[people/arne_f/network.git] / functions.ipv6

#!/bin/bash
###############################################################################
#                                                                             #
# IPFire.org - A linux based firewall                                         #
# Copyright (C) 2010  Michael Tremer & Christian Schmidt                      #
#                                                                             #
# This program is free software: you can redistribute it and/or modify        #
# it under the terms of the GNU General Public License as published by        #
# the Free Software Foundation, either version 3 of the License, or           #
# (at your option) any later version.                                         #
#                                                                             #
# This program is distributed in the hope that it will be useful,             #
# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
# GNU General Public License for more details.                                #
#                                                                             #
# You should have received a copy of the GNU General Public License           #
# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
#                                                                             #
###############################################################################

IP_SUPPORTED_PROTOCOLS="${IP_SUPPORTED_PROTOCOLS} ipv6"

function ipv6_init() {
	log INFO "Initializing IPv6 networking."

	# Enable forwarding on all devices
	ipv6_device_forwarding_disable all
	ipv6_device_forwarding_disable default

	# Disable autoconfiguration on all devices per default
	ipv6_device_autoconf_disable all
	ipv6_device_autoconf_disable default

	# XXX do we need this?
	#local device
	#for device in $(devices_get_all); do
	#	ipv6_device_forwarding_disable ${device}
	#	ipv6_device_autoconf_disable ${device}
	#done
}

init_register ipv6_init

function ipv6_device_autoconf_enable() {
	local device=${1}

	assert isset device

	# Allow setting default and all settings
	if ! isoneof device all default; then
		assert device_exists ${device}
	fi

	local val
	for val in accept_ra accept_redirects; do
		echo 1 > /proc/sys/net/ipv6/conf/${device}/${val}
	done
}

function ipv6_device_autoconf_disable() {
	local device=${1}

	assert isset device

	# Allow setting default and all settings
	if ! isoneof device all default; then
		assert device_exists ${device}
	fi

	local val
	for val in accept_ra accept_redirects; do
		echo 0 > /proc/sys/net/ipv6/conf/${device}/${val}
	done
}

function ipv6_device_forwarding_enable() {
	local device=${1}

	assert isset device

	# Allow setting default and all settings
	if ! isoneof device all default; then
		assert device_exists ${device}
	fi

	echo 1 > /proc/sys/net/ipv6/conf/${device}/forwarding
}

function ipv6_device_forwarding_disable() {
	local device=${1}

	assert isset device

	# Allow setting default and all settings
	if ! isoneof device all default; then
		assert device_exists ${device}
	fi

	echo 0 > /proc/sys/net/ipv6/conf/${device}/forwarding
}

# Enable IPv6 RFC3041 privacy extensions if desired
function ipv6_device_privacy_extensions_enable() {
	local device=${1}
	local type=${2}

	assert isset device
	assert device_exists ${device}

	# Default value is rfc3041
	if [ -z "${type}" ]; then
		type="rfc3041"
	fi

	assert isset type

	case "${type}" in
		rfc3041)
			echo 2 > /proc/sys/net/ipv6/conf/${device}/use_tempaddr
			;;
		*)
			error_log "Given type '${type}' is not supported."
			return ${EXIT_ERROR}
			;;
	esac

	return ${EXIT_OK}
}

function ipv6_device_privacy_extensions_disable() {
	local device=${1}

	assert isset device
	assert device_exists ${device}

	echo 0 > /proc/sys/net/ipv6/conf/${device}/use_tempaddr
}

function ipv6_is_valid() {
	local address=${1}

	assert isset address

	local prefix=$(ip_get_prefix ${address})
	address=$(ip_split_prefix ${address})

	# Check length
	[ ${#address} -gt 39 ] && return ${EXIT_ERROR}

	# Check prefix if provided
	if [ -n "${prefix}" ]; then
		# XXX need to check was largest prefix is
		if [ ${prefix} -lt 0 ] && [ ${prefix} -gt 64 ]; then
			return ${EXIT_ERROR}
		fi
	fi

