<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">... for completeness, this is the down-client script<div class=""><br class=""></div><div class=""><div style="color: rgb(212, 212, 212); background-color: rgb(30, 30, 30); font-family: Menlo, Monaco, "Courier New", monospace; line-height: 18px; white-space: pre;" class=""><div class=""><span style="color: #ce9178;" class="">down-client)</span></div><div class=""><span style="color: #ce9178;" class=""> iptables -S FORWARD | grep "reqid \${PLUTO_REQID}" | cut -d' ' -f2- | while read RULE</span></div><div class=""><span style="color: #ce9178;" class=""> do</span></div><div class=""><span style="color: #ce9178;" class=""> iptables -D \$RULE</span></div><br class=""><div class=""><span style="color: #ce9178;" class=""> logger -t \$TAG -p \$FAC_PRIO -- \\</span></div><div class=""><span style="color: #ce9178;" class=""> "- \$PLUTO_XAUTH_ID (\$PLUTO_REQID) \$RULE"</span></div><div class=""><span style="color: #ce9178;" class=""> done</span></div><div class=""><span style="color: #ce9178;" class=""> ;;</span></div><div class=""><span style="color: #ce9178;" class=""></span></div></div><div class=""><br class="webkit-block-placeholder"></div><div class=""><br class=""></div><div><blockquote type="cite" class=""><div class="">On 31 Oct 2019, at 22:56, Christian Salway <<a href="mailto:christian.salway@naimuri.com" class="">christian.salway@naimuri.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Thanks, Tobias,<div class=""><br class=""></div><div class="">I went down the route of writing a custom updown script as I didn’t know how to write hooks so this seemed easiest.</div><div class=""><br class=""></div><div class=""><div style="background-color: rgb(30, 30, 30); line-height: 18px;" class=""><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class="">cat <<<span style="color: #569cd6;" class="">EOF</span><span style="color: #ce9178;" class=""> > /opt/strongswan/_updown</span></div><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class="">#!/bin/bash</span></div><font color="#d4d4d4" style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre;" class=""><br class=""></font><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class="">LDAPURL='${LDAPURL}'</span></div><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class="">BASEOU='${BASEOU}'</span></div><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class="">BINDUN='${BINDUN}'</span></div><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class="">BINDPW='${BINDPW}'</span></div><font color="#d4d4d4" style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre;" class=""><br class=""></font><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class="">TAG=charon-route</span></div><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class="">FAC_PRIO=local0.notice</span></div><font color="#d4d4d4" style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre;" class=""><br class=""></font><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class="">IPSEC_POLICY="-m policy --pol ipsec --proto \$PLUTO_PROTO --reqid \$PLUTO_REQID"</span></div><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class="">IPSEC_POLICY_IN="\$IPSEC_POLICY --dir in"</span></div><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class="">IPSEC_POLICY_OUT="\$IPSEC_POLICY --dir out"</span></div><font color="#d4d4d4" style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre;" class=""><br class=""></font><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class="">case "\$PLUTO_VERB" in</span></div><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class="">up-client)</span></div><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class=""> # expects a group name in the format cidr-xx.xx.xx.xx-nn, eg: cidr-172.31.0.0-16</span></div><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class=""> ldapsearch -H "\${LDAPURL}" -x -D "\${BINDUN}" -w "\${BINDPW}" -b "\${BASEOU}" -LLL "(sAMAccountName=\${PLUTO_XAUTH_ID})" memberOf | \\</span></div><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class=""> grep -oP '(?<=memberOf: CN=cidr-).+?(?=,OU.