people/jschlag/network.git
7 months agoNitsi: Add test for port bonding master
Jonatan Schlag [Tue, 18 Sep 2018 19:48:08 +0000 (21:48 +0200)]
Nitsi: Add test for port bonding

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
7 months agoFix function port_get_slaves
Jonatan Schlag [Sun, 16 Sep 2018 21:51:34 +0000 (23:51 +0200)]
Fix function port_get_slaves

This functions failed when we set the SLAVES variable before in another
function.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
7 months agoMerge remote-tracking branch 'upstream/master'
Jonatan Schlag [Sun, 16 Sep 2018 14:16:43 +0000 (16:16 +0200)]
Merge remote-tracking branch 'upstream/master'

7 months agoipsec: security policies: Make integrity command plural
Michael Tremer [Sun, 16 Sep 2018 14:15:53 +0000 (15:15 +0100)]
ipsec: security policies: Make integrity command plural

References: #11446

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoMerge remote-tracking branch 'upstream/master'
Jonatan Schlag [Sun, 16 Sep 2018 14:15:52 +0000 (16:15 +0200)]
Merge remote-tracking branch 'upstream/master'

7 months agoMove vpn tests into an own directory structure
Jonatan Schlag [Sun, 16 Sep 2018 14:13:56 +0000 (16:13 +0200)]
Move vpn tests into an own directory structure

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
7 months agoipsec: security policies: Make group type command plural
Michael Tremer [Sun, 16 Sep 2018 14:11:36 +0000 (15:11 +0100)]
ipsec: security policies: Make group type command plural

References: #11446

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoAdjust include paths because of the new include path feature
Jonatan Schlag [Sun, 16 Sep 2018 14:00:00 +0000 (16:00 +0200)]
Adjust include paths because of the new include path feature

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
7 months agoipsec: security policies: Show PRFs when dumping SecPol conf
Michael Tremer [Sun, 16 Sep 2018 14:00:42 +0000 (16:00 +0200)]
ipsec: security policies: Show PRFs when dumping SecPol conf

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoipsec: security polices: Make cipher command plural
Michael Tremer [Sun, 16 Sep 2018 13:57:31 +0000 (15:57 +0200)]
ipsec: security polices: Make cipher command plural

References: #11446

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoUse new include path feature of nitsi
Jonatan Schlag [Sun, 16 Sep 2018 13:54:04 +0000 (15:54 +0200)]
Use new include path feature of nitsi

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
7 months agoipsec: security-policies: Make PRF command plural
Michael Tremer [Sun, 16 Sep 2018 13:51:31 +0000 (15:51 +0200)]
ipsec: security-policies: Make PRF command plural

References: #11446

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoipsec: security-policies: Add CLI to modify PRFs
Michael Tremer [Sun, 16 Sep 2018 13:45:45 +0000 (15:45 +0200)]
ipsec: security-policies: Add CLI to modify PRFs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoipsec: Generate IKE proposals with PRFs
Michael Tremer [Sun, 16 Sep 2018 13:19:55 +0000 (15:19 +0200)]
ipsec: Generate IKE proposals with PRFs

This is now a requirement for AEAD ciphers and strongswan
refuses to start.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoNitsi: port vlan test- check if detach works
Jonatan Schlag [Sun, 16 Sep 2018 12:36:26 +0000 (14:36 +0200)]
Nitsi: port vlan test- check if detach works

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
7 months agoAdd vlan port test for nitsi
Jonatan Schlag [Sun, 16 Sep 2018 12:03:37 +0000 (14:03 +0200)]
Add vlan port test for nitsi

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
7 months agoMerge remote-tracking branch 'jschlag/master'
Michael Tremer [Sun, 16 Sep 2018 11:53:53 +0000 (12:53 +0100)]
Merge remote-tracking branch 'jschlag/master'

7 months agonitsi: Add test for PPPoE server/client
Michael Tremer [Sun, 16 Sep 2018 11:52:39 +0000 (12:52 +0100)]
nitsi: Add test for PPPoE server/client

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agopppoe: Bring up port when zone is coming up
Michael Tremer [Sun, 16 Sep 2018 11:50:30 +0000 (12:50 +0100)]
pppoe: Bring up port when zone is coming up

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoAdd VPN n2n tests for vti
Jonatan Schlag [Sun, 16 Sep 2018 11:16:23 +0000 (13:16 +0200)]
Add VPN n2n tests for vti

