_ID LOCAL_PREFIX" +IPSEC_CONNECTION_CONFIG_SETTINGS="${IPSEC_CONNECTION_CONFIG_SETTINGS} MODE PEER PSK" +IPSEC_CONNECTION_CONFIG_SETTINGS="${IPSEC_CONNECTION_CONFIG_SETTINGS} REMOTE_ID REMOTE_PREFIX" +IPSEC_CONNECTION_CONFIG_SETTINGS="${IPSEC_CONNECTION_CONFIG_SETTINGS} SECURITY_POLICY" + +# Default values +IPSEC_DEFAULT_MODE="tunnel" +IPSEC_DEFAULT_AUTH_MODE="psk" +IPSEC_DEFAULT_INACTIVITY_TIMEOUT="0" +IPSEC_DEFAULT_SECURITY_POLICY="system" + +IPSEC_VALID_MODES="gre-transport tunnel vti" +IPSEC_VALID_AUTH_MODES="PSK psk" + +# This function writes all values to a via ${connection} specificated VPN IPsec configuration file +ipsec_connection_write_config() { + assert [ $# -ge 1 ] + + local connection="${1}" + + if ! ipsec_connection_exists "${connection}"; then + log ERROR "No such VPN IPsec connection: ${connection}" + return ${EXIT_ERROR} + fi + + local path="$(ipsec_connection_path "${connection}")/settings" + + if ! settings_write "${path}" ${IPSEC_CONNECTION_CONFIG_SETTINGS}; then + log ERROR "Could not write configuration settings for VPN IPsec connection ${connection}" + return ${EXIT_ERROR} + fi + + ipsec_reload ${connection} +} + +# This funtion writes the value for one key to a via ${connection} specificated VPN IPsec connection configuration file +ipsec_connection_write_config_key() { + assert [ $# -ge 3 ] + + local connection=${1} + local key=${2} + shift 2 + + local value="$@" + + if ! ipsec_connection_exists "${connection}"; then + log ERROR "No such VPN ipsec connection: ${connection}" + return ${EXIT_ERROR} + fi + + log DEBUG "Set '${key}' to new value '${value}' in VPN ipsec connection '${connection}'" + + local ${IPSEC_CONNECTION_CONFIG_SETTINGS} + + # Read the config settings + if ! ipsec_connection_read_config "${connection}"; then + return ${EXIT_ERROR} + fi + + # Set the key to a new value + assign "${key}" "${value}" + + if ! ipsec_connection_write_config "${connection}"; then + return ${EXIT_ERROR} + fi + + return ${EXIT_TRUE} +} + +# Reads one or more keys out of a settings file or all if no key is provided. +ipsec_connection_read_config() { + assert [ $# -ge 1 ] + + local connection="${1}" + shift 1 + + if ! ipsec_connection_exists "${connection}"; then + log ERROR "No such VPN IPsec connection : ${connection}" + return ${EXIT_ERROR} + fi + + + local args + if [ $# -eq 0 ] && [ -n "${IPSEC_CONNECTION_CONFIG_SETTINGS}" ]; then + list_append args ${IPSEC_CONNECTION_CONFIG_SETTINGS} + else + list_append args $@ + fi + + local path="$(ipsec_connection_path "${connection}")/settings" + + if ! settings_read "${path}" ${args}; then + log ERROR "Could not read settings for VPN IPsec connection ${connection}" + return ${EXIT_ERROR} + fi +} + +# Returns the path to a the directory for given connection +ipsec_connection_path() { + assert [ $# -eq 1 ] + + local connection=${1} + + echo "${NETWORK_CONFIG_DIR}/vpn/ipsec/connection/${connection}" +} + +# This function checks if a vpn ipsec connection exists +# Returns True when yes and false when not +ipsec_connection_exists() { + assert [ $# -eq 1 ] + + local connection=${1} + + local path=$(ipsec_connection_path "${connection}") + + [ -d "${path}" ] && return ${EXIT_TRUE} || return ${EXIT_FALSE} +} + +# Reloads the connection after config changes +ipsec_reload() { + return ${EXIT_TRUE} +} + +# Handle the cli after authentification +ipsec_connection_authentication() { + if [ ! $# -gt 1 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + + local connection=${1} + local cmd=${2} + shift 2 + + case ${cmd} in + mode) + ipsec_connection_authentication_mode "${connection}" $@ + ;; + pre-shared-key) + ipsec_connection_authentication_psk "${connection}" $@ + ;; + *) + log ERROR "Unrecognized argument: ${cmd}" + return ${EXIT_ERROR} + ;; + esac +} + +# Set the authentification mode +ipsec_connection_authentication_mode() { + if [ ! $# -eq 2 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local mode=${2} + + if ! isoneof mode ${IPSEC_VALID_AUTH_MODES}; then + log ERROR "Auth mode '${mode}' is invalid" + return ${EXIT_ERROR} + fi + + if ! ipsec_connection_write_config_key "${connection}" "AUTH_MODE" ${mode,,}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi +} + +# Set the psk +ipsec_connection_authentication_psk() { + if [ ! $# -eq 2]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local psk=${2} + + # TODO Check if psk is valid + + if ! ipsec_connection_write_config_key "${connection}" "PSK" ${psk}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi + + return ${EXIT_OK} +} + +# Handle the cli after local +ipsec_connection_local() { + if [ ! $# -ge 2 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + + local connection=${1} + local cmd=${2} + shift 2 + + case ${cmd} in + id) + ipsec_connection_id "${connection}" "LOCAL" $@ + ;; + prefix) + ipsec_connection_prefix "${connection}" "LOCAL" $@ + ;; + *) + log ERROR "Unrecognized argument: ${cmd}" + return ${EXIT_ERROR} + ;; + esac + + return ${EXIT_OK} +} + +# Set the connection mode +ipsec_connection_mode() { + if [ ! $# -eq 2]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local mode=${2} + + if ! isoneof mode ${IPSEC_VALID_MODES}; then + log ERROR "Mode '${mode}' is invalid" + return ${EXIT_ERROR} + fi + + if ! ipsec_connection_write_config_key "${connection}" "MODE" ${mode}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi + + return ${EXIT_OK} +} + +# Set the peer to connect to +ipsec_connection_peer() { + if [ ! $# -eq 2]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local peer=${2} + + if ! ipsec_connection_check_peer ${peer}; then + log ERROR "Peer '${peer}' is invalid" + return ${EXIT_ERROR} + fi + + if ! ipsec_connection_write_config_key "${connection}" "PEER" ${peer}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi + + return ${EXIT_OK} +} + +#Set the local or remote id +ipsec_connection_id() { + if [ ! $# -eq 3 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local type=${2} + local id=${3} + + if ! ipsec_connection_check_id ${id}; then + log ERROR "Id '${id}' is invalid" + return ${EXIT_ERROR} + fi + + if ! ipsec_connection_write_config_key "${connection}" "${type}_ID" ${id}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi + + return ${EXIT_OK} +} + +# Set the local or remote prefix +ipsec_connection_prefix() { + if [ ! $# -ge 3 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local type=${2} + shift 2 + + local _prefix="${type}_PREFIX" + local "${_prefix}" + if ! ipsec_connection_read_config "${connection}" "${_prefix}"; then + return ${EXIT_ERROR} + fi + + # Remove duplicated entries to proceed the list safely + assign "${_prefix}" "$(list_unique ${!_prefix} )" + + local prefixes_added + local prefixes_removed + local prefixes_set + + while [ $# -gt 0 ]; do + local arg="${1}" + + case "${arg}" in + +*) + list_append prefixes_added "${arg:1}" + ;; + -*) + list_append prefixes_removed "${arg:1}" + ;; + [A-Fa-f0-9]*) + list_append prefixes_set "${arg}" + ;; + *) + error "Invalid argument: ${arg}" + return ${EXIT_ERROR} + ;; + esac + shift + done + + # Check if the user is trying a mixed operation + if ! list_is_empty prefixes_set && (! list_is_empty prefixes_added || ! list_is_empty prefixes_removed); then + error "You cannot reset the prefix list and add or remove prefixes at the same time" + return ${EXIT_ERROR} + fi + + # Set new prefix list + if ! list_is_empty prefixes_set; then + # Check if all prefixes are valid + local prefix + for prefix in ${prefixes_set}; do + if ! ip_net_is_valid ${prefix}; then + error "Unsupported prefix: ${prefix}" + return ${EXIT_ERROR} + fi + done + + assign "${_prefix}" "${prefixes_set}" + + # Perform incremental updates + else + local prefix + + # Perform all removals + for prefix in ${prefixes_removed}; do + if ! list_remove "${_prefix}" ${prefix}; then + warning "${prefix} was not on the list and could not be removed" + fi + done + + + for prefix in ${prefixes_added}; do + if ip_net_is_valid ${prefix}; then + if ! list_append_unique "${_prefix}" ${prefix}; then + warning "${prefix} is already on the prefix list" + fi + else + warning "${prefix} is not a valiv IP net and could not be added" + fi + done + fi + + # Check if the list contain at least one valid prefix + if list_is_empty ${_prefix}; then + error "Cannot save an empty prefix list" + return ${EXIT_ERROR} + fi + + # Save everything + if ! ipsec_connection_write_config_key "${connection}" "${_prefix}" ${!