Merge branch 'master' into next

diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
index 97b8897af87bba6f84ec2e961e3bbb62849a17ef..8abc675f7f6f8d5693598ade0523748a5b20f20d 100755 (executable)
--- a/config/firewall/rules.pl
+++ b/config/firewall/rules.pl
@@ -88,14 +88,27 @@ sub main {
        # Flush all chains.
        &flush();
 
-       # Reload firewall rules.
-       &preparerules();
+       # Prepare firewall rules.
+       if (! -z  "${General::swroot}/firewall/input"){
+               &buildrules(\%configinputfw);
+       }
+       if (! -z  "${General::swroot}/firewall/outgoing"){
+               &buildrules(\%configoutgoingfw);
+       }
+       if (! -z  "${General::swroot}/firewall/config"){
+               &buildrules(\%configfwdfw);
+       }
 
        # Load P2P block rules.
        &p2pblock();
 
        # Reload firewall policy.
        run("/usr/sbin/firewall-policy");
+
+       #Reload firewall.local if present
+       if ( -f '/etc/sysconfig/firewall.local'){
+               run("/etc/sysconfig/firewall.local reload");
+       }
 }
 
 sub run {
@@ -146,18 +159,6 @@ sub flush {
        run("$IPTABLES -t mangle -F $CHAIN_MANGLE_NAT_DESTINATION_FIX");
 }
 
-sub preparerules {
-       if (! -z  "${General::swroot}/firewall/input"){
-               &buildrules(\%configinputfw);
-       }
-       if (! -z  "${General::swroot}/firewall/outgoing"){
-               &buildrules(\%configoutgoingfw);
-       }
-       if (! -z  "${General::swroot}/firewall/config"){
-               &buildrules(\%configfwdfw);
-       }
-}
-
 sub buildrules {
        my $hash = shift;
 
@@ -512,10 +513,6 @@ sub buildrules {
                        }
                }
        }
-       #Reload firewall.local if present
-       if ( -f '/etc/sysconfig/firewall.local'){
-               run("/etc/sysconfig/firewall.local reload");
-       }
 }
 
 # Formats the given timestamp into the iptables format which is "hh:mm" UTC.

diff --git a/config/httpd/global.conf b/config/httpd/global.conf
index a9770264366361a611db5ea5e91238fa81289c6f..3fbd5e2946d9b36a7d225510e79715b9095a73b5 100644 (file)
--- a/config/httpd/global.conf
+++ b/config/httpd/global.conf
@@ -1,7 +1,7 @@
 Timeout 300
 ServerSignature on
 UseCanonicalName off
-ServerTokens Full
+ServerTokens Prod
 LogLevel warn
 CustomLog /var/log/httpd/access_log combined
 Include /etc/httpd/conf/hostname.conf

diff --git a/config/rootfiles/common/armv5tel/initscripts b/config/rootfiles/common/armv5tel/initscripts
index 52487669ae19830a73c17cb9f05804a56e4b0bf4..8ddf34ae87fa656dc450c1e5ad47387dbf1c616f 100644 (file)
--- a/config/rootfiles/common/armv5tel/initscripts
+++ b/config/rootfiles/common/armv5tel/initscripts
@@ -61,6 +61,7 @@ etc/rc.d/init.d/mounttmpfs
 #etc/rc.d/init.d/mysql
 #etc/rc.d/init.d/netsnmpd
 etc/rc.d/init.d/network
+etc/rc.d/init.d/network-trigger
 etc/rc.d/init.d/network-vlans
 #etc/rc.d/init.d/networking
 etc/rc.d/init.d/networking/any
@@ -229,6 +230,7 @@ etc/rc.d/rcsysinit.d/S73swconfig
 etc/rc.d/rcsysinit.d/S75firstsetup
 etc/rc.d/rcsysinit.d/S80localnet
 etc/rc.d/rcsysinit.d/S85firewall
+etc/rc.d/rcsysinit.d/S90network-trigger
 etc/rc.d/rcsysinit.d/S91network-vlans
 etc/rc.d/rcsysinit.d/S92rngd
 etc/rc.d/rc3.d/S15fireinfo

