network

network@lists.ipfire.org

108 discussions

[PATCH 1/3] zone: fix zone_config()
by Jonatan Schlag 15 Jul '17

15 Jul '17

Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.zone | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/functions/functions.zone b/src/functions/functions.zone index acf68f5..11a8dc2 100644 --- a/src/functions/functions.zone +++ b/src/functions/functions.zone @@ -565,9 +565,9 @@ zone_config() { # TODO This could be also a valid hid local id=${cmd} - if zone_config_id_is valid ${zone} ${id} && [[ ${1} == "edit" ]]; then + if zone_config_id_is_valid ${zone} ${id} && [[ ${1} == "edit" ]]; then shift 1 - zone_config_edit "${zone}" "${id}""$@" + zone_config_edit "${zone}" "${id}" "$@" else error "Unrecognized argument: ${cmd}" cli_usage root-zone-config-subcommands -- 2.6.3

2 5

new feature vpn-security-policies
by Jonatan Schlag 14 Jul '17

14 Jul '17

The following two patches add the base for the new vpn security policies feature. They are defenitely not perfetc and because of that i want to ask for commands. This would help me to bring this patches into a mergeable format.

2 6

Re: [RFC 1/2] vpn-security-policies: add new feature vpn security-policies
by Michael Tremer 14 Jul '17