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
7 months agoUse new phase1 and setup recipes in vpn tests
Jonatan Schlag [Sun, 16 Sep 2018 11:13:43 +0000 (13:13 +0200)]
Use new phase1 and setup recipes in vpn tests

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
7 months agonitsi: Make sure that we are always running with the most recent source
Michael Tremer [Sun, 16 Sep 2018 08:21:53 +0000 (09:21 +0100)]
nitsi: Make sure that we are always running with the most recent source

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agonitsi: Automatically drop to a shell in case a test fails
Michael Tremer [Sun, 16 Sep 2018 08:16:21 +0000 (09:16 +0100)]
nitsi: Automatically drop to a shell in case a test fails

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agopppoe-server: Run with absolute path
Michael Tremer [Sun, 16 Sep 2018 09:26:22 +0000 (11:26 +0200)]
pppoe-server: Run with absolute path

Because PATH has been changed this script is executing
itself recursively

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agopppoe-server: Read configuration again
Michael Tremer [Sun, 16 Sep 2018 09:24:28 +0000 (11:24 +0200)]
pppoe-server: Read configuration again

This was broken since config IDs have been introduced

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoInstall ppp scripts with executable permissions
Michael Tremer [Sun, 16 Sep 2018 08:55:38 +0000 (10:55 +0200)]
Install ppp scripts with executable permissions

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoMerge remote-tracking branch 'upstream/master'
Jonatan Schlag [Sat, 15 Sep 2018 22:14:36 +0000 (00:14 +0200)]
Merge remote-tracking branch 'upstream/master'

7 months agonitsi: Drop Hello World test
Michael Tremer [Sat, 15 Sep 2018 22:11:36 +0000 (23:11 +0100)]
nitsi: Drop Hello World test

This is a little bit useless now that we have tests
that do stuff that is more useful.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agonitsi: Add phase1
Michael Tremer [Sat, 15 Sep 2018 21:57:09 +0000 (22:57 +0100)]
nitsi: Add phase1

This is supposed to be a good base to build on for any test that
needs a working layer 2 and some IP addresses on the network
to reach any other machines

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoMake make distcheck happy
Michael Tremer [Sat, 15 Sep 2018 16:04:40 +0000 (17:04 +0100)]
Make make distcheck happy

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoChange ipv6 addresses from global to "private" addresses in nitsi
Jonatan Schlag [Sat, 15 Sep 2018 15:59:49 +0000 (17:59 +0200)]
Change ipv6 addresses from global to "private" addresses in nitsi

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
7 months agoMake setting of traffic selectors in nitsi test easier
Jonatan Schlag [Sat, 15 Sep 2018 15:55:01 +0000 (17:55 +0200)]
Make setting of traffic selectors in nitsi test easier

We now include the file for ipv4 and for ipv6 into the file for ipv64
which makes maintenance easier.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
7 months agoInclude ping test of ipv4 and ipv6 into ipv64 test
Jonatan Schlag [Sat, 15 Sep 2018 15:49:26 +0000 (17:49 +0200)]
Include ping test of ipv4 and ipv6 into ipv64 test

This make changing ip addresses easier.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
7 months agoMakefile: Install dhclient-helper as an executable script
Michael Tremer [Sat, 15 Sep 2018 18:40:31 +0000 (20:40 +0200)]
Makefile: Install dhclient-helper as an executable script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoChange ipv6 addresses from global to "private" addresses in nitsi
Jonatan Schlag [Sat, 15 Sep 2018 15:59:49 +0000 (17:59 +0200)]
Change ipv6 addresses from global to "private" addresses in nitsi

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
7 months agoMake setting of traffic selectors in nitsi test easier
Jonatan Schlag [Sat, 15 Sep 2018 15:55:01 +0000 (17:55 +0200)]
Make setting of traffic selectors in nitsi test easier

We now include the file for ipv4 and for ipv6 into the file for ipv64
which makes maintenance easier.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
7 months agoInclude ping test of ipv4 and ipv6 into ipv64 test
Jonatan Schlag [Sat, 15 Sep 2018 15:49:26 +0000 (17:49 +0200)]
Include ping test of ipv4 and ipv6 into ipv64 test