_prefix}; then + log ERROR "Could not write configuration settings" + fi + + return ${EXIT_OK} +} + +# Handle the cli after remote +ipsec_connection_remote() { + if [ ! $# -ge 2 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + + local connection=${1} + local cmd=${2} + shift 2 + + case ${cmd} in + id) + ipsec_connection_id "${connection}" "REMOTE" $@ + ;; + + prefix) + ipsec_connection_prefix "${connection}" "REMOTE" $@ + ;; + *) + log ERROR "Unrecognized argument: ${cmd}" + return ${EXIT_ERROR} + ;; + esac + + return ${EXIT_OK} +} + +# Set the inactivity timeout +ipsec_connection_inactivity_timeout() { + if [ ! $# -ge 2 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + + local connection=${1} + shift 1 + local value=$@ + + if ! isinteger value; then + value=$(parse_time $@) + if [ ! $? -eq 0 ]; then + log ERROR "Parsing the passed time was not sucessful please check the passed values." + return ${EXIT_ERROR} + fi + fi + + if [ ${value} -le 0 ]; then + log ERROR "The passed time value must be in the sum greater zero seconds." + return ${EXIT_ERROR} + fi + + if ! ipsec_connection_write_config_key "${connection}" "INACTIVITY_TIMEOUT" ${value}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi + + return ${EXIT_OK} +} + + +# Set the security policy to use +ipsec_connection_security_policy() { + if [ ! $# -eq 2 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local security_policy=${2} + + if ! vpn_security_policy_exists ${security_policy}; then + log ERROR "No such vpn security policy '${security_policy}'" + return ${EXIT_ERROR} + fi + + if ! ipsec_connection_write_config_key "${connection}" "SECURITY_POLICY" ${security_policy}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi +} + +# Check if a id is valid +ipsec_connection_check_id() { + assert [ $# -eq 1 ] + local id=${1} + + if [[ ${id} =~ ^@[[:alnum:]]+$ ]] || ip_is_valid ${id}; then + return ${EXIT_TRUE} + else + return ${EXIT_FALSE} + fi +} + +# Checks if a peer is valid +ipsec_connection_check_peer() { + assert [ $# -eq 1 ] + local peer=${1} + + # TODO Accept also FQDNs + if ip_is_valid ${peer}; then + return ${EXIT_TRUE} + else + return ${EXIT_FALSE} + fi +} + +# This function checks if a VPN IPsec connection name is valid +# Allowed are only A-Za-z0-9 +ipsec_connection_check_name() { + assert [ $# -eq 1 ] + + local connection=${1} + + [[ "${connection}" =~ [^[:alnum:]$] ]] +} + +# Function that creates one VPN IPsec connection +ipsec_connection_new() { + if [ $# -gt 1 ]; then + error "Too many arguments" + return ${EXIT_ERROR} + fi + + local connection="${1}" + if ! isset connection; then + error "Please provide a connection name" + return ${EXIT_ERROR} + fi + + # Check for duplicates + if ipsec_connection_exists "${connection}"; then + error "The VPN IPsec connection ${connection} already exists" + return ${EXIT_ERROR} + fi + + # Check if the name of the connection is valid + if ipsec_connection_check_name "${connection}"; then + error "'${connection}' contains illegal characters" + return ${EXIT_ERROR} + fi + + log DEBUG "Creating VPN IPsec connection ${connection}" + + if ! mkdir -p $(ipsec_connection_path "${connection}"); then + log ERROR "Could not create config directory for ${connection}" + return ${EXIT_ERROR} + fi + + local ${IPSEC_CONNECTION_CONFIG_SETTINGS} + + MODE=${IPSEC_DEFAULT_MODE} + AUTH_MODE=${IPSEC_DEFAULT_AUTH_MODE} + INACTIVITY_TIMEOUT=${IPSEC_DEFAULT_INACTIVITY_TIMEOUT} + SECURITY_POLICY=${IPSEC_DEFAULT_SECURITY_POLICY} + + if ! ipsec_connection_write_config "${connection}"; then + log ERROR "Could not write new config file" + return ${EXIT_ERROR} + fi +} + +# Function that deletes based on the passed parameters one ore more vpn security policies +ipsec_connection_destroy() { + local connection + for connection in $@; do + if ! ipsec_connection_exists "${connection}"; then + log ERROR "The VPN IPsec connection ${connection} does not exist." + continue + fi + + log DEBUG "Deleting VPN IPsec connection ${connection}" + if ! rm -rf $(ipsec_connection_path "${connection}"); then + log ERROR "Deleting the VPN IPsec connection ${connection} was not sucessful" + return ${EXIT_ERROR} + fi + done +} -- 2.6.3

