ip-tunnel: choose the correct type based on the ip protocol

[network.git] / src / functions / functions.ip-tunnel

#!/bin/bash
###############################################################################
#                                                                             #
# IPFire.org - A linux based firewall                                         #
# Copyright (C) 2012-2013  IPFire Network Development Team                    #
#                                                                             #
# This program is free software: you can redistribute it and/or modify        #
# it under the terms of the GNU General Public License as published by        #
# the Free Software Foundation, either version 3 of the License, or           #
# (at your option) any later version.                                         #
#                                                                             #
# This program is distributed in the hope that it will be useful,             #
# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
# GNU General Public License for more details.                                #
#                                                                             #
# You should have received a copy of the GNU General Public License           #
# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
#                                                                             #
###############################################################################

IP_TUNNEL_MODES="gre sit vti"

# This function converts our modes into the type
# the iproute2 tool uses
ip_tunnel_convert_mode_to_iproute2_mode() {
	local mode=${1}
	local protocol=${2}

	if ! isset mode || ! isset protocol; then
		log ERROR "Did not get mode and/or protocol"
		return ${EXIT_ERROR}
	fi

	if [[ "${protocol}" = "ipv4" ]]; then
		# When we use IPv4 we can use our modes
		echo "${mode}"
	fi

	if [[ "${protocol}" = "ipv6" ]]; then
		# When we use IPv6 we have to convert
		case "${mode}" in
			"vti")
				echo "vti6"
				;;
			"gre")
				echo "ip6gre"
		esac
	fi
}

ip_tunnel_add() {
	local device=${1}
	shift

	local mode
	local ttl

	local remote_address
	local local_address

	local ikey
	local okey

	while [ $# -gt 0 ]; do
		case "${1}" in
			--mode=*)
				mode="$(cli_get_val "${1}")"
				;;
			--ttl=*)
				ttl="$(cli_get_val "${1}")"
				;;
			--remote-address=*)
				remote_address="$(cli_get_val "${1}")"
				;;
			--local-address=*)
				local_address="$(cli_get_val "${1}")"
				;;

			# Keys for VTI
			--ikey=*)
				ikey="$(cli_get_val "${1}")"
				;;
			--okey=*)
				okey="$(cli_get_val "${1}")"
				;;
		esac
		shift
	done

	if ! isset mode; then
		error "--mode= is not set. Must be one of ${IP_TUNNEL_MODES}"
		return ${EXIT_ERROR}
	fi

	if ! isoneof mode ${IP_TUNNEL_MODES}; then
		error "Invalid mode: ${mode}"
		return ${EXIT_ERROR}
	fi

	# Detect the IP protocol, which is important to decide which mode we have to use
	local remote_address_protocol="$(ip_detect_protocol "${remote_address}")"

	# If we could not detect the IP protocol something with
	# ${remote_address} is wrong
	if ! isset remote_address_protocol; then
		log ERROR "Could not determine remote address IP protocol"
		return ${EXIT_ERROR}
	fi

	# We cannot mix IPv6 and IPv4
	if [[ "${remote_address_protocol}" != \
		"$(ip_detect_protocol "${local_address}")" ]] ; then
		log ERROR "Local and remote address\
			are not from the same IP protocol"
		return ${EXIT_ERROR}
	fi

	# ikey and okey must be set for VTI devices
	if [ "${mode}" = "vti" ] && (! isset ikey || ! isset okey); then
		error "--ikey= and --okey= must be set for VTI device"
		return ${EXIT_ERROR}
	fi

	# If TTL is set, make sure it is an integer.
	if isset ttl && ! isinteger ttl; then
		error "TTL must be an integer: ${ttl}"
		return ${EXIT_ERROR}
	fi

	local cmd_args

	# Apply TTL if a value has been set.
	if isset ttl; then
		cmd_args="${cmd_args} ttl ${ttl}"
	fi

	# Apply local address if a value has been set.
	if isset local_address; then
		cmd_args="${cmd_args} local ${local_address}"
	fi

	# Apply remote address if a value has been set.
	if isset remote_address; then
		cmd_args="${cmd_args} remote ${remote_address}"
	fi

	# Add ikey and okey for VTI devices
	if [ "${mode}" = "vti" ]; then
		cmd_args="${cmd_args} ikey ${ikey} okey ${okey}"
	fi

	# Determine the mode based on the IP protocol
	mode=$(ip_tunnel_convert_mode_to_iproute2_mode "${mode}" "${remote_address_protocol}")

	log DEBUG "Creating tunnel device '${device}' (mode=${mode})..."

	# Create the device.
	if ! cmd ip link add name ${device} type ${mode} ${cmd_args}; then
		error "Could not create tunnel device ${device}"
		return ${EXIT_ERROR}
	fi

	# Disable policy lookups for VTI devices
	if [ "${mode}" = "vti" ]; then
		sysctl_set "net.ipv4.conf.${device}.disable_policy" "1"
	fi

	return ${EXIT_OK}
}

ip_tunnel_del() {
	device_delete "$@"
}

ip_tunnel_change_keys() {
	local device="${1}"
	shift

	if ! isset device; then
		error "No device given"
		return ${EXIT_ERROR}
	fi

	local ikey
	local okey

	while [ $# -gt 0 ]; do
		case "${1}" in
			--ikey=*)
				ikey="$(cli_get_val ${1})"
				;;
			--okey=*)
				okey="$(cli_get_val ${1})"
				;;
			*)
				error "Invalid argument: ${1}"
				return ${EXIT_ERROR}
				;;
		esac
		shift
	done

	if ! isset ikey || ! isset okey; then
		error "You need to set --ikey= and --okey="
		return ${EXIT_ERROR}
	fi

	if ! device_exists "${device}"; then
		error "No such device: ${device}"
		return ${EXIT_ERROR}
	fi

	# Determine the device type
	local type="$(device_tunnel_get_type ${device})"

	if ! isoneof "type" vti vti6; then
		log ERROR "Device type '${type}' is invalid"
		return ${EXIT_ERROR}
	fi

	if ! cmd ip link change dev "${device}" \
		type "${type}" ikey "${ikey}" okey "${okey}"; then
		log ERROR "Could not change keys of device ${device}"
		return ${EXIT_ERROR}
	fi

	return ${EXIT_OK}
}