This make changing ip addresses easier.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
7 months agovpn: Poly1305 is AEAD
Michael Tremer [Sat, 15 Sep 2018 15:06:05 +0000 (16:06 +0100)]
vpn: Poly1305 is AEAD

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agonitsi: Rename make-install include file to setup
Michael Tremer [Sat, 15 Sep 2018 14:58:16 +0000 (15:58 +0100)]
nitsi: Rename make-install include file to setup

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agonitsi: Include some inital commands in make-install template
Michael Tremer [Sat, 15 Sep 2018 14:53:25 +0000 (15:53 +0100)]
nitsi: Include some inital commands in make-install template

This allows us to have a couple fewer includes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agonitsi: Install configuration files into the right place
Michael Tremer [Sat, 15 Sep 2018 13:33:55 +0000 (14:33 +0100)]
nitsi: Install configuration files into the right place

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agonitsi: Remove lines that are already in the default settings file
Michael Tremer [Sat, 15 Sep 2018 13:32:22 +0000 (14:32 +0100)]
nitsi: Remove lines that are already in the default settings file

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agonitsi: Remove reference to non-existant strongswan.conf file
Michael Tremer [Sat, 15 Sep 2018 13:29:48 +0000 (14:29 +0100)]
nitsi: Remove reference to non-existant strongswan.conf file

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoMerge branch 'nitsi-zone-commands'
Jonatan Schlag [Sat, 15 Sep 2018 13:25:08 +0000 (15:25 +0200)]
Merge branch 'nitsi-zone-commands'

7 months agoIPsec: Add support for ChaCha20-Poly1305
Michael Tremer [Sat, 15 Sep 2018 12:49:59 +0000 (13:49 +0100)]
IPsec: Add support for ChaCha20-Poly1305

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoFix hook for static address configuration.
Stefan Schantl [Sat, 11 Aug 2018 19:21:27 +0000 (21:21 +0200)]
Fix hook for static address configuration.

Add the required hook_new function and "id" information which have been
introduced in earlier commits to make this hook work again.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Tested-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoAdd recipe for port vars
Jonatan Schlag [Sat, 15 Sep 2018 11:59:24 +0000 (13:59 +0200)]
Add recipe for port vars

These vars contain the port name which is plugged into the virtual
network.

As this relation changes every reboot these vars make it possible to
write recipes which depends on correct links between two ports.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
7 months agoAdd gitignore in include dir of nitsi recipes
Jonatan Schlag [Sat, 15 Sep 2018 11:57:21 +0000 (13:57 +0200)]
Add gitignore in include dir of nitsi recipes

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
7 months agoAdd include recipe for nitsi vpn n2n tests
Jonatan Schlag [Sat, 15 Sep 2018 11:48:08 +0000 (13:48 +0200)]
Add include recipe for nitsi vpn n2n tests

This recipes are the base for all n2n ipsec tests.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
7 months agoAdd default settings file for nitsi tests
Jonatan Schlag [Sat, 15 Sep 2018 11:41:55 +0000 (13:41 +0200)]
Add default settings file for nitsi tests

This makes writing a test much faster.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
8 months agoreset: Trigger udev to re-add all network interfaces
Michael Tremer [Wed, 15 Aug 2018 09:31:14 +0000 (10:31 +0100)]
reset: Trigger udev to re-add all network interfaces

Fixes: #11815

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoRemove registration of functions called on init
Michael Tremer [Wed, 15 Aug 2018 09:26:51 +0000 (10:26 +0100)]
Remove registration of functions called on init

Only one function used this and it was slow since it got initialised
every time the functions were loaded.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agodns: Re-generate resolv.conf when flushing settings
Michael Tremer [Wed, 15 Aug 2018 09:24:05 +0000 (10:24 +0100)]
dns: Re-generate resolv.conf when flushing settings

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoAdd a test to check that we can attach ports to a zone of type bridge
Jonatan Schlag [Sat, 11 Aug 2018 12:32:59 +0000 (14:32 +0200)]
Add a test to check that we can attach ports to a zone of type bridge

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
8 months agoAdd new test zone-new-bridge
Jonatan Schlag [Tue, 7 Aug 2018 17:15:34 +0000 (19:15 +0200)]
Add new test zone-new-bridge

This test checks if we can create a new zone of type bridge.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
8 months agoAdd test for command raw device-get-by-mac-address
Jonatan Schlag [Sat, 28 Jul 2018 11:59:16 +0000 (13:59 +0200)]
Add test for command raw device-get-by-mac-address

