Merge pull request #25 from labriqueinternet/issue7

Fix #7 and add command-line Cube File loader

conf/hook_post-iptable-rules

@@ -0,0 +1,70 @@
+#!/bin/bash
+
+host6=$(dig AAAA +short <TPL:SERVER_NAME> | tail -n1)
+host4=$(dig A +short <TPL:SERVER_NAME> | tail -n1)
+
+# IPv6
+
+sudo ip6tables -N vpnclient_in
+sudo ip6tables -N vpnclient_out
+sudo ip6tables -N vpnclient_fwd
+
+sudo ip6tables -A vpnclient_in -p icmpv6 -j ACCEPT
+sudo ip6tables -A vpnclient_in -s fd00::/8,fe80::/10 -j ACCEPT
+sudo ip6tables -A vpnclient_in -p tcp --dport 22 -j ACCEPT
+sudo ip6tables -A vpnclient_in -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+sudo ip6tables -A vpnclient_in -j DROP
+
+if [ ! -z "${host6}" ]; then
+  sudo ip6tables -A vpnclient_out -d ${host6} -p <TPL:PROTO> --dport <TPL:SERVER_PORT> -j ACCEPT
+fi
+
+for i in <TPL:DNS0> <TPL:DNS1>; do
+  if [[ "${i}" =~ : ]]; then
+    sudo ip6tables -A vpnclient_out -p udp -d "${i}" --dport 53 -j ACCEPT
+  fi
+done
+
+sudo ip6tables -A vpnclient_out -d fd00::/8,fe80::/10 -j ACCEPT
+sudo ip6tables -A vpnclient_out -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+sudo ip6tables -A vpnclient_out -j DROP
+
+sudo ip6tables -A vpnclient_fwd -j DROP
+
+sudo ip6tables -I INPUT 1 -i <TPL:WIRED_DEVICE> -j vpnclient_in
+sudo ip6tables -I OUTPUT 1 -o <TPL:WIRED_DEVICE> -j vpnclient_out
+sudo ip6tables -I FORWARD 1 -o <TPL:WIRED_DEVICE> -j vpnclient_fwd
+
+# IPv4
+
+sudo iptables -N vpnclient_in
+sudo iptables -N vpnclient_out
+sudo iptables -N vpnclient_fwd
+
+sudo iptables -A vpnclient_in -p icmp -j ACCEPT
+sudo iptables -A vpnclient_in -s 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16 -j ACCEPT
+sudo iptables -A vpnclient_in -p tcp --dport 22 -j ACCEPT
+sudo iptables -A vpnclient_in -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+sudo iptables -A vpnclient_in -j DROP
+
+if [ ! -z "${host4}" ]; then
+  sudo iptables -A vpnclient_out -d ${host4} -p <TPL:PROTO> --dport <TPL:SERVER_PORT> -j ACCEPT
+fi
+
+for i in <TPL:DNS0> <TPL:DNS1>; do
+  if [[ "${i}" =~ \. ]]; then
+    sudo iptables -A vpnclient_out -p udp -d "${i}" --dport 53 -j ACCEPT
+  fi
+done
+
+sudo iptables -A vpnclient_out -d 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16 -j ACCEPT
+sudo iptables -A vpnclient_out -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+sudo iptables -A vpnclient_out -j DROP
+
+sudo iptables -A vpnclient_fwd -j DROP
+
+sudo iptables -I INPUT 1 -i <TPL:WIRED_DEVICE> -j vpnclient_in
+sudo iptables -I OUTPUT 1 -o <TPL:WIRED_DEVICE> -j vpnclient_out
+sudo iptables -I FORWARD 1 -o  <TPL:WIRED_DEVICE> -j vpnclient_fwd
+
+exit 0

conf/openvpn@.service

@@ -0,0 +1,5 @@
+.include /lib/systemd/system/openvpn@.service
+
+[Service]
+Restart=always
+RestartSec=1

conf/ynh-vpnclient

@@ -38,6 +38,13 @@ is_hotspot_knowme() {
   [ "${hotspot_vpnclient}" == yes ]
 }
 
+is_firewall_set() {
+  wired_device=${1}
+
+  ip6tables -nvL OUTPUT | grep vpnclient_out | grep -q "${wired_device}"\
+  && iptables -nvL OUTPUT | grep vpnclient_out | grep -q "${wired_device}"
+}
+
 is_ip6addr_set() {
   ip address show dev tun0 2> /dev/null | grep -q "${ynh_ip6_addr}/128"
 }
@@ -64,7 +71,7 @@ is_openvpn_running() {
 is_running() {
   ((has_nativeip6 && is_serverip6route_set "${new_server_ip6}") || ! has_nativeip6)\
   && ((! has_hotspot_app && has_ip6delegatedprefix && is_ip6addr_set) || has_hotspot_app || ! has_ip6delegatedprefix)\
-  && is_dns_set && is_openvpn_running
+  && is_dns_set && is_firewall_set && is_openvpn_running
 }
 
