From 39063981f7605a994851eec4a7acae86b2327983 Mon Sep 17 00:00:00 2001 From: Jaco Kroon Date: Tue, 26 Sep 2023 14:45:13 +0200 Subject: [PATCH] pppd: implement net-init, net-pre-up and net-down. net-init executes as a blocking script directly after the unit number becomes available. This can be used to initialise aspects related to the ppp connection that lives outside of the ppp connection. It can also be used to clean up (in the author's extremely unlikely case) where a previous pppd crashed, and net-down didn't execute in order to clean up. net-pre-up executes as a blocking script after auth, prior to NCPs being negotiated. Unlike ip-pre-up this is guaranteed to execute prior to the interface being brought up, and can be used in an NCP agnostic manner to pre-initialise aspects of the interface for which it still needs to be down (amongst others it's recommended that firewall changes happen here). net-down executes in a non-blocking manner just prior to pppd terminating and can be used to clean up actions from previous scripts. You will notice that I mention ip-pre-up doesn't gaurantee that the interface will still be down, this is because in a Linux world all protocols runs on the same interface, compared to solaris where I'm informed each protocol runs on it's own sub-interface, each of which has it's own operational state. The man page for pppd has also been adjusted to indicate as much. Signed-off-by: Jaco Kroon --- pppd/main.c | 39 +++++++++++++++++++++++++++++++++++++++ pppd/pathnames.h | 4 ++++ pppd/pppd.8 | 33 +++++++++++++++++++++++++++++++-- 3 files changed, 74 insertions(+), 2 deletions(-) diff --git a/pppd/main.c b/pppd/main.c index c207d10..9fbcfb6 100644 --- a/pppd/main.c +++ b/pppd/main.c @@ -248,6 +248,7 @@ static void holdoff_end(void *); static void forget_child(int pid, int status); static int reap_kids(void); static void childwait_end(void *); +static void run_net_script(char* script, int wait); #ifdef PPP_WITH_TDB static void update_db_entry(void); @@ -799,6 +800,26 @@ setup_signals(void) signal(SIGPIPE, SIG_IGN); } +/* + * net-* scripts to be run come through here. + */ +void run_net_script(char* script, int wait) +{ + char strspeed[32]; + char *argv[6]; + + slprintf(strspeed, sizeof(strspeed), "%d", baud_rate); + + argv[0] = script; + argv[1] = ifname; + argv[2] = devnam; + argv[3] = strspeed; + argv[4] = ipparam; + argv[5] = NULL; + + run_program(script, argv, 0, NULL, NULL, wait); +} + /* * set_ifunit - do things we need to do once we know which ppp * unit we are using. @@ -820,6 +841,7 @@ set_ifunit(int iskey) create_pidfile(getpid()); /* write pid to file */ create_linkpidfile(getpid()); } + run_net_script(PPP_PATH_NET_INIT, 1); } /* @@ -1222,6 +1244,23 @@ ppp_recv_config(int unit, int mru, u_int32_t accm, int pcomp, int accomp) void new_phase(ppp_phase_t p) { + switch (p) { + case PHASE_NETWORK: + if (phase <= PHASE_NETWORK) { + char iftmpname[IFNAMSIZ]; + int ifindex = if_nametoindex(ifname); + run_net_script(PPP_PATH_NET_PREUP, 1); + if (if_indextoname(ifindex, iftmpname) && strcmp(iftmpname, ifname)) { + info("Detected interface name change from %s to %s.", ifname, iftmpname); + strcpy(ifname, iftmpname); + } + } + break; + case PHASE_DISCONNECT: + run_net_script(PPP_PATH_NET_DOWN, 0); + break; + } + phase = p; if (new_phase_hook) (*new_phase_hook)(p); diff --git a/pppd/pathnames.h b/pppd/pathnames.h index de2fb68..439c6c8 100644 --- a/pppd/pathnames.h +++ b/pppd/pathnames.h @@ -107,6 +107,10 @@ #define PPP_PATH_PEERFILES PPP_PATH_CONFDIR "/peers/" #define PPP_PATH_RESOLV PPP_PATH_CONFDIR "/resolv.conf" +#define PPP_PATH_NET_INIT PPP_PATH_CONFDIR "/net-init" +#define PPP_PATH_NET_PREUP PPP_PATH_CONFDIR "/net-pre-up" +#define PPP_PATH_NET_DOWN PPP_PATH_CONFDIR "/net-down" + #define PPP_PATH_CONNERRS PPP_PATH_VARLOG "/connect-errors" #define PPP_PATH_USEROPT ".ppprc" diff --git a/pppd/pppd.8 b/pppd/pppd.8 index 79b5bea..f66ca89 100644 --- a/pppd/pppd.8 +++ b/pppd/pppd.8 @@ -1729,8 +1729,8 @@ We failed to authenticate ourselves to the peer. Pppd invokes scripts at various stages in its processing which can be used to perform site-specific ancillary processing. These scripts are usually shell scripts, but could be executable code files instead. -Pppd does not wait for the scripts to finish (except for the ip-pre-up -script). The scripts are +Pppd does not wait for the scripts to finish (except for the net-init, +net-pre-up and ip-pre-up scripts). The scripts are executed as root (with the real and effective user-id set to 0), so that they can do things such as update routing tables or run privileged daemons. Be careful that the contents of these scripts do @@ -1840,6 +1840,14 @@ IP addresses assigned but is still down. This can be used to add firewall rules before any IP traffic can pass through the interface. Pppd will wait for this script to finish before bringing the interface up, so this script should run quickly. +.PP +WARNING: Please note that on systems where a single interface carries multiple +protocols (Linux) ip-pre-up is NOT actually guaranteed to execute prior to the +interface moving into an up state, although IP information won't be known you +should consider using net-pre-up instead, alternatively, disable other NCPs +such that IPv4 is the only negotiated protocol - which will also result in a +guarantee that ip-pre-up is called prior to the interface going into an UP +state. .TP .B /etc/ppp/ip\-up A program or script which is executed when the link is available for @@ -1869,6 +1877,27 @@ Similar to /etc/ppp/ip\-down, but it is executed when IPv6 packets can no longer be transmitted on the link. It is executed with the same parameters as the ipv6\-up script. .TP +.B /etc/ppp/net\-init +This script will be executed the moment the ppp unit number is known. This +script will be waited for and should not cause significant delays. This can be +used to update book-keeping type systems external to ppp and provides the only +guaranteed point where a script can be executed knowing the ppp unit number +prior to LCP being initiated. It is executed with the parameters +.IP +\fIinterface\-name tty\-device speed ipparam +.TP +.B /etc/ppp/net\-pre\-up +This script will be executed just prior to NCP negotiations initiating, and is +guaranteed to be executed whilst the interface (Linux) and/or sub-interfaces +(Solaris) as the case may be is/are still down. ppp will block waiting for +this script to complete, and the interface may be safely renamed in this script +(using for example "ip li set dev $1 name ppp-foobar". The parameters are the +same as for net\-init. +.TP +.B /etc/ppp/net\-down +This script will be executed just prior to ppp terminating and will not be +waited for. The parameters are the same as for net\-init. +.TP .B /var/run/ppp\fIn\fB.pid \fR(BSD or Linux), \fB/etc/ppp/ppp\fIn\fB.pid \fR(others) Process-ID for pppd process on ppp interface unit \fIn\fR. .TP -- 2.39.2