diff --git a/config/rootfiles/common/i586/initscripts b/config/rootfiles/common/i586/initscripts
index 845ae504b3f38327734ad393274a796542ed6745..3d4dd62ff0495f52d8a5ea59b0d83c3be3c87df9 100644 (file)
--- a/config/rootfiles/common/i586/initscripts
+++ b/config/rootfiles/common/i586/initscripts
@@ -63,6 +63,7 @@ etc/rc.d/init.d/mounttmpfs
 #etc/rc.d/init.d/mysql
 #etc/rc.d/init.d/netsnmpd
 etc/rc.d/init.d/network
+etc/rc.d/init.d/network-trigger
 etc/rc.d/init.d/network-vlans
 #etc/rc.d/init.d/networking
 etc/rc.d/init.d/networking/any
@@ -234,6 +235,7 @@ etc/rc.d/rcsysinit.d/S70console
 etc/rc.d/rcsysinit.d/S75firstsetup
 etc/rc.d/rcsysinit.d/S80localnet
 etc/rc.d/rcsysinit.d/S85firewall
+etc/rc.d/rcsysinit.d/S90network-trigger
 etc/rc.d/rcsysinit.d/S91network-vlans
 etc/rc.d/rcsysinit.d/S92rngd
 etc/rc.d/rc3.d/S15fireinfo

diff --git a/config/rootfiles/common/strongswan b/config/rootfiles/common/strongswan
index e55c43c03b9975fe0f6dd106dc84dba5255cd018..a26a86c3e2bace808fc74e38266a437398b9c4ae 100644 (file)
--- a/config/rootfiles/common/strongswan
+++ b/config/rootfiles/common/strongswan
@@ -30,6 +30,7 @@ etc/strongswan.d/charon/eap-tls.conf
 etc/strongswan.d/charon/eap-ttls.conf
 etc/strongswan.d/charon/farp.conf
 etc/strongswan.d/charon/fips-prf.conf
+etc/strongswan.d/charon/gcm.conf
 etc/strongswan.d/charon/gcrypt.conf
 etc/strongswan.d/charon/gmp.conf
 etc/strongswan.d/charon/hmac.conf
@@ -107,6 +108,7 @@ usr/lib/ipsec/plugins/libstrongswan-eap-tls.so
 usr/lib/ipsec/plugins/libstrongswan-eap-ttls.so
 usr/lib/ipsec/plugins/libstrongswan-farp.so
 usr/lib/ipsec/plugins/libstrongswan-fips-prf.so
+usr/lib/ipsec/plugins/libstrongswan-gcm.so
 usr/lib/ipsec/plugins/libstrongswan-gcrypt.so
 usr/lib/ipsec/plugins/libstrongswan-gmp.so
 usr/lib/ipsec/plugins/libstrongswan-hmac.so
@@ -187,6 +189,7 @@ usr/sbin/ipsec
 #usr/share/strongswan/templates/config/plugins/eap-ttls.conf
 #usr/share/strongswan/templates/config/plugins/farp.conf
 #usr/share/strongswan/templates/config/plugins/fips-prf.conf
+#usr/share/strongswan/templates/config/plugins/gcm.conf
 #usr/share/strongswan/templates/config/plugins/gcrypt.conf
 #usr/share/strongswan/templates/config/plugins/gmp.conf
 #usr/share/strongswan/templates/config/plugins/hmac.conf

diff --git a/config/rootfiles/common/udev b/config/rootfiles/common/udev
index bc1cdaa1ff3ba1ceae448a37f13ed5b8314b6e85..d01c4610158f05d6da4b1febd2f1ac5b1e6ee772 100644 (file)
--- a/config/rootfiles/common/udev
+++ b/config/rootfiles/common/udev
@@ -2,7 +2,6 @@ bin/udevadm
 etc/modprobe.d/blacklist.conf
 etc/udev
 #etc/udev/rules.d
-#etc/udev/rules.d/30-persistent-network.rules
 #etc/udev/rules.d/55-lfs.rules
 #etc/udev/rules.d/81-cdrom.rules
 #etc/udev/rules.d/83-cdrom-symlinks.rules
@@ -29,6 +28,7 @@ lib/udev
 #lib/udev/hwdb.d/60-keyboard.hwdb
 #lib/udev/init-net-rules.sh
 #lib/udev/mtd_probe
+#lib/udev/network-hotplug-rename
 #lib/udev/rule_generator.functions
 #lib/udev/rules.d
 #lib/udev/rules.d/25-alsa.rules
@@ -37,6 +37,7 @@ lib/udev
 #lib/udev/rules.d/50-udev-default.rules
 #lib/udev/rules.d/60-cdrom_id.rules
 #lib/udev/rules.d/60-keyboard.rules
+#lib/udev/rules.d/60-net.rules
 #lib/udev/rules.d/60-persistent-alsa.rules
 #lib/udev/rules.d/60-persistent-input.rules
 #lib/udev/rules.d/60-persistent-serial.rules

