src/functions/functions.ip-tunnel

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2012-2013  IPFire Network Development Team                    #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 IP_TUNNEL_MODES="gre sit vti"
  23
  24 ip_tunnel_protocol_to_name() {
  25         local protocol="${1}"
  26
  27         case "${protocol}" in
  28                 gre)
  29                         print "Generic Routing Encapsulation"
  30                         ;;
  31                 sit)
  32                         print "Simple Internet Transition"
  33                         ;;
  34                 vti)
  35                         print "Virtual Tunnel Interface"
  36                         ;;
  37                 *)
  38                         print "${protocol}"
  39                         ;;
  40         esac
  41 }
  42
  43 # This function converts our modes into the type
  44 # the iproute2 tool uses
  45 ip_tunnel_convert_mode_to_iproute2_mode() {
  46         local mode=${1}
  47         local protocol=${2}
  48
  49         if ! isset mode || ! isset protocol; then
  50                 log ERROR "Did not get mode and/or protocol"
  51                 return ${EXIT_ERROR}
  52         fi
  53
  54         if [[ "${protocol}" = "ipv4" ]]; then
  55                 # When we use IPv4 we can use our modes
  56                 echo "${mode}"
  57         fi
  58
  59         if [[ "${protocol}" = "ipv6" ]]; then
  60                 # When we use IPv6 we have to convert
  61                 case "${mode}" in
  62                         "vti")
  63                                 echo "vti6"
  64                                 ;;
  65                         "gre")
  66                                 echo "ip6gre"
  67                 esac
  68         fi
  69 }
  70
  71 ip_tunnel_add() {
  72         local device=${1}
  73         shift
  74
  75         local mode
  76         local ttl
  77
  78         local remote_address
  79         local local_address
  80
  81         local ikey
  82         local okey
  83
  84         while [ $# -gt 0 ]; do
  85                 case "${1}" in
  86                         --mode=*)
  87                                 mode="$(cli_get_val "${1}")"
  88                                 ;;
  89                         --ttl=*)
  90                                 ttl="$(cli_get_val "${1}")"
  91                                 ;;
  92                         --remote-address=*)
  93                                 remote_address="$(cli_get_val "${1}")"
  94                                 ;;
  95                         --local-address=*)
  96                                 local_address="$(cli_get_val "${1}")"
  97                                 ;;
  98
  99                         # Keys for VTI
 100                         --ikey=*)
 101                                 ikey="$(cli_get_val "${1}")"
 102                                 ;;
 103                         --okey=*)
 104                                 okey="$(cli_get_val "${1}")"
 105                                 ;;
 106                 esac
 107                 shift
 108         done
 109
 110         if ! isset mode; then
 111                 error "--mode= is not set. Must be one of ${IP_TUNNEL_MODES}"
 112                 return ${EXIT_ERROR}
 113         fi
 114
 115         if ! isoneof mode ${IP_TUNNEL_MODES}; then
 116                 error "Invalid mode: ${mode}"
 117                 return ${EXIT_ERROR}
 118         fi
 119
 120         # We cannot mix IPv6 and IPv4
 121         if isset local_address && ! ip_protocol_match "${remote_address}" "${local_address}"; then
 122                 log ERROR "Local and remote address are not of the same IP protocol"
 123                 return ${EXIT_ERROR}
 124         fi
 125
 126         # ikey and okey must be set for VTI devices
 127         if [ "${mode}" = "vti" ] && (! isset ikey || ! isset okey); then
 128                 error "--ikey= and --okey= must be set for VTI device"
 129                 return ${EXIT_ERROR}
 130         fi
 131
 132         # If TTL is set, make sure it is an integer.
 133         if isset ttl && ! isinteger ttl; then
 134                 error "TTL must be an integer: ${ttl}"
 135                 return ${EXIT_ERROR}
 136         fi
 137
 138         local cmd_args
 139
 140         # Apply TTL if a value has been set.
 141         if isset ttl; then
 142                 cmd_args="${cmd_args} ttl ${ttl}"
 143         fi
 144
 145         # Apply local address if a value has been set.
 146         if isset local_address; then
 147                 cmd_args="${cmd_args} local ${local_address}"
 148         fi
 149
 150         # Apply remote address if a value has been set.
 151         if isset remote_address; then
 152                 cmd_args="${cmd_args} remote ${remote_address}"
 153         fi
 154
 155         # Add ikey and okey for VTI devices
 156         if [ "${mode}" = "vti" ]; then
 157                 cmd_args="${cmd_args} ikey ${ikey} okey ${okey}"
 158         fi
 159
 160         # Determine the mode based on the IP protocol
 161         local remote_address_protocol="$(ip_detect_protocol "${remote_address}")"
 162         mode=$(ip_tunnel_convert_mode_to_iproute2_mode "${mode}" "${remote_address_protocol}")
 163
 164         log DEBUG "Creating tunnel device '${device}' (mode=${mode})..."
