src/functions/functions.ip-tunnel

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2012-2013  IPFire Network Development Team                    #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 IP_TUNNEL_MODES="gre sit vti"
  23
  24 ip_tunnel_protocol_to_name() {
  25         local protocol="${1}"
  26
  27         case "${protocol}" in
  28                 gre)
  29                         print "Generic Routing Encapsulation"
  30                         ;;
  31                 sit)
  32                         print "Simple Internet Transition"
  33                         ;;
  34                 vti)
  35                         print "Virtual Tunnel Interface"
  36                         ;;
  37                 *)
  38                         print "${protocol}"
  39                         ;;
  40         esac
  41 }
  42
  43 # This function converts our modes into the type
  44 # the iproute2 tool uses
  45 ip_tunnel_convert_mode_to_iproute2_mode() {
  46         local mode=${1}
  47         local protocol=${2}
  48
  49         if ! isset mode || ! isset protocol; then
  50                 log ERROR "Did not get mode and/or protocol"
  51                 return ${EXIT_ERROR}
  52         fi
  53
  54         if [[ "${protocol}" = "ipv4" ]]; then
  55                 # When we use IPv4 we can use our modes
  56                 echo "${mode}"
  57         fi
  58
  59         if [[ "${protocol}" = "ipv6" ]]; then
  60                 # When we use IPv6 we have to convert
  61                 case "${mode}" in
  62                         "vti")
  63                                 echo "vti6"
  64                                 ;;
  65                         "gre")
  66                                 echo "ip6gre"
  67                 esac
  68         fi
  69 }
  70
  71 ip_tunnel_add() {
  72         local device=${1}
  73         shift
  74
  75         local mode
  76         local ttl
  77
  78         local remote_address
  79         local local_address
  80
  81         local ikey
  82         local okey
  83
  84         while [ $# -gt 0 ]; do
  85                 case "${1}" in
  86                         --mode=*)
  87                                 mode="$(cli_get_val "${1}")"
  88                                 ;;
  89                         --ttl=*)
  90                                 ttl="$(cli_get_val "${1}")"
  91                                 ;;
  92                         --remote-address=*)
  93                                 remote_address="$(cli_get_val "${1}")"
  94                                 ;;
  95                         --local-address=*)
  96                                 local_address="$(cli_get_val "${1}")"
  97                                 ;;
  98
  99                         # Keys for VTI
 100                         --ikey=*)
 101                                 ikey="$(cli_get_val "${1}")"
 102                                 ;;
 103                         --okey=*)
 104                                 okey="$(cli_get_val "${1}")"
 105                                 ;;
 106                 esac
 107                 shift
 108         done
 109
 110         if ! isset mode; then
 111                 error "--mode= is not set. Must be one of ${IP_TUNNEL_MODES}"
 112                 return ${EXIT_ERROR}
 113         fi
 114
 115         if ! isoneof mode ${IP_TUNNEL_MODES}; then
 116                 error "Invalid mode: ${mode}"
 117                 return ${EXIT_ERROR}
 118         fi
 119
 120         # We cannot mix IPv6 and IPv4
 121         if isset local_address && ! ip_protocol_match "${remote_address}" "${local_address}"; then
 122                 log ERROR "Local and remote address are not of the same IP protocol"
 123                 return ${EXIT_ERROR}
 124         fi
 125
 126         # ikey and okey must be set for VTI devices
 127         if [ "${mode}" = "vti" ] && (! isset ikey || ! isset okey); then
 128                 error "--ikey= and --okey= must be set for VTI device"
 129                 return ${EXIT_ERROR}
 130         fi
 131
 132         # If TTL is set, make sure it is an integer.
 133         if isset ttl && ! isinteger ttl; then
 134                 error "TTL must be an integer: ${ttl}"
 135                 return ${EXIT_ERROR}
 136         fi
 137
 138         local cmd_args
 139
 140         # Apply TTL if a value has been set.
 141         if isset ttl; then
 142                 cmd_args="${cmd_args} ttl ${ttl}"
 143         fi
 144
 145         # Apply local address if a value has been set.
 146         if isset local_address; then
 147                 cmd_args="${cmd_args} local ${local_address}"
 148         fi
 149
 150         # Apply remote address if a value has been set.
 151         if isset remote_address; then
 152                 cmd_args="${cmd_args} remote ${remote_address}"
 153         fi
 154
 155         # Add ikey and okey for VTI devices
 156         if [ "${mode}" = "vti" ]; then
 157                 cmd_args="${cmd_args} ikey ${ikey} okey ${okey}"
 158         fi
 159
 160         # Determine the mode based on the IP protocol
 161         local remote_address_protocol="$(ip_detect_protocol "${remote_address}")"
 162         mode=$(ip_tunnel_convert_mode_to_iproute2_mode "${mode}" "${remote_address_protocol}")
 163
 164         log DEBUG "Creating tunnel device '${device}' (mode=${mode})..."
 165
 166         # Create the device.
 167         if ! cmd ip link add name ${device} type ${mode} ${cmd_args}; then
 168                 error "Could not create tunnel device ${device}"
 169                 return ${EXIT_ERROR}
 170         fi
 171
 172         # Disable policy lookups for VTI devices
 173         if [ "${mode}" = "vti" ]; then
 174                 sysctl_set "net.ipv4.conf.${device}.disable_policy" "1"
 175         fi
 176
 177         return ${EXIT_OK}
 178 }
 179
 180 ip_tunnel_del() {
 181         device_delete "$@"
 182 }
 183
 184 ip_tunnel_change_keys() {
 185         local device="${1}"
 186         shift
 187
 188         if ! isset device; then
 189                 error "No device given"
 190                 return ${EXIT_ERROR}
 191         fi
 192
 193         local ikey
 194         local okey
 195
 196         while [ $# -gt 0 ]; do
 197                 case "${1}" in
 198                         --ikey=*)
 199                                 ikey="$(cli_get_val ${1})"
 200                                 ;;
 201                         --okey=*)
 202                                 okey="$(cli_get_val ${1})"
 203                                 ;;
 204                         *)
 205                                 error "Invalid argument: ${1}"
 206                                 return ${EXIT_ERROR}
 207                                 ;;
 208                 esac
 209                 shift
 210         done
 211
 212         if ! isset ikey || ! isset okey; then
 213                 error "You need to set --ikey= and --okey="
 214                 return ${EXIT_ERROR}
 215         fi
 216
 217         if ! device_exists "${device}"; then
 218                 error "No such device: ${device}"
 219                 return ${EXIT_ERROR}
 220         fi
 221
 222         # Determine the device type
 223         local type="$(device_tunnel_get_type ${device})"
 224
 225         if ! isoneof "type" vti vti6; then
 226                 log ERROR "Device type '${type}' is invalid"
 227                 return ${EXIT_ERROR}
 228         fi
 229
 230         if ! cmd ip link change dev "${device}" \
 231                 type "${type}" ikey "${ikey}" okey "${okey}"; then
 232                 log ERROR "Could not change keys of device ${device}"
 233                 return ${EXIT_ERROR}
 234         fi
 235
 236         return ${EXIT_OK}
 237 }