diff --git a/config/udev/60-net.rules b/config/udev/60-net.rules
new file mode 100644 (file)
index 0000000..4f22a1e
--- /dev/null
+++ b/config/udev/60-net.rules
@@ -0,0 +1,3 @@
+# Call a script that checks for the right name of the new device.
+# If it matches the configuration it will be renamed accordingly.
+ACTION=="add", SUBSYSTEM=="net", PROGRAM="/lib/udev/network-hotplug-rename", RESULT=="?*", NAME="$result"

diff --git a/config/udev/network-hotplug-rename b/config/udev/network-hotplug-rename
new file mode 100644 (file)
index 0000000..331b788
--- /dev/null
+++ b/config/udev/network-hotplug-rename
@@ -0,0 +1,75 @@
+#!/bin/bash
+###############################################################################
+#                                                                             #
+# IPFire.org - A linux based firewall                                         #
+# Copyright (C) 2015  IPFire Team  <info@ipfire.org>                          #
+#                                                                             #
+# This program is free software: you can redistribute it and/or modify        #
+# it under the terms of the GNU General Public License as published by        #
+# the Free Software Foundation, either version 3 of the License, or           #
+# (at your option) any later version.                                         #
+#                                                                             #
+# This program is distributed in the hope that it will be useful,             #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
+# GNU General Public License for more details.                                #
+#                                                                             #
+# You should have received a copy of the GNU General Public License           #
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
+#                                                                             #
+###############################################################################
+
+# Check if all appropriate variables are set
+[ -n "${INTERFACE}" ] || exit 2
+
+# Ignore virtual interfaces, etc.
+case "${INTERFACE}" in
+       lo)
+               exit 0
+               ;;
+       tun*)
+               exit 0
+               ;;
+       ppp*)
+               exit 0
+               ;;
+esac
+
+# Check if INTERFACE actually exists
+[ -d "/sys/class/net/${INTERFACE}" ] || exit 1
+
+# If the network configuration is not readable,
+# we cannot go on.
+if [ ! -r "/var/ipfire/ethernet/settings" ]; then
+       exit 1
+fi
+
+# Read network settings
+eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
+
+# Standard zones
+ZONES="RED GREEN ORANGE BLUE"
+
+# Determine the address of INTERFACE
+ADDRESS="$(</sys/class/net/${INTERFACE}/address)"
+
+# Walk through all zones and find the matching interface
+for zone in ${ZONES}; do
+       address="${zone}_MACADDR"
+       device="${zone}_DEV"
+
+       # Skip if address or device is unset
+       [ -n "${!address}" -a -n "${!device}" ] || continue
+
+       # If a matching interface has been found we will
+       # print the name to which udev will rename it.
+       if [ "${ADDRESS}" = "${!address}" ]; then
+               echo "${!device}"
+               exit 0
+       fi
+done
+
+# If we get here we have not found a matching device,
+# but we won't return an error any way. The new device
+# will remain with the previous name.
+exit 0

diff --git a/html/cgi-bin/connections.cgi b/html/cgi-bin/connections.cgi
index f1ed2125a2cb9e253ca332f7de01c1b09985e601..5c17d33e276a51c4a90bda383e2c616af012c818 100644 (file)
--- a/html/cgi-bin/connections.cgi
+++ b/html/cgi-bin/connections.cgi
@@ -520,7 +520,8 @@ foreach my $line (@conntrack) {
        }
 
        my $sip_colour = ipcolour($sip);
-       my $dip_colour = ipcolour($dip);
+       # use colour of destination network for DNAT
+       my $dip_colour = $dip ne $dip_ret ? ipcolour($dip_ret) : ipcolour($dip);
 
        my $sserv = '';
        if ($sport < 1024) {

diff --git a/html/cgi-bin/logs.cgi/firewalllog.dat b/html/cgi-bin/logs.cgi/firewalllog.dat
index 8bb4900638b7b1ce431c99c18d568c65f159aa84..7525626668b6aa595b1a6dca0221a385032210b4 100644 (file)
--- a/html/cgi-bin/logs.cgi/firewalllog.dat
+++ b/html/cgi-bin/logs.cgi/firewalllog.dat
@@ -334,13 +334,14 @@ foreach $_ (@log)
         my $comment = $3; 
         my $packet = $4;
 
