(legacy, ipsec) fix ipsec diag page, connect to vici, drop smp support, add...

(legacy, ipsec) fix ipsec diag page, connect to vici, drop smp support, add privilege separation using configd

src/opnsense/scripts/ipsec/connect.py

+#!/usr/local/bin/python2.7
+
+"""
+    Copyright (c) 2015 Ad Schellevis
+    All rights reserved.
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+
+    1. Redistributions of source code must retain the above copyright notice,
+     this list of conditions and the following disclaimer.
+
+    2. Redistributions in binary form must reproduce the above copyright
+     notice, this list of conditions and the following disclaimer in the
+     documentation and/or other materials provided with the distribution.
+
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+
+    --------------------------------------------------------------------------------------
+    connect ipsec connection
+"""
+import sys
+import os
+import subprocess
+import ujson
+import vici
+
+# parse input parameter
+conn_id = None
+if len(sys.argv) > 1:
+    p_conn_id = sys.argv[1].strip()
+
+# validate if SA is active before trying to disconnect, validates input data
+# and collect child sa's to bring up.
+conns_found = []
+s = vici.Session()
+for conns in s.list_conns():
+    for conn in conns:
+        if conn == p_conn_id:
+            conns_found.append(conn)
+            for child in conns[conn]['children']:
+                if child not in conns_found:
+                    conns_found.append(child)
+
+# setup connection if found        
+for conn_id in conns_found:
+    devnull = open(os.devnull, 'w')
+    subprocess.call(['/usr/local/sbin/ipsec', 'up', conn_id], stdin=devnull, stdout=devnull, stderr=devnull)
+
+
+

src/opnsense/scripts/ipsec/disconnect.py

+#!/usr/local/bin/python2.7
+
+"""
+    Copyright (c) 2015 Ad Schellevis
+    All rights reserved.
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+
+    1. Redistributions of source code must retain the above copyright notice,
+     this list of conditions and the following disclaimer.
+
+    2. Redistributions in binary form must reproduce the above copyright
+     notice, this list of conditions and the following disclaimer in the
+     documentation and/or other materials provided with the distribution.
+
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+
+    --------------------------------------------------------------------------------------
+    disconnect ipsec connection
+"""
+import sys
+import os
+import subprocess
+import ujson
+import vici
+
+# parse input parameter
+conn_id = None
+if len(sys.argv) > 1:
+    conn_id = sys.argv[1].strip()
+
+# validate if SA is active before trying to disconnect, validates input data
+conn_found = False
+s = vici.Session()
+for sas in s.list_sas():
+    for sa in sas:
+        if sa == conn_id:
+            conn_found = True
+
+# terminate connection if found        
+if conn_found:
+    devnull = open(os.devnull, 'w')
+    subprocess.call(['/usr/local/sbin/ipsec', 'down', conn_id], stdin=devnull, stdout=devnull, stderr=devnull)
+
+
+

src/opnsense/scripts/ipsec/list_status.py

@@ -39,11 +39,12 @@ for conns in s.list_conns():
     for connection_id in conns:
         result[connection_id] = dict()
         result[connection_id]['version'] = conns[connection_id]['version']
-        result[connection_id]['local_addrs'] = ','.join(conns[connection_id]['local_addrs'])
+        result[connection_id]['local-addrs'] = ','.join(conns[connection_id]['local_addrs'])
         result[connection_id]['local-id'] = ''
         result[connection_id]['local-class'] = []
         result[connection_id]['remote-id'] = ''
         result[connection_id]['remote-class'] = []
+        result[connection_id]['remote-addrs'] =  ','.join(conns[connection_id]['remote_addrs'])
         result[connection_id]['children'] = conns[connection_id]['children']
         result[connection_id]['sas'] = []
 

src/opnsense/service/conf/actions.d/actions_ipsec.conf

@@ -3,3 +3,15 @@ command:/usr/local/opnsense/scripts/ipsec/list_status.py
 parameters:
 type:script_output
 message:IPsec list status
+
+[connect]
+command:/usr/local/opnsense/scripts/ipsec/connect.py
+parameters:%s
+type=script
+message:IPsec connect %s
+
+[disconnect]
+command:/usr/local/opnsense/scripts/ipsec/disconnect.py
+parameters:%s
+type=script
+message:IPsec disconnect %s