14 Jul '17

Hi, On Fri, 2017-07-14 at 14:04 +0200, Jonatan Schlag wrote: > > > Am Fr, 14. Jul, 2017 um 1:24 schrieb Michael Tremer <michael.tremer@i > pfire.org>: > > Hi, > > > > On Thu, 2017-07-13 at 20:33 +0200, Jonatan Schlag wrote: > > For further explanation see: > > http://wiki.ipfire.org/devel/network/security-policies > > > > Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> > > --- > > src/functions/functions.vpn-security-policies | 437 > > ++++++++++++++++++++++++++ > > 1 file changed, 437 insertions(+) > > create mode 100644 src/functions/functions.vpn-security-policies > > > > diff --git a/src/functions/functions.vpn-security-policies > > b/src/functions/functions.vpn-security-policies > > new file mode 100644 > > index 0000000..9e24e4f > > --- /dev/null > > +++ b/src/functions/functions.vpn-security-policies > > @@ -0,0 +1,437 @@ > > +#!/bin/bash > > +################################################################# > > ### > > ########### > > +# > > > > # > > +# IPFire.org - A linux based > > firewall # > > +# Copyright (C) 2013 IPFire Network Development > > Team # > > +# > > > > # > > > > It's 2017 :) > > > > +# This program is free software: you can redistribute it and/or > > modify # > > +# it under the terms of the GNU General Public License as > > published > > by # > > +# the Free Software Foundation, either version 3 of the License, > > or # > > +# (at your option) any later > > version. # > > +# > > > > # > > +# This program is distributed in the hope that it will be > > useful, # > > +# but WITHOUT ANY WARRANTY; without even the implied warranty > > of # > > +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See > > the # > > +# GNU General Public License for more > > details. # > > +# > > > > # > > +# You should have received a copy of the GNU General Public > > License # > > +# along with this program. If not, see <http://www.gnu.org/licen > > ses > > />. # > > +# > > > > # > > +################################################################# > > ### > > ########### > > + > > +VPN_SECURITY_POLICIES_CONFIG_SETTINGS="CIPHER COMPRESSION > > GROUP_TYPE > > INTEGRITY KEY_EXCHANGE LIFETIME PFS" > > +VPN_SECURITY_POLICIES_READONLY="system" > > + > > +VPN_SUPPORTED_CIPHERS="AES192 AES256 AES128" > > +VPN_SUPPORTED_INTEGRITY="SHA512 SHA256 SHA128" > > +VPN_SUPPORTED_GROUP_TYPES="MODP4096 MODP8192" > > > > Obviously these need to be extended. But this will suit as a proof- > > of- > > concept. Just please order stuff alphabetically. In this case it is > > best to do it descending. > > > > +vpn_security_policies_check_readonly() { > > + # This functions checks if a policy is readonly > > + # returns true when yes and false when no > > + > > + if isoneof name ${VPN_SECURITY_POLICIES_READONLY}; then > > + return ${EXIT_TRUE} > > + else > > + return ${EXIT_FALSE} > > + fi > > +} > > > > Ok. > > > > +vpn_security_policies_write_config() { > > + # This function writes all values to a via ${name} > > specificated vpn security policy configuration file > > + assert [ $# -ge 1 ] > > + > > + local name="${1}" > > + > > + if ! vpn_security_policy_exists ${name}; then > > + log ERROR "No such policy: ${name}" > > + return ${EXIT_ERROR} > > + fi > > > > I think you need to improve some of the error messages. A sentence > > is > > usually good. The shorter the sweeter. Not sure if "no such policy" > > is > > helpful when they are actually called security policies. So, don't > > go > > too short. > > > > + > > + if vpn_security_policies_check_readonly ${name}; then > > + log ERROR "${name} is a readable only vpn > > security > > policy" > > + return ${EXIT_ERROR} > > + fi > > > > Here I would suggest: "The system security policy cannot be > > changed" > > > > + > > + local args > > + list_append args ${VPN_SECURITY_POLICIES_CONFIG_SETTINGS} > > > > No need to call list_append here. Settings args to > > VPN_SECURITY_POLICIES_CONFIG_SETTINGS is enough. You just just pass > > it > > to settings_write without using $args. > > > > + > > + local path="$(vpn_security_policies_path ${name})" > > + if [ ! -w ${path} ]; then > > + log ERROR "${path} is not writeable" > > + return ${EXIT_ERROR} > > + fi > > + > > + settings_write "${path}" ${args} > > + # TODO everytime we successfully write a config we should > > call some trigger to take the changes into effect > > +} > > > > Space between the settings_write and comments, please. > > > > What happens when the settings could not be written? > > > > +vpn_security_policies_write_config_key() { > > + # This funtion writes the value for one key to a via > > ${name} > > specificated vpn security policy configuration file > > + assert [ $# -ge 3 ] > > + local name=${1} > > + > > + if ! vpn_security_policy_exists ${name}; then > > + log ERROR "No such policy: ${name}" > > + return ${EXIT_ERROR} > > + fi > > + > > + local key=${2} > > + shift 2 > > + local value="$@" > > + log DEBUG "Set '${key}' to new value '${value}'" > > > > Please group the argument parsing together at the top and then test > > if > > the policy exists. This is hard to read. > > > > Also the logging message is a bit random since it doesn't mention > > the > > security policy here. > > > > + # Read the config settings > > + if ! vpn_security_policies_read_config ${name}; then > > + return ${EXIT_ERROR} > > + fi > > > > This will overwrite any global variables. So you will need to > > call > > > > local VPN_SECURITY_POLICIES_CONFIG_SETTINGS > > > > before you read the settings from file. > > > > + # Set the key to a new value > > + eval "${key}=\"${value}\"" > > > > Never ever use eval. This will allow someone to pass shell commands > > that may get executed. At no time ever we would want that. > > I was aware of the problems eval can result, but we use it at some > other functions, so I thought i would be ok. > Anyway already changed. > > > There is a function called assign() that takes care of assigning a > > variable. > > > > + if ! vpn_security_policies_write_config ${name}; then > > + return ${EXIT_ERROR} > > + fi > > + > > + return ${EXIT_TRUE} > > + > > +} > > + > > +vpn_security_policies_read_config() { > > + # Reads one or more keys out of a settings file or all if > > no > > key is provided. > > + assert [ $# -ge 1 ] > > + > > + local name="${1}" > > + shift 1 > > + > > + if ! vpn_security_policy_exists ${name}; then > > + log ERROR "No such policy: ${name}" > > + return ${EXIT_ERROR} > > + fi > > + > > + > > + local args > > + if [ $# -eq 0 ] && [ -n > > "${VPN_SECURITY_POLICIES_CONFIG_SETTINGS}" ]; then > > + list_append args > > ${VPN_SECURITY_POLICIES_CONFIG_SETTINGS} > > + else > > + list_append args $@ > > + fi > > + > > + local path="$(vpn_security_policies_path ${name})" > > + if [ ! -r ${path} ]; then > > + log ERROR "${path} is not readable" > > + return ${EXIT_ERROR} > > + fi > > > > Why do you need to do this every time? Doesn't settings_read do > > this? > > > > + > > + settings_read "${path}" ${args} > > +} > > + > > +vpn_security_policies_path() { > > + # Returns the path to a the configuration fora given name > > + assert [ $# -eq 1 ] > > + local name=${1} > > + > > + if vpn_security_policies_check_readonly ${name}; then > > + echo "/usr/share/network/vpn/security- > > policies/${name}" > > + else > > + echo "/etc/network/vpn/security-policies/${name}" > > + fi > > +} > > > > Hard-coded paths :( > > > > + > > +vpn_security_policies_show() { > > + # Print the content of a vpn security policy > > configuration > > file in a nice way > > + assert [ $# -eq 1 ] > > + local name=${1} > > > > Here you will need to do the local variable initialization before > > you > > red this in - as above. > > > > + # Break if read fails > > + if ! vpn_security_policies_read_config ${name}; then > > + return ${EXIT_ERROR} > > + fi > > + > > + cli_print_fmt1 0 "Security Policy: ${name}" > > + cli_space > > + > > + # This could be done in a loop but a loop is much more > > complicated > > + # because we print 'Group Types' but the variable is > > named > > 'GROUP_TYPES' > > + cli_print_fmt1 1 "Ciphers:" > > + cli_print_fmt1 2 "${CIPHER}" > > + cli_space > > > > This does not show any broken ciphers as broken. But we could add > > this > > later as well. This patch is quite huge already. > > > > + cli_print_fmt1 1 "Integrity:" > > + cli_print_fmt1 2 "${INTEGRITY}" > > + cli_space > > + cli_print_fmt1 1 "Group Types:" > > + cli_print_fmt1 2 "${GROUP_TYPE}" > > + cli_space > > + > > + cli_print_fmt1 1 "Key exchange:" "${KEY_EXCHANGE}" > > > > Capital E in Exchange > > > > + cli_print_fmt1 1 "Key Lifetime in seconds:" "${LIFETIME}" > > > > The lifetime should be formatted nicely because seconds are hard to > > understand. There is a function that formats these nicely. > > > > + if enabled PFS; then > > + cli_print_fmt1 1 "Perfect Forward Secrecy:" > > "enabled" > > + else > > + cli_print_fmt1 1 "Perfect Forward Secrecy:" > > "disabled" > > + fi > > + cli_space > > + if enabled COMPRESSION; then > > + cli_print_fmt1 1 "Compression:" "enabled" > > + else > > + cli_print_fmt1 1 "Compression:" "disabled" > > + fi > > + cli_space > > +} > > + > > +vpn_security_policy_exists() { > > + # This function checks if a vpn security policy exists > > + # Returns True when yes and false when not > > + assert [ $# -eq 1 ] > > + local name=${1} > > + > > + local path=$(vpn_security_policies_path ${name}) > > + [ -f ${path} ] > > +} > > + > > + > > +vpn_security_policies_cipher(){ > > + # This function parses the parameters for the 'cipher' > > command > > + local name=${1} > > + shift > > + > > + if [ $# -eq 0 ]; then > > + log ERROR "You must pass at least one value after > > cipher" > > + return ${EXIT_ERROR} > > + fi > > + > > > > local CIPHER > > > > + if ! vpn_security_policies_read_config ${name} "CIPHER"; > > then > > + return ${EXIT_ERROR} > > + fi > > + > > + # Remove duplicated entries to proceed the list safely > > + CIPHER="$(list_unique ${CIPHER})" > > + > > + while [ $# -gt 0 ]; do > > + case "${1}" in > > + -*) > > + value=${1#-} > > + # Check if the cipher is in the > > list > > of ciphers and > > + # check if the list has after > > removing this cipher at least one valid value > > + if list_match ${value} ${CIPHER} > > && > > [ $(list_length ${CIPHER}) -gt 1 ]; then > > + list_remove CIPHER > > ${value} > > + else > > + log ERROR "Can not remove > > ${value} from the list of Ciphers because ${value} is not in the > > list > > or the list would be empty after removing this cipher" > > + fi > > > > There is no return here which ends the function on this error. > > > > I think you should check this after the loop to support things > > like: > > > > -3DES +AES256 > > > > This would crash if 3DES is the last cipher but the user does not > > intend to remove all ciphers. > > > > + ;; > > + +*) > > + value=${1#+} > > + # Check if the Ciphers is in the > > list of supported ciphers. > > + if ! isoneof value > > ${VPN_SUPPORTED_CIPHERS}; then > > + log ERROR "${value} is > > not a > > supported cipher and can thats why not added to the list of > > ciphers" > > + else > > + if list_match ${value} > > ${CIPHER}; then > > + log WARNING > > "${value} is already in the list of ciphers of this policy" > > + else > > + list_append > > CIPHER > > ${value} > > + fi > > + fi > > + ;; > > + esac > > + shift > > + done > > + > > + vpn_security_policies_write_config_key ${name} "CIPHER" > > ${CIPHER} > > > > Are there no errors to catch here? > > > > +} > > + > > +vpn_security_policies_compression(){ > > + # This function parses the parameters for the > > 'compression' > > command > > + local name=${1} > > + local value=${2} > > + # Check if we get only one argument after compression > > <name> > > + if [ ! $# -eq 2 ] || ! isbool value; then > > + log ERROR "You can pass only one parameter after > > compression and this one must be 'on' or 'off'" > > + return ${EXIT_ERROR} > > + fi > > > > Probably not the nicest handling in case of no argument or so. This > > also suggests two values but actually more would be accepted as > > well. > > I added a comment but just for clarification, sure more values are > allowed. But I see no sense in print 1 0 on off true false yes no, > because it does not make things more clear it makes them even worse. > From my point of view on and off are the most understandable phrases, > so I print just this two but other will works too. > > And something like "All boolean values are accepted" is too implicit. No, that is not better to show all possible values. But what could help is saying what is not possible. For example: "Invalid argument" > > + > > + vpn_security_policies_write_config_key "${name}" > > "COMPRESSION" "${value}" > > +} > > + > > +vpn_security_policies_group_type(){ > > + # This function parses the parameters for the 'group- > > type' > > command. > > + local name=${1} > > + shift > > + > > + if [ $# -eq 0 ]; then > > + log ERROR "You must pass at least one value after > > group-type" > > + return ${EXIT_ERROR} > > + fi > > + > > + if ! vpn_security_policies_read_config ${name} > > "GROUP_TYPE"; > > then > > + return ${EXIT_ERROR} > > + fi > > + > > + # Remove duplicated entries to proceed the list safely > > + GROUP_TYPE="$(list_unique ${GROUP_TYPE})" > > + > > + while [ $# -gt 0 ]; do > > + case "${1}" in > > + -*) > > + value=${1#-} > > + # Check if the group type is in > > the > > list of group types and > > + # check if the list has after > > removing this group type at leatst one valid value > > + if list_match ${value} > > ${GROUP_TYPE} > > && [ $(list_length ${GROUP_TYPE}) -gt 1 ]; then > > + list_remove GROUP_TYPE > > ${value} > > + else > > + log ERROR "Can not remove > > ${value} from the list of group types because ${value} is not in > > the > > list or the list would be empty after removing this group type" > > + fi > > + ;; > > + +*) > > + value=${1#+} > > + # Check if the group type is in > > the > > list of supported group types. > > + if ! isoneof value > > ${VPN_SUPPORTED_GROUP_TYPES}; then > > + log ERROR "${value} is > > not a > > supported group type and can thats why not added to the list of > > group > > types" > > + else > > + if list_match ${value} > > ${GROUP_TYPE}; then > > + log WARNING > > "${value} is already in the list of group-types of this policy" > > + else > > + list_append > > GROUP_TYPES ${value} > > + fi > > + fi > > + ;; > > + esac > > + shift > > + done > > + > > + vpn_security_policies_write_config_key ${name} > > "GROUP_TYPE" > > ${GROUP_TYPE} > > +} > > > > Same as above. > > > > + > > +vpn_security_policies_integrity(){ > > + # This function parses the parameters for the 'integrity' > > command > > + local name=${1} > > + shift > > + > > + if [ $# -eq 0 ]; then > > + log ERROR "You must pass at least one value after > > integrity" > > + return ${EXIT_ERROR} > > + fi > > + > > + if ! vpn_security_policies_read_config ${name} > > "INTEGRITY"; > > then > > + return ${EXIT_ERROR} > > + fi > > + > > + # Remove duplicated entries to proceed the list safely > > + INTEGRITY="$(list_unique ${INTEGRITY})" > > + > > + while [ $# -gt 0 ]; do > > + case "${1}" in > > + -*) > > + value=${1#-} > > + # Check if the integrity hash is > > in > > the list of integrity hashes and > > + # check if the list has after > > removing this integrity hash at least one valid value > > + if list_match ${value} > > ${INTEGRITY} > > && [ $(list_length ${INTEGRITY}) -gt 1 ]; then > > + list_remove INTEGRITY > > ${value} > > + else > > + log ERROR "Can not remove > > ${value} from the list of integrity hashes because ${value} is not > > in > > the list or the list would be empty after removing this integrity > > hash" > > + fi > > + ;; > > + +*) > > + value=${1#+} > > + # Check if the Ciphers is in the > > list of supported integrity hashes. > > + if ! isoneof value > > ${VPN_SUPPORTED_INTEGRITY}; then > > + log ERROR "${value} is > > not a > > supported integrity hashes and can thats why not added to the list > > of > > integrity hashes" > > + else > > + if list_match ${value} > > ${INTEGRITY}; then > > + log WARNING > > "${value} is already in the list of integrety hashes of this > > policy" > > + else > > + list_append > > INTEGRITY ${value} > > + fi > > + fi > > + ;; > > + esac > > + shift > > + done > > + > > + vpn_security_policies_write_config_key ${name} > > "INTEGRITY" > > ${INTEGRITY} > > +} > > > > Likewise. > > > > + > > +vpn_security_policies_key_exchange() { > > + # This function parses the parameters for the 'key- > > exchange' > > command > > + local name=${1} > > + local value=${2} > > + # Check if we get only one argument after compression > > <name> > > + if [ ! $# -eq 2 ] || ! isoneof value "ikev1" "ikev2"; > > then > > + log ERROR "You can pass only one parameter after > > key-exchange and this one must be 'ikev1' or 'ikev2'" > > + return ${EXIT_ERROR} > > + fi > > > > Should we accept values like "IKEv2", too? > > > > + > > + vpn_security_policies_write_config_key "${name}" > > "KEY_EXCHANGE" "${value}" > > +} > > + > > +vpn_security_policies_lifetime(){ > > + # This function parses the parameters for the 'lifetime' > > command > > + local name=${1} > > + local value=${2} > > + # Check if we get only one argument after compression > > <name> > > + if [ ! $# -eq 2 ] || ! isinteger value || [ ${value} -le > > 0 > > ]; then > > + log ERROR "You can pass only one parameter after > > liftime and this one must be an valid integer greater zero" > > + return ${EXIT_ERROR} > > + fi > > + > > + vpn_security_policies_write_config_key "${name}" > > "LIFETIME" > > "${value}" > > +} > > > > This one should accept values like "1h". There is a function for > > it. > > > > + > > +vpn_security_policies_pfs(){ > > + # This function parses the parameters for the 'pfs' > > command > > + local name=${1} > > + local value=${2} > > + # Check if we get only one argument after compression > > <name> > > + if [ ! $# -eq 2 ] || ! isbool value; then > > + log ERROR "You can pass only one parameter after > > pfs > > and this one must be 'on' or 'off'" > > + return ${EXIT_ERROR} > > + fi > > + > > + vpn_security_policies_write_config_key "${name}" "PFS" > > "${value}" > > +} > > > > See above. > > > > + > > +vpn_security_policies_check_name() { > > + # This function checks if a vpn security policy name is > > valid > > + # Allowed are only A-Za-z0-9 > > + assert [ $# -eq 1 ] > > + local name=${1} > > + [[ ${name} =~ [[:alnum:]] ]] > > > > This only checks if there is at least one alphanumerical character > > in > > the string. But it does not exclusively check for them I think. > > > > +} > > + > > +vpn_security_policies_new() { > > + # Function that creates based on the paramters one ore > > more > > new vpn security policies > > + local name > > + for name in $@; do > > + if vpn_security_policy_exists ${name}; then > > + log ERROR "The vpn security policy > > ${name} > > does already exist" > > + continue > > + fi > > + > > + if vpn_security_policies_check_name ${name}; then > > + log ERROR "'${name}' contains illegal > > characters. Allowed are only A-Za-z0-9 are allowed" > > + continue > > + fi > > + > > + log DEBUG "Creating vpn security policy ${name}" > > + cp "$(vpn_security_policies_path "system")" > > "$(vpn_security_policies_path ${name})" > > > > Don't use cp. > > Why not not and what would be a better solution? Just read the stuff and then write it again using the shell. That avoids forking the cp process. The other reason is that cp is not very predictable sometimes. If a directory exists for the target, it would then place the file into that directory. That is not what we want. You could maybe write a function called copy() in the util functions file that looks like this: copy() { local src=${1} local dst=${2} local data=$(fread ${src}) fwrite ${dst} "${data}" } Obviously this is not smart for gigabytes of data, but this is good enough to copy a configuration file of a few kilobytes. Best, -Michael > > Best, > Jonatan > > > > > + done > > + > > +} > > > > What happens when I create a new policy called "system"? > > > > + > > +vpn_security_policies_destroy() { > > + # Function that deletes based on the passed parameters > > one > > ore more vpn security policies > > + local name > > + for name in $@; do > > + if ! vpn_security_policy_exists ${name}; then > > + log ERROR "The vpn security policy > > ${name} > > does not exist" > > + continue > > + fi > > + > > + if vpn_security_policies_check_readonly ${name}; > > then > > + log ERROR "The vpn security policy > > ${name} > > is readonly and can thats why not deleted" > > + continue > > + fi > > + > > + log DEBUG "Deleting vpn security policy ${name}" > > + rm -f $(vpn_security_policies_path ${name}) > > + done > > +} > > > > This is overall good work. See the comments above and go through > > them > > one by one and please send an updated version of the patch when > > ever > > you are ready. > > > > Best, > > -Michael > > > > > >