-        $packet =~ /IN=(\w+)/;       my $iface=$1; if ( $1 =~ /2./ ){ $iface="";}
-        $packet =~ /SRC=([\d\.]+)/;  my $srcaddr=$1;
-        $packet =~ /DST=([\d\.]+)/;  my $dstaddr=$1;
-        $packet =~ /MAC=([\w+\:]+)/; my $macaddr=$1;
-        $packet =~ /PROTO=(\w+)/;    my $proto=$1;
-        $packet =~ /SPT=(\d+)/;      my $srcport=$1;
-        $packet =~ /DPT=(\d+)/;      my $dstport=$1;
+               my ($iface, $srcaddr, $dstaddr, $macaddr, $proto, $srcport, $dstport);
+               $iface=$1   if $packet =~ /IN=(\w+)/;
+               $srcaddr=$1 if $packet =~ /SRC=([\d\.]+)/;
+               $dstaddr=$1 if $packet =~ /DST=([\d\.]+)/;
+               $macaddr=$1 if $packet =~ /MAC=([\w+\:]+)/;
+               $proto=$1   if $packet =~ /PROTO=(\w+)/;
+               $srcport=$1 if $packet =~ /SPT=(\d+)/;
+               $dstport=$1 if $packet =~ /DPT=(\d+)/;
 
         my $gi = Geo::IP::PurePerl->new();
         my $ccode = $gi->country_code_by_name($srcaddr);

diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index a6d7056191a5024f414ed778e30beb34c17270e8..26f6f5311dbf96346f454e7f873c0c9e9cbc4d49 100644 (file)
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -437,14 +437,6 @@ sub writeipsecfiles {
        }
        print CONF "\n";
     }#foreach key
-
-    # Add post user includes to config file
-    # After the GUI-connections allows to patch connections.
-    if (-e "/etc/ipsec.user-post.conf") {
-        print CONF "include /etc/ipsec.user-post.conf\n";
-        print CONF "\n";
-    }
-
     print SECRETS $last_secrets if ($last_secrets);
     close(CONF);
     close(SECRETS);
@@ -1886,12 +1878,12 @@ END
        $cgiparams{'REMOTE_ID'} = '';
 