 ## Setters
@@ -73,6 +80,21 @@ set_ip6addr() {
   ip address add "${ynh_ip6_addr}/128" dev tun0
 }
 
+set_firewall() {
+  wired_device=${1}
+
+  cp /etc/yunohost/hooks.d/{90-vpnclient.tpl,post_iptable_rules/90-vpnclient}
+
+  sed "s|<TPL:SERVER_NAME>|${ynh_server_name}|g" -i /etc/yunohost/hooks.d/post_iptable_rules/90-vpnclient
+  sed "s|<TPL:SERVER_PORT>|${ynh_server_port}|g" -i /etc/yunohost/hooks.d/post_iptable_rules/90-vpnclient
+  sed "s|<TPL:PROTO>|${ynh_server_proto}|g" -i /etc/yunohost/hooks.d/post_iptable_rules/90-vpnclient
+  sed "s|<TPL:WIRED_DEVICE>|${wired_device}|g" -i /etc/yunohost/hooks.d/post_iptable_rules/90-vpnclient
+  sed "s|<TPL:DNS0>|${ynh_dns0}|g" -i /etc/yunohost/hooks.d/post_iptable_rules/90-vpnclient
+  sed "s|<TPL:DNS1>|${ynh_dns1}|g" -i /etc/yunohost/hooks.d/post_iptable_rules/90-vpnclient
+
+  yunohost firewall reload
+}
+
 set_serverip6route() {
   server_ip6=${1}
   ip6_gw=${2}
@@ -141,6 +163,11 @@ unset_ip6addr() {
   ip address delete "${ynh_ip6_addr}/128" dev tun0
 }
 
+unset_firewall() {
+  rm -f /etc/yunohost/hooks.d/post_iptable_rules/90-vpnclient
+  yunohost firewall reload
+}
+
 unset_serverip6route() {
   server_ip6=${1}
   ip6_gw=${2}
@@ -287,6 +314,12 @@ case "${1}" in
         set_dns
       fi
 
+      # Set ipv6/ipv4 firewall
+      if ! is_firewall_set "${new_wired_device}"; then
+        echo "Set IPv6/IPv4 firewall"
+        set_firewall "${new_wired_device}"
+      fi
+
       # Update dynamic settings
       ynh_setting_set vpnclient server_ip6 "${new_server_ip6}"
       ynh_setting_set vpnclient ip6_gw "${new_ip6_gw}"
@@ -312,6 +345,11 @@ case "${1}" in
       unset_serverip6route "${old_server_ip6}" "${old_ip6_gw}" "${old_wired_device}"
     fi
 
+    if is_firewall_set "${old_wired_device}"; then
+      echo "Unset IPv6/IPv4 firewall"
+      unset_firewall
+    fi
+
     if is_dns_set; then
       echo "Unset forced host DNS resolvers"
       unset_dns
@@ -384,6 +422,13 @@ case "${1}" in
       echo "[INFO] No IPv6 server route to set"
     fi
 
+    if is_firewall_set "${new_wired_device}"; then
+      echo "[OK] IPv6/IPv4 firewall set"
+    else
+      echo "[ERR] No IPv6/IPv4 firewall set"
+      exitcode=1
+    fi
+
     if is_dns_set; then
       echo "[OK] Host DNS correctly set"
     else
@@ -401,7 +446,7 @@ case "${1}" in
     exit ${exitcode}
   ;;
   *)
-    echo "Usage: $0 {start|stop|litestop|restart|status}"
+    echo "Usage: $0 {start|stop|restart|status}"
     exit 1
   ;;
 esac

