From 20f984d3762d4e1c1496c0fa639203cdcefe1e40 Mon Sep 17 00:00:00 2001 From: CN_SZTL Date: Tue, 3 Mar 2020 11:52:46 +0800 Subject: [PATCH] package lienol: sync packages --- .../Makefile | 4 +-- .../model/cbi/ipsec-server/settings.lua | 20 ++--------- .../root/etc/config/ipsec | 8 ++--- .../root/etc/init.d/ipsecvpn | 18 +++++----- .../root/usr/share/ipsecvpn/firewall.include | 34 +++++++------------ 5 files changed, 28 insertions(+), 56 deletions(-) diff --git a/package/lienol/luci-app-ipsec-vpnserver-manyusers/Makefile b/package/lienol/luci-app-ipsec-vpnserver-manyusers/Makefile index c9fe16923f..62b40c0471 100644 --- a/package/lienol/luci-app-ipsec-vpnserver-manyusers/Makefile +++ b/package/lienol/luci-app-ipsec-vpnserver-manyusers/Makefile @@ -8,8 +8,8 @@ include $(TOPDIR)/rules.mk LUCI_TITLE:=LuCI support for IPSec VPN Server LUCI_DEPENDS:=+strongswan +strongswan-minimal +strongswan-mod-xauth-generic LUCI_PKGARCH:=all -PKG_VERSION:=1.0 -PKG_RELEASE:=13-20191213 +PKG_VERSION:=1.1 +PKG_RELEASE:=2 include $(TOPDIR)/feeds/luci/luci.mk diff --git a/package/lienol/luci-app-ipsec-vpnserver-manyusers/luasrc/model/cbi/ipsec-server/settings.lua b/package/lienol/luci-app-ipsec-vpnserver-manyusers/luasrc/model/cbi/ipsec-server/settings.lua index d80e97d53f..d2415d527d 100644 --- a/package/lienol/luci-app-ipsec-vpnserver-manyusers/luasrc/model/cbi/ipsec-server/settings.lua +++ b/package/lienol/luci-app-ipsec-vpnserver-manyusers/luasrc/model/cbi/ipsec-server/settings.lua @@ -22,33 +22,17 @@ clientip.description = translate( clientip.optional = false clientip.rmempty = false +--[[ clientdns = s:option(Value, "clientdns", translate("VPN Client DNS")) clientdns.datatype = "ip4addr" clientdns.description = translate("DNS using in VPN tunnel.") clientdns.optional = false clientdns.rmempty = false +]]-- secret = s:option(Value, "secret", translate("Secret Pre-Shared Key")) secret.password = true -o = s:option(Flag, "is_nat", translate("is_nat")) -o.rmempty = false - -o = s:option(ListValue, "export_interface", translate("Interface"), - translate("Specify interface forwarding traffic.")) -o:value("default", translate("default")) -for _, iface in ipairs(ifaces) do - if (iface:match("^br*") or iface:match("^eth*") or iface:match("^pppoe*") or - iface:match("wlan*")) then - local nets = net:get_interface(iface) - nets = nets and nets:get_networks() or {} - for k, v in pairs(nets) do nets[k] = nets[k].sid end - nets = table.concat(nets, ",") - o:value(iface, ((#nets > 0) and "%s (%s)" % {iface, nets} or iface)) - end -end -o:depends("is_nat", "1") - function mp.on_save(self) require "luci.model.uci" require "luci.sys" diff --git a/package/lienol/luci-app-ipsec-vpnserver-manyusers/root/etc/config/ipsec b/package/lienol/luci-app-ipsec-vpnserver-manyusers/root/etc/config/ipsec index 05b819bb20..cb0981fbc7 100644 --- a/package/lienol/luci-app-ipsec-vpnserver-manyusers/root/etc/config/ipsec +++ b/package/lienol/luci-app-ipsec-vpnserver-manyusers/root/etc/config/ipsec @@ -1,11 +1,9 @@ config service 'ipsec' - option secret 'ipsec' - option clientip '192.168.100.1/24' - option is_nat '1' - option export_interface 'default' - option clientdns '208.67.222.222' option enabled '0' + option secret 'ipsec' + option clientip '192.168.100.10/24' + option clientdns '192.168.1.1' config users option enabled '1' diff --git a/package/lienol/luci-app-ipsec-vpnserver-manyusers/root/etc/init.d/ipsecvpn b/package/lienol/luci-app-ipsec-vpnserver-manyusers/root/etc/init.d/ipsecvpn index 6fd044edc8..7ef7aeb2b9 100755 --- a/package/lienol/luci-app-ipsec-vpnserver-manyusers/root/etc/init.d/ipsecvpn +++ b/package/lienol/luci-app-ipsec-vpnserver-manyusers/root/etc/init.d/ipsecvpn @@ -1,5 +1,4 @@ #!/bin/sh /etc/rc.common -# Copyright (C) 2018-2019 Lienol START=90 STOP=10 @@ -47,7 +46,7 @@ remove_includes() { do_include() { local conf="$1" local uciconf="$2" - local backup=`mktemp -t -p /tmp/ ipsec-init-XXXXXX` + local backup=$(mktemp -t -p /tmp/ ipsec-init-XXXXXX) [ ! -f "${conf}" ] && rm -rf "${conf}" touch "${conf}" @@ -242,7 +241,7 @@ config_remote() { local ipdest [ "$remote_gateway" = "%any" ] && ipdest="1.1.1.1" || ipdest="$remote_gateway" - local_gateway=`ip route get $ipdest | awk -F"src" '/src/{gsub(/ /,"");print $2}'` + local_gateway=$(ip route get $ipdest | awk -F"src" '/src/{gsub(/ /,"");print $2}') } [ -n "$local_identifier" ] && secret_xappend -n "$local_identifier " || secret_xappend -n "$local_gateway " @@ -339,7 +338,7 @@ service_running() { } reload_service() { - local bool vt_enabled=`uci get ipsec.@service[0].enabled 2>/dev/null` + local bool vt_enabled=$(uci get ipsec.@service[0].enabled 2>/dev/null) [ "$vt_enabled" = 0 ] && /etc/init.d/ipsecvpn stop > /dev/null 2>&1 && return running && { prepare_env @@ -368,12 +367,11 @@ service_triggers() { start_service() { fw3 reload - local vt_enabled=`uci get ipsec.@service[0].enabled 2>/dev/null` - local vt_clientip=`uci get ipsec.@service[0].clientip` - local vt_clientdns=`uci get ipsec.@service[0].clientdns` - local vt_secret=`uci get ipsec.@service[0].secret 2>/dev/null` - local vt_is_nat=`uci get ipsec.@service[0].is_nat 2>/dev/null` - local vt_export_interface=`uci get ipsec.@service[0].export_interface 2>/dev/null` + local vt_enabled=$(uci -q get ipsec.@service[0].enabled) + local vt_clientip=$(uci -q get ipsec.@service[0].clientip) + local vt_clientdns=$(uci -q get ipsec.@service[0].clientdns) + [ -z "$vt_clientdns" ] && local vt_clientdns="8.8.4.4" + local vt_secret=$(uci -q get ipsec.@service[0].secret) [ "$vt_enabled" = 0 ] && /etc/init.d/ipsecvpn stop > /dev/null 2>&1 && return diff --git a/package/lienol/luci-app-ipsec-vpnserver-manyusers/root/usr/share/ipsecvpn/firewall.include b/package/lienol/luci-app-ipsec-vpnserver-manyusers/root/usr/share/ipsecvpn/firewall.include index b3dbc84ea4..658fd639c5 100755 --- a/package/lienol/luci-app-ipsec-vpnserver-manyusers/root/usr/share/ipsecvpn/firewall.include +++ b/package/lienol/luci-app-ipsec-vpnserver-manyusers/root/usr/share/ipsecvpn/firewall.include @@ -1,45 +1,37 @@ #!