1 0

[PATCH] dhcp: remove useless delay setting
by Jonatan Schlag 14 Jul '17

14 Jul '17

Fixes: #11420 Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/hooks/configs/dhcp | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/src/hooks/configs/dhcp b/src/hooks/configs/dhcp index 5ac01b6..8bb6aa9 100644 --- a/src/hooks/configs/dhcp +++ b/src/hooks/configs/dhcp @@ -21,16 +21,13 @@ . /usr/lib/network/header-config -HOOK_CONFIG_SETTINGS="HOOK DELAY ENABLE_IPV6 ENABLE_IPV4" +HOOK_CONFIG_SETTINGS="HOOK ENABLE_IPV6 ENABLE_IPV4" # Default settings. -DELAY=0 ENABLE_IPV6="on" ENABLE_IPV4="on" hook_check_config_settings() { - assert isset DELAY - assert isinteger DELAY assert isset ENABLE_IPV6 assert isbool ENABLE_IPV6 assert isset ENABLE_IPV4 @@ -40,9 +37,6 @@ hook_check_config_settings() { hook_parse_cmdline() { while [ $# -gt 0 ]; do case "${1}" in - --delay=*) - DELAY="$(cli_get_val "${1}")" - ;; --enable-ipv6) ENABLE_IPV6="on" ;; -- 2.6.3

2 1

[PATCH] config hook: prevent two hooks with the same settings
by Jonatan Schlag 14 Jul '17

14 Jul '17

A ipv4-static config with the same IPv4 address twice is senseless. A new function zone_config_check_same_setting is introduced. The function provides an easy way to check if a config of the given hook has the same value for a given key. We can now check inside hook_new if an ipv4-static or ipv6-static config with the same value exist and break with an error. Fixes: #11418 Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.zone | 33 +++++++++++++++++++++++++++++++++ src/hooks/configs/ipv4-static | 5 +++++ src/hooks/configs/ipv6-static | 5 +++++ 3 files changed, 43 insertions(+) diff --git a/src/functions/functions.zone b/src/functions/functions.zone index d121225..768bb9f 100644 --- a/src/functions/functions.zone +++ b/src/functions/functions.zone @@ -1024,6 +1024,39 @@ zone_config_get_new_id() { done } +zone_config_check_same_setting() { + # This functions checks if a config hook + # with the same setting is already configured for this zone. + # Returns True when yes and False when no. + + assert [ $# -eq 4 ] + + local zone=${1} + local hook=${2} + local key=${3} + local value=${4} + + # The key should be local for this function + local ${key} + local config + + for config in $(zone_configs_list ${zone}); do + # Check if the config is from the given hook, when not continue + if [[ $(zone_config_get_hook "${zone}" "${config}") != ${hook} ]]; then + continue + fi + # Get the value of the key for a given function + zone_config_settings_read "${zone}" "${config}" \ + --ignore-superfluous-settings "${key}" + # Check if the value of the config and the passed value are eqal + if [[ "${value}" == "${!key}" ]]; then + return ${EXIT_TRUE} + fi + done + + return ${EXIT_FALSE} +} + zone_config_get_hook() { assert [ $# -eq 2 ] diff --git a/src/hooks/configs/ipv4-static b/src/hooks/configs/ipv4-static index c395200..9454282 100644 --- a/src/hooks/configs/ipv4-static +++ b/src/hooks/configs/ipv4-static @@ -102,6 +102,11 @@ hook_new() { exit ${EXIT_CONF_ERROR} fi + if zone_config_check_same_setting "${zone}" "ipv4-static" "ADDRESS" "${ADDRESS}"; then + error "An ipv4-static config with the same IPv4 address is already configured" + exit ${EXIT_CONF_ERROR} + fi + if ! isset GATEWAY && zone_is_nonlocal "${zone}"; then warning "You did not configure a gateway for a non-local zone" fi diff --git a/src/hooks/configs/ipv6-static b/src/hooks/configs/ipv6-static index f43ef7e..b0f6537 100644 --- a/src/hooks/configs/ipv6-static +++ b/src/hooks/configs/ipv6-static @@ -59,6 +59,11 @@ hook_new() { GATEWAY=$(ipv6_format "${GATEWAY}") fi + if zone_config_check_same_setting "${zone}" "ipv6-static" "ADDRESS" "${ADDRESS}"; then + error "An ipv6-static config with the same IPv6 address is already configured" + exit ${EXIT_CONF_ERROR} + fi + zone_config_settings_write "${zone}" "${HOOK}" exit ${EXIT_OK} -- 2.6.3

2 2

[PATCH v2 1/2] zone: new function zone_config_settings_destroy
by Jonatan Schlag 14 Jul '17

14 Jul '17

Similar to zone_config_settings_write and zone_config_settings_read this function provides an easy way to delete a config file. Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.zone | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/src/functions/functions.zone b/src/functions/functions.zone index acf68f5..44237cd 100644 --- a/src/functions/functions.zone +++ b/src/functions/functions.zone @@ -1272,6 +1272,24 @@ zone_config_settings_write() { settings_write "${path}" ${args} } +zone_config_settings_destroy() { + # This function deletes the config file for a given zone and config + assert [ $# -ge 2 ] + local zone="${1}" + local config="${2}" + + local path="$(zone_dir "${zone}")/configs/${config}" + + # Check if path is valid + if [ ! -f ${path} ]; then + log ERROR "Path: '${path}' is not valid" + return ${EXIT_ERROR} + fi + + log DEBUG "Deleting config file ${path}" + rm -f "${path}" + +} zone_port_settings_read() { assert [ $# -ge 2 ] -- 2.6.3

