on the Solaris side via "ndpd.conf" (see ``man ifconfig'').
* release as patch 20100104-1
+
+Fri Jan 8 10:00:50 CET 2010
+
+ * import into git repository
+
+ * options.c: add sanity checks for most typical error cases
+ (--ifconfig-ipv6-pool configured with no --ifconfig-ipv6, etc)
+
+ * options.c: modify get_ipv6_addr() to be more flexible about netbits
+ (optional now, default to /64) and to return the address-without-netbits
+ string now (-> for options that want the IPv6 address in printable
+ form, but without /nn)
+
+ * options.c: modify --ifconfig-ipv6 to optionally accept /netbits,
+ you can do now "ifconfig-ipv6 2001:df8::1/64 2001:df8::2" or just
+ "ifconfig-ipv6 2001:df8::5 2001:df8::7", defaulting to /64
+
+ * options.h: add necessary structure elements for --ifconfig-ipv6-push
+
+ * options.c: implement "parse options" side of --ifconfig-ipv6-push
+
+Tue Jan 12 22:42:09 CET 2010
+
+ * tun.c: in TARGET_NETBSD #ifdef, distinguish between "old" code
+ (IPv4 only, but unmodified read/write) and "new" code (multi-af,
+ extra 32 bit AF on read/write of the tun interface) - pre-4.0
+ NetBSD systems don't have TUNSIFHEAD, no way to have common code.
+
+ * TEST SUCCESS: NetBSD 5.0/Sparc64: client-ipv6 with route-ipv6 (v4+v6)
+
+ * TEST SUCCESS: NetBSD 3.1/Sparc64: client-ipv6 with route-ipv6 (v4-only)
+
+Thu Jan 14 15:41:50 CET 2010
+
+ * multi.c: if "--ifconfig-push" is used together with "--ifconfig-ipv6-pool"
+ and no "--ifconfig-ipv6-push" is seen, issue warning - the current
+ implementation of pools has IPv6 tied to IPv4, so if v4 does not use
+ the pool, it breaks for IPv6. Not a *big* problem (since there is
+ enough v6, just give those users a static v6 address as well), but needs
+ to be pointed out clearly.
+
+ * release as patch 20100114-1
mi->context.c2.push_ifconfig_defined = true;
mi->context.c2.push_ifconfig_local = mi->context.options.push_ifconfig_local;
mi->context.c2.push_ifconfig_remote_netmask = mi->context.options.push_ifconfig_remote_netmask;
+
+ /* the current implementation does not allow "static IPv4, pool IPv6",
+ * (see below) so issue a warning if that happens - don't break the
+ * session, though, as we don't even know if this client WANTS IPv6
+ */
+ if ( mi->context.c1.tuntap->ipv6 &&
+ mi->context.options.ifconfig_ipv6_pool_defined &&
+ ! mi->context.options.push_ifconfig_ipv6_defined )
+ {
+ msg( M_INFO, "MULTI_sva: WARNING: if --ifconfig-push is used for IPv4, automatic IPv6 assignment from --ifconfig-ipv6-pool does not work. Use --ifconfig-ipv6-push for IPv6 then." );
+ }
}
else if (m->ifconfig_pool && mi->vaddr_handle < 0) /* otherwise, choose a pool address */
{
msg (D_MULTI_ERRORS, "MULTI: no free --ifconfig-pool addresses are available");
}
}
+
+ /* IPv6 push_ifconfig is a bit problematic - since IPv6 shares the
+ * pool handling with IPv4, the combination "static IPv4, dynamic IPv6"
+ * will fail (because no pool will be allocated in this case).