        #use default advanced value
-       $cgiparams{'IKE_ENCRYPTION'} = 'aes256|aes192|aes128|3des';     #[18];
-       $cgiparams{'IKE_INTEGRITY'}  = 'sha2_256|sha|md5';      #[19];
+       $cgiparams{'IKE_ENCRYPTION'} = 'aes256|aes192|aes128|aes256gcm128|aes192gcm128|aes128gcm128|aes256gcm96|aes192gcm96|aes128gcm96|aes256gcm64|aes192gcm64|aes128gcm64';   #[18];
+       $cgiparams{'IKE_INTEGRITY'}  = 'sha2_512|sha2_256|sha'; #[19];
        $cgiparams{'IKE_GROUPTYPE'}  = '4096|3072|2048|1536|1024';              #[20];
        $cgiparams{'IKE_LIFETIME'}   = '3';             #[16];
-       $cgiparams{'ESP_ENCRYPTION'} = 'aes256|aes192|aes128|3des';     #[21];
-       $cgiparams{'ESP_INTEGRITY'}  = 'sha2_256|sha1|md5';     #[22];
+       $cgiparams{'ESP_ENCRYPTION'} = 'aes256|aes192|aes128|aes256gcm128|aes192gcm128|aes128gcm128|aes256gcm96|aes192gcm96|aes128gcm96|aes256gcm64|aes192gcm64|aes128gcm64';   #[21];
+       $cgiparams{'ESP_INTEGRITY'}  = 'sha2_512|sha2_256|sha1';        #[22];
        $cgiparams{'ESP_GROUPTYPE'}  = '';              #[23];
        $cgiparams{'ESP_KEYLIFE'}    = '1';             #[17];
        $cgiparams{'COMPRESSION'}    = 'on';            #[13];
@@ -2145,7 +2137,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
            goto ADVANCED_ERROR;
        }
        foreach my $val (@temp) {
-           if ($val !~ /^(aes256|aes192|aes128|3des|camellia256|camellia192|camellia128)$/) {
+           if ($val !~ /^(aes(256|192|128)(gcm(128|96|64))?|3des|camellia(256|192|128))$/) {
                $errormessage = $Lang::tr{'invalid input'};
                goto ADVANCED_ERROR;
            }
@@ -2176,8 +2168,8 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
            $errormessage = $Lang::tr{'invalid input for ike lifetime'};
            goto ADVANCED_ERROR;
        }
-       if ($cgiparams{'IKE_LIFETIME'} < 1 || $cgiparams{'IKE_LIFETIME'} > 24) {
-           $errormessage = $Lang::tr{'ike lifetime should be between 1 and 24 hours'};
+       if ($cgiparams{'IKE_LIFETIME'} < 1 || $cgiparams{'IKE_LIFETIME'} > 8) {
+           $errormessage = $Lang::tr{'ike lifetime should be between 1 and 8 hours'};
            goto ADVANCED_ERROR;
        }
        @temp = split('\|', $cgiparams{'ESP_ENCRYPTION'});
@@ -2186,7 +2178,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
            goto ADVANCED_ERROR;
        }
        foreach my $val (@temp) {
-           if ($val !~ /^(aes256|aes192|aes128|3des|camellia256|camellia192|camellia128)$/) {
+           if ($val !~ /^(aes(256|192|128)(gcm(128|96|64))?|3des|camellia(256|192|128))$/) {
                $errormessage = $Lang::tr{'invalid input'};
                goto ADVANCED_ERROR;
            }
@@ -2297,6 +2289,15 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
     $checked{'IKE_ENCRYPTION'}{'aes256'} = '';
     $checked{'IKE_ENCRYPTION'}{'aes192'} = '';
     $checked{'IKE_ENCRYPTION'}{'aes128'} = '';
+    $checked{'IKE_ENCRYPTION'}{'aes256gcm128'} = '';
+    $checked{'IKE_ENCRYPTION'}{'aes192gcm128'} = '';
+    $checked{'IKE_ENCRYPTION'}{'aes128gcm128'} = '';
+    $checked{'IKE_ENCRYPTION'}{'aes256gcm96'} = '';
+    $checked{'IKE_ENCRYPTION'}{'aes192gcm96'} = '';
+    $checked{'IKE_ENCRYPTION'}{'aes128gcm96'} = '';
+    $checked{'IKE_ENCRYPTION'}{'aes256gcm64'} = '';
+    $checked{'IKE_ENCRYPTION'}{'aes192gcm64'} = '';
+    $checked{'IKE_ENCRYPTION'}{'aes128gcm64'} = '';
     $checked{'IKE_ENCRYPTION'}{'3des'} = '';
     $checked{'IKE_ENCRYPTION'}{'camellia256'} = '';
     $checked{'IKE_ENCRYPTION'}{'camellia192'} = '';
@@ -2328,6 +2329,15 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
     $checked{'ESP_ENCRYPTION'}{'aes256'} = '';
     $checked{'ESP_ENCRYPTION'}{'aes192'} = '';
     $checked{'ESP_ENCRYPTION'}{'aes128'} = '';
+    $checked{'ESP_ENCRYPTION'}{'aes256gcm128'} = '';
+    $checked{'ESP_ENCRYPTION'}{'aes192gcm128'} = '';
+    $checked{'ESP_ENCRYPTION'}{'aes128gcm128'} = '';
+    $checked{'ESP_ENCRYPTION'}{'aes256gcm96'} = '';
+    $checked{'ESP_ENCRYPTION'}{'aes192gcm96'} = '';
+    $checked{'ESP_ENCRYPTION'}{'aes128gcm96'} = '';
+    $checked{'ESP_ENCRYPTION'}{'aes256gcm64'} = '';
+    $checked{'ESP_ENCRYPTION'}{'aes192gcm64'} = '';
+    $checked{'ESP_ENCRYPTION'}{'aes128gcm64'} = '';
     $checked{'ESP_ENCRYPTION'}{'3des'} = '';
     $checked{'ESP_ENCRYPTION'}{'camellia256'} = '';
     $checked{'ESP_ENCRYPTION'}{'camellia192'} = '';
@@ -2406,24 +2416,42 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                        <td class='boldbase' width="15%">$Lang::tr{'encryption'}</td>
                        <td class='boldbase'>
                                <select name='IKE_ENCRYPTION' multiple='multiple' size='6' style='width: 100%'>
-                                       <option value='aes256' $checked{'IKE_ENCRYPTION'}{'aes256'}>AES (256 bit)</option>
-                                       <option value='aes192' $checked{'IKE_ENCRYPTION'}{'aes192'}>AES (192 bit)</option>
-                                       <option value='aes128' $checked{'IKE_ENCRYPTION'}{'aes128'}>AES (128 bit)</option>
-                                       <option value='3des' $checked{'IKE_ENCRYPTION'}{'3des'}>3DES</option>
-                                       <option value='camellia256' $checked{'IKE_ENCRYPTION'}{'camellia256'}>Camellia (256 bit)</option>
-                                       <option value='camellia192' $checked{'IKE_ENCRYPTION'}{'camellia192'}>Camellia (192 bit)</option>
-                                       <option value='camellia128' $checked{'IKE_ENCRYPTION'}{'camellia128'}>Camellia (128 bit)</option>
