IPsec: Fix routing in tunnel mode

Two syntax errors make the routing in tunnel mode non working

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

firewall: Disable PMTU by default

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

firewall: Enable ECN by default

Apple has tried this and it seems to be safe now

https://www.ietf.org/proceedings/98/slides/slides-98-maprg-tcp-ecn-experience-with-enabling-ecn-on-the-internet-padma-bhooma-00.pdf

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

firewall: Enable ECN fallback mechanism when ECN is enabled

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Fix routing

Based on the examples found in strongswan
we need to specific the source IP for our routes through an IPsec VPN.
If we have no source IP (a router can route packages
which do not belong to the network assigned to our zones) we set no routes,
but clients can still use the tunnel.

For IPsec VPNs in tunnel mode we
also need the device which has the ${PLUTO_ME} IP address asigned.

The source IP  is determined ip_get_assigned_addresses_from_net()
the device is determined by the  device_get_by_ip_address() function.

For tunnel mode see:
https://www.strongswan.org/testing/testresults/ipv6-stroke/net2net-ip4-in-ip6-ikev2/moon.ip.route

Fixes: #11629
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Log the content of all PLUTO variables in debug mode

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Add new function ip_get__assigned_addresses_from_net()

This function is neede by IPsec to set the routes correctly.
We can now now find a source IP for a given net.
This way is ugly because the source IP
is unpredictable if we get multiple IPs.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Add new function: device_get_by_assigned_ip_address()

This function is used to get a device from an IP address
which is assigned to the device.
This function needs to be introduced
to set the routes for IPsec correctly.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Fix zone_config_check_same_setting

Every time we edited a config zone_config_check_same_setting
returns that a identical config was found but this config was the config
we want to edit. So we now generate the id inside hook_new and pass the
id always to hook_parse_cmdline and to zone_config_check_same_setting.

So we can skip this config.

Fixes: #11451
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Fix radvd startup

We now only start radvd when we write a config for a zone into the config
file.

Fixes: #11450
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Replace ipv[64]-static by one static hook

There is no need to split this into multiple hooks
since they share a lot of common configuration, etc.

There is no migration path provided here.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipv6-static: Remove shell switches to define address and prefix

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Makefile: All shell library files where executable which they shouldn't be

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

functions: Include path to new utils

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

network-phy-list-ht-caps: Don't print empty lines

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libnetwork: Don't fail when wireless devices are not supported by nl80211

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libnetwork: Properly handle errors from netlink messages

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

network-phy-list-ht-caps: Fix SEGV when no PHY was found

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libnetwork: Add command that returns supported HT caps for wireless PHYs

Fixes #11611

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libnetwork: Add objects for 802.11 PHYs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libnetwork: Initialise netlink connection when initialising context

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libnetwork: Depend on libnl >= 3.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libnetwork: Get index for interfaces

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libnetwork: Add network_log function to header

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libnetwork: Actually free context

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libnetwork: Add interface objects

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libnetwork: Add logging infrastructure

Fixes #11610

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libnetwork: Add central context object

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ip-tunnel: Make delete function an alias for device_delete

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Shut down devices before we remove them

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dhclient-script: fix bound

When we get a BOUND we should have only new_* variables set.
So it is stated in the manpage.
Apparently, also old_* variables are set so we never got into the block where the IP address was set.
We now always set a new IP Address when we get a BOUND.

Fixes: #11363
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Jonatan Schlag &lt;<a href="mailto:jonatan.schlag@ipfire.org">jonatan.schlag@ipfire.org</a>&gt;
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless-networks: validate priority

Fixes: #11469
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless-networks: change encryption-mode to modes

We also use now our great +/- syntax.

Fixes: #11471
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Properly validate FQDNs

Fixes #11441

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Make testuite run properly to make make distcheck happy

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Create configuration directories on install

Fixes #11455

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop placeholder for WEP key validation

We don't support WEP any more.