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoAdd new function device_get_by_mac_address()
Jonatan Schlag [Sat, 28 Jul 2018 11:59:15 +0000 (13:59 +0200)]
Add new function device_get_by_mac_address()

We need this function and the command to identify ports in a nitsi test.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoAdd recipe to set network settings
Jonatan Schlag [Sat, 28 Jul 2018 11:59:14 +0000 (13:59 +0200)]
Add recipe to set network settings

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoAdd recipe to reset network configuration
Jonatan Schlag [Sat, 28 Jul 2018 11:59:13 +0000 (13:59 +0200)]
Add recipe to reset network configuration

We use --force here to avoid the y/n question.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoAdd include dir for nitsi test
Jonatan Schlag [Sat, 30 Jun 2018 15:54:04 +0000 (17:54 +0200)]
Add include dir for nitsi test

When we include recipes in our recipe we must be shure in some cases
that the recipe are generated out of a .in file.

All files in the include dir will be generated before every test so we
can be shure that these files are present.

This is useful for recipes like the make-install recipe in this test,
which needs to be generated and will be included in nearly every test.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoFix network reset
Jonatan Schlag [Sat, 30 Jun 2018 15:53:48 +0000 (17:53 +0200)]
Fix network reset

The functions zone_destroy and zone_destroy_now where merged to
zone_destroy in an earlier commit. So we have to use zone_destroy here.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoWe need to change the path of the image in the settings file to
Jonatan Schlag [Mon, 25 Jun 2018 09:01:43 +0000 (11:01 +0200)]
We need to change the path of the image in the settings file to

When we do not change this path accordingly to the place where we store
our images the copy in feature does not work.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoAdapt settings file of nitsi tests to new syntax
Jonatan Schlag [Mon, 25 Jun 2018 09:01:42 +0000 (11:01 +0200)]
Adapt settings file of nitsi tests to new syntax

Nitsi is using a new syntax for settings file so we need to change the
settings files of our tests.

I dropped some settings in the hello-world test because we do not need
them for this test.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoAdapt nitsi command line to new syntax
Jonatan Schlag [Mon, 25 Jun 2018 09:01:41 +0000 (11:01 +0200)]
Adapt nitsi command line to new syntax

Nitsi is now using subparsers so we have to add 'run-test' to the
command line.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agoDrop README file from virtual environment
Michael Tremer [Mon, 4 Jun 2018 15:38:32 +0000 (16:38 +0100)]
Drop README file from virtual environment

Those instructions are no longer valid

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
10 months agoNITSI: Automatically download required images
Michael Tremer [Mon, 4 Jun 2018 15:38:31 +0000 (16:38 +0100)]
NITSI: Automatically download required images

This patch lets make automatically download all required
images and extracts them.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
10 months agoMakefile: Ship virtual environment files in release tarball
Michael Tremer [Mon, 4 Jun 2018 15:38:30 +0000 (16:38 +0100)]
Makefile: Ship virtual environment files in release tarball

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
10 months agonitsi: Add a test that calls "make check" in the virtual environment
Michael Tremer [Mon, 4 Jun 2018 15:38:29 +0000 (16:38 +0100)]
nitsi: Add a test that calls "make check" in the virtual environment

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
10 months agoMakefile: Remove any excess substitution rules
Michael Tremer [Mon, 4 Jun 2018 15:38:28 +0000 (16:38 +0100)]
Makefile: Remove any excess substitution rules

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
10 months agoBuild source tarball before running any NITSI tests
Michael Tremer [Mon, 4 Jun 2018 15:38:27 +0000 (16:38 +0100)]
Build source tarball before running any NITSI tests

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
10 months agonitsi: Create "nitsi" Makefile target
Michael Tremer [Mon, 4 Jun 2018 15:38:26 +0000 (16:38 +0100)]
nitsi: Create "nitsi" Makefile target

Calling "make nitsi" will run all nitsi tests

Reviewed-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agoFix test hello-world
Jonatan Schlag [Mon, 4 Jun 2018 09:57:31 +0000 (11:57 +0200)]
Fix test hello-world

In the moment a single all statement is not supported by nitsi.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agoFix path to virtual environment of hello-world test
Jonatan Schlag [Mon, 4 Jun 2018 09:50:53 +0000 (11:50 +0200)]
Fix path to virtual environment of hello-world test

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agoAdd first test for nitsi
Jonatan Schlag [Mon, 28 May 2018 14:12:26 +0000 (16:12 +0200)]
Add first test for nitsi

This commit introduce NITSI. Nitsi is the "Networking integration test
suite for IPFire". We can test the network code in a virtual environment
on any system.