	# XXX find :: twice?
	# XXX check for documentation prefix?

	# Check for bad characters
	local char
	for char in 0 1 2 3 4 5 6 7 8 9 a b c d e f :; do
		address=${address//${char}/}
	done
	[ -n "${address}" ] && return ${EXIT_ERROR}

	return ${EXIT_OK}
}

function ipv6_implode() {
	local address=${1}

	assert isset address

	if ! ipv6_is_valid ${address}; then
		error "IPv6 address is invalid: ${address}"
		return ${EXIT_ERROR}
	fi

	# Save prefix
	local prefix=$(ip_get_prefix ${address})
	address=$(ip_split_prefix ${address})

	# Make proper address in exploded format
	address=$(ipv6_explode ${address})

	local block
	local char
	local i

	local address_new
	local block_new

	for block in ${address//:/\ }; do
		block_new=
		for i in $(seq 0 ${#block}); do
			char="${block:${i}:1}"

			[ -z "${char}" ] && continue

			if [ -z "${block_new}" ] && [ "${char}" = "0" ]; then
				continue
			fi

			block_new="${block_new}${char}"
		done

		[ -z "${block_new}" ] && block_new="0"

		address_new="${address_new}:${block_new}"
	done

	# Cut first colon (:)
	address="${address_new:1:${#address_new}}"

	local match
	local matches=()
	local pattern
	local pos_start
	local pos_next
	for pos_start in $(seq 0 ${#address}); do
		matches["${pos_start}"]=0

		for pos_next in $(seq ${pos_start} 2 ${#address}); do
			case "${pos_start}" in
				0)
					match="${address:${pos_next}:2}"
					pattern="0:"
					;;
				*)
					match="${address:${pos_next}:2}"
					pattern=":0"
					;;
			esac

			[ -z "${match}" ] && continue

			if [ "${match}" = "${pattern}" ]; then
				matches[${pos_start}]=$(( matches[${pos_start}] + 1))
			else
				break
			fi
		done
	done

	local pos_best
	local pos_best_val=0
	for i in $(seq 0 ${#matches[@]}); do
		[ -z "${matches[${i}]}" ] && continue

		if [ ${matches[${i}]} -gt ${pos_best_val} ]; then
			pos_best=${i}
			pos_best_val=${matches[${i}]}
		fi
	done

	if [ -n "${pos_best}" ]; then
		address_new="${address:0:${pos_best}}::"

		local pos_end=$(( ${pos_best_val} * 2 + ${pos_best} + 1))
		
		if [ "${pos_best}" = "0" ]; then
			pos_end=$(( ${pos_end} - 1 ))
		fi

		address="${address_new}${address:${pos_end}:${#address}}"
	fi

	# If a prefix was provided we append it in the end
	[ -n "${prefix}" ] && address="${address}/${prefix}"

	assert ipv6_is_valid ${address}

	echo "${address}"
}

function ipv6_explode() {
	local address=${1}

	assert isset address

	local prefix=$(ip_get_prefix ${address})
	address=$(ip_split_prefix ${address})

	if [ ${#address} -eq 39 ]; then
		echo "${address}$([ -n "${prefix}" ] && echo "/${prefix}")"
		return ${EXIT_OK}	
	fi

	address=${address//::/:X:}

	local block
	local block_count=0
	local block_id
	local block_max=8
	local blocks=()

	for block in ${address//:/\ }; do
		blocks[${block_count}]=${block}
		
		block_count=$(( ${block_count} + 1 ))
	done

	if [ ${#blocks[@]} -lt ${block_max} ]; then
		for block_id in $(seq ${#blocks[@]} -1 0); do
			block=${blocks[${block_id}]}

			[ -z "${block}" ] && continue

			if [ "${block}" = "X" ]; then
				blocks[${block_id}]="0000"
				break
			fi

			blocks[$(( ${block_max} - ${block_count} + ${block_id} ))]=${block}
			blocks[${block_id}]="0000"
		done
	fi

	for block_id in $(seq 0 ${#blocks[@]}); do
		block=${blocks[${block_id}]}

		[ -z "${block}" ] && block="0000"

		while [ "${#block}" -lt 4 ]; do
			block="0${block}"
		done

		blocks[${block_id}]=${block}
	done

	address=
	for block in ${blocks[@]}; do
		address="${address}:${block}"
	done
	address=${address:1:39}