1 1

[PATCH 1/2] zone: new function zone_config_settings_destroy
by Jonatan Schlag 12 Jul '17

12 Jul '17

Similar to zone_config_settings_write and zone_config_settings_read this function provides an easy way to delete a config file. Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.zone | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/src/functions/functions.zone b/src/functions/functions.zone index d121225..0dd4fde 100644 --- a/src/functions/functions.zone +++ b/src/functions/functions.zone @@ -1248,6 +1248,24 @@ zone_config_settings_write() { settings_write "${path}" ${args} } +zone_config_settings_destroy() { + # This function deletes the config file for a given zone and config + assert [ $# -ge 2 ] + local zone="${1}" + local config="${2}" + + local path="$(zone_dir "${zone}")/configs/${config}" + + # Check if path is valid + if [ ! -f ${path} ]; then + log ERROR "Path: '${path}' is not valid" + return ${EXIT_ERROR} + fi + + log DEBUG "Deleting config file ${path}" + rm -f "${path}" + +} zone_port_settings_read() { assert [ $# -ge 2 ] -- 2.6.3

2 2

[PATCH] zone: make edit syntax clear
by Jonatan Schlag 11 Jul '17

11 Jul '17

Fixes: #11422 Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.zone | 3 --- 1 file changed, 3 deletions(-) diff --git a/src/functions/functions.zone b/src/functions/functions.zone index ff6d945..acf68f5 100644 --- a/src/functions/functions.zone +++ b/src/functions/functions.zone @@ -557,9 +557,6 @@ zone_config() { log ERROR "${id} is not a valid id" fi ;; - edit) - zone_config_edit "${zone}" "$@" - ;; list) zone_config_list "${zone}" "$@" ;; -- 2.6.3