1 1

[RFC PATCH 1/2] Add vpn-ipsec functions
by Jonatan Schlag 28 Jul '17

28 Jul '17

Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- Makefile.am | 1 + src/functions/functions.vpn-ipsec | 550 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 551 insertions(+) create mode 100644 src/functions/functions.vpn-ipsec diff --git a/Makefile.am b/Makefile.am index 761e849..c14bb17 100644 --- a/Makefile.am +++ b/Makefile.am @@ -160,6 +160,7 @@ dist_network_SCRIPTS = \ src/functions/functions.usb \ src/functions/functions.util \ src/functions/functions.vlan \ + src/functions/functions.vpn-ipsec \ src/functions/functions.vpn-security-policies \ src/functions/functions.wireless \ src/functions/functions.wpa_supplicant \ diff --git a/src/functions/functions.vpn-ipsec b/src/functions/functions.vpn-ipsec new file mode 100644 index 0000000..2bfa3a2 --- /dev/null +++ b/src/functions/functions.vpn-ipsec @@ -0,0 +1,550 @@ +#!/bin/bash +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2017 IPFire Network Development Team # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +VPN_IPSEC_CONNECTION_CONFIG_SETTINGS="AUTH_MODE INACTIVITY_TIMEOUT LOCAL_ID LOCAL_PREFIX" +VPN_IPSEC_CONNECTION_CONFIG_SETTINGS="${VPN_IPSEC_CONNECTION_CONFIG_SETTINGS} MODE PEER PSK" +VPN_IPSEC_CONNECTION_CONFIG_SETTINGS="${VPN_IPSEC_CONNECTION_CONFIG_SETTINGS} REMOTE_ID REMOTE_PREFIX" +VPN_IPSEC_CONNECTION_CONFIG_SETTINGS="${VPN_IPSEC_CONNECTION_CONFIG_SETTINGS} SECURITY_POLICY" + +# Default values +MODE="tunnel" +AUTH_MODE="psk" +INACTIVITY_TIMEOUT="0" +SECURITY_POLICY="system" + +# This function writes all values to a via ${connection} specificated VPN IPsec configuration file +vpn_ipsec_connection_write_config() { + assert [ $# -ge 1 ] + + local connection="${1}" + + if ! vpn_ipsec_connection_exists "${connection}"; then + log ERROR "No such VPN IPsec connection: ${connection}" + return ${EXIT_ERROR} + fi + + local path="$(vpn_ipsec_connection_path "${connection}")" + if [ ! -w ${path} ]; then + log ERROR "${path} is not writeable" + return ${EXIT_ERROR} + fi + + if ! settings_write "${path}" ${VPN_IPSEC_CONNECTION_CONFIG_SETTINGS}; then + log ERROR "Could not write configuration settings for VPN IPsec connection ${connection}" + return ${EXIT_ERROR} + fi + + # TODO everytime we successfully write a config we should call some trigger to take the changes into effect +} + +# This funtion writes the value for one key to a via ${connection} specificated VPN IPsec connection configuration file +vpn_ipsec_connection_write_config_key() { + assert [ $# -ge 3 ] + + local connection=${1} + local key=${2} + shift 2 + + local value="$@" + + if ! vpn_ipsec_connection_exists "${connection}"; then + log ERROR "No such VPN ipsec connection: ${connection}" + return ${EXIT_ERROR} + fi + + log DEBUG "Set '${key}' to new value '${value}' in VPN ipsec connection '${connection}'" + + local ${VPN_IPSEC_CONNECTION_CONFIG_SETTINGS} + + # Read the config settings + if ! vpn_ipsec_connection_read_config "${connection}"; then + return ${EXIT_ERROR} + fi + + # Set the key to a new value + assign "${key}" "${value}" + + if ! vpn_ipsec_connection_write_config "${connection}"; then + return ${EXIT_ERROR} + fi + + return ${EXIT_TRUE} +} + +# Reads one or more keys out of a settings file or all if no key is provided. +vpn_ipsec_connection_read_config() { + assert [ $# -ge 1 ] + + local connection="${1}" + shift 1 + + if ! vpn_ipsec_connection_exists "${connection}"; then + log ERROR "No such VPN IPsec connection : ${connection}" + return ${EXIT_ERROR} + fi + + + local args + if [ $# -eq 0 ] && [ -n "${VPN_IPSEC_CONNECTION_CONFIG_SETTINGS}" ]; then + list_append args ${VPN_IPSEC_CONNECTION_CONFIG_SETTINGS} + else + list_append args $@ + fi + + local path="$(vpn_ipsec_connection_path ${connection})" + + if ! settings_read "${path}" ${args}; then + log ERROR "Could not read settings for VPN IPsec connection ${connection}" + return ${EXIT_ERROR} + fi +} + +# Returns the path to a the configuration for given connection +vpn_ipsec_connection_path() { + assert [ $# -eq 1 ] + + local connection=${1} + + echo "${NETWORK_CONFIG_DIR}/vpn/ipsec/connection/${connection}" +} + +# This function checks if a vpn ipsec connection exists +# Returns True when yes and false when not +vpn_ipsec_connection_exists() { + assert [ $# -eq 1 ] + + local connection=${1} + + local path=$(vpn_ipsec_connection_path "${connection}") + + [ -f ${path} ] && return ${EXIT_TRUE} || return ${EXIT_FALSE} +} + +# Handle the cli after authentification +vpn_ipsec_connection_authentication() { + if [ ! $# -gt 1 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + + local connection=${1} + local cmd=${2} + shift 2 + + case ${cmd} in + mode) + vpn_ipsec_connection_authentication_mode ${connection} $@ + ;; + pre-shared-key) + vpn_ipsec_connection_authentication_psk ${connection} $@ + ;; + *) + log ERROR "Unrecognized argument: ${cmd}" + return ${EXIT_ERROR} + ;; + esac +} + +# Set the authentification mode +vpn_ipsec_connection_authentication_mode() { + if [ ! $# -eq 2]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local mode=${2} + + if ! isoneof mode "psk" "PSK"; then + log ERROR "Auth mode '${mode}' is not valid" + return ${EXIT_ERROR} + fi + + if ! vpn_ipsec_connection_write_config_key ${connection} "AUTH_MODE" ${mode,,}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi +} + +# Set the psk +vpn_ipsec_connection_authentication_psk() { + if [ ! $# -eq 2]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local psk=${2} + + # TODO Check if psk is valid + + if ! vpn_ipsec_connection_write_config_key ${connection} "PSK" ${psk}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi + + +} + +# Handle the cli after local +vpn_ipsec_connection_local() { + if [ ! $# -ge 2 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + + local connection=${1} + local cmd=${2} + shift 2 + + case ${cmd} in + prefix) + vpn_ipsec_connection_prefix ${connection} "LOCAL" $@ + ;; + id) + vpn_ipsec_connection_id ${connection} "LOCAL" $@ + ;; + *) + log ERROR "Unrecognized argument: ${cmd}" + return ${EXIT_ERROR} + ;; + esac + + return ${EXIT_OK} + +} + +# Set the connection mode +vpn_ipsec_connection_mode() { + if [ ! $# -eq 2]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local mode=${2} + + if ! isoneof mode "tunnel" "vti" "gre-transport"; then + log ERROR "Mode '${mode}' is not valid" + return ${EXIT_ERROR} + fi + + if ! vpn_ipsec_connection_write_config_key ${connection} "MODE" ${mode}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi + +} + +# Set the peer to connect to +vpn_ipsec_connection_peer() { + if [ ! $# -eq 2]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local peer=${2} + + if ! vpn_ipsec_connection_check_peer ${peer}; then + log ERROR "Peer '${peer}' is not valid" + return ${EXIT_ERROR} + fi + + if ! vpn_ipsec_connection_write_config_key ${connection} "PEER" ${peer}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi +} + +#Set the local or remote id +vpn_ipsec_connection_id() { + if [ ! $# -eq 3]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local type=${2} + local id=${3} + + if ! vpn_ipsec_connection_check_id ${id}; then + log ERROR "Id '${id}' is not valid" + return ${EXIT_ERROR} + fi + + if ! vpn_ipsec_connection_write_config_key ${connection} "${type}_ID" ${id}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi + + return ${EXIT_OK} +} + +# Set the local or remote prefix +vpn_ipsec_connection_prefix() { + if [ ! $# -ge 3 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local type=${2} + shift 2 + + local _prefix="${type}_PREFIX" + local "${_prefix}" + if ! vpn_ipsec_connection_read_config ${connection} "${_prefix}"; then + return ${EXIT_ERROR} + fi + + # Remove duplicated entries to proceed the list safely + assign "${_prefix}" "$(list_unique ${!_prefix} )" + + local prefixes_added + local prefixes_removed + local prefixes_set + + while [ $# -gt 0 ]; do + local arg="${1}" + + case "${arg}" in + +*) + list_append prefixes_added "${arg:1}" + ;; + -*) + list_append prefixes_removed "${arg:1}" + ;; + [A-Z0-9]*) + list_append prefixes_set "${arg}" + ;; + *) + error "Invalid argument: ${arg}" + return ${EXIT_ERROR} + ;; + esac + shift + done + + # Check if the user is trying a mixed operation + if ! list_is_empty prefixes_set && (! list_is_empty prefixes_added || ! list_is_empty prefixes_removed); then + error "You cannot reset the prefix list and add or remove prefixes at the same time" + return ${EXIT_ERROR} + fi + + # Set new prefixe list + if ! list_is_empty prefixes_set; then + # Check if all prefixes are valid + local prefix + for prefix in ${prefixes_set}; do + if ! ip_net_is_valid ${prefix}; then + error "Unsupported prefix: ${prefix}" + return ${EXIT_ERROR} + fi + done + + assign "${_prefix}" "${prefixes_set}" + + # Perform incremental updates + else + local prefix + + # Perform all removals + for prefix in ${prefixes_removed}; do + if ! list_remove "${_prefix}" ${prefix}; then + warning "${prefix} was not on the list and could not be removed" + fi + done + + for prefix in ${prefixes_added}; do + if ip_net_is_valid ${prefix}; then + if ! list_append_unique "${_prefix}" ${prefix}; then + warning "${prefix} is already on the prefix list" + fi + else + warning "${prefix} is not a valiv IP net and could not be added" + fi + done + fi + + # Check if the list contain at least one valid prefixe + if list_is_empty ${_prefix}; then + error "Cannot save an empty prefix list" + return ${EXIT_ERROR} + fi + + # Save everything + if ! vpn_ipsec_connection_write_config_key ${connection} "${_prefix}" ${!_prefix}; then + log ERROR "Could not write configuration settings" + fi +} + +# Handle the cli after remote +vpn_ipsec_connection_remote() { + if [ ! $# -ge 2 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + + local connection=${1} + local cmd=${2} + shift 2 + + case ${cmd} in + prefix) + vpn_ipsec_connection_prefix ${connection} "REMOTE" $@ + ;; + id) + vpn_ipsec_connection_id ${connection} "REMOTE" $@ + ;; + *) + log ERROR "Unrecognized argument: ${cmd}" + return ${EXIT_ERROR} + ;; + esac + + return ${EXIT_OK} +} + +# Set the inactivity timeout +vpn_ipsec_connection_inactivity_timeout() { + if [ ! $# -ge 2 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + + local connection=${1} + shift 1 + local value=$@ + + if ! isinteger value; then + value=$(parse_time $@) + if [ ! $? -eq 0 ]; then + log ERROR "Parsing the passed time was not sucessful please check the passed values." + return ${EXIT_ERROR} + fi + fi + + if [ ${value} -le 0 ]; then + log ERROR "The passed time value must be in the sum greater zero seconds." + return ${EXIT_ERROR} + fi + + if ! vpn_ipsec_connection_write_config_key ${connection} "INACTIVITY_TIMEOUT" ${value}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi + +} + +# Set the security policy to use +vpn_ipsec_connection_security_policy() { + if [ ! $# -eq 2 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local security_policy=${2} + + if ! vpn_security_policy_exists ${security_policy}; then + log ERROR "No such vpn security policy '${security_policy}'" + return ${EXIT_ERROR} + fi + + if ! vpn_ipsec_connection_write_config_key ${connection} "SECURITY_POLICY" ${security_policy}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi +} + +# Check if a id is valid +vpn_ipsec_connection_check_id() { + assert [ $# -eq 1 ] + local id=${1} + + if [[ ${id} =~ ^@[[:alnum:]]+$ ]] || ip_is_valid ${id}; then + return ${EXIT_TRUE} + else + return ${EXIT_FALSE} + fi +} + +# Checks if a peer is valid +vpn_ipsec_connection_check_peer() { + assert [ $# -eq 1 ] + local peer=${1} + + # TODO Accept also FQDNs + if ip_is_valid ${peer}; then + return ${EXIT_TRUE} + else + return ${EXIT_FALSE} + fi +} + +# This function checks if a VPN IPsec connection name is valid +# Allowed are only A-Za-z0-9 +vpn_ipsec_connection_check_name() { + assert [ $# -eq 1 ] + + local connection=${1} + + [[ ${connection} =~ [^[:alnum:]$] ]] +} + +# Function that creates one VPN IPsec connection +vpn_ipsec_connection_new() { + if [ $# -gt 1 ]; then + error "Too many arguments" + return ${EXIT_ERROR} + fi + + local connection="${1}" + if ! isset connection; then + error "Please provide a connection name" + return ${EXIT_ERROR} + fi + + # Check for duplicates + if vpn_ipsec_connection_exists "${connection}"; then + error "The VPN IPsec connection ${connection} already exists" + return ${EXIT_ERROR} + fi + + # Check if the name of the connection is valid + if vpn_ipsec_connection_check_name "${connection}"; then + error "'${connection}' contains illegal characters" + return ${EXIT_ERROR} + fi + + log DEBUG "Creating VPN IPsec connection ${connection}" + + touch $(vpn_ipsec_connection_path ${connection}) + vpn_ipsec_connection_write_config "${connection}" +} + +# Function that deletes based on the passed parameters one ore more vpn security policies +vpn_ipsec_connection_destroy() { + local connection + for connection in $@; do + if ! vpn_ipsec_connection_exists ${connection}; then + log ERROR "The VPN IPsec connection ${connection} does not exist." + continue + fi + + log DEBUG "Deleting VPN IPsec connection ${connection}" + settings_remove $(vpn_ipsec_connection_path ${connection}) + done +} -- 2.6.3