 165
 166         # Create the device.
 167         if ! cmd ip link add name ${device} type ${mode} ${cmd_args}; then
 168                 error "Could not create tunnel device ${device}"
 169                 return ${EXIT_ERROR}
 170         fi
 171
 172         # Disable policy lookups for VTI devices
 173         if [ "${mode}" = "vti" ]; then
 174                 sysctl_set "net.ipv4.conf.${device}.disable_policy" "1"
 175         fi
 176
 177         return ${EXIT_OK}
 178 }
 179
 180 ip_tunnel_del() {
 181         device_delete "$@"
 182 }
 183
 184 ip_tunnel_change() {
 185         local device="${1}"
 186         shift
 187
 188         if ! device_exists "${device}"; then
 189                 log ERROR "No such device: ${device}"
 190                 return ${EXIT_ERROR}
 191         fi
 192
 193         # Determine the device type
 194         local type="$(device_tunnel_get_type ${device})"
 195
 196         local local
 197         local remote
 198
 199         while [ $# -gt 0 ]; do
 200                 case "${1}" in
 201                         --local=*)
 202                                 local="$(cli_get_val "${1}")"
 203
 204                                 if ! ip_is_valid "${local}"; then
 205                                         error "Invalid IP address for --local: ${local}"
 206                                         return ${EXIT_ERROR}
 207                                 fi
 208
 209                                 if ! isoneof "type" gre gre6 vti vti6; then
 210                                         log ERROR "Cannot change --local for devices of type ${type}"
 211                                         return ${EXIT_ERROR}
 212                                 fi
 213                                 ;;
 214                         --remote=*)
 215                                 remote="$(cli_get_val "${1}")"
 216
 217                                 if ! ip_is_valid "${remote}"; then
 218                                         error "Invalid IP address for --remote: ${remote}"
 219                                         return ${EXIT_ERROR}
 220                                 fi
 221
 222                                 if ! isoneof "type" gre gre6 vti vti6; then
 223                                         log ERROR "Cannot change --remote for devices of type ${type}"
 224                                         return ${EXIT_ERROR}
 225                                 fi
 226                                 ;;
 227                 esac
 228                 shift
 229         done
 230
 231         # XXX If a device is of an IP protocol and the protocol of remote and local
 232         # have changed, we will need to destroy the interface and recreate it with
 233         # the correct type
 234
 235         local cmd_args
 236
 237         if isset local; then
 238                 cmd_args="${cmd_args} local ${local}"
 239         fi
 240
 241         if isset remote; then
 242                 cmd_args="${cmd_args} remote ${remote}"
 243         fi
 244
 245         # Exit if there is nothing to do
 246         if ! isset cmd_args; then
 247                 return ${EXIT_OK}
 248         fi
 249
 250         # Run ip command
 251         cmd ip link change dev "${device}" type "${type}" ${cmd_args}
 252 }
 253
 254 ip_tunnel_change_keys() {
 255         local device="${1}"
 256         shift
 257
 258         if ! isset device; then
 259                 error "No device given"
 260                 return ${EXIT_ERROR}
 261         fi
 262
 263         local ikey
 264         local okey
 265
 266         while [ $# -gt 0 ]; do
 267                 case "${1}" in
 268                         --ikey=*)
 269                                 ikey="$(cli_get_val ${1})"
 270                                 ;;
 271                         --okey=*)
 272                                 okey="$(cli_get_val ${1})"
 273                                 ;;
 274                         *)
 275                                 error "Invalid argument: ${1}"
 276                                 return ${EXIT_ERROR}
 277                                 ;;
 278                 esac
 279                 shift
 280         done
 281
 282         if ! isset ikey || ! isset okey; then
 283                 error "You need to set --ikey= and --okey="
 284                 return ${EXIT_ERROR}
 285         fi
 286
 287         if ! device_exists "${device}"; then
 288                 error "No such device: ${device}"
 289                 return ${EXIT_ERROR}
 290         fi
 291
 292         # Determine the device type
 293         local type="$(device_tunnel_get_type ${device})"
 294
 295         if ! isoneof "type" vti vti6; then
 296                 log ERROR "Device type '${type}' is invalid"
 297                 return ${EXIT_ERROR}
 298         fi
 299
 300         if ! cmd ip link change dev "${device}" \
 301                 type "${type}" ikey "${ikey}" okey "${okey}"; then
 302                 log ERROR "Could not change keys of device ${device}"
 303                 return ${EXIT_ERROR}
 304         fi
 305
 306         return ${EXIT_OK}
 307 }