1 0

[PATCH] dhcp: merge hooks ipv4-dhcp and ipv6-dhcp
by Jonatan Schlag 11 Jul '17

11 Jul '17

Fixes: #11404 Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- Makefile.am | 3 +- src/hooks/configs/dhcp | 190 ++++++++++++++++++++++++++++++++++++++++++++ src/hooks/configs/ipv4-dhcp | 122 ---------------------------- src/hooks/configs/ipv6-dhcp | 100 ----------------------- 4 files changed, 191 insertions(+), 224 deletions(-) create mode 100644 src/hooks/configs/dhcp delete mode 100644 src/hooks/configs/ipv4-dhcp delete mode 100644 src/hooks/configs/ipv6-dhcp diff --git a/Makefile.am b/Makefile.am index 9124288..e2800d0 100644 --- a/Makefile.am +++ b/Makefile.am @@ -196,10 +196,9 @@ INSTALL_EXEC_HOOKS += bridge-stp-install-hook UNINSTALL_EXEC_HOOKS += bridge-stp-uninstall-hook dist_hooks_configs_SCRIPTS = \ - src/hooks/configs/ipv4-dhcp \ + src/hooks/configs/dhcp \ src/hooks/configs/ipv4-static \ src/hooks/configs/ipv6-auto \ - src/hooks/configs/ipv6-dhcp \ src/hooks/configs/ipv6-static \ src/hooks/configs/pppoe-server diff --git a/src/hooks/configs/dhcp b/src/hooks/configs/dhcp new file mode 100644 index 0000000..5ac01b6 --- /dev/null +++ b/src/hooks/configs/dhcp @@ -0,0 +1,190 @@ +#!/bin/bash +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2010 Michael Tremer & Christian Schmidt # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +. /usr/lib/network/header-config + +HOOK_CONFIG_SETTINGS="HOOK DELAY ENABLE_IPV6 ENABLE_IPV4" + +# Default settings. +DELAY=0 +ENABLE_IPV6="on" +ENABLE_IPV4="on" + +hook_check_config_settings() { + assert isset DELAY + assert isinteger DELAY + assert isset ENABLE_IPV6 + assert isbool ENABLE_IPV6 + assert isset ENABLE_IPV4 + assert isbool ENABLE_IPV4 +} + +hook_parse_cmdline() { + while [ $# -gt 0 ]; do + case "${1}" in + --delay=*) + DELAY="$(cli_get_val "${1}")" + ;; + --enable-ipv6) + ENABLE_IPV6="on" + ;; + --disable-ipv6) + ENABLE_IPV6="off" + ;; + --enable-ipv4) + ENABLE_IPV4="on" + ;; + --disable-ipv4) + ENABLE_IPV4="off" + ;; + *) + warning "Ignoring unknown option '${1}'" + ;; + esac + shift + done +} + +hook_new() { + local zone="${1}" + shift + + if zone_config_hook_is_configured ${zone} "dhcp"; then + log ERROR "You can configure the dhcp hook only once for a zone" + return ${EXIT_ERROR} + fi + + if ! hook_parse_cmdline $@; then + # Return an error if the parsing of the cmd line fails + return ${EXIT_ERROR} + fi + + # Check if the user disabled ipv4 and ipv6 + + if ! enabled ENABLE_IPV6 && ! enabled ENABLE_IPV4; then + log ERROR "You disabled IPv6 and IPv4. At least one must be enabled" + return ${EXIT_ERROR} + fi + + zone_config_settings_write "${zone}" "${HOOK}" + + exit ${EXIT_OK} +} + +hook_up() { + local zone=${1} + local config=${2} + shift 2 + + if ! device_exists ${zone}; then + error "Zone '${zone}' doesn't exist." + exit ${EXIT_ERROR} + fi + + zone_config_settings_read "${zone}" "${config}" + + # Start dhclient for IPv6 on this zone if enabled. + if enabled ENABLE_IPV6; then + dhclient_start ${zone} ipv6 + fi + + # Start dhclient for IPv4 on this zone if enabled. + if enabled ENABLE_IPV4; then + dhclient_start ${zone} ipv4 + fi + + exit ${EXIT_OK} +} + +hook_down() { + local zone=${1} + local config=${2} + shift 2 + + if ! device_exists ${zone}; then + error "Zone '${zone}' doesn't exist." + exit ${EXIT_ERROR} + fi + + # Stop dhclient for IPv6 on this zone. + dhclient_stop ${zone} ipv6 + + # Stop dhclient for IPv4 on this zone. + dhclient_stop ${zone} ipv4 + + exit ${EXIT_OK} +} + +hook_status() { + local zone=${1} + local config=${2} + shift 2 + + if ! device_exists ${zone}; then + error "Zone '${zone}' doesn't exist." + exit ${EXIT_ERROR} + fi + + zone_config_settings_read "${zone}" "${config}" + + local status + if dhclient_status ${zone} ipv4 || dhclient_status ${zone} ipv6; then + status="${MSG_HOOK_UP}" + else + status="${MSG_HOOK_DOWN}" + fi + cli_statusline 3 "${HOOK}" "${status}" + + cli_space + + local proto + for proto in "IPv6" "IPv4"; do + local _proto=${proto,,} + + cli_print_fmt1 3 "${proto}" + + if enabled ENABLE_${proto^^}; then + cli_print_fmt1 4 "Status" "enabled" + + local address="$(db_get "${zone}/${_proto}/local-ip-address")" + if isset address; then + cli_print_fmt1 4 "Address" "${address}" + fi + + local gateway="$(db_get "${zone}/${_proto}/remote-ip-address")" + if isset gateway; then + cli_print_fmt1 4 "Gateway" "${gateway}" + fi + + local dns_servers="$(db_get "${zone}/${_proto}/domain-name-servers")" + if isset dns_servers; then + cli_print_fmt1 4 "DNS Servers" "${dns_servers}" + fi + else + cli_print_fmt1 4 "Status" "disabled" + fi + + cli_space + + done + + exit ${EXIT_OK} +} diff --git a/src/hooks/configs/ipv4-dhcp b/src/hooks/configs/ipv4-dhcp deleted file mode 100644 index 39e0312..0000000 --- a/src/hooks/configs/ipv4-dhcp +++ /dev/null @@ -1,122 +0,0 @@ -#!/bin/bash -############################################################################### -# # -# IPFire.org - A linux based firewall # -# Copyright (C) 2010 Michael Tremer & Christian Schmidt # -# # -# This program is free software: you can redistribute it and/or modify # -# it under the terms of the GNU General Public License as published by # -# the Free Software Foundation, either version 3 of the License, or # -# (at your option) any later version. # -# # -# This program is distributed in the hope that it will be useful, # -# but WITHOUT ANY WARRANTY; without even the implied warranty of # -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # -# GNU General Public License for more details. # -# # -# You should have received a copy of the GNU General Public License # -# along with this program. If not, see <http://www.gnu.org/licenses/>. # -# # -############################################################################### - -. /usr/lib/network/header-config - -HOOK_CONFIG_SETTINGS="HOOK DELAY" - -# Default settings. -DELAY=0 - -hook_check_config_settings() { - assert isset DELAY - assert isinteger DELAY -} - -hook_new() { - local zone="${1}" - shift - - if zone_config_hook_is_configured ${zone} "ipv4-dhcp"; then - log ERROR "You can configure the ipv4-dhcp hook only once for a zone" - return ${EXIT_ERROR} - fi - - while [ $# -gt 0 ]; do - case "${1}" in - --delay=*) - DELAY="$(cli_get_val "${1}")" - ;; - esac - shift - done - - zone_config_settings_write "${zone}" "${HOOK}" - - exit ${EXIT_OK} -} - -hook_up() { - local zone=${1} - local config=${2} - shift 2 - - if ! device_exists ${zone}; then - error "Zone '${zone}' doesn't exist." - exit ${EXIT_ERROR} - fi - - # Start dhclient for IPv4 on this zone. - dhclient_start ${zone} ipv4 - - exit ${EXIT_OK} -} - -hook_down() { - local zone=${1} - local config=${2} - shift 2 - - if ! device_exists ${zone}; then - error "Zone '${zone}' doesn't exist." - exit ${EXIT_ERROR} - fi - - # Stop dhclient for IPv4 on this zone. - dhclient_stop ${zone} ipv4 - - exit ${EXIT_OK} -} - -hook_status() { - local zone=${1} - local config=${2} - shift 2 - - if ! device_exists ${zone}; then - error "Zone '${zone}' doesn't exist." - exit ${EXIT_ERROR} - fi - - zone_config_settings_read "${zone}" "${config}" - - local status - if dhclient_status ${zone} ipv4; then - status="${MSG_HOOK_UP}" - else - status="${MSG_HOOK_DOWN}" - fi - cli_statusline 3 "${HOOK}" "${status}" - - cli_print_fmt1 3 "IPv4 address" "$(db_get "${zone}/ipv4/local-ip-address")" - local gateway="$(db_get "${zone}/ipv4/remote-ip-address")" - if isset gateway; then - cli_print_fmt1 3 "Gateway" "${gateway}" - cli_space - fi - local dns_servers="$(db_get "${zone}/ipv4/domain-name-servers")" - if isset dns_servers; then - cli_print_fmt1 3 "DNS-Servers" "${dns_servers}" - cli_space - fi - - exit ${EXIT_OK} -} diff --git a/src/hooks/configs/ipv6-dhcp b/src/hooks/configs/ipv6-dhcp deleted file mode 100644 index 74ec765..0000000 --- a/src/hooks/configs/ipv6-dhcp +++ /dev/null @@ -1,100 +0,0 @@ -#!/bin/bash -############################################################################### -# # -# IPFire.org - A linux based firewall # -# Copyright (C) 2010 Michael Tremer & Christian Schmidt # -# # -# This program is free software: you can redistribute it and/or modify # -# it under the terms of the GNU General Public License as published by # -# the Free Software Foundation, either version 3 of the License, or # -# (at your option) any later version. # -# # -# This program is distributed in the hope that it will be useful, # -# but WITHOUT ANY WARRANTY; without even the implied warranty of # -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # -# GNU General Public License for more details. # -# # -# You should have received a copy of the GNU General Public License # -# along with this program. If not, see <http://www.gnu.org/licenses/>. # -# # -############################################################################### - -. /usr/lib/network/header-config - -HOOK_CONFIG_SETTINGS="HOOK" - -hook_new() { - local zone="${1}" - shift - - if zone_config_hook_is_configured ${zone} "ipv6-dhcp"; then - log ERROR "You can configure the ipv6-dhcp hook only once for a zone" - return ${EXIT_ERROR} - fi - - zone_config_settings_write "${zone}" "${HOOK}" - - exit ${EXIT_OK} -} - -hook_up() { - local zone="${1}" - local config="${2}" - shift 2 - - if ! device_exists "${zone}"; then - error "Zone '${zone}' doesn't exist." - exit ${EXIT_ERROR} - fi - - # Start dhclient for IPv6 on this zone. - dhclient_start "${zone}" "ipv6" - - exit ${EXIT_OK} -} - -hook_down() { - local zone="${1}" - local config="${2}" - shift 2 - - if ! device_exists "${zone}"; then - error "Zone '${zone}' doesn't exist." - exit ${EXIT_ERROR} - fi - - # Stop dhclient for IPv6 on this zone. - dhclient_stop "${zone}" "ipv6" - - exit ${EXIT_OK} -} - -hook_status() { - local zone="${1}" - local config="${2}" - shift 2 - - if ! device_exists "${zone}"; then - error "Zone '${zone}' doesn't exist." - exit ${EXIT_ERROR} - fi - - zone_config_settings_read "${zone}" "${config}" - - local status - if dhclient_status "${zone}" "ipv6"; then - status="${MSG_HOOK_UP}" - else - status="${MSG_HOOK_DOWN}" - fi - cli_statusline 3 "${HOOK}" "${status}" - - cli_print_fmt1 3 "IPv6 address" "$(db_get "${zone}/ipv6/local-ip-address")" - local gateway="$(db_get "${zone}/ipv6/remote-ip-address")" - if isset gateway; then - cli_print_fmt1 3 "Gateway" "${gateway}" - fi - cli_space - - exit ${EXIT_OK} -} -- 2.6.3