+                                       <option value='aes256' $checked{'IKE_ENCRYPTION'}{'aes256'}>256 bit AES-CBC</option>
+                                       <option value='aes192' $checked{'IKE_ENCRYPTION'}{'aes192'}>192 bit AES-CBC</option>
+                                       <option value='aes128' $checked{'IKE_ENCRYPTION'}{'aes128'}>128 bit AES-CBC</option>
+                                       <option value='aes256gcm128' $checked{'IKE_ENCRYPTION'}{'aes256gcm128'}>256 bit AES-GCM/128 bit ICV</option>
+                                       <option value='aes192gcm128' $checked{'IKE_ENCRYPTION'}{'aes192gcm128'}>192 bit AES-GCM/128 bit ICV</option>
+                                       <option value='aes128gcm128' $checked{'IKE_ENCRYPTION'}{'aes128gcm128'}>128 bit AES-GCM/128 bit ICV</option>
+                                       <option value='aes256gcm96' $checked{'IKE_ENCRYPTION'}{'aes256gcm96'}>256 bit AES-GCM/96 bit ICV</option>
+                                       <option value='aes192gcm96' $checked{'IKE_ENCRYPTION'}{'aes192gcm96'}>192 bit AES-GCM/96 bit ICV</option>
+                                       <option value='aes128gcm96' $checked{'IKE_ENCRYPTION'}{'aes128gcm96'}>128 bit AES-GCM/96 bit ICV</option>
+                                       <option value='aes256gcm64' $checked{'IKE_ENCRYPTION'}{'aes256gcm64'}>256 bit AES-GCM/64 bit ICV</option>
+                                       <option value='aes192gcm64' $checked{'IKE_ENCRYPTION'}{'aes192gcm64'}>192 bit AES-GCM/64 bit ICV</option>
+                                       <option value='aes128gcm64' $checked{'IKE_ENCRYPTION'}{'aes128gcm64'}>128 bit AES-GCM/64 bit ICV</option>
+                                       <option value='3des' $checked{'IKE_ENCRYPTION'}{'3des'}>168 bit 3DES-EDE-CBC</option>
+                                       <option value='camellia256' $checked{'IKE_ENCRYPTION'}{'camellia256'}>256 bit Camellia-CBC</option>
+                                       <option value='camellia192' $checked{'IKE_ENCRYPTION'}{'camellia192'}>192 bit Camellia-CBC</option>
+                                       <option value='camellia128' $checked{'IKE_ENCRYPTION'}{'camellia128'}>128 bit Camellia-CBC</option>
                                </select>
                        </td>
                        <td class='boldbase'>
                                <select name='ESP_ENCRYPTION' multiple='multiple' size='6' style='width: 100%'>
-                                       <option value='aes256' $checked{'ESP_ENCRYPTION'}{'aes256'}>AES (256 bit)</option>
-                                       <option value='aes192' $checked{'ESP_ENCRYPTION'}{'aes192'}>AES (192 bit)</option>
-                                       <option value='aes128' $checked{'ESP_ENCRYPTION'}{'aes128'}>AES (128 bit)</option>
-                                       <option value='3des' $checked{'ESP_ENCRYPTION'}{'3des'}>3DES</option>
-                                       <option value='camellia256' $checked{'ESP_ENCRYPTION'}{'camellia256'}>Camellia (256 bit)</option>
-                                       <option value='camellia192' $checked{'ESP_ENCRYPTION'}{'camellia192'}>Camellia (192 bit)</option>
-                                       <option value='camellia128' $checked{'ESP_ENCRYPTION'}{'camellia128'}>Camellia (128 bit)</option>
+                                       <option value='aes256' $checked{'ESP_ENCRYPTION'}{'aes256'}>256 bit AES-CBC</option>
+                                       <option value='aes192' $checked{'ESP_ENCRYPTION'}{'aes192'}>192 bit AES-CBC</option>
+                                       <option value='aes128' $checked{'ESP_ENCRYPTION'}{'aes128'}>128 bit AES-CBC</option>
+                                       <option value='aes256gcm128' $checked{'ESP_ENCRYPTION'}{'aes256gcm128'}>256 bit AES-GCM/128 bit ICV</option>
+                                       <option value='aes192gcm128' $checked{'ESP_ENCRYPTION'}{'aes192gcm128'}>192 bit AES-GCM/128 bit ICV</option>
+                                       <option value='aes128gcm128' $checked{'ESP_ENCRYPTION'}{'aes128gcm128'}>128 bit AES-GCM/128 bit ICV</option>
+                                       <option value='aes256gcm96' $checked{'ESP_ENCRYPTION'}{'aes256gcm96'}>256 bit AES-GCM/96 bit ICV</option>
+                                       <option value='aes192gcm96' $checked{'ESP_ENCRYPTION'}{'aes192gcm96'}>192 bit AES-GCM/96 bit ICV</option>
+                                       <option value='aes128gcm96' $checked{'ESP_ENCRYPTION'}{'aes128gcm96'}>128 bit AES-GCM/96 bit ICV</option>
+                                       <option value='aes256gcm64' $checked{'ESP_ENCRYPTION'}{'aes256gcm64'}>256 bit AES-GCM/64 bit ICV</option>
+                                       <option value='aes192gcm64' $checked{'ESP_ENCRYPTION'}{'aes192gcm64'}>192 bit AES-GCM/64 bit ICV</option>
+                                       <option value='aes128gcm64' $checked{'ESP_ENCRYPTION'}{'aes128gcm64'}>128 bit AES-GCM/64 bit ICV</option>
+                                       <option value='3des' $checked{'ESP_ENCRYPTION'}{'3des'}>168 bit 3DES-EDE-CBC</option>
+                                       <option value='camellia256' $checked{'ESP_ENCRYPTION'}{'camellia256'}>256 bit Camellia-CBC</option>
+                                       <option value='camellia192' $checked{'ESP_ENCRYPTION'}{'camellia192'}>192 bit Camellia-CBC</option>
+                                       <option value='camellia128' $checked{'ESP_ENCRYPTION'}{'camellia128'}>128 bit Camellia-CBC</option>
                                </select>
                        </td>
                </tr>

