=== modified file 'network-hooks.d/bridge'
--- network-hooks.d/bridge 2011-11-28 23:40:46 +0000
+++ network-hooks.d/bridge 2011-12-27 03:56:39 +0000
@@ -41,9 +41,9 @@
"$brctl" addbr "$BRIDGE"
for port in $PORTS; do
"$brctl" addif "$BRIDGE" "$port"
- ip link set up "$port"
+ ip link set dev "$port" up
done
- ip link set up "$BRIDGE"
+ ip link set dev "$BRIDGE" up
sleep "$DELAY"
if [ -n "$IPADDRS" ]; then
for ipaddr in $IPADDRS; do
@@ -57,9 +57,9 @@
fi
;;
stop)
- ip link set down "$BRIDGE"
+ ip link set dev "$BRIDGE" down
for port in $PORTS; do
- ip link set down "$port"
+ ip link set dev "$port" down
"$brctl" delif "$BRIDGE" "$port"
done
"$brctl" delbr "$BRIDGE"
=== added file 'network-hooks.d/wireless'
--- network-hooks.d/wireless 1970-01-01 00:00:00 +0000
+++ network-hooks.d/wireless 2011-12-27 03:56:39 +0000
@@ -0,0 +1,136 @@
+#!/bin/sh
+#
+# This is an example of a Mandos client network hook. This hook
+# brings up a wireless interface as specified in a separate
+# configuration file. To be used, this file and any needed
+# configuration file(s) should be copied into the
+# /etc/mandos/network-hooks.d directory.
+#
+# Copying and distribution of this file, with or without modification,
+# are permitted in any medium without royalty provided the copyright
+# notice and this notice are preserved. This file is offered as-is,
+# without any warranty.
+
+set -e
+
+RUNDIR="/run"
+CTRL="$RUNDIR/wpa_supplicant-global"
+CTRLDIR="$RUNDIR/wpa_supplicant"
+PIDFILE="$RUNDIR/wpa_supplicant-mandos.pid"
+
+CONFIG="$MANDOSNETHOOKDIR/wireless.conf"
+
+# Read config file
+if [ -e "$CONFIG" ]; then
+ . "$CONFIG"
+else
+ exit
+fi
+
+interfaces="`env|sed -n -e 's/^\(MODULE\|IPADDRS\|ROUTES\|WPA_DRIVER\)_\([^=]*\)=.*/\2/p' \"$CONFIG\" |sort -u`"
+
+# Exit if DEVICE is set and is not any of the wireless interfaces
+if [ -n "$DEVICE" ]; then
+ while :; do
+ for IF in $interfaces; do
+ if [ "$IF" = "$DEVICE" ]; then
+ break 2
+ fi
+ done
+ exit
+ done
+fi
+
+wpa_supplicant=/sbin/wpa_supplicant
+wpa_cli=/sbin/wpa_cli
+ip=/bin/ip
+
+# Used by the wpa_interface_* functions in the wireless.conf file
+wpa_cli_set(){
+ case "$1" in
+ ssid|psk) arg="\"$2\"" ;;
+ *) arg="$2" ;;
+ esac
+ "$wpa_cli" -p "$CTRLDIR" -i "$INTERFACE" set_network "$NETWORK" \
+ "$1" "$arg" 2>&1 | sed -e '/^OK$/d'
+}
+
+if [ $VERBOSITY -gt 0 ]; then
+ WPAS_OPTIONS="-d $WPAS_OPTIONS"
+fi
+if [ -n "$PIDFILE" ]; then
+ WPAS_OPTIONS="-P$PIDFILE $WPAS_OPTIONS"
+fi
+
+case "${MODE:-$1}" in
+ start)
+ mkdir -m u=rwx,go= -p "$CTRLDIR"
+ "$wpa_supplicant" -B -g "$CTRL" -p "$CTRLDIR" $WPAS_OPTIONS
+ for INTERFACE in $interfaces; do
+ DRIVER=`eval 'echo "$WPA_DRIVER_'"$INTERFACE"\"`
+ DELAY=`eval 'echo "$DELAY_'"$INTERFACE"\"`
+ "$wpa_cli" -g "$CTRL" interface_add "$INTERFACE" "" \
+ "${DRIVER:-wext}" "$CTRLDIR" > /dev/null \
+ | sed -e '/^OK$/d'
+ NETWORK=`"$wpa_cli" -p "$CTRLDIR" -i "$INTERFACE" add_network`
+ eval wpa_interface_"$INTERFACE"
+ "$wpa_cli" -p "$CTRLDIR" -i "$INTERFACE" enable_network \
+ "$NETWORK" | sed -e '/^OK$/d'
+ ( sleep "${DELAY:-$DELAY}" || : ) &
+ sleep=$!