	# If a prefix was provided we append it in the end again
	[ -n "${prefix}" ] && address="${address}/${prefix}"

	assert ipv6_is_valid ${address}

	echo "${address}"
}

function ipv6_hash() {
	local address=${1}

	assert isset address

	# Explode address
	address=$(ipv6_explode ${address})

	echo "${address//:/}"
}
Commit	Line	Data
4231f419 MT	1	#!/bin/bash
	2	###############################################################################
	3	# #
	4	# IPFire.org - A linux based firewall #
	5	# Copyright (C) 2010 Michael Tremer & Christian Schmidt #
	6	# #
	7	# This program is free software: you can redistribute it and/or modify #
	8	# it under the terms of the GNU General Public License as published by #
	9	# the Free Software Foundation, either version 3 of the License, or #
	10	# (at your option) any later version. #
	11	# #
	12	# This program is distributed in the hope that it will be useful, #
	13	# but WITHOUT ANY WARRANTY; without even the implied warranty of #
	14	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
	15	# GNU General Public License for more details. #
	16	# #
	17	# You should have received a copy of the GNU General Public License #
	18	# along with this program. If not, see <http://www.gnu.org/licenses/>. #
	19	# #
	20	###############################################################################
	21
e617226b MT	22	IP_SUPPORTED_PROTOCOLS="${IP_SUPPORTED_PROTOCOLS} ipv6"
e617226b MT	23
58fb41ee MT	24	function ipv6_init() {
	25	log INFO "Initializing IPv6 networking."
	26
	27	# Enable forwarding on all devices
	28	ipv6_device_forwarding_disable all
	29	ipv6_device_forwarding_disable default
	30
	31	# Disable autoconfiguration on all devices per default
	32	ipv6_device_autoconf_disable all
	33	ipv6_device_autoconf_disable default
	34
	35	# XXX do we need this?
	36	#local device
	37	#for device in $(devices_get_all); do
	38	# ipv6_device_forwarding_disable ${device}
	39	# ipv6_device_autoconf_disable ${device}
	40	#done
	41	}
	42
	43	init_register ipv6_init
	44
4231f419 MT	45	function ipv6_device_autoconf_enable() {
	46	local device=${1}
	47
58fb41ee MT	48	assert isset device
	49
	50	# Allow setting default and all settings
	51	if ! isoneof device all default; then
	52	assert device_exists ${device}
4231f419 MT	53	fi
4231f419 MT	54
58fb41ee MT	55	local val
	56	for val in accept_ra accept_redirects; do
	57	echo 1 > /proc/sys/net/ipv6/conf/${device}/${val}
	58	done
4231f419 MT	59	}
	60
	61	function ipv6_device_autoconf_disable() {
	62	local device=${1}
	63
58fb41ee MT	64	assert isset device
	65
	66	# Allow setting default and all settings
	67	if ! isoneof device all default; then
	68	assert device_exists ${device}
	69	fi
	70
	71	local val
	72	for val in accept_ra accept_redirects; do
	73	echo 0 > /proc/sys/net/ipv6/conf/${device}/${val}
	74	done
	75	}
	76
	77	function ipv6_device_forwarding_enable() {
	78	local device=${1}
	79
	80	assert isset device
	81
	82	# Allow setting default and all settings
	83	if ! isoneof device all default; then
	84	assert device_exists ${device}
	85	fi
	86
	87	echo 1 > /proc/sys/net/ipv6/conf/${device}/forwarding
	88	}
	89
	90	function ipv6_device_forwarding_disable() {
