From: Nikos Mavrogiannopoulos Date: Sat, 10 Jan 2015 10:04:19 +0000 (+0100) Subject: openconnect: update to 7.03 X-Git-Url: http://git.openwrt.org/%22https:/collectd.org//%22http:/www.crowdsec.net/%22/%22https:/collectd.org/%22http:/www.crowdsec.net/%22?a=commitdiff_plain;h=9cb5b3864dc10be3777776556043d96540eeae05;p=feed%2Fpackages.git openconnect: update to 7.03 Signed-off-by: Nikos Mavrogiannopoulos --- diff --git a/net/openconnect/Makefile b/net/openconnect/Makefile index 00fbf8b612..6ae8de9d68 100644 --- a/net/openconnect/Makefile +++ b/net/openconnect/Makefile @@ -8,12 +8,17 @@ include $(TOPDIR)/rules.mk PKG_NAME:=openconnect -PKG_VERSION:=6.00 -PKG_RELEASE:=3 +PKG_VERSION:=7.03 +PKG_RELEASE:=1 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=ftp://ftp.infradead.org/pub/openconnect/ -PKG_MD5SUM:=7e28e23c6e281be31446e6c365f5d273 +PKG_MD5SUM:=83f6a359906d49473f591ba613ca3fe5 + +PKG_CONFIG_DEPENDS:= \ + CONFIG_OPENCONNECT_GNUTLS \ + CONFIG_OPENCONNECT_OPENSSL \ + include $(INCLUDE_DIR)/package.mk @@ -42,7 +47,9 @@ endef CONFIGURE_ARGS += \ --disable-shared \ - --with-vpnc-script=/lib/netifd/vpnc-script + --with-vpnc-script=/lib/netifd/vpnc-script \ + --without-libpcsclite \ + --without-stoken ifeq ($(CONFIG_OPENCONNECT_OPENSSL),y) CONFIGURE_ARGS += \ diff --git a/net/openconnect/README b/net/openconnect/README index 1cf13b5129..5c42fd103d 100644 --- a/net/openconnect/README +++ b/net/openconnect/README @@ -3,27 +3,26 @@ The openconnect client expects to be configured using the uci interface. To setup a VPN connection, add the following to /etc/config/network: config interface 'MYVPN' - option _orig_ifname 'vpnc' - option _orig_bridge 'false' option proto 'openconnect' option server 'vpn.example.com' option port '4443' option username 'test' option password 'secret' option serverhash 'AE7FF6A0426F0A0CD0A02EB9EC3C5066FAEB0B25' + option authgroup 'DEFAULT' The additional files are also used: -/etc/openconnect/user-cert-vpn-MYVPN.pem: The user certificate -/etc/openconnect/user-key-vpn-MYVPN.pem: The user private key -/etc/openconnect/ca-vpn-MYVPN.pem: The CA certificate (instead of serverhash) +/etc/config/openconnect-user-cert-vpn-MYVPN.pem: The user certificate +/etc/config/openconnect-user-key-vpn-MYVPN.pem: The user private key +/etc/config/openconnect-ca-vpn-MYVPN.pem: The CA certificate (instead of serverhash) After these are setup you can initiate the VPN using "ifup MYVPN", and deinitialize it using ifdown. You may also use the luci web interface -(Network -> Interfaces -> AVPN Connect). +(Network -> Interfaces -> MYVPN Connect). Note that you need to configure the firewall to allow communication between the MYVPN interface and lan. There is a luci plugin to allow configuring an openconnect interface from -the web environment; see the luci-protocol-openconnect package. +the web environment; see the luci-proto-openconnect package. diff --git a/net/openconnect/files/openconnect-wrapper b/net/openconnect/files/openconnect-wrapper