+ * OTOH, this doesn't make too much sense in reality - and the other
+ * way round ("dynamic IPv4, static IPv6") or "both static" makes sense
+ * -> and so it's implemented right now
+ */
+ if ( mi->context.c1.tuntap->ipv6 &&
+ mi->context.options.push_ifconfig_ipv6_defined )
+ {
+ mi->context.c2.push_ifconfig_ipv6_local =
+ mi->context.options.push_ifconfig_ipv6_local;
+ mi->context.c2.push_ifconfig_ipv6_remote =
+ mi->context.options.push_ifconfig_ipv6_remote;
+ mi->context.c2.push_ifconfig_ipv6_netbits =
+ mi->context.options.push_ifconfig_ipv6_netbits;
+ mi->context.c2.push_ifconfig_ipv6_defined = true;
+
+ msg( M_INFO, "MULTI_sva: push_ifconfig_ipv6 %s/%d",
+ print_in6_addr( mi->context.c2.push_ifconfig_ipv6_local, 0, &gc ),
+ mi->context.c2.push_ifconfig_ipv6_netbits );
+ }
+
gc_free (&gc);
}
"--ifconfig-push local remote-netmask : Push an ifconfig option to remote,\n"
" overrides --ifconfig-pool dynamic allocation.\n"
" Only valid in a client-specific config file.\n"
+ "--ifconfig-ipv6-push local/bits remote : Push an ifconfig-ipv6 option to\n"
+ " remote, overrides --ifconfig-ipv6-pool allocation.\n"
+ " Only valid in a client-specific config file.\n"
+ "--iroute network [netmask] : Route subnet to client.\n"
"--iroute network [netmask] : Route subnet to client.\n"
"--iroute-ipv6 network/bits : Route IPv6 subnet to client.\n"
" Sets up internal routes only.\n"
return ret;
}
-/* parse a text string containing an IPv6 address + netbits
+/* helper: parse a text string containing an IPv6 address + netbits
* in "standard format" (2001:dba::/32)
+ * "/nn" is optional, default to /64 if missing
+ *
* return true if parsing succeeded, modify *network and *netbits
+ * return address part without "/nn" in *printable_ipv6 (if != NULL)
*/
bool
get_ipv6_addr( const char * prefix_str, struct in6_addr *network,
- unsigned int * netbits, int msglevel )
+ unsigned int * netbits, char ** printable_ipv6, int msglevel )
{
int rc;
char * sep, * endp;
int bits;
+ struct in6_addr t_network;
sep = strchr( prefix_str, '/' );
if ( sep == NULL )
- {
- msg (msglevel, "IPv6 prefix '%s': missing '/'", prefix_str);
- return false;
- }
-
- bits = strtol( sep+1, &endp, 10 );
- if ( *endp != '\0' || bits < 0 || bits > 128 )
- {
- msg (msglevel, "IPv6 prefix '%s': invalid '/bits' spec", prefix_str);
- return false;
- }
+ {
+ bits = 64;
+ }
+ else
+ {
+ bits = strtol( sep+1, &endp, 10 );
+ if ( *endp != '\0' || bits < 0 || bits > 128 )
+ {
+ msg (msglevel, "IPv6 prefix '%s': invalid '/bits' spec", prefix_str);
+ return false;
+ }
+ }
/* temporary replace '/' in caller-provided string with '\0', otherwise
* inet_pton() will refuse prefix string
* (alternative would be to strncpy() the prefix to temporary buffer)
*/
- *sep = '\0';
- rc = inet_pton( AF_INET6, prefix_str, network );
- *sep = '/';
+ if ( sep != NULL ) *sep = '\0';
+
+ rc = inet_pton( AF_INET6, prefix_str, &t_network );
+
+ if ( rc == 1 && printable_ipv6 != NULL )