diff --git a/lfs/initscripts b/lfs/initscripts
index f656c72a7458025459f1481a568a1721f4059804..400594136230363a5ea32c29bab06658cffbe7bb 100755 (executable)
--- a/lfs/initscripts
+++ b/lfs/initscripts
@@ -176,6 +176,7 @@ $(TARGET) :
        ln -sf ../init.d/firstsetup  /etc/rc.d/rcsysinit.d/S75firstsetup
        ln -sf ../init.d/localnet    /etc/rc.d/rcsysinit.d/S80localnet
        ln -sf ../init.d/firewall    /etc/rc.d/rcsysinit.d/S85firewall
+       ln -sf ../init.d/network-trigger /etc/rc.d/rcsysinit.d/S90network-trigger
        ln -sf ../init.d/network-vlans /etc/rc.d/rcsysinit.d/S91network-vlans
        ln -sf ../init.d/rngd        /etc/rc.d/rcsysinit.d/S92rngd
        ln -sf ../init.d/wlanclient  /etc/rc.d/rc0.d/K82wlanclient

diff --git a/lfs/strongswan b/lfs/strongswan
index 43995b5a118d7b4d00e9737e8a595a9fe87a9ddb..77c287a09a3cc6d158e788afbb8bbc17549b21da 100644 (file)
--- a/lfs/strongswan
+++ b/lfs/strongswan
@@ -93,6 +93,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
                --enable-farp \
                --enable-openssl \
                --enable-gcrypt \
+               --enable-gcm \
                --enable-xauth-eap \
                --enable-xauth-noauth \
                --enable-eap-radius \

diff --git a/lfs/udev b/lfs/udev
index 15dae817b2b35dd6d02f7ccbfb80be7dbdb487b1..e58839c405e93a214b37774d3cb06cf83fe1a996 100644 (file)
--- a/lfs/udev
+++ b/lfs/udev
@@ -93,9 +93,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
        rm -f /lib/udev/rules.d/75-persistent-net-generator.rules
        rm -f /lib/udev/rules.d/80-net-name-slot.rules
 