	91	local device=${1}
	92
	93	assert isset device
	94
	95	# Allow setting default and all settings
	96	if ! isoneof device all default; then
	97	assert device_exists ${device}
4231f419 MT	98	fi
4231f419 MT	99
58fb41ee MT	100	echo 0 > /proc/sys/net/ipv6/conf/${device}/forwarding
	101	}
	102
	103	# Enable IPv6 RFC3041 privacy extensions if desired
	104	function ipv6_device_privacy_extensions_enable() {
	105	local device=${1}
	106	local type=${2}
	107
	108	assert isset device
	109	assert device_exists ${device}
	110
	111	# Default value is rfc3041
	112	if [ -z "${type}" ]; then
	113	type="rfc3041"
	114	fi
	115
	116	assert isset type
	117
	118	case "${type}" in
	119	rfc3041)
	120	echo 2 > /proc/sys/net/ipv6/conf/${device}/use_tempaddr
	121	;;
	122	*)
	123	error_log "Given type '${type}' is not supported."
	124	return ${EXIT_ERROR}
	125	;;
	126	esac
	127
	128	return ${EXIT_OK}
	129	}
	130
	131	function ipv6_device_privacy_extensions_disable() {
	132	local device=${1}
	133
	134	assert isset device
	135	assert device_exists ${device}
	136
	137	echo 0 > /proc/sys/net/ipv6/conf/${device}/use_tempaddr
4231f419 MT	138	}
	139
	140	function ipv6_is_valid() {
	141	local address=${1}
	142
58fb41ee MT	143	assert isset address
58fb41ee MT	144
38f61548 MT	145	local prefix=$(ip_get_prefix ${address})
	146	address=$(ip_split_prefix ${address})
	147
4231f419 MT	148	# Check length
	149	[ ${#address} -gt 39 ] && return ${EXIT_ERROR}
	150
38f61548 MT	151	# Check prefix if provided
	152	if [ -n "${prefix}" ]; then
	153	# XXX need to check was largest prefix is
	154	if [ ${prefix} -lt 0 ] && [ ${prefix} -gt 64 ]; then
	155	return ${EXIT_ERROR}
	156	fi
	157	fi
	158
4231f419 MT	159	# XXX find :: twice?
	160	# XXX check for documentation prefix?
	161
	162	# Check for bad characters
	163	local char
	164	for char in 0 1 2 3 4 5 6 7 8 9 a b c d e f :; do
	165	address=${address//${char}/}
	166	done
	167	[ -n "${address}" ] && return ${EXIT_ERROR}
	168
	169	return ${EXIT_OK}
	170	}
	171
	172	function ipv6_implode() {
	173	local address=${1}
	174
58fb41ee MT	175	assert isset address
58fb41ee MT	176
4231f419 MT	177	if ! ipv6_is_valid ${address}; then
	178	error "IPv6 address is invalid: ${address}"
	179	return ${EXIT_ERROR}
	180	fi
	181
38f61548 MT	182	# Save prefix
	183	local prefix=$(ip_get_prefix ${address})
	184	address=$(ip_split_prefix ${address})
	185
4231f419 MT	186	# Make proper address in exploded format
	187	address=$(ipv6_explode ${address})
	188
	189	local block
	190	local char
	191	local i
	192
	193	local address_new
	194	local block_new
	195
	196	for block in ${address//:/\ }; do
	197	block_new=
	198	for i in $(seq 0 ${#block}); do
	199	char="${block:${i}:1}"
	200
	201	[ -z "${char}" ] && continue
	202
	203	if [ -z "${block_new}" ] && [ "${char}" = "0" ]; then
	204	continue
	205	fi
	206
	207	block_new="${block_new}${char}"
	208	done
	209
	210	[ -z "${block_new}" ] && block_new="0"
	211
	212	address_new="${address_new}:${block_new}"
	213	done
	214
	215	# Cut first colon (:)
	216	address="${address_new:1:${#address_new}}"
	217
	218	local match
	219	local matches=()
	220	local pattern
	221	local pos_start
	222	local pos_next
	223	for pos_start in $(seq 0 ${#address}); do
