vlan: Create devices when they don't exist, yet

The hotplug triggers will take care of attaching the
device to the zone it should belong to.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Revert "Never overwrite PATH"

This reverts commit 42249a1489fab6c1baae91e23fd8a91302570b48.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

util: Drop cmd_clean_environment function

cmd is now doing this by default

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

util: Fix cmd function and never leak anything into the environment

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Save START_ACTION parameter

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: log a debug message when deleting a strongswan config

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: fix enable and disable

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Only set traffic selector marks in VTI mode

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Fix typo

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Make sure not to reload strongswan if it is not running

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

settings: Use file_delete to delete a file

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Properly shut down connections when destroyed

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Make sure strongswan is started when it should be

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

reset: Destroy all user-defined security policies

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

reset: Destroy all IPsec VPN connections

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

settings: Don't log skipped configuration lines

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Add our configuration header to each configuration file

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Fix typo in variable check

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Enable strongswan to start at boot when needed

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Always make sure that n2n connections are unique

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: add status feature

We can now disable and enable IPsec connections.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: reload connection when the security policy changes

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: reload connection when the config changes

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Set routes to peered networks

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: GRE: Use outer IP addresses for peering

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ip-tunnel: Use "ip link" instead of "ip tunnel"

ip tunnel seems to be in an awful condition and ip
link works just fine.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Let the updown script handle all events

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rename fwrite to fappend

Because that is what the function is actually doing.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

security-policies: Delete cached content when policy is deleted

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

security-policies: Rename AH proposals to IKE proposals

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Revert "ipsec: Only allow strict use of security policies"

This reverts commit a48e4dd265d6256fdc3c5b2fc8e6b85ca4d40361.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

security-policies: Cache output of proposal generators

These functions are really really slow and the output stays
constants as long as the configuration is not being changed.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Only allow strict use of security policies

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Fix DPD configuration

dpd_action has to go into the children section

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bash-autocompletion: up and down for ipsec connections

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Add prototype-level support for GRE tunnels

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ip-tunnel: Add support for GRE tunnels

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Fix configuration variable list

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Add prototype-level support for VTI

This will create a VTI interface for IPsec connections
configured as such and bring it up so that traffic can
be passed around.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Add commands to bring connections up and down

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ip-tunnel: Make local address optional

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bash-autocompletion: add basic security-policy support

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

raw: add command vpn-security-policy-exists

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: add local address, dpd settings and start action settings

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Support Dead Peer Detection

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Allow defining START_ACTION

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Support binding a connection to a certain address

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Write functions to generate strongSwan configuration

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Disable compression in system policy

Compression in IPsec is slow (strongSwan only supports
DEFLATE) and there are security concerns about it
revealing information about the plaintext.

So for a little gain in bandwith, it does not seem to
be right to take that risk right now.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Fix typos in CLI parsing

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

security-policies: List "performance" as read-only

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bash-autocompletion: fix typos

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: add basic bash completion for ipsec

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

raw: add command new list-vpn-security-policies-all

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

raw: add new command list-ipsec-connections

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

raw: add new command ipsec-connection-exists

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

vpn-security-policies: add new function vpn_security_policies_list_all

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: add new function ipsec_list_connections

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Fix typo

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wpa_supplication: Correctly escape SSIDs with spaces

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

vti: Disable policy lookups for VTI devices

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Check PSK for a good length

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Fix typo in warning message

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Fix another shell syntax error

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Always make value of AUTH_MODE uppercase

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Add connection show command

This shows the current configuration of a connection

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Fix another bash syntax error

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Fix typo

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Move connections to /etc/network/vpn/ipsec/connections

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Makefile: Fix alphabetical order

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

vpn: Move VPN CLI functions into separate files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

route: Move CLI functions into functions file

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

network: add new ipsec functionality

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: add new functions

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

config hook: prevent two hooks with the same settings

A ipv4-static config with the same IPv4 address twice is senseless.
A new function zone_config_check_same_setting is introduced.
The function provides an easy way to check if a config
of the given hook has the same value for a given key.
We can now check inside hook_new if an ipv4-static or ipv6-static config
with the same value exist and break with an error.

Fixes: #11418
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

autocompletion: use hids instead of ids

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

raw: add command zone-config-hid-is-valid

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

raw: add command list-zone-config-hids

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

header-config: add generic hook_hid function

This function will always be there so when we call hook_hid we will get a result.
This is also nice for testing.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hook: also hook_hid is a valid command

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

zone: config list print also hids

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

zone: accept also hids in zone_config()

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

zone: add config hid functions

These are the basic functions to work with hids.

Fixes: #11406
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

header-zone: refactor hook_config_destroy

We now just bring the hook down, execute hook_destroy which can be not empty inside the hook,
because it is defined in src/header-config.
After this we delete the config file.

Fixes: #11416
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

zone: new function zone_config_settings_destroy

Similar to zone_config_settings_write and zone_config_settings_read
this function provides an easy way to delete a config file.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

autocompletion: improve config part

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

network: add new raw command zone-config-id-is-valid

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

network: add new raw command list-zone-config-ids

This commands make it possible to list all used ids
for a zone from the command line.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

zone: add new function zone_config_list_ids

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Remove support for Rapid Spanning Tree Protocol

The userspace daemon is not very stable and unfortunately
not very well tested so that reliable use of it is impossible
right now.

We keep supporting STP as implemented in the Linux kernel
which has some disadvantages, but has proven to be more solid.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

security-policies: Add new "performance" policy

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Remove overcomplicated list assignment which doesn't work

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Fix syntax error after line-break

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

util: Log return code of commands only if something failed

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

list: Make use of the assign function to set variables

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

header-port: Remove unsafe use of eval

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

list: Remove unsafe use of eval

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

security-polices: Improve modification of cipher lists

This now supports setting a cipher list in one command and returns
some useful warnings when an intended change could not be performed.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

batman-adv: Use correct functions to read from /sys/class/net

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Improve performance of reading files from the device tree

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>