+ while :; do
+ kill -0 $sleep || break
+ STATE=`"$wpa_cli" -p "$CTRLDIR" -i "$INTERFACE" status | sed -n -e 's/^wpa_state=//p'`
+ if [ "$STATE" = COMPLETED ]; then
+ kill $sleep
+ break
+ fi
+ sleep 1
+ done &
+ wait $sleep || :
+ IPADDRS=`eval 'echo "$IPADDRS_'"$INTERFACE"\"`
+ if [ -n "$IPADDRS" ]; then
+ if [ "$IPADDRS" = dhcp ]; then
+ ipconfig -c dhcp -d "$INTERFACE" || :
+ #dhclient "$INTERFACE"
+ else
+ for ipaddr in $IPADDRS; do
+ "$ip" addr add "$ipaddr" dev "$INTERFACE"
+ done
+ fi
+ fi
+ ROUTES=`eval 'echo "$ROUTES_'"$INTERFACE"\"`
+ if [ -n "$ROUTES" ]; then
+ for route in $ROUTES; do
+ "$ip" route add "$route" dev "$BRIDGE"
+ done
+ fi
+ done
+ ;;
+ stop)
+ "$wpa_cli" -g "$CTRL" terminate 2>&1 | sed -e '/^OK$/d'
+ for INTERFACE in $interfaces; do
+ "$ip" addr show scope global permanent dev "$INTERFACE" \
+ | while read type addr rest; do
+ case "$type" in
+ inet|inet6)
+ "$ip" addr del "$addr" dev "$INTERFACE"
+ ;;
+ esac
+ done
+ "$ip" link set dev "$INTERFACE" down
+ done
+ ;;
+ files)
+ echo "$wpa_supplicant"
+ echo "$wpa_cli"
+ echo "$ip"
+ ;;
+ modules)
+ if [ "$IPADDRS" = dhcp ]; then
+ echo af_packet
+ fi
+ sed -n -e 's/#.*$//' -e 's/[ ]*$//' -e 's/^MODULE=//p' \
+ "$CONFIG"
+ ;;
+esac
=== added file 'network-hooks.d/wireless.conf'
--- network-hooks.d/wireless.conf 1970-01-01 00:00:00 +0000
+++ network-hooks.d/wireless.conf 2011-12-27 03:56:39 +0000
@@ -0,0 +1,17 @@
+# Extra options for wpa_supplicant, if any
+#WPAS_OPTIONS=""
+
+# wlan0
+MODULE_wlan0=ath9k
+#WPA_DRIVER_wlan0=wext
+wpa_interface_wlan0(){
+ # Use this format to set simple things:
+ wpa_cli_set ssid home
+ wpa_cli_set psk "secret passphrase"
+ # Use this format to do more complex things with wpa_cli:
+ #"$wpa_cli" -p "$CTRLDIR" -i "$INTERFACE" set_network "$NETWORK" passphrase '"secret passphrase"'
+}
+#DELAY_wlan0=10
+IPADDRS_wlan0=dhcp
+#IPADDRS_wlan0="192.0.2.3/24 2001:DB8::aede:48ff:fe71:f6f2/32"
+#ROUTES_wlan0="192.0.2.0/24 2001:DB8::/32"
=== modified file 'plugins.d/mandos-client.c'
--- plugins.d/mandos-client.c 2011-12-25 00:40:09 +0000
+++ plugins.d/mandos-client.c 2011-12-27 03:56:39 +0000
@@ -1473,6 +1473,13 @@
_exit(EX_OSERR);
}
free(delaystring);
+ if(connect_to != NULL){
+ ret = setenv("CONNECT", connect_to);
+ if(ret == -1){
+ perror_plus("setenv");
+ _exit(EX_OSERR);
+ }
+ }
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
perror_plus("execl");
_exit(EXIT_FAILURE);
@@ -1601,7 +1608,7 @@
.group = 2 },
{ .name = "retry", .key = 132,
.arg = "SECONDS",
- .doc = "Retry interval used when denied by the mandos server",
+ .doc = "Retry interval used when denied by the Mandos server",
.group = 2 },
{ .name = "network-hook-dir", .key = 133,
.arg = "DIR",
=== modified file 'plugins.d/mandos-client.xml'
--- plugins.d/mandos-client.xml 2011-11-27 14:44:28 +0000
+++ plugins.d/mandos-client.xml 2011-12-27 03:56:39 +0000
@@ -583,7 +583,23 @@
This will be the same as the
- option passed to &COMMANDNAME;.
+ option passed to &COMMANDNAME;. Is
+ only set if MODE is
+ start or
+ stop.
+
+
+
+
+ CONNECT
+
+
+ This will be the same as the
+ option passed to &COMMANDNAME;. Is
+ only set if is passed and
+ MODE is
+ start or
+ stop.