This test has the only purpose to check if nitsi is working.

For more information about nitsi see the manpages and the git
repository on git.ipfire.org

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agoAdd simple Readme for the basic virtual-environment
Jonatan Schlag [Mon, 4 Jun 2018 07:45:35 +0000 (09:45 +0200)]
Add simple Readme for the basic virtual-environment

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agoAdd first basic virtual environment for nitsi
Jonatan Schlag [Mon, 4 Jun 2018 07:45:34 +0000 (09:45 +0200)]
Add first basic virtual environment for nitsi

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
13 months agoIPsec: regenerate a swanctl config on connection startup if no config is found
Jonatan Schlag [Thu, 8 Mar 2018 09:09:02 +0000 (09:09 +0000)]
IPsec: regenerate a swanctl config on connection startup if no config is found

This is an easy way to forcing a regenration if we do not want to change any setting.

Fixes: #11627

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
13 months agoip-tunnel: choose the correct type based on the ip protocol
Jonatan Schlag [Sun, 4 Mar 2018 18:24:59 +0000 (18:24 +0000)]
ip-tunnel: choose the correct type based on the ip protocol

IPv4 and IPv6 need different types for iproute2.
So in the _add function we have to determine the mode
based on the IP protocol of the ${remote_address}.

When we change ikey and okey we have to dertermine the mode the device
have currently.

Fixes: #11431

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
13 months agoip-tunnel: Improve checks
Jonatan Schlag [Sun, 4 Mar 2018 18:24:58 +0000 (18:24 +0000)]
ip-tunnel: Improve checks

We cannot mix ipv6 and ipv4 and we also need to detect the IP protocol
version to decide which mode we have to use.
This is done in a seperated commit.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
13 months agodevice: add new function device_tunnel_get_type()
Jonatan Schlag [Sun, 4 Mar 2018 18:24:57 +0000 (18:24 +0000)]
device: add new function device_tunnel_get_type()

If we already know that the device must be a ip-tunnel device
we can save time when we check just for the types
a ip-tunnel device can have.

To avoid code duplication we call this function from device_get_type()

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
13 months agodevice: add new function device_is_vti6
Jonatan Schlag [Sun, 4 Mar 2018 18:24:56 +0000 (18:24 +0000)]
device: add new function device_is_vti6

This functions checks if a device is a vti6 device.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
13 months agoip-tunnel: add new function
Jonatan Schlag [Sun, 4 Mar 2018 18:24:55 +0000 (18:24 +0000)]
ip-tunnel: add new function

To be undependent from the IP protocol we use, when we use tunnel modes
in our code, this function converts the modes
to the modes the iproute2 tool uses
which often depend on the IP protocol version.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
13 months agoIPsec: Fix routing in tunnel mode
Jonatan Schlag [Sun, 4 Mar 2018 16:19:55 +0000 (16:19 +0000)]
IPsec: Fix routing in tunnel mode

Two syntax errors make the routing in tunnel mode non working

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
13 months agofirewall: Disable PMTU by default
Michael Tremer [Thu, 1 Mar 2018 15:22:47 +0000 (15:22 +0000)]
firewall: Disable PMTU by default

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
13 months agofirewall: Enable ECN by default
Michael Tremer [Thu, 1 Mar 2018 15:21:13 +0000 (15:21 +0000)]
firewall: Enable ECN by default

Apple has tried this and it seems to be safe now

https://www.ietf.org/proceedings/98/slides/slides-98-maprg-tcp-ecn-experience-with-enabling-ecn-on-the-internet-padma-bhooma-00.pdf

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
13 months agofirewall: Enable ECN fallback mechanism when ECN is enabled
Michael Tremer [Thu, 1 Mar 2018 15:16:27 +0000 (15:16 +0000)]
firewall: Enable ECN fallback mechanism when ECN is enabled

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
13 months agoIPsec: Fix routing
Jonatan Schlag [Thu, 1 Mar 2018 15:15:38 +0000 (15:15 +0000)]
IPsec: Fix routing

Based on the examples found in strongswan
we need to specific the source IP for our routes through an IPsec VPN.
If we have no source IP (a router can route packages
which do not belong to the network assigned to our zones) we set no routes,
but clients can still use the tunnel.