index 744e5a5cd0..082dfba73a 100755 --- a/net/openconnect/files/openconnect-wrapper +++ b/net/openconnect/files/openconnect-wrapper @@ -22,7 +22,17 @@ cleanup() exit 0 } -trap cleanup 1 2 3 6 15 +cleanup2() +{ + if ! test -z "$pid";then + kill -2 $pid + wait $pid + fi + exit 0 +} + +trap cleanup2 2 +trap cleanup 1 3 6 15 rm -f "$pidfile" /usr/sbin/openconnect $* <$pwfile & diff --git a/net/openconnect/files/openconnect.sh b/net/openconnect/files/openconnect.sh index ad708073a3..2d3f7141ca 100755 --- a/net/openconnect/files/openconnect.sh +++ b/net/openconnect/files/openconnect.sh @@ -17,7 +17,7 @@ proto_openconnect_init_config() { proto_openconnect_setup() { local config="$1" - json_get_vars server port username serverhash authgroup password vgroup + json_get_vars server port username serverhash authgroup password vgroup token_mode token_secret grep -q tun /proc/modules || insmod tun @@ -38,10 +38,23 @@ proto_openconnect_setup() { cmdline="$server$port -i vpn-$config --non-inter --syslog --script /lib/netifd/vpnc-script" - [ -f /etc/openconnect/ca-vpn-$config.pem ] && append cmdline "--cafile /etc/openconnect/ca-vpn-$config.pem" - [ -f /etc/openconnect/user-cert-vpn-$config.pem ] && append cmdline "-c /etc/openconnect/user-cert-vpn-$config.pem" - [ -f /etc/openconnect/user-key-vpn-$config.pem ] && append cmdline "--sslkey /etc/openconnect/user-key-vpn-$config.pem" - [ -n "$serverhash" ] && append cmdline "--servercert=$serverhash" + # migrate to new config files + [ -f /etc/openconnect/user-cert-vpn-$config.pem ] && mv "/etc/openconnect/user-cert-vpn-$config.pem" "/etc/config/openconnect-user-cert-vpn-$config.pem" + [ -f /etc/openconnect/user-key-vpn-$config.pem ] && mv "/etc/openconnect/user-key-vpn-$config.pem" "/etc/config/openconnect-user-key-vpn-$config.pem" + [ -f /etc/openconnect/ca-vpn-$config.pem ] && mv "/etc/openconnect/ca-vpn-$config.pem" "/etc/config/openconnect-ca-vpn-$config.pem" + + # read new config files + [ -f /etc/config/openconnect-user-cert-vpn-$config.pem ] && append cmdline "-c /etc/config/openconnect-user-cert-vpn-$config.pem" + [ -f /etc/config/openconnect-user-key-vpn-$config.pem ] && append cmdline "--sslkey /etc/config/openconnect-user-key-vpn-$config.pem" + [ -f /etc/config/openconnect-ca-vpn-$config.pem ] && { + append cmdline "--cafile /etc/openconnect/ca-vpn-$config.pem" + append cmdline "--no-system-trust" + } + + [ -n "$serverhash" ] && { + append cmdline " --servercert=$serverhash" + append cmdline "--no-system-trust" + } [ -n "$authgroup" ] && append cmdline "--authgroup $authgroup" [ -n "$username" ] && append cmdline "-u $username" [ -n "$password" ] && { @@ -51,10 +64,13 @@ proto_openconnect_setup() { append cmdline "--passwd-on-stdin" } + [ -n "$token_mode" ] && append cmdline "--token-mode=$token_mode" + [ -n "$token_secret" ] && append cmdline "--token-secret=$token_secret" + proto_export INTERFACE="$config" logger -t openconnect "executing 'openconnect $cmdline'" - if [ -f "$pwfile" ];then + if [ -f "$pwfile" ]; then proto_run_command "$config" /usr/sbin/openconnect-wrapper $pwfile $cmdline else proto_run_command "$config" /usr/sbin/openconnect $cmdline @@ -68,7 +84,7 @@ proto_openconnect_teardown() { rm -f $pwfile logger -t openconnect "bringing down openconnect" - proto_kill_command "$config" + proto_kill_command "$config" 2 } add_protocol openconnect diff --git a/net/openconnect/files/vpnc-script b/net/openconnect/files/vpnc-script index c8151471b9..1217eea890 100755 --- a/net/openconnect/files/vpnc-script +++ b/net/openconnect/files/vpnc-script @@ -26,6 +26,8 @@ #* CISCO_IPV6_SPLIT_INC_%d_ADDR -- IPv6 network address #* CISCO_IPV6_SPLIT_INC_$%d_MASKLEN -- IPv6 subnet masklen +HOOKS_DIR=/etc/openconnect + # FIXMEs: # Section A: route handling @@ -44,13 +46,12 @@ # Section B: Split DNS handling -# 1) Maybe dnsmasq can do something like that -# 2) Parse dns packets going out via tunnel and redirect them to original dns-server +# 1) We parse CISCO_SPLIT_DNS and use dnsmasq to set it do_connect() { if [ -n "$CISCO_BANNER" ]; then logger -t openconnect "Connect Banner:" - logger -t openconnect "$CISCO_BANNER" | while read LINE ; do logger -t openconnect "|" "$LINE" ; done + echo "$CISCO_BANNER" | while read LINE ; do logger -t openconnect "|" "$LINE" ; done fi proto_init_update "$TUNDEV" 1 @@ -80,8 +81,23 @@ do_connect() { [[ "$addr" != "$mask" ]] && proto_add_ipv6_address "$addr" "$mask" fi - [ -n "$INTERNAL_IP4_DNS" ] && proto_add_dns_server "$INTERNAL_IP4_DNS" - [ -n "$CISCO_DEF_DOMAIN" ] && proto_add_dns_search "$CISCO_DEF_DOMAIN" + if [ -n "$CISCO_SPLIT_DNS" ] && [ -d "/tmp/dnsmasq.d/" ];then + SDNS=`echo $CISCO_SPLIT_DNS|sed 's/,/\n/g'` + DNSMASQ_FILE="/tmp/dnsmasq.d/openconnect.$TUNDEV" + rm -f $DNSMASQ_FILE + echo "$SDNS" | while read i; do + if [ -n "$INTERNAL_IP4_DNS" ];then + echo "server=/$i/$INTERNAL_IP4_DNS" >> $DNSMASQ_FILE + fi + if [ -n "$INTERNAL_IP6_DNS" ];then + echo "server=/$i/$INTERNAL_IP6_DNS" >> $DNSMASQ_FILE + fi + done + /etc/init.d/dnsmasq restart + else + [ -n "$INTERNAL_IP4_DNS" ] && proto_add_dns_server "$INTERNAL_IP4_DNS" + [ -n "$CISCO_DEF_DOMAIN" ] && proto_add_dns_search "$CISCO_DEF_DOMAIN" + fi if [ -n "$CISCO_SPLIT_INC" ]; then i=0 @@ -118,10 +134,22 @@ do_connect() { } do_disconnect() { + rm -f "/tmp/dnsmasq.d/openconnect.$TUNDEV" proto_init_update "$TUNDEV" 0 proto_send_update "$INTERFACE" } +#### Hooks +run_hooks() { + HOOK="$1" + + if [ -d ${HOOKS_DIR}/${HOOK}.d ]; then + for script in ${HOOKS_DIR}/${HOOK}.d/* ; do + [ -f $script ] && . $script + done + fi +} + #### Main if [ -z "$reason" ]; then @@ -137,14 +165,20 @@ fi case "$reason" in pre-init) + run_hooks pre-init ;; connect) + run_hooks connect do_connect + run_hooks post-connect ;; disconnect) + run_hooks disconnect do_disconnect + run_hooks post-disconnect ;; reconnect) + run_hooks reconnect ;; *) logger -t openconnect "unknown reason '$reason'. Maybe vpnc-script is out of date" 1>&2