2 4

[PATCH v2] config hook: prevent two hooks with the same settings
by Jonatan Schlag 27 Jul '17

27 Jul '17

A ipv4-static config with the same IPv4 address twice is senseless. A new function zone_config_check_same_setting is introduced. The function provides an easy way to check if a config of the given hook has the same value for a given key. We can now check inside hook_new if an ipv4-static or ipv6-static config with the same value exist and break with an error. Fixes: #11418 Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.zone | 33 +++++++++++++++++++++++++++++++++ src/hooks/configs/ipv4-static | 5 +++++ src/hooks/configs/ipv6-static | 5 +++++ 3 files changed, 43 insertions(+) diff --git a/src/functions/functions.zone b/src/functions/functions.zone index a3ca029..1eb492f 100644 --- a/src/functions/functions.zone +++ b/src/functions/functions.zone @@ -1150,6 +1150,39 @@ zone_config_get_new_id() { done } +zone_config_check_same_setting() { + # This functions checks if a config hook + # with the same setting is already configured for this zone. + # Returns True when yes and False when no. + + assert [ $# -eq 4 ] + + local zone=${1} + local hook=${2} + local key=${3} + local value=${4} + + # The key should be local for this function + local ${key} + local config + + for config in $(zone_configs_list ${zone}); do + # Check if the config is from the given hook, when not continue + if [[ $(zone_config_get_hook "${zone}" "${config}") != ${hook} ]]; then + continue + fi + # Get the value of the key for a given function + zone_config_settings_read "${zone}" "${config}" \ + --ignore-superfluous-settings "${key}" + # Check if the value of the config and the passed value are eqal + if [[ "${value}" == "${!key}" ]]; then + return ${EXIT_TRUE} + fi + done + + return ${EXIT_FALSE} +} + zone_config_get_hook() { assert [ $# -eq 2 ] diff --git a/src/hooks/configs/ipv4-static b/src/hooks/configs/ipv4-static index 36629e0..ef74991 100644 --- a/src/hooks/configs/ipv4-static +++ b/src/hooks/configs/ipv4-static @@ -99,6 +99,11 @@ hook_parse_cmdline() { exit ${EXIT_CONF_ERROR} fi + if zone_config_check_same_setting "${zone}" "ipv4-static" "ADDRESS" "${ADDRESS}"; then + error "An ipv4-static config with the same IPv4 address is already configured" + exit ${EXIT_CONF_ERROR} + fi + if ! isset GATEWAY && zone_is_nonlocal "${zone}"; then warning "You did not configure a gateway for a non-local zone" fi diff --git a/src/hooks/configs/ipv6-static b/src/hooks/configs/ipv6-static index 4c1d7df..c41401c 100644 --- a/src/hooks/configs/ipv6-static +++ b/src/hooks/configs/ipv6-static @@ -49,6 +49,11 @@ hook_parse_cmdline() { shift done + if zone_config_check_same_setting "${zone}" "ipv6-static" "ADDRESS" "${ADDRESS}"; then + error "An ipv6-static config with the same IPv6 address is already configured" + exit ${EXIT_CONF_ERROR} + fi + # Store IPv6 address in small format. ADDRESS=$(ipv6_format "${ADDRESS}") -- 2.6.3