-       # Create rule file for the setup
-       touch /etc/udev/rules.d/30-persistent-network.rules
-
        # Blacklist some modules
        cp -vf $(DIR_SRC)/config/udev/blacklist.conf /etc/modprobe.d/blacklist.conf
 
@@ -107,6 +104,12 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
        install -v -m 644 $(DIR_SRC)/config/udev/25-alsa.rules \
                /lib/udev/rules.d
 
+       # Install network rules.
+       install -v -m 755 $(DIR_SRC)/config/udev/network-hotplug-rename \
+               /lib/udev/network-hotplug-rename
+       install -v -m 644 $(DIR_SRC)/config/udev/60-net.rules \
+               /lib/udev/rules.d
+
        # Install hwrng rules.
        install -v -m 644 $(DIR_SRC)/config/udev/90-hwrng.rules \
                /lib/udev/rules.d

diff --git a/src/initscripts/init.d/network-trigger b/src/initscripts/init.d/network-trigger
new file mode 100644 (file)
index 0000000..0d9de45
--- /dev/null
+++ b/src/initscripts/init.d/network-trigger
@@ -0,0 +1,22 @@
+#!/bin/sh
+########################################################################
+# Begin $rc_base/init.d/network-trigger
+########################################################################
+
+. /etc/sysconfig/rc
+. ${rc_functions}
+
+case "${1}" in
+       start)
+               boot_mesg "Triggering network devices..."
+               udevadm trigger --action="add" --subsystem-match="net"
+               evaluate_retval
+               ;;
+
+       *)
+               echo "Usage: ${0} {start}"
+               exit 1
+               ;;
+esac
+
+# End $rc_base/init.d/network-trigger

diff --git a/src/setup/netstuff.c b/src/setup/netstuff.c
index a656e9f910b183a8520b95308c7f02ed02503caa..f5b3849893e0784f63ba8cdf6752d50c45588766 100644 (file)
--- a/src/setup/netstuff.c
+++ b/src/setup/netstuff.c
@@ -527,27 +527,6 @@ int rename_nics(void) {
                                }
 }
 
-int create_udev(void)
-{
-       #define UDEV_NET_CONF "/etc/udev/rules.d/30-persistent-network.rules"
-       FILE *fp;
-       int i;
-
-       if ( (fp = fopen(UDEV_NET_CONF, "w")) == NULL ) {
-               fprintf(stderr,"Couldn't open" UDEV_NET_CONF);
-               return 1;
-       }
-
-       for (i = 0 ; i < 4 ; i++)
-       {
-               if (strcmp(knics[i].macaddr, "")) {
-                       fprintf(fp,"\n# %s\nACTION==\"add\", SUBSYSTEM==\"net\", ATTR{type}==\"1\", ATTR{address}==\"%s\", NAME=\"%s0\"\n", knics[i].description, knics[i].macaddr, lcolourcard[i]);
-               }
-       }
-       fclose(fp);
-       return 0;
-}
-
 int write_configs_netudev(int card , int colour)
 {      
        char commandstring[STRING_SIZE];

diff --git a/src/setup/networking.c b/src/setup/networking.c
index df4f00f0b1f6b28e238aefd255780708fea4dbba..0791764ebddaab149397557ccaf090edbc65a0d9 100644 (file)
--- a/src/setup/networking.c
+++ b/src/setup/networking.c
@@ -117,7 +117,6 @@ int handlenetworking(void)
        } else {
                rename_nics();
        }
-       create_udev();
        return 1;
 }
 

diff --git a/src/setup/setup.h b/src/setup/setup.h
index 388d2edcfed9ff75ebbe7182235db51abf19cb6f..14fd64634bd4ef3ad09f33be14f86c75610d863c 100644 (file)
--- a/src/setup/setup.h
+++ b/src/setup/setup.h
@@ -79,7 +79,6 @@ void networkdialogcallbacktype(newtComponent cm, void *data);
 int interfacecheck(struct keyvalue *kv, char *colour);
 int rename_nics(void);
 int init_knics(void);
-int create_udev(void);
 int scan_network_cards(void);
 int nicmenu(int colour);
 int clear_card_entry(int cards);