+ {
+ *printable_ipv6 = string_alloc( prefix_str, NULL );
+ }
+
+ if ( sep != NULL ) *sep = '/';
if ( rc != 1 )
- {
- msg (msglevel, "IPv6 prefix '%s': invalid network part", prefix_str);
- return false;
- }
- *netbits = bits;
+ {
+ msg (msglevel, "IPv6 prefix '%s': invalid IPv6 address", prefix_str);
+ return false;
+ }
+
+ if ( netbits != NULL )
+ {
+ *netbits = bits;
+ }
+ if ( network != NULL )
+ {
+ *network = t_network;
+ }
return true; /* parsing OK, values set */
}
struct in6_addr t_addr;
unsigned int t_bits;
- return get_ipv6_addr( ipv6_prefix_spec, &t_addr, &t_bits, M_WARN );
+ return get_ipv6_addr( ipv6_prefix_spec, &t_addr, &t_bits, NULL, M_WARN );
}
static char *
msg (D_SHOW_PARMS, " ifconfig_pool_netmask = %s", print_in_addr_t (o->ifconfig_pool_netmask, 0, &gc));
SHOW_STR (ifconfig_pool_persist_filename);
SHOW_INT (ifconfig_pool_persist_refresh_freq);
+ SHOW_BOOL (ifconfig_ipv6_pool_defined);
msg (D_SHOW_PARMS, " ifconfig_ipv6_pool_base = %s", print_in6_addr (o->ifconfig_ipv6_pool_base, 0, &gc));
SHOW_INT (ifconfig_ipv6_pool_netbits);
SHOW_INT (n_bcast_buf);
SHOW_BOOL (push_ifconfig_defined);
msg (D_SHOW_PARMS, " push_ifconfig_local = %s", print_in_addr_t (o->push_ifconfig_local, 0, &gc));
msg (D_SHOW_PARMS, " push_ifconfig_remote_netmask = %s", print_in_addr_t (o->push_ifconfig_remote_netmask, 0, &gc));
+ SHOW_BOOL (push_ifconfig_ipv6_defined);
+ msg (D_SHOW_PARMS, " push_ifconfig_ipv6_local = %s/%d", print_in6_addr (o->push_ifconfig_ipv6_local, 0, &gc), o->push_ifconfig_ipv6_netbits );
+ msg (D_SHOW_PARMS, " push_ifconfig_ipv6_remote = %s", print_in6_addr (o->push_ifconfig_ipv6_remote, 0, &gc));
SHOW_BOOL (enable_c2c);
SHOW_BOOL (duplicate_cn);
SHOW_INT (cf_max);
ALLOC_OBJ_GC (ir, struct iroute_ipv6, &o->gc);
- if ( get_ipv6_addr (prefix_str, &ir->network, &ir->netbits, msglevel ) < 0 )
+ if ( get_ipv6_addr (prefix_str, &ir->network, &ir->netbits, NULL, msglevel ) < 0 )
{
msg (msglevel, "in --iroute-ipv6 %s: Bad IPv6 prefix specification",
prefix_str);
SHOW_BOOL (ifconfig_noexec);
SHOW_BOOL (ifconfig_nowarn);
SHOW_STR (ifconfig_ipv6_local);
+ SHOW_INT (ifconfig_ipv6_netbits);
SHOW_STR (ifconfig_ipv6_remote);
#ifdef HAVE_GETTIMEOFDAY
msg (M_USAGE, "--up-delay cannot be used with --mode server");
if (!options->ifconfig_pool_defined && options->ifconfig_pool_persist_filename)
msg (M_USAGE, "--ifconfig-pool-persist must be used with --ifconfig-pool");
+ if (options->ifconfig_ipv6_pool_defined && !options->ifconfig_ipv6_local )
+ msg (M_USAGE, "--ifconfig-ipv6-pool needs --ifconfig-ipv6");
+ if (options->ifconfig_ipv6_local && !options->tun_ipv6 )
+ msg (M_INFO, "Warning: --ifconfig-ipv6 without --tun-ipv6 will not do IPv6");
+
if (options->auth_user_pass_file)
msg (M_USAGE, "--auth-user-pass cannot be used with --mode server (it should be used on the client side only)");
if (options->ccd_exclusive && !options->client_config_dir)
*/