conf/ynh-vpnclient-loadcubefile.sh

@@ -0,0 +1,132 @@
+#!/bin/bash
+
+# VPN Client app for YunoHost
+# Copyright (C) 2015 Julien Vaubourg <julien@vaubourg.com>
+# Contribute at https://github.com/labriqueinternet/vpnclient_ynh
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Options
+
+while getopts "u:p:c:h" opt; do
+  case $opt in
+    u)
+      ynh_user=$OPTARG
+    ;;
+    p)
+      ynh_password=$OPTARG
+    ;;
+    c)
+      cubefile_path=$OPTARG
+
+      if [ ! -r "${cubefile_path}" ]; then
+        echo "[ERR] Cube file does not exist or is unreadable" >&2
+        exit 1
+      fi
+    ;;
+    h)
+      echo "-u SSO username (user with permissions on VPN Client)"
+      echo "-p SSO password"
+      echo "-c Dot cube file path"
+      echo "-h This help"
+
+      exit 0
+    ;;
+    \?)
+      echo "[ERR] Invalid option: -$OPTARG (-h for help)" >&2
+      exit 1
+    ;;
+    :)
+      echo "[ERR] Option -$OPTARG requires an argument" >&2
+      exit 1
+    ;;
+  esac
+done
+
+if [ -z "${ynh_user}" ]; then
+  echo "[ERR] Option -u is mandatory (-h for help)" >&2
+  exit 1
+fi
+
+if [ -z "${ynh_password}" ]; then
+  echo "[ERR] Option -p is mandatory (-h for help)" >&2
+  exit 1
+fi
+
+if [ -z "${cubefile_path}" ]; then
+  echo "[ERR] Option -c is mandatory (-h for help)" >&2
+  exit 1
+fi
+
+
+# Other variables
+
+ynh_setting() {
+  app=${1}
+  setting=${2}
+
+  sudo grep "^${setting}:" "/etc/yunohost/apps/${app}/settings.yml" | sed s/^[^:]\\+:\\s*[\"\']\\?// | sed s/\\s*[\"\']\$//
+}
+
+tmpdir=$(mktemp -dp /tmp/ vpnclient-loadcubefile-XXXXX)
+
+cubefile_ip6=$(sed -n '/ip6_net/ { s/.*"\([0-9a-zA-Z:]\+\)".*/\1/p }' "${cubefile_path}")
+
+ynh_domain=$(ynh_setting vpnclient domain)
+ynh_path=$(ynh_setting vpnclient path)
+ynh_service_enabled=$(ynh_setting vpnclient service_enabled)
+
+
+# SSO login
+
+curl -kLe "https://${ynh_domain}/yunohost/sso/" -d "user=${ynh_user}" -d "password=${ynh_password}" "https://${ynh_domain}/yunohost/sso/" --resolve "${ynh_domain}:443:127.0.0.1" -c "${tmpdir}/cookies" 2> /dev/null | grep -q Logout
+
+if [ $? -ne 0 ]; then
+  echo "[ERROR] SSO login failed" >&2
+  exit 1
+fi
+
+
+# Upload cube file
+
+output=$(curl -kL -F "service_enabled=${ynh_service_enabled}" -F _method=put -F "cubefile=@${cubefile_path}" "https://${ynh_domain}/${ynh_path}/?/settings" --resolve "${ynh_domain}:443:127.0.0.1" -b "${tmpdir}/cookies" 2> /dev/null | grep RETURN_MSG | sed 's/<!-- RETURN_MSG -->//' | sed 's/<\/?[^>]\+>//g' | sed 's/^ \+//g')
+
+
+# Configure IPv6 Delegated Prefix on Hotspot
+
+if [ ! -z "${cubefile_ip6}" ] && (sudo yunohost app info hotspot | grep -q Hotspot); then
+  ynh_multissid=$(ynh_setting hotspot multissid)
+
+  if [ "${ynh_multissid}" -eq 1 ]; then
+    ynh_ip6_net=$(ynh_setting vpnclient ip6_net)
+    ynh_ip6_addr=$(ynh_setting vpnclient ip6_addr)
+
+    sudo systemctl stop ynh-hotspot &> /dev/null
+    sudo yunohost app setting hotspot ip6_net -v "${ynh_ip6_net}"
+    sudo yunohost app setting hotspot ip6_addr -v "${ynh_ip6_addr}"
+    sudo systemctl start ynh-hotspot &> /dev/null
+
+    echo "[INFO] Wifi Hotspot found with only one SSID: IPv6 Delegated Prefix automatically configured" >&2
+  fi
+fi
+
+
+# Done!
+
+echo [VPN] $output
+(echo $output | grep -q Error) && exit 1
+
+rm -r "${tmpdir}/"
+
+exit 0

scripts/install

@@ -26,6 +26,8 @@ url_path=${2}
 server_name=${3}
 
 if ! $upgrade; then
+ 
+  source ./prerequisites
 
   # Check arguments
   if [ -z "${server_name}" ]; then
@@ -42,7 +44,7 @@ if ! $upgrade; then
 fi
 
 # Install packages
-packages='php5-fpm sipcalc openvpn'
+packages='php5-fpm sipcalc dnsutils openvpn curl'
 export DEBIAN_FRONTEND=noninteractive
 
 sudo apt-get --assume-yes --force-yes install ${packages}
@@ -76,15 +78,21 @@ sudo yunohost app setting vpnclient gitcommit -v "${gitcommit}"
 sudo install -o root -g root -m 0755 ../conf/ipv6_expanded /usr/local/bin/
 sudo install -o root -g root -m 0755 ../conf/ipv6_compressed /usr/local/bin/
 