For IPsec VPNs in tunnel mode we
also need the device which has the ${PLUTO_ME} IP address asigned.

The source IP  is determined ip_get_assigned_addresses_from_net()
the device is determined by the  device_get_by_ip_address() function.

For tunnel mode see:
https://www.strongswan.org/testing/testresults/ipv6-stroke/net2net-ip4-in-ip6-ikev2/moon.ip.route

Fixes: #11629

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
13 months agoIPsec: Log the content of all PLUTO variables in debug mode
Jonatan Schlag via network [Fri, 23 Feb 2018 11:05:35 +0000 (11:05 +0000)]
IPsec: Log the content of all PLUTO variables in debug mode

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
13 months agoAdd new function ip_get__assigned_addresses_from_net()
Jonatan Schlag [Wed, 28 Feb 2018 16:31:27 +0000 (16:31 +0000)]
Add new function ip_get__assigned_addresses_from_net()

This function is neede by IPsec to set the routes correctly.
We can now now find a source IP for a given net.
This way is ugly because the source IP
is unpredictable if we get multiple IPs.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
13 months agoAdd new function: device_get_by_assigned_ip_address()
Jonatan Schlag via network [Fri, 23 Feb 2018 11:05:33 +0000 (11:05 +0000)]
Add new function: device_get_by_assigned_ip_address()

This function is used to get a device from an IP address
which is assigned to the device.
This function needs to be introduced
to set the routes for IPsec correctly.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
14 months agoFix zone_config_check_same_setting
Jonatan Schlag [Wed, 7 Feb 2018 14:53:47 +0000 (14:53 +0000)]
Fix zone_config_check_same_setting

Every time we edited a config zone_config_check_same_setting
returns that a identical config was found but this config was the config
we want to edit. So we now generate the id inside hook_new and pass the
id always to hook_parse_cmdline and to zone_config_check_same_setting.

So we can skip this config.

Fixes: #11451

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
14 months agoFix radvd startup
Jonatan Schlag [Sat, 10 Feb 2018 12:14:05 +0000 (12:14 +0000)]
Fix radvd startup

We now only start radvd when we write a config for a zone into the config
file.

Fixes: #11450

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
14 months agoReplace ipv[64]-static by one static hook
Michael Tremer [Tue, 6 Feb 2018 14:49:21 +0000 (14:49 +0000)]
Replace ipv[64]-static by one static hook

There is no need to split this into multiple hooks
since they share a lot of common configuration, etc.

There is no migration path provided here.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
14 months agoipv6-static: Remove shell switches to define address and prefix
Michael Tremer [Tue, 6 Feb 2018 13:43:38 +0000 (13:43 +0000)]
ipv6-static: Remove shell switches to define address and prefix

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
14 months agoMakefile: All shell library files where executable which they shouldn't be
Michael Tremer [Tue, 6 Feb 2018 13:39:41 +0000 (13:39 +0000)]
Makefile: All shell library files where executable which they shouldn't be

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
14 months agofunctions: Include path to new utils
Michael Tremer [Tue, 6 Feb 2018 13:36:36 +0000 (13:36 +0000)]
functions: Include path to new utils

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
14 months agonetwork-phy-list-ht-caps: Don't print empty lines
Michael Tremer [Tue, 6 Feb 2018 13:32:40 +0000 (13:32 +0000)]
network-phy-list-ht-caps: Don't print empty lines

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
14 months agolibnetwork: Don't fail when wireless devices are not supported by nl80211
Michael Tremer [Tue, 6 Feb 2018 13:31:48 +0000 (13:31 +0000)]
libnetwork: Don't fail when wireless devices are not supported by nl80211

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
14 months agolibnetwork: Properly handle errors from netlink messages
Michael Tremer [Tue, 6 Feb 2018 13:21:29 +0000 (13:21 +0000)]
libnetwork: Properly handle errors from netlink messages

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
14 months agonetwork-phy-list-ht-caps: Fix SEGV when no PHY was found
Michael Tremer [Tue, 6 Feb 2018 11:46:56 +0000 (11:46 +0000)]
network-phy-list-ht-caps: Fix SEGV when no PHY was found

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>