2 ###############################################################################
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2012-2013 IPFire Network Development Team #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
20 ###############################################################################
22 IP_TUNNEL_MODES
="gre sit vti"
24 ip_tunnel_protocol_to_name
() {
29 print
"Generic Routing Encapsulation"
32 print
"Simple Internet Transition"
35 print
"Virtual Tunnel Interface"
43 # This function converts our modes into the type
44 # the iproute2 tool uses
45 ip_tunnel_convert_mode_to_iproute2_mode
() {
49 if ! isset mode ||
! isset protocol
; then
50 log ERROR
"Did not get mode and/or protocol"
54 if [[ "${protocol}" = "ipv4" ]]; then
55 # When we use IPv4 we can use our modes
59 if [[ "${protocol}" = "ipv6" ]]; then
60 # When we use IPv6 we have to convert
84 while [ $# -gt 0 ]; do
87 mode
="$(cli_get_val "${1}")"
90 ttl
="$(cli_get_val "${1}")"
93 remote_address
="$(cli_get_val "${1}")"
96 local_address
="$(cli_get_val "${1}")"
101 ikey
="$(cli_get_val "${1}")"
104 okey
="$(cli_get_val "${1}")"
110 if ! isset mode
; then
111 error
"--mode= is not set. Must be one of ${IP_TUNNEL_MODES}"
115 if ! isoneof mode
${IP_TUNNEL_MODES}; then
116 error
"Invalid mode: ${mode}"
120 # We cannot mix IPv6 and IPv4
121 if isset local_address
&& ! ip_protocol_match
"${remote_address}" "${local_address}"; then
122 log ERROR
"Local and remote address are not of the same IP protocol"
126 # ikey and okey must be set for VTI devices
127 if [ "${mode}" = "vti" ] && (! isset ikey ||
! isset okey
); then
128 error
"--ikey= and --okey= must be set for VTI device"
132 # If TTL is set, make sure it is an integer.
133 if isset ttl
&& ! isinteger ttl
; then
134 error
"TTL must be an integer: ${ttl}"
140 # Apply TTL if a value has been set.
142 cmd_args
="${cmd_args} ttl ${ttl}"
145 # Apply local address if a value has been set.
146 if isset local_address
; then
147 cmd_args
="${cmd_args} local ${local_address}"
150 # Apply remote address if a value has been set.
151 if isset remote_address
; then
152 cmd_args
="${cmd_args} remote ${remote_address}"
155 # Add ikey and okey for VTI devices
156 if [ "${mode}" = "vti" ]; then
157 cmd_args
="${cmd_args} ikey ${ikey} okey ${okey}"
160 # Determine the mode based on the IP protocol
161 local remote_address_protocol
="$(ip_detect_protocol "${remote_address}")"
162 mode
=$
(ip_tunnel_convert_mode_to_iproute2_mode
"${mode}" "${remote_address_protocol}")
164 log DEBUG
"Creating tunnel device '${device}' (mode=${mode})..."
167 if ! cmd ip link add name
${device} type ${mode} ${cmd_args}; then
168 error
"Could not create tunnel device ${device}"
172 # Disable policy lookups for VTI devices
173 if [ "${mode}" = "vti" ]; then
174 sysctl_set
"net.ipv4.conf.${device}.disable_policy" "1"
188 if ! device_exists
"${device}"; then
189 log ERROR
"No such device: ${device}"
193 # Determine the device type
194 local type="$(device_tunnel_get_type ${device})"
199 while [ $# -gt 0 ]; do
202 local="$(cli_get_val "${1}")"
204 if ! ip_is_valid
"${local}"; then
205 error
"Invalid IP address for --local: ${local}"
209 if ! isoneof
"type" gre gre6 vti vti6
; then
210 log ERROR
"Cannot change --local for devices of type ${type}"
215 remote
="$(cli_get_val "${1}")"
217 if ! ip_is_valid
"${remote}"; then
218 error
"Invalid IP address for --remote: ${remote}"
222 if ! isoneof
"type" gre gre6 vti vti6
; then
223 log ERROR
"Cannot change --remote for devices of type ${type}"
231 # XXX If a device is of an IP protocol and the protocol of remote and local
232 # have changed, we will need to destroy the interface and recreate it with
238 cmd_args
="${cmd_args} local ${local}"
241 if isset remote
; then
242 cmd_args
="${cmd_args} remote ${remote}"
245 # Exit if there is nothing to do
246 if ! isset cmd_args
; then
251 cmd ip link change dev
"${device}" type "${type}" ${cmd_args}