netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

(tinc) add cipher selection

Browse Source
This commit is contained in:
Ad Schellevis
2016-11-14 14:02:23 +01:00
parent 65f15e457a
commit 6963470dad
6 changed files with 90 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/tinc/src/opnsense/mvc/app/controllers/OPNsense/Tinc/forms/dialogHost.xml
+10
View File
@@ -35,6 +35,16 @@
<type>textbox</type>
<help>Public key for this host in the network</help>
</field>
<field>
<id>host.cipher</id>
<label>Cipher</label>
<type>dropdown</type>
<help> The symmetric cipher algorithm used to encrypt UDP packets.
Any cipher supported by LibreSSL or OpenSSL is recognised.
Furthermore, specifying "none" will turn off packet encryption.
It is best to use only those ciphers which support CBC mode
</help>
</field>
<field>
<id>host.connectTo</id>
<label>Connect To</label>
net/tinc/src/opnsense/mvc/app/controllers/OPNsense/Tinc/forms/dialogNetwork.xml
+10
View File
@@ -17,6 +17,16 @@
<type>text</type>
<help>This machines internal address to use and network mask for the whole network</help>
</field>
<field>
<id>network.cipher</id>
<label>Cipher</label>
<type>dropdown</type>
<help> The symmetric cipher algorithm used to encrypt UDP packets.
Any cipher supported by LibreSSL or OpenSSL is recognised.
Furthermore, specifying "none" will turn off packet encryption.
It is best to use only those ciphers which support CBC mode
</help>
</field>
<field>
<id>network.debuglevel</id>
<label>Debug</label>
net/tinc/src/opnsense/mvc/app/models/OPNsense/Tinc/Tinc.xml
+16
View File
@@ -42,6 +42,14 @@
<pubkey type="TextField">
<Required>Y</Required>
</pubkey>
<cipher type="JsonKeyValueStoreField">
<Required>Y</Required>
<Multiple>N</Multiple>
<ConfigdPopulateAct>tinc list ciphers</ConfigdPopulateAct>
<ConfigdPopulateTTL>1</ConfigdPopulateTTL>
<SourceFile>/tmp/tinc_current_cipher_options.index</SourceFile>
<default>blowfish</default>
</cipher>
<enabled type="BooleanField">
<default>1</default>
<Required>Y</Required>
@@ -93,6 +101,14 @@
<pubkey type="TextField">
<Required>Y</Required>
</pubkey>
<cipher type="JsonKeyValueStoreField">
<Required>Y</Required>
<Multiple>N</Multiple>
<ConfigdPopulateAct>tinc list ciphers</ConfigdPopulateAct>
<ConfigdPopulateTTL>1</ConfigdPopulateTTL>
<SourceFile>/tmp/tinc_current_cipher_options.index</SourceFile>
<default>blowfish</default>
</cipher>
<connectTo type="BooleanField">
<default>1</default>
<Required>Y</Required>
net/tinc/src/opnsense/scripts/OPNsense/Tinc/lib/objects.py
+2
View File
@@ -109,6 +109,7 @@ class Host(NetwConfObject):
self._connectTo = "0"
self._payload['subnet'] = None
self._payload['pubkey'] = None
self._payload['cipher'] = None
def connect_to_this_host(self):
if self.is_valid() and self._connectTo == "1":
@@ -123,6 +124,7 @@ class Host(NetwConfObject):
result = list()
result.append('Address=%(address)s'%self._payload)
result.append('Subnet=%(subnet)s'%self._payload)
result.append('Cipher=%(cipher)s'%self._payload)
result.append(self._payload['pubkey'])
return '\n'.join(result)
net/tinc/src/opnsense/scripts/OPNsense/Tinc/list_ciphers.py
Executable
+50
View File
@@ -0,0 +1,50 @@
#!/usr/local/bin/python2.7
"""
Copyright (c) 2016 Deciso B.V. - Ad Schellevis
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
--------------------------------------------------------------------------------------
list ciphers
"""
from subprocess import Popen, PIPE
import ujson
response = dict()
p = Popen(['/usr/bin/openssl','enc', '-help'],stdin=PIPE, stdout=PIPE, stderr=PIPE, bufsize=-1)
output, error = p.communicate()
cipher_section = False
for line in error.split('\n'):
if line.find('Cipher Types') == 0:
cipher_section = True
continue
if cipher_section:
for item in line.split():
if len(item) > 1:
response[item[1:]] = item[1:]
response["none"] = "None"
# output generated keys
print (ujson.dumps(response))
net/tinc/src/opnsense/service/templates/OPNsense/Tinc/tinc_deploy.xml
+2
View File
@@ -17,6 +17,7 @@
<address>{{network.extaddress}}</address>
<subnet>{{network.subnet}}</subnet>
<pubkey><![CDATA[{{network.pubkey}}]]></pubkey>
<cipher>{{network.cipher}}</cipher>
<connectto>0</connectto>
</host>
{% for host in helpers.toList('OPNsense.Tinc.hosts.host', 'hostname') %}
@@ -27,6 +28,7 @@
<address>{{host.extaddress}}</address>
<subnet>{{host.subnet}}</subnet>
<pubkey><![CDATA[{{host.pubkey}}]]></pubkey>
<cipher>{{host.cipher}}</cipher>
<connectto>{{host.connectTo}}</connectto>
</host>
{% endif %}