+# Install command-line cube file loader
+sudo install -o root -g root -m 0755 ../conf/ynh-vpnclient-loadcubefile.sh /usr/local/bin/
+
 # Copy confs
 sudo mkdir -pm 0755 /var/log/nginx/
 sudo chown root:admins /etc/openvpn/
 sudo chmod 775 /etc/openvpn/
+sudo mkdir -pm 0755 /etc/yunohost/hooks.d/post_iptable_rules/
 
 sudo install -b -o root -g admins -m 0664 ../conf/openvpn_client.conf.tpl /etc/openvpn/client.conf.tpl
 sudo install -o root -g root -m 0644 ../conf/openvpn_client.conf.tpl /etc/openvpn/client.conf.tpl.restore
 sudo install -b -o root -g root -m 0644 ../conf/nginx_vpnadmin.conf "/etc/nginx/conf.d/${domain}.d/vpnadmin.conf"
 sudo install -b -o root -g root -m 0644 ../conf/phpfpm_vpnadmin.conf /etc/php5/fpm/pool.d/vpnadmin.conf
+sudo install -b -o root -g root -m 0755 ../conf/hook_post-iptable-rules /etc/yunohost/hooks.d/90-vpnclient.tpl
+sudo install -b -o root -g root -m 0644 ../conf/openvpn@.service /etc/systemd/system/
 
 # Copy web sources
 sudo mkdir -pm 0755 /var/www/vpnadmin/

scripts/prerequisites

@@ -0,0 +1,8 @@
+# Source me
+
+# Check Moulinette version (firewall hook)
+ynh_moulinette_version=$(sudo dpkg -l moulinette-yunohost | grep ii | awk '{ print $3 }' | sed 's/\.//g')
+
+if [ "${ynh_moulinette_version}" -lt 240 ]; then
+  echo "WARN: You need a YunoHost-Moulinette version equals or greater than 2.4.0 for activating the firewalling" >&2
+fi

scripts/remove

@@ -31,6 +31,9 @@ sudo rm -f /tmp/.ynh-vpnclient-*
 sudo rm -f /etc/openvpn/client.conf{.tpl,.tpl.restore,}
 sudo rm -f /etc/nginx/conf.d/${domain}.d/vpnadmin.conf
 sudo rm -f /etc/php5/fpm/pool.d/vpnadmin.conf
+sudo rm -f /etc/yunohost/hooks.d/90-vpnclient.tpl
+sudo rm -f /etc/systemd/system/openvpn@.service
+sudo rm -f /usr/local/bin/ynh-vpnclient-loadcubefile.sh
 
 # Remove certificates
 sudo rm -rf /etc/openvpn/keys/

scripts/upgrade

@@ -7,6 +7,8 @@ ynh_setting() {
   sudo grep "^${setting}:" "/etc/yunohost/apps/${app}/settings.yml" | sed s/^[^:]\\+:\\s*[\"\']\\?// | sed s/\\s*[\"\']\$//
 }
 
+source ./prerequisites
+
 domain=$(ynh_setting vpnclient domain)
 path=$(ynh_setting vpnclient path)
 server_name=$(ynh_setting vpnclient server_name)

sources/views/layout.html.php

@@ -46,17 +46,17 @@
     <?php if(isset($flash['error'])): ?>
       <div class="alert alert-dismissible alert-danger fade in" style="margin-top: 20px" role="alert">
         <button type="button" class="close" data-dismiss="alert"><span aria-hidden="true">&times;</span><span class="sr-only">Close</span></button>
-        <strong><?= _('Error') ?>:</strong> <?= $flash['error'] ?>
+        <strong><?= _('Error') ?>:</strong> <?= $flash['error'] ?><!-- RETURN_MSG -->
       </div>
     <?php elseif(isset($flash['notice'])): ?>
       <div class="alert alert-dismissible alert-info fade in" style="margin-top: 20px" role="alert">
         <button type="button" class="close" data-dismiss="alert"><span aria-hidden="true">&times;</span><span class="sr-only">Close</span></button>
-        <strong><?= _('Notice') ?>:</strong> <?= $flash['notice'] ?>
+        <strong><?= _('Notice') ?>:</strong> <?= $flash['notice'] ?><!-- RETURN_MSG -->
       </div>
     <?php elseif(isset($flash['success'])): ?>
       <div class="alert alert-dismissible alert-success fade in" style="margin-top: 20px" role="alert">
         <button type="button" class="close" data-dismiss="alert"><span aria-hidden="true">&times;</span><span class="sr-only">Close</span></button>
-        <?= $flash['success'] ?>
+        <?= $flash['success'] ?><!-- RETURN_MSG -->
       </div>
     <?php endif; ?>