	224	matches["${pos_start}"]=0
	225
	226	for pos_next in $(seq ${pos_start} 2 ${#address}); do
	227	case "${pos_start}" in
	228	0)
	229	match="${address:${pos_next}:2}"
	230	pattern="0:"
	231	;;
	232	*)
	233	match="${address:${pos_next}:2}"
	234	pattern=":0"
	235	;;
	236	esac
	237
	238	[ -z "${match}" ] && continue
	239
	240	if [ "${match}" = "${pattern}" ]; then
	241	matches[${pos_start}]=$(( matches[${pos_start}] + 1))
	242	else
	243	break
	244	fi
	245	done
	246	done
	247
	248	local pos_best
	249	local pos_best_val=0
250	for i in $(seq 0 ${#matches[@]}); do
251	[ -z "${matches[${i}]}" ] && continue
252
253	if [ ${matches[${i}]} -gt ${pos_best_val} ]; then
254	pos_best=${i}
255	pos_best_val=${matches[${i}]}
256	fi
257	done
258
259	if [ -n "${pos_best}" ]; then
260	address_new="${address:0:${pos_best}}::"
261
262	local pos_end=$(( ${pos_best_val} * 2 + ${pos_best} + 1))
263
264	if [ "${pos_best}" = "0" ]; then
265	pos_end=$(( ${pos_end} - 1 ))
266	fi
267
268	address="${address_new}${address:${pos_end}:${#address}}"
269	fi
270
38f61548 MT	271	# If a prefix was provided we append it in the end
	272	[ -n "${prefix}" ] && address="${address}/${prefix}"
	273
4231f419 MT	274	assert ipv6_is_valid ${address}
	275
	276	echo "${address}"
	277	}
	278
	279	function ipv6_explode() {
	280	local address=${1}
	281
58fb41ee MT	282	assert isset address
58fb41ee MT	283
38f61548 MT	284	local prefix=$(ip_get_prefix ${address})
	285	address=$(ip_split_prefix ${address})
	286
4231f419	287	if [ ${#address} -eq 39 ]; then
38f61548	288	echo "${address}$([ -n "${prefix}" ] && echo "/${prefix}")"
4231f419 MT	289	return ${EXIT_OK}
	290	fi
	291
	292	address=${address//::/:X:}
	293
	294	local block
	295	local block_count=0
	296	local block_id
	297	local block_max=8
	298	local blocks=()
	299
	300	for block in ${address//:/\ }; do
	301	blocks[${block_count}]=${block}
	302
	303	block_count=$(( ${block_count} + 1 ))
	304	done
	305
	306	if [ ${#blocks[@]} -lt ${block_max} ]; then
	307	for block_id in $(seq ${#blocks[@]} -1 0); do
	308	block=${blocks[${block_id}]}
	309
	310	[ -z "${block}" ] && continue
	311
	312	if [ "${block}" = "X" ]; then
	313	blocks[${block_id}]="0000"
	314	break
	315	fi
	316
	317	blocks[$(( ${block_max} - ${block_count} + ${block_id} ))]=${block}
	318	blocks[${block_id}]="0000"
	319	done
	320	fi
	321
	322	for block_id in $(seq 0 ${#blocks[@]}); do
	323	block=${blocks[${block_id}]}
	324
	325	[ -z "${block}" ] && block="0000"
	326
	327	while [ "${#block}" -lt 4 ]; do
	328	block="0${block}"
	329	done
	330
	331	blocks[${block_id}]=${block}
	332	done
	333
	334	address=
	335	for block in ${blocks[@]}; do
	336	address="${address}:${block}"
	337	done
	338	address=${address:1:39}
	339
38f61548 MT	340	# If a prefix was provided we append it in the end again
	341	[ -n "${prefix}" ] && address="${address}/${prefix}"
	342
4231f419 MT	343	assert ipv6_is_valid ${address}
	344
	345	echo "${address}"
	346	}
	347
	348	function ipv6_hash() {
	349	local address=${1}
	350
58fb41ee MT	351	assert isset address
58fb41ee MT	352
4231f419 MT	353	# Explode address
	354	address=$(ipv6_explode ${address})
	355
	356	echo "${address//:/}"
	357	}