Skip to content

[security/tinc] Enable usage of no, one or several addresses per hosts #2110

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AdSchellevis merged 2 commits into from
Nov 15, 2020
Merged

[security/tinc] Enable usage of no, one or several addresses per hosts #2110

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a3d383b
Enable usage of no, one or several addresses per hosts
ElNounch Nov 14, 2020
151bc98
Using list view for both external addresses and hosted subnets
ElNounch Nov 15, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions security/tinc/src/opnsense/mvc/app/controllers/OPNsense/Tinc/forms/dialogHost.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,10 @@
<field>
<id>host.extaddress</id>
<label>Ext. Address</label>
<type>text</type>
<help>This machines external address to use</help>
<type>select_multiple</type>
<style>tokenize</style>
<allownew>true</allownew>
<help>External address of selected machine</help>
</field>
<field>
<id>host.extport</id>
Expand All @@ -32,7 +34,9 @@
<field>
<id>host.subnet</id>
<label>Subnet</label>
<type>text</type>
<type>select_multiple</type>
<style>tokenize</style>
<allownew>true</allownew>
<help>This machines part of the network</help>
</field>
<field>
Expand Down
10 changes: 7 additions & 3 deletions security/tinc/src/opnsense/mvc/app/controllers/OPNsense/Tinc/forms/dialogNetwork.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,8 +68,10 @@
<field>
<id>network.extaddress</id>
<label>Ext. Address</label>
<type>text</type>
<help>This machines external address to use</help>
<type>select_multiple</type>
<style>tokenize</style>
<allownew>true</allownew>
<help>External addresses of this machine</help>
</field>
<field>
<id>network.extport</id>
Expand All @@ -80,7 +82,9 @@
<field>
<id>network.subnet</id>
<label>Subnet</label>
<type>text</type>
<type>select_multiple</type>
<style>tokenize</style>
<allownew>true</allownew>
<help>This machines part of the network</help>
</field>
<field>
Expand Down
31 changes: 25 additions & 6 deletions security/tinc/src/opnsense/mvc/app/models/OPNsense/Tinc/Tinc.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,9 +21,11 @@
<mask>/^([0-9a-zA-Z\_]){1,1024}$/u</mask>
<ValidationMessage>Please specify a valid hostname.</ValidationMessage>
</hostname>
<extaddress type="TextField">
<Required>Y</Required>
Copy link
Copy Markdown
Member

@AdSchellevis AdSchellevis Nov 14, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we could also use a HostnameField in combination with a tokeniser in the form, in which case you wouldn't need to explain the split character.

<mask>/^([0-9a-zA-Z\.,_\-:]){0,1024}$/u</mask>
<extaddress type="HostnameField">
<Required>N</Required>
<IpAllowed>1</IpAllowed>
<FieldSeparator>,</FieldSeparator>
<AsList>Y</AsList>
</extaddress>
<extport type="IntegerField">
<Required>Y</Required>
Expand All @@ -41,6 +43,7 @@
<WildcardEnabled>N</WildcardEnabled>
<NetMaskRequired>Y</NetMaskRequired>
<FieldSeparator>,</FieldSeparator>
<AsList>Y</AsList>
<Constraints>
<check001>
<ValidationMessage>Subnet field must be set in router mode.</ValidationMessage>
Expand Down Expand Up @@ -131,15 +134,26 @@
<MaximumValue>65535</MaximumValue>
<ValidationMessage>Port number must be between 1...65535</ValidationMessage>
</extport>
<extaddress type="TextField">
<Required>Y</Required>
<mask>/^([0-9a-zA-Z\.,_\-:]){0,1024}$/u</mask>
<extaddress type="HostnameField">
<Required>N</Required>
<IpAllowed>1</IpAllowed>
<FieldSeparator>,</FieldSeparator>
<AsList>Y</AsList>
<Constraints>
<check001>
<ValidationMessage>Need external address if you intend to "Connect To" this host</ValidationMessage>
<type>SetIfConstraint</type>
<field>connectTo</field>
<check>1</check>
</check001>
</Constraints>
</extaddress>
<subnet type="NetworkField">
<Required>N</Required>
<WildcardEnabled>N</WildcardEnabled>
<NetMaskRequired>Y</NetMaskRequired>
<FieldSeparator>,</FieldSeparator>
<AsList>Y</AsList>
</subnet>
<pubkey type="TextField">
<Required>Y</Required>
Expand All @@ -154,6 +168,11 @@
<connectTo type="BooleanField">
<default>1</default>
<Required>Y</Required>
<Constraints>
<check001>
<reference>extaddress.check001</reference>
</check001>
</Constraints>
</connectTo>
<enabled type="BooleanField">
<default>1</default>
Expand Down
27 changes: 18 additions & 9 deletions security/tinc/src/opnsense/scripts/OPNsense/Tinc/lib/objects.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ def __init__(self):
self._payload = dict()
self._payload['hostname'] = None
self._payload['network'] = None
self._payload['address'] = None
self._payload['address'] = ''
self._payload['port'] = None

def is_valid(self):
Expand All @@ -55,6 +55,11 @@ def get_network(self):
def get_basepath(self):
return '/usr/local/etc/tinc/%(network)s' % self._payload

def get_addresses(self):
if not self._payload['address']:
return
yield from self._payload['address'].split(',')

class Network(NetwConfObject):
def __init__(self):
super(Network, self).__init__()
Expand Down Expand Up @@ -106,7 +111,7 @@ def config_text(self):
result.append('ConnectTo = %s' % (host.get_hostname(),))
result.append('Device=/dev/tinc%(id)s' % self._payload)
result.append('Name=%(hostname)s' % self._payload)
return '\n'.join(result)
return '\n'.join(result) + '\n'

def filename(self):
return self.get_basepath() + '/tinc.conf'
Expand All @@ -127,25 +132,29 @@ def __init__(self):
self._payload['cipher'] = None

def connect_to_this_host(self):
if self.is_valid() and self._connectTo == "1":
if self.is_valid() and self._payload['address'] and self._connectTo == "1":
return True
else:
return False

def set_connectto(self, value):
self._connectTo = value.text

def get_subnets(self):
if not self._payload['subnet']:
return
yield from self._payload['subnet'].split(',')

def config_text(self):
result = list()
result.append('Address=%(address)s %(port)s'%self._payload)
if 'subnet' in self._payload:
networks = self._payload['subnet'].split(',')
for network in networks:
result.append('Subnet=%s' % network)
for address in self.get_addresses():
result.append('Address=%s %s' % (address, self._payload['port']))
for network in self.get_subnets():
result.append('Subnet=%s' % network)
result.append('Cipher=%(cipher)s'%self._payload)
result.append('Digest=sha256')
result.append(self._payload['pubkey'])
return '\n'.join(result)
return '\n'.join(result) + '\n'

def filename(self):
return '%s/hosts/%s' % (self.get_basepath(), self._payload['hostname'])