+)' | \\</span></div><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class=""> sed 's|-|/|' | while read CIDR</span></div><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class=""> do</span></div><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class=""> iptables -I FORWARD 1 -o \$PLUTO_INTERFACE -p \$PLUTO_PEER_PROTOCOL \\</span></div><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class=""> -s \$CIDR -d \$PLUTO_PEER_CLIENT </span><span style="color: rgb(206, 145, 120);" class="">\$IPSEC_POLICY_OUT -j ACCEPT</span></div><font color="#d4d4d4" style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre;" class=""><br class=""></font><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class=""> iptables -I FORWARD 1 -i \$PLUTO_INTERFACE -p \$PLUTO_MY_PROTOCOL \\</span></div><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class=""> -s \$PLUTO_PEER_CLIENT -d \$CIDR </span><span style="color: rgb(206, 145, 120);" class="">\$IPSEC_POLICY_IN -j ACCEPT</span></div><font color="#d4d4d4" style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre;" class=""><br class=""></font><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class=""> logger -t \$TAG -p \$FAC_PRIO \\</span></div><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class=""> "+ \$PLUTO_XAUTH_ID (\$PLUTO_REQID) \$PLUTO_PEER_CLIENT == \$PLUTO_PEER -- \$PLUTO_ME == \$CIDR"</span></div><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class=""> done</span></div><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class=""> ;;</span></div><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class="">down-client)</span></div><div class=""><span style="color: rgb(206, 145, 120); font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre;" class=""> # remove rules - yet to be written. Needs to assume the user might have been removed from the Group before </span><font color="#ce9178" face="Menlo, Monaco, Courier New, monospace" class=""><span style="caret-color: rgb(206, 145, 120); white-space: pre;" class="">disconnection</span></font></div><div class=""><font color="#ce9178" class=""><font face="Menlo, Monaco, Courier New, monospace" class=""><span style="white-space: pre;" class=""> iptables -F FORWARD # TESTING ONLY</span></font></font></div><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class=""> ;;</span></div><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class="">*) echo "\$0: unknown verb '\$PLUTO_VERB'" >&2</span></div><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class=""> ;;</span></div><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #ce9178;" class="">esac</span></div><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class=""><span style="color: #569cd6;" class="">EOF</span></div><div style="font-family: Menlo, Monaco, "Courier New", monospace; white-space: pre; color: rgb(212, 212, 212);" class="">chmod +x /opt/strongswan/_updown</div></div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><div style="color: rgb(212, 212, 212); background-color: rgb(30, 30, 30); font-family: Menlo, Monaco, "Courier New", monospace; line-height: 18px; white-space: pre;" class=""><div class=""><span style="color: #ce9178;" class="">children {</span></div><div class=""><span style="color: #ce9178;" class=""> child {</span></div><div class=""><span style="color: #ce9178;" class=""> local_ts = ${CLIENT_ROUTES}</span></div><div class=""><span style="color: #ce9178;" class=""> </span><span style="color: rgb(206, 145, 120);" class=""> updown = /opt/strongswan/_updown</span></div><div class=""><span style="color: #ce9178;" class=""> }</span></div><div class=""><span style="color: #ce9178;" class="">}</span></div></div></div><div class=""><br class=""><div class="">
<div dir="auto" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br class=""></div></div></div></div></div></div></div></div><div class=""><blockquote type="cite" class=""><div class="">On 31 Oct 2019, at 09:22, Tobias Brunner <<a href="mailto:tobias@strongswan.org" class="">tobias@strongswan.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Hi Christian,<br class=""><br class=""><blockquote type="cite" class="">How would that work? Because a user can be a member of one or more groups and thus how does strongswan select the connection with all the groups.<br class=""></blockquote><br class="">Since a single group match is currently enough to satisfy the group<br class="">constraint (there is also no "best"-match based on groups), you'll have<br class="">to assign unique groups to the users that have access to specific<br class="">networks. That is, groups for individual networks won't work (unless<br class="">members of such groups only have access to one network), you need groups<br class="">that allow access to combinations of networks. If you can't change the<br class="">original group assignment, you'll need to map them somehow, for<br class="">instance, write a plugin that implements the authorize hook and assign a<br class="">new group based on the ones already assigned. Alternatively, write a<br class="">plugin that implements the narrow hook and assigns traffic selectors<br class="">based on whatever strategy you like.<br class=""><br class="">Regards,<br class="">Tobias<br class=""></div></div></blockquote></div><br class=""></div></div></div></blockquote></div><br class=""></div></body></html>