if (options->ifconfig_pool_defined || options->ifconfig_pool_persist_filename)
msg (M_USAGE, "--ifconfig-pool/--ifconfig-pool-persist requires --mode server");
+ if (options->ifconfig_ipv6_pool_defined)
+ msg (M_USAGE, "--ifconfig-ipv6-pool requires --mode server");
if (options->real_hash_size != defaults.real_hash_size
|| options->virtual_hash_size != defaults.virtual_hash_size)
msg (M_USAGE, "--hash-size requires --mode server");
}
else if (streq (p[0], "ifconfig-ipv6") && p[1] && p[2] )
{
+ unsigned int netbits;
+ char * ipv6_local;
+
VERIFY_PERMISSION (OPT_P_UP);
- /* TODO: should we accept address + netbits (2001:db8::1/64) here? */
- if ( ipv6_addr_safe( p[1] ) && ipv6_addr_safe( p[2] ) )
+ if ( get_ipv6_addr( p[1], NULL, &netbits, &ipv6_local, msglevel ) &&
+ ipv6_addr_safe( p[2] ) )
{
- options->ifconfig_ipv6_local = p[1];
+ if ( netbits < 64 || netbits > 124 )
+ {
+ msg( msglevel, "ifconfig-ipv6: /netbits must be between 64 and 124, not '/%d'", netbits );
+ goto err;
+ }
+ options->ifconfig_ipv6_local = ipv6_local;
+ options->ifconfig_ipv6_netbits = netbits;
options->ifconfig_ipv6_remote = p[2];
}
else
unsigned int netbits = 0;
VERIFY_PERMISSION (OPT_P_GENERAL);
- if ( ! get_ipv6_addr (p[1], &network, &netbits, lev) )
+ if ( ! get_ipv6_addr (p[1], &network, &netbits, NULL, lev) )
{
msg (msglevel, "error parsing --server-ipv6 parameter");
goto err;
if (p[2]) /* no "nopool" options or similar for IPv6 */
{
- msg (msglevel, "error parsing --server: %s is not a recognized flag", p[3]);
+ msg (msglevel, "error parsing --server-ipv6: %s is not a recognized flag", p[3]);
goto err;
}
}
unsigned int netbits = 0;
VERIFY_PERMISSION (OPT_P_GENERAL);
- if ( ! get_ipv6_addr (p[1], &network, &netbits, lev ) )
+ if ( ! get_ipv6_addr (p[1], &network, &netbits, NULL, lev ) )
{
msg (msglevel, "error parsing --ifconfig-ipv6-pool parameters");
goto err;
goto err;
}
}
+ else if (streq (p[0], "ifconfig-ipv6-push") && p[1] )
+ {
+ struct in6_addr local, remote;
+ unsigned int netbits;
+
+ VERIFY_PERMISSION (OPT_P_INSTANCE);
+
+ if ( ! get_ipv6_addr( p[1], &local, &netbits, NULL, msglevel ) )
+ {
+ msg (msglevel, "cannot parse --ifconfig-ipv6-push addresses");
+ goto err;
+ }
+
+ if ( p[2] )
+ {
+ if ( !get_ipv6_addr( p[2], &remote, NULL, NULL, msglevel ) )
+ {
+ msg( msglevel, "cannot parse --ifconfig-ipv6-push addresses");
+ goto err;
+ }
+ }
+ else
+ {
+ if ( ! options->ifconfig_ipv6_local ||
+ ! get_ipv6_addr( options->ifconfig_ipv6_local, &remote,
+ NULL, NULL, msglevel ) )
+ {
+ msg( msglevel, "second argument to --ifconfig-ipv6-push missing and no global --ifconfig-ipv6 address set");
+ goto err;
+ }
+ }
+
+ options->push_ifconfig_ipv6_defined = true;
+ options->push_ifconfig_ipv6_local = local;
+ options->push_ifconfig_ipv6_netbits = netbits;
+ options->push_ifconfig_ipv6_remote = remote;
+ }
else if (streq (p[0], "disable"))
{
VERIFY_PERMISSION (OPT_P_INSTANCE);
projects / thirdparty / openvpn.git / commitdiff