1 0

[PATCH] dhcp: merge hooks ipv4-dhcp and ipv6-dhcp
by Jonatan Schlag 11 Jul '17

11 Jul '17

We use on and off instead of true and false to keep the config files more humand readable. Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- Makefile.am | 3 +- src/hooks/configs/dhcp | 223 ++++++++++++++++++++++++++++++++++++++++++++ src/hooks/configs/ipv4-dhcp | 122 ------------------------ src/hooks/configs/ipv6-dhcp | 100 -------------------- 4 files changed, 224 insertions(+), 224 deletions(-) create mode 100644 src/hooks/configs/dhcp delete mode 100644 src/hooks/configs/ipv4-dhcp delete mode 100644 src/hooks/configs/ipv6-dhcp diff --git a/Makefile.am b/Makefile.am index 32e7166..2bbc537 100644 --- a/Makefile.am +++ b/Makefile.am @@ -196,10 +196,9 @@ INSTALL_EXEC_HOOKS += bridge-stp-install-hook UNINSTALL_EXEC_HOOKS += bridge-stp-uninstall-hook dist_hooks_configs_SCRIPTS = \ - src/hooks/configs/ipv4-dhcp \ + src/hooks/configs/dhcp \ src/hooks/configs/ipv4-static \ src/hooks/configs/ipv6-auto \ - src/hooks/configs/ipv6-dhcp \ src/hooks/configs/ipv6-static \ src/hooks/configs/pppoe-server diff --git a/src/hooks/configs/dhcp b/src/hooks/configs/dhcp new file mode 100644 index 0000000..4aca87f --- /dev/null +++ b/src/hooks/configs/dhcp @@ -0,0 +1,223 @@ +#!/bin/bash +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2010 Michael Tremer & Christian Schmidt # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +. /usr/lib/network/header-config + +HOOK_CONFIG_SETTINGS="HOOK DELAY ENABLE_IPV4 ENABLE_IPV6" + +# Default settings. +DELAY=0 +ENABLE_IPV4="on" +ENABLE_IPV6="on" + +hook_check_config_settings() { + assert isset DELAY + assert isinteger DELAY + assert isset ENABLE_IPV4 + assert isbool ENABLE_IPV4 + assert isset ENABLE_IPV6 + assert isbool ENABLE_IPV6 +} + +hook_parse_cmdline() { + # These variables are there to check if a user tries to disable + # and enable ipv6 or ipv4 at the same time. I would not chrash + # but things could happen the user did not expect and + # thats why we check for this mistake + local ipv6_passed + local ipv4_passed + ipv6_passed=false + ipv4_passed=false + + while [ $# -gt 0 ]; do + case "${1}" in + --delay=*) + DELAY="$(cli_get_val "${1}")" + ;; + --enable-ipv6) + ENABLE_IPV6="on" + if ${ipv6_passed}; then + # --disable-ipv6 was passed earlier + log ERROR "You cannot disable and enable ipv6 at the same time" + return ${EXIT_ERROR} + fi + ipv6_passed=true + ;; + --disable-ipv6) + ENABLE_IPV6="off" + if ${ipv6_passed}; then + # --enable-ipv6 was passed earlier + log ERROR "You cannot disable and enable ipv6 at the same time" + return ${EXIT_ERROR} + fi + ipv6_passed=true + ;; + --enable-ipv4) + ENABLE_IPV4="on" + if ${ipv4_passed}; then + # --disable-ipv4 was passed earlier + log ERROR "You cannot disable and enable ipv4 at the same time" + return ${EXIT_ERROR} + fi + ipv4_passed=true + ;; + --disable-ipv4) + ENABLE_IPV4="off" + if ${ipv4_passed}; then + # --enable-ipv4 was passed earlier + log ERROR "You cannot disable and enable ipv4 at the same time" + return ${EXIT_ERROR} + fi + ipv4_passed=true + ;; + *) + warning "Ignoring unknown option '${1}'" + ;; + esac + shift + done +} + +hook_new() { + local zone="${1}" + shift + + if zone_config_hook_is_configured ${zone} "dhcp"; then + log ERROR "You can configure the dhcp hook only once for a zone" + return ${EXIT_ERROR} + fi + + if ! hook_parse_cmdline $@; then + # Return an error if the parsing of the cmd line fails + return ${EXIT_ERROR} + fi + + # Check if the user disabled ipv4 and ipv6 + + if ! enabled ENABLE_IPV6 && ! enabled ENABLE_IPV4; then + log ERROR "You disabled IPv6 and IPv4. At least one must be enabled" + return ${EXIT_ERROR} + fi + + zone_config_settings_write "${zone}" "${HOOK}" + + exit ${EXIT_OK} +} + +hook_up() { + local zone=${1} + local config=${2} + shift 2 + + if ! device_exists ${zone}; then + error "Zone '${zone}' doesn't exist." + exit ${EXIT_ERROR} + fi + + zone_config_settings_read "${zone}" "${config}" + + # Start dhclient for IPv6 on this zone if enabled. + if enabled ENABLE_IPV6; then + dhclient_start ${zone} ipv6 + fi + + # Start dhclient for IPv4 on this zone if enabled. + if enabled ENABLE_IPV4; then + dhclient_start ${zone} ipv4 + fi + + exit ${EXIT_OK} +} + +hook_down() { + local zone=${1} + local config=${2} + shift 2 + + if ! device_exists ${zone}; then + error "Zone '${zone}' doesn't exist." + exit ${EXIT_ERROR} + fi + + # Stop dhclient for IPv6 on this zone. + dhclient_stop ${zone} ipv6 + + # Stop dhclient for IPv4 on this zone. + dhclient_stop ${zone} ipv4 + + exit ${EXIT_OK} +} + +hook_status() { + local zone=${1} + local config=${2} + shift 2 + + if ! device_exists ${zone}; then + error "Zone '${zone}' doesn't exist." + exit ${EXIT_ERROR} + fi + + zone_config_settings_read "${zone}" "${config}" + + local status + if dhclient_status ${zone} ipv4 || dhclient_status ${zone} ipv6; then + status="${MSG_HOOK_UP}" + else + status="${MSG_HOOK_DOWN}" + fi + cli_statusline 3 "${HOOK}" "${status}" + + cli_space + + local proto + for proto in "IPv6" "IPv4"; do + local _proto=${proto,,} + + cli_print_fmt1 3 "${proto}" + + if enabled ENABLE_${proto^^}; then + cli_print_fmt1 4 "Status" "enabled" + + local address="$(db_get "${zone}/${_proto}/local-ip-address")" + if isset address; then + cli_print_fmt1 4 "Address" "${address}" + fi + + local gateway="$(db_get "${zone}/${_proto}/remote-ip-address")" + if isset gateway; then + cli_print_fmt1 4 "Gateway" "${gateway}" + fi + + local dns_servers="$(db_get "${zone}/${_proto}/domain-name-servers")" + if isset dns_servers; then + cli_print_fmt1 4 "DNS Servers" "${dns_servers}" + fi + else + cli_print_fmt1 4 "Status" "disabled" + fi + + cli_space + + done + + exit ${EXIT_OK} +} diff --git a/src/hooks/configs/ipv4-dhcp b/src/hooks/configs/ipv4-dhcp deleted file mode 100644 index 39e0312..0000000 --- a/src/hooks/configs/ipv4-dhcp +++ /dev/null @@ -1,122 +0,0 @@ -#!/bin/bash -############################################################################### -# # -# IPFire.org - A linux based firewall # -# Copyright (C) 2010 Michael Tremer & Christian Schmidt # -# # -# This program is free software: you can redistribute it and/or modify # -# it under the terms of the GNU General Public License as published by # -# the Free Software Foundation, either version 3 of the License, or # -# (at your option) any later version. # -# # -# This program is distributed in the hope that it will be useful, # -# but WITHOUT ANY WARRANTY; without even the implied warranty of # -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # -# GNU General Public License for more details. # -# # -# You should have received a copy of the GNU General Public License # -# along with this program. If not, see <http://www.gnu.org/licenses/>. # -# # -############################################################################### - -. /usr/lib/network/header-config - -HOOK_CONFIG_SETTINGS="HOOK DELAY" - -# Default settings. -DELAY=0 - -hook_check_config_settings() { - assert isset DELAY - assert isinteger DELAY -} - -hook_new() { - local zone="${1}" - shift - - if zone_config_hook_is_configured ${zone} "ipv4-dhcp"; then - log ERROR "You can configure the ipv4-dhcp hook only once for a zone" - return ${EXIT_ERROR} - fi - - while [ $# -gt 0 ]; do - case "${1}" in - --delay=*) - DELAY="$(cli_get_val "${1}")" - ;; - esac - shift - done - - zone_config_settings_write "${zone}" "${HOOK}" - - exit ${EXIT_OK} -} - -hook_up() { - local zone=${1} - local config=${2} - shift 2 - - if ! device_exists ${zone}; then - error "Zone '${zone}' doesn't exist." - exit ${EXIT_ERROR} - fi - - # Start dhclient for IPv4 on this zone. - dhclient_start ${zone} ipv4 - - exit ${EXIT_OK} -} - -hook_down() { - local zone=${1} - local config=${2} - shift 2 - - if ! device_exists ${zone}; then - error "Zone '${zone}' doesn't exist." - exit ${EXIT_ERROR} - fi - - # Stop dhclient for IPv4 on this zone. - dhclient_stop ${zone} ipv4 - - exit ${EXIT_OK} -} - -hook_status() { - local zone=${1} - local config=${2} - shift 2 - - if ! device_exists ${zone}; then - error "Zone '${zone}' doesn't exist." - exit ${EXIT_ERROR} - fi - - zone_config_settings_read "${zone}" "${config}" - - local status - if dhclient_status ${zone} ipv4; then - status="${MSG_HOOK_UP}" - else - status="${MSG_HOOK_DOWN}" - fi - cli_statusline 3 "${HOOK}" "${status}" - - cli_print_fmt1 3 "IPv4 address" "$(db_get "${zone}/ipv4/local-ip-address")" - local gateway="$(db_get "${zone}/ipv4/remote-ip-address")" - if isset gateway; then - cli_print_fmt1 3 "Gateway" "${gateway}" - cli_space - fi - local dns_servers="$(db_get "${zone}/ipv4/domain-name-servers")" - if isset dns_servers; then - cli_print_fmt1 3 "DNS-Servers" "${dns_servers}" - cli_space - fi - - exit ${EXIT_OK} -} diff --git a/src/hooks/configs/ipv6-dhcp b/src/hooks/configs/ipv6-dhcp deleted file mode 100644 index 74ec765..0000000 --- a/src/hooks/configs/ipv6-dhcp +++ /dev/null @@ -1,100 +0,0 @@ -#!/bin/bash -############################################################################### -# # -# IPFire.org - A linux based firewall # -# Copyright (C) 2010 Michael Tremer & Christian Schmidt # -# # -# This program is free software: you can redistribute it and/or modify # -# it under the terms of the GNU General Public License as published by # -# the Free Software Foundation, either version 3 of the License, or # -# (at your option) any later version. # -# # -# This program is distributed in the hope that it will be useful, # -# but WITHOUT ANY WARRANTY; without even the implied warranty of # -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # -# GNU General Public License for more details. # -# # -# You should have received a copy of the GNU General Public License # -# along with this program. If not, see <http://www.gnu.org/licenses/>. # -# # -############################################################################### - -. /usr/lib/network/header-config - -HOOK_CONFIG_SETTINGS="HOOK" - -hook_new() { - local zone="${1}" - shift - - if zone_config_hook_is_configured ${zone} "ipv6-dhcp"; then - log ERROR "You can configure the ipv6-dhcp hook only once for a zone" - return ${EXIT_ERROR} - fi - - zone_config_settings_write "${zone}" "${HOOK}" - - exit ${EXIT_OK} -} - -hook_up() { - local zone="${1}" - local config="${2}" - shift 2 - - if ! device_exists "${zone}"; then - error "Zone '${zone}' doesn't exist." - exit ${EXIT_ERROR} - fi - - # Start dhclient for IPv6 on this zone. - dhclient_start "${zone}" "ipv6" - - exit ${EXIT_OK} -} - -hook_down() { - local zone="${1}" - local config="${2}" - shift 2 - - if ! device_exists "${zone}"; then - error "Zone '${zone}' doesn't exist." - exit ${EXIT_ERROR} - fi - - # Stop dhclient for IPv6 on this zone. - dhclient_stop "${zone}" "ipv6" - - exit ${EXIT_OK} -} - -hook_status() { - local zone="${1}" - local config="${2}" - shift 2 - - if ! device_exists "${zone}"; then - error "Zone '${zone}' doesn't exist." - exit ${EXIT_ERROR} - fi - - zone_config_settings_read "${zone}" "${config}" - - local status - if dhclient_status "${zone}" "ipv6"; then - status="${MSG_HOOK_UP}" - else - status="${MSG_HOOK_DOWN}" - fi - cli_statusline 3 "${HOOK}" "${status}" - - cli_print_fmt1 3 "IPv6 address" "$(db_get "${zone}/ipv6/local-ip-address")" - local gateway="$(db_get "${zone}/ipv6/remote-ip-address")" - if isset gateway; then - cli_print_fmt1 3 "Gateway" "${gateway}" - fi - cli_space - - exit ${EXIT_OK} -} -- 2.6.3

2 1

← Newer
1
...
5
6
7
8
9
10
11
Older →

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

network