1 0

[PATCH v2 1/8] zone: add config hid functions
by Jonatan Schlag 26 Jul '17

26 Jul '17

These are the basic functions to work with hids. Fixes: #11406 Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.zone | 80 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 80 insertions(+) diff --git a/src/functions/functions.zone b/src/functions/functions.zone index bba1705..0696750 100644 --- a/src/functions/functions.zone +++ b/src/functions/functions.zone @@ -656,6 +656,69 @@ zone_config_list_ids() { echo ${ids} } +# List all hids of a zone +zone_config_list_hids() { + assert [ $# -eq 1 ] + local zone=${1} + + local config + local hids + + for config in $(zone_configs_list ${zone}); do + # Append hids to the list + zone_config_get_hid "${zone}" "${config}" + done +} + +# get the hid from a given config +zone_config_get_hid() { + assert [ $# -eq 2 ] + local zone=${1} + local config=${2} + + local hook + + hook="$(zone_config_get_hook "${zone}" "${config}")" + hook_exec "config" "${hook}" "hid" "${zone}" "${config}" +} + +# Checks if a hid is valid for a given zone +zone_config_hid_is_valid() { + assert [ $# -eq 2] + local zone=${1} + local hid=${2} + + local _hid + for _hid in $(zone_config_list_hids "${zone}"); do + if [[ ${_hid} = ${hid} ]]; then + return ${EXIT_TRUE} + fi + done + + return ${EXIT_FALSE} +} + +# This function converts a hid to a id +zone_config_convert_hid_to_id() { + assert [ $# -eq 2 ] + local zone=${1} + local hid=${2} + + local hook + local config + + for config in $(zone_configs_list ${zone}); do + # Get hook from config + hook="$(zone_config_get_hook "${zone}" "${config}")" + if [[ "$(hook_exec "config" "${hook}" "hid" "${zone}" "${config}")" == "${hid}" ]]; then + config_get_id_from_config "${config}" + return ${EXIT_TRUE} + fi + done + + return ${EXIT_FALSE} +} + zone_show() { local zone=${1} @@ -1114,6 +1177,23 @@ zone_config_id_is_valid() { [ -f ${zone_path}/configs/*.${id} ]; } +# This function checks if a given hid is valid for a zone +# Return True when yes and false when no +zone_config_hid_is_valid() { + assert [ $# -eq 2 ] + local zone=${1} + local hid=${2} + + local _hid + for _hid in $(zone_config_list_hids ${zone}); do + if [[ ${_hid} == ${hid} ]]; then + return ${EXIT_TRUE} + fi + done + + return ${EXIT_FALSE} +} + zone_config_get_hook_from_id() { # Returns the hook for a given id assert [ $# -eq 2 ] -- 2.6.3

1 7

[PATCH] zone: response with an error if a zone is already up or down
by Jonatan Schlag 25 Jul '17

25 Jul '17

Fixes: #11368 Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.zone | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/src/functions/functions.zone b/src/functions/functions.zone index 91ce629..eccca3a 100644 --- a/src/functions/functions.zone +++ b/src/functions/functions.zone @@ -369,6 +369,12 @@ zone_up() { return ${EXIT_ERROR} fi + # Check if the zone is already up + if zone_is_active ${zone}; then + log ERROR "Zone ${zone} is already up" + return ${EXIT_ERROR} + fi + # Check if a zone has got the remove tag. if zone_has_destroy_tag ${zone}; then error "Cannot bring up any zone which is to be removed." @@ -405,6 +411,13 @@ zone_down() { return ${EXIT_ERROR} fi + # Check if the zone is already down + if ! zone_is_active ${zone}; then + log ERROR "Zone ${zone} is already down" + return ${EXIT_ERROR} + fi + + local hook="$(zone_get_hook "${zone}")" if [ -z "${hook}" ]; then error "Config file did not provide any hook." -- 2.6.3

2 1

Add hids
by Jonatan Schlag 25 Jul '17

25 Jul '17

The following patches add support for hids in configs. Hids are human readable ids. Please notice that the patches are based on the patchset from the July 24, 2017, 7:10 p.m. beginning with the patch 'zone: add new function zone_config_list_ids' and the following three patches. These four patches needs to be merged first.

2 13

← Newer
1
2
3
4
5
6
7
8
9
10
11
Older →

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

network