/bin/sh -iptables -D INPUT -p udp -m multiport --dports 500,4500 -m comment --comment "Rule For IPSec VPN Server" -j ACCEPT 2> /dev/null -ipsec_nums=`iptables -t nat -L POSTROUTING 2> /dev/null|grep -c "Rule For IPSec VPN Server"` +iptables -D INPUT -p udp -m multiport --dports 500,4500 -m comment --comment "IPSec VPN Server" -j ACCEPT 2> /dev/null +ipsec_nums=$(iptables -t nat -L POSTROUTING 2> /dev/null | grep -c "IPSec VPN Server") if [ -n "$ipsec_nums" ]; then until [ "$ipsec_nums" = 0 ] do - rules=`iptables -t nat -L POSTROUTING --line-num 2> /dev/null|grep "Rule For IPSec VPN Server" |awk '{print $1}'` + rules=$(iptables -t nat -L POSTROUTING --line-num 2> /dev/null | grep "IPSec VPN Server" |awk '{print $1}') for rule in $rules do iptables -t nat -D POSTROUTING $rule 2> /dev/null break done - ipsec_nums=`expr $ipsec_nums - 1` + ipsec_nums=$(expr $ipsec_nums - 1) done fi -nums=`iptables -L forwarding_rule 2> /dev/null|grep -c "Rule For IPSec VPN Server"` +nums=$(iptables -L forwarding_rule 2> /dev/null | grep -c "IPSec VPN Server") if [ -n "$nums" ]; then until [ "$nums" = 0 ] do - rules=`iptables -L forwarding_rule --line-num 2> /dev/null|grep "Rule For IPSec VPN Server" |awk '{print $1}'` + rules=$(iptables -L forwarding_rule --line-num 2> /dev/null | grep "IPSec VPN Server" |awk '{print $1}') for rule in $rules do iptables -D forwarding_rule $rule 2> /dev/null break done - nums=`expr $nums - 1` + nums=$(expr $nums - 1) done fi -enable=$(uci get ipsec.ipsec.enabled) -if [ $enable -eq 1 ]; then - is_nat=$(uci get ipsec.ipsec.is_nat) - if [ "$is_nat" -eq 1 ];then - clientip=$(uci get ipsec.ipsec.clientip) - export_interface=$(uci get ipsec.ipsec.export_interface) - if [ "$export_interface" != "default" ];then - iptables -t nat -I POSTROUTING -s ${clientip%.*}.0/24 -o ${export_interface} -m comment --comment "Rule For IPSec VPN Server" -j MASQUERADE - else - iptables -t nat -I POSTROUTING -s ${clientip%.*}.0/24 -m comment --comment "Rule For IPSec VPN Server" -j MASQUERADE - fi - iptables -I forwarding_rule -s ${clientip%.*}.0/24 -m comment --comment "Rule For IPSec VPN Server" -j ACCEPT - fi - iptables -I INPUT -p udp -m multiport --dports 500,4500 -m comment --comment "Rule For IPSec VPN Server" -j ACCEPT +enable=$(uci -q get ipsec.ipsec.enabled) +if [ -n "$enable" -a "$enable" == 1 ]; then + clientip=$(uci -q get ipsec.ipsec.clientip) + iptables -t nat -I POSTROUTING -s ${clientip%.*}.0/24 -m comment --comment "IPSec VPN Server" -j MASQUERADE + iptables -I forwarding_rule -s ${clientip%.*}.0/24 -m comment --comment "IPSec VPN Server" -j ACCEPT + iptables -I INPUT -p udp -m multiport --dports 500,4500 -m comment --comment "IPSec VPN Server" -j ACCEPT fi