Hurricane Electric tunnel broker IPv4 endpoint updater for IPCop v1.4 [patch]
Nick Austin <[email protected]>
| Newsgroups | gmane.comp.security.ipcop.devel |
|---|---|
| Message-ID | <CAPrP9G_jPkQQ71r_5woZBm3OwdshbzvWPkKhBq8Zs+Y-wvY_Dg@mail.gmail.com> |
I've hacked up (and attached) a quick patch which adds support for updating the IPv4 endpoint for Hurricane Electric IPv6 tunnels. See: http://www.tunnelbroker.net/ Problem: The IPv6 tunnel broker needs to know your current IPv4 address in order to send you 6in4 packets. Many people have dynamic IP addresses. Solution: I've added a Dynamic DNS rule for he.net which behaves like any other DDNS target, and keeps your current IPv4 address updated. Thanks! PS. Also useful to add to /etc/rc.d/rc.firewall.local under start section: HE_TUNNELBROKER_IP=209.51.181.2 iptables -A CUSTOMFORWARD -i eth2 -p 41 -s HE_TUNNELBROKER_IP -j ACCEPT iptables -t nat -A CUSTOMPREROUTING -i eth2 -s $HE_TUNNELBROKER_IP -p 41 -j DNAT --to 192.168.100.15 ------------------------------------------------------------------------------ All the data continuously generated in your IT infrastructure contains a definitive record of customers, application performance, security threats, fraudulent activity, and more. Splunk takes this data and makes sense of it. IT sense. And common sense. http://p.sf.net/sfu/splunk-novd2d _______________________________________________ IPCop-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/ipcop-devel
he.patch
(text/x-patch, 3.2 KB)
diff -urN orig/home/httpd/cgi-bin/ddns.cgi new/home/httpd/cgi-bin/ddns.cgi
--- orig/home/httpd/cgi-bin/ddns.cgi 2011-11-24 14:58:19.634758136 -0800
+++ new/home/httpd/cgi-bin/ddns.cgi 2011-11-24 14:57:03.579030221 -0800
@@ -74,6 +74,7 @@
$va{'everydns.net'} = { LOGIN=>1, HOSTNAME=>0, DOMAIN=>1, PASSWORD=>1, LBNAME=>'', HELP=>$Lang::tr{'ddns help plus'} };
$va{'freedns.afraid.org'}={ LOGIN=>1, HOSTNAME=>0, DOMAIN=>0, PASSWORD=>0, LBNAME=>'', HELP=>$Lang::tr{'ddns help freedns'}}; # connect string is in LOGIN field
$va{'namecheap.com'} = { LOGIN=>0, HOSTNAME=>0, DOMAIN=>1, PASSWORD=>1, LBNAME=>'', HELP=>$Lang::tr{'ddns help plus'} };
+$va{'he.net'} = { LOGIN=>1, HOSTNAME=>1, DOMAIN=>0, PASSWORD=>1, LBNAME=>'', HELP=>$ddnsprefix };
$va{'no-ip.com'} = { LOGIN=>1, HOSTNAME=>0, DOMAIN=>1, PASSWORD=>1, LBNAME=>'', HELP=>$ddnsprefix };
$va{'nsupdate'} = { LOGIN=>1, HOSTNAME=>0, DOMAIN=>1, PASSWORD=>1, LBNAME=>'', HELP=>$Lang::tr{'ddns help plus'} };
$va{'ods.org'} = { LOGIN=>1, HOSTNAME=>0, DOMAIN=>1, PASSWORD=>1, LBNAME=>'', HELP=>$Lang::tr{'ddns help plus'} };
diff -urN orig/usr/local/bin/setddns.pl new/usr/local/bin/setddns.pl
--- orig/usr/local/bin/setddns.pl 2011-11-24 14:58:40.990400935 -0800
+++ new/usr/local/bin/setddns.pl 2011-11-24 15:11:44.162571322 -0800
@@ -16,6 +16,7 @@
use strict;
use IO::Socket;
use Net::SSLeay;
+use MIME::Base64;
require '/var/ipcop/general-functions.pl';
@@ -459,6 +460,40 @@
&General::log("Dynamic DNS ip-update for $settings{'HOSTNAME'}.$settings{'DOMAIN'} : failure (could not connect to server)");
}
}
+ elsif ($settings{'SERVICE'} eq 'he') {
+ # use proxy ?
+ my %proxysettings;
+ &General::readhash("${General::swroot}/proxy/settings", \%proxysettings);
+ if ($_=$proxysettings{'UPSTREAM_PROXY'}) {
+ my ($peer, $peerport) = (/^(?:[a-zA-Z ]+\:\/\/)?(?:[A-Za-z0-9\_\.\-]*?(?:\:[A-Za-z0-9\_\.\-]*?)?\@)?([a-zA-Z0-9\.\_\-]*?)(?:\:([0-9]{1,5}))?(?:\/.*?)?$/);
+ Net::SSLeay::set_proxy($peer,$peerport,$proxysettings{'UPSTREAM_USER'},$proxysettings{'UPSTREAM_PASSWORD'} );
+ }
+ # fetch
+ my ($out, $response) = Net::SSLeay::get_https(
+ 'ipv4.tunnelbroker.net', 443,
+ "/ipv4_end.php?tid=$settings{'HOSTNAME'}&ip=$ip",
+ Net::SSLeay::make_headers(
+ 'User-Agent' => 'Ipcop',
+ 'Authorization' => 'Basic ' . encode_base64("$settings{'LOGIN'}:$settings{'PASSWORD'}"))
+ );
+ #Valid responses from service are:
+ # +OK: Tunnel endpoint updated to: 1.2.3.4
+ # -ERROR: This tunnel is already associated with this IP address. Please try and limit your updates to IP changes.
+ # -ERROR: Invalid API key or password
+ if ($response =~ m%HTTP/1\.. 200 OK%) {
+ if ( $out !~ m/\+OK:/ ) {
+ $out =~ m/ERROR:(.*)$/;
+ &General::log("Dynamic DNS ip-update for $settings{'HOSTNAME'} : failure ($1)");
+ } else {
+ &General::log("Dynamic DNS ip-update for $settings{'HOSTNAME'} : success");
+ $success++;
+ }
+ } else {
+ &General::log("Dynamic DNS ip-update for tunnel ".
+ "$settings{'HOSTNAME'} : failure (could not connect to ".
+ "server (non-200 HTTP response or other)");
+ }
+ }
elsif ($settings{'SERVICE'} eq 'no-ip') {
open(F, ">${General::swroot}/ddns/noipsettings");
flock F, 2;