src/hooks/ports/ip-tunnel

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2018  IPFire Network Development Team                         #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 . /usr/lib/network/header-port
  23
  24 SUPPORTED_IP_TUNNEL_MODES="gretap"
  25
  26 HOOK_SETTINGS="ADDRESS MARK MODE PEER LOCAL_ADDRESS"
  27
  28 hook_check_settings() {
  29         assert isset MODE
  30         assert isoneof MODE ${SUPPORTED_IP_TUNNEL_MODES}
  31
  32         # Generate a random mark
  33         if ! isset MARK; then
  34                 MARK="$(( ${RANDOM} & 0xffffffff ))"
  35         fi
  36 }
  37
  38 hook_parse_cmdline() {
  39         while [ $# -gt 0 ]; do
  40                 case "${1}" in
  41                         --local-address=*)
  42                                 LOCAL_ADDRESS="$(cli_get_val "${1}")"
  43                                 ;;
  44
  45                         --mode=*)
  46                                 MODE="$(cli_get_val "${1}")"
  47
  48                                 # MODE must be on the list of supported protocols
  49                                 if ! isoneof MODE ${SUPPORTED_IP_TUNNEL_MODES}; then
  50                                         error "Unsupported mode: ${mode}"
  51                                         return ${EXIT_ERROR}
  52                                 fi
  53                                 ;;
  54
  55                         --peer=*)
  56                                 PEER="$(cli_get_val "${1}")"
  57                                 ;;
  58
  59                         *)
  60                                 error "Unknown option: ${1}"
  61                                 return ${EXIT_ERROR}
  62                                 ;;
  63                 esac
  64                 shift
  65         done
  66
  67         # If PEER is set, it must be a valid IP address
  68         if isset PEER && ! ip_is_valid "${PEER}"; then
  69                 error "Peer ${PEER} is not a valid IP address"
  70                 return ${EXIT_ERROR}
  71         fi
  72
  73         # If LOCAL_ADDRESS is set, it must be a valid IP address
  74         # of the same protocol than PEER is
  75         if isset LOCAL_ADDRESS; then
  76                 if ! ip_is_valid "${LOCAL_ADDRESS}"; then
  77                         error "Local address ${LOCAL_ADDRESS} is not a valid IP address"
  78                         return ${EXIT_ERROR}
  79                 fi
  80
  81                 if ! ip_protocol_match "${PEER}" "${LOCAL_ADDRESS}"; then
  82                         error "Peer and local address are of different IP protocols"
  83                         return ${EXIT_ERROR}
  84                 fi
  85         fi
  86
  87         return ${EXIT_OK}
  88 }
  89
  90 hook_create() {
  91         local port="${1}"
  92         assert isset port
  93
  94         local ${HOOK_SETTINGS}
  95         if ! port_settings_read "${port}" ${HOOK_SETTINGS}; then
  96                 log ERROR "Could not read settings for port ${port}"
  97                 return ${EXIT_ERROR}
  98         fi
  99
 100         if ! ip_tunnel_add "${port}" \
 101                         --mode="${MODE}" \
 102                         --address="${ADDRESS}" \
 103                         --remote-address="${PEER}" \
 104                         --local-address="${LOCAL_ADDRESS}" \
 105                         --ikey="${MARK}" \
 106                         --okey="${MARK}"; then
 107                 return ${EXIT_ERROR}
 108         fi
 109
 110         exit ${EXIT_OK}
 111 }
 112
 113 hook_remove() {
 114         local port="${1}"
 115         assert isset port
 116
 117         # Remove the device
 118         if ! ip_tunnel_del "${port}"; then
 119                 return ${EXIT_ERROR}
 120         fi
 121
 122         exit ${EXIT_OK}
 123 }
 124
 125 hook_hotplug_rename() {
 126         local port="${1}"
 127         assert isset port
 128
 129         local device="${2}"
 130         assert isset device
 131
 132         local ${HOOK_SETTINGS}
 133         if ! port_settings_read "${port}" ${HOOK_SETTINGS}; then
 134                 log ERROR "Could not read settings for port ${port}"
 135                 return ${EXIT_ERROR}
 136         fi
 137
 138         # Get the current MAC address of the device.
 139         local address="$(device_get_address ${device})"
 140         assert isset address
 141
 142         # Return OK on match
 143         if [ "${ADDRESS}" = "${address}" ]; then
 144                 return ${EXIT_OK}
 145         fi
 146
 147         return ${EXIT_ERROR}
 148 }