Fixes #11468

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

man: Update wireless zone documentation according to latest changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Add new libnetwork

This is going to be a central place to all things that needed
to be implemented in C here.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

man: Add documentation for VPN security policies

Fixes #11426

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless networks: Actively scan for hidden networks

Fixes #11476

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless networks: Allow using a client certificate to authenticate

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless networks: Set default MODES

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless networks: Set default priority to 0

This is wpa_supplicant's default, too and the user can
then set any priority higher and order the networks according
to own preferences.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless: Use random MAC addresses when scanning for better privacy

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless networks: Allow using WPA-EAP

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless networks: Allow using a custom CA per network

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless networks: Verify server certificates against CAs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless networks: Write user credentials into configuration

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless networks: Rename ENCRYPTION_MODES to MODES

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wpa_supplicant: Drop complicated config generation function

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

802.11s: Generate config in extra function

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Forgot to move one line

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wpa_supplicant: Move config header generation into own function

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless: Add support for 802.1X authentication

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless: Fix crash of status if not connected

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wpa_supplicant: Doesn't like spaces here

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wpa_supplicant: Add ctrl_interface

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

interrupts: Fix passing of command line args with $@

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

interrupts: Fix directory listing

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless: Drop old network configuration from hook and use new one

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless networks: Add priority to WPA supplicant configuration

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless networks: Allow using multiple modes at the same time

To be more compatible with networks where encryption methods
are unknown, we allow using multiple (or all) methods that
we support at the same time.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless: Drop support for WEP

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless networks: Add configured EAP modes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless networks: Convert to use handles internally

SSIDs are hard to handle since we have no efficient way to
list them all.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless networks: Allow exporting configuration into WPA supplicant format

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless networks: Validate any PSKs for WPA*

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless networks: Only delete one network at a time

Destroying multiple networks in one go is not really a good
idea here, since error codes are not properly passed on.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless networks: Properly validate encryption modes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless networks: Call pre-shared-key correctly

The name "key" is used multiple times here. Once for the
pre-shared-key of the network and secondly for the configuration
field in the settings file.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cli_wireless_network: Refactor for better application logic

No functional changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Fix typo

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Move wireless networks functions into extra file

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rename NETWORK_WIRELESS_NETWORK_DIR to NETWORK_WIRELESS_NETWORKS_DIR

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless: add network feature

See http://wiki.ipfire.org/devel/network/wireless-networks

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

util: add normalize function

This function remove all non alpha numerical characters from a string
and substitute this characters with one -

So HELLO%%/$&/)%$%(&&HH becomes hello-hh

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop wireless-adhoc port

This was only useful for B.A.T.M.A.N. and could not be
attached to a bridge zone which leaves it useless for us.

The backend functionality is kept to potentially implement
this as a zone again.

Fixes #11460

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Remove B.A.T.M.A.N.

We do not seem to have an obvious application for this
and since 802.11s is wider supported we will support
that for wireless mesh networks instead.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bridge: Correctly apply STP priority

Fixes #10609

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rename make_parent_dir to make_parent_directory

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dhclient-script: IP addresses could change on REBIND

When the client binds to a new DHCP server, the IP address
could change and therefore we need to check if that has
happened and update everything accordingly.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dhclient-script: No need to set up the device again

To get the lease, the device must have been up

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wpa_supplicant: Use nl80211 instead of wext to communicate with the kernel

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wpa_supplicant: Fix typo in variable name

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wpa_supplicant: Move configuration to /etc/wpa_supplicant

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wpa_supplicant: Drop config helper

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

802.11s: Write WPA supplicant configuration

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wpa_supplicant: Support 802.11s

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Remove obsolete comment

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

802.11s: Allow setting a PSK for SAE authentication

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wpa_supplicant: Rename zone variable to device

Since we are using this for ports now, too, the variable
should have a generic name and the zone check must be removed

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Remove zone_dir and zone_file

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Dropping port_dir()

This function is always returning constant values but
needs to fork a subshell for that which has some performance
impact.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

device_get_all: Drop function

This is basically device_list which is used everywhere else
in the code.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Introduce list_directory

This function lists all files in a directory which
is a functionality that we use very very often.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hooks_list: Remove duplicate function

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-pools: reload pools after destroying pools

Fixes: #11433
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-pool: delete on destroy also the swanctl configuration file

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

network reset: destroy all IPsec pools

Fixes: #11432
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>