2 ###############################################################################
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2012 IPFire Network Development Team #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
20 ###############################################################################
22 # Functions for static routing.
26 if cli_help_requested $@
; then
27 cli_show_man network-route
39 error
"Unrecognized action: ${action}"
40 cli_run_help network route
50 if cli_help_requested $@
; then
51 cli_show_man network-route-static
63 # Remove an existing route.
77 error
"Unrecognized action: ${action}"
78 cli_run_help network route
84 # Applying all routes.
91 local ${NETWORK_CONFIG_ROUTES_PARAMS}
93 while [ $# -gt 0 ]; do
96 gateway
=$
(cli_get_val
${1})
108 mtu
=$
(cli_get_val
${1})
111 if isset network
; then
112 error
"Bad number of arguments. Network passed twice or more"
124 if ! ip_net_is_valid
${network} && ! ip_is_valid
${network}; then
125 error
"The given network is invalid: ${network}"
129 if route_find_duplicate
${network}; then
130 error
"A route to ${network} does already exist."
134 # Check if gateway and unreachable are both enabled.
135 if isset gateway
; then
136 if enabled unreachable
; then
137 error
"You cannot use both, --gateway=${gateway} and --unreachable at the same time."
141 if enabled prohibit
; then
142 error
"You cannot use both, --gateway=${gateway} and --prohibit at the same time."
146 if enabled blackhole
; then
147 error
"You cannot use both, --gateway=${gateway} and --blackhole at the same time."
151 # Check if network and gateway IP protocol version match.
152 if ! ip_is_valid
${gateway}; then
153 error
"--gateway= is not a valid IP address."
157 # Check if the gateway is part of the statically routed network
158 if ip_network_is_subset_of
${gateway} ${network}; then
159 error
"The gateway is in the routed network"
163 local network_proto
=$
(ip_detect_protocol
${network})
164 assert isset network_proto
166 local gateway_proto
=$
(ip_detect_protocol
${gateway})
167 assert isset gateway_proto
169 if [ "${network_proto}" != "${gateway_proto}" ]; then
170 error
"The IP protocol version of the given network and gateway did not match."
175 local counter
=$
(list_count true
${unreachable} ${prohibit} ${blackhole})
176 if [ ${counter} -gt 1 ]; then
177 error
"You can only use one of --unreachable, --prohibit or --blackhole."
182 if isset mtu
&& ! isinteger mtu
; then
183 error
"MTU must be an integer number: ${mtu}"
188 list_append line
"network=\"${network}\""
190 # Add gateway to configuration entry when it is set.
191 if isset gateway
; then
192 list_append line
"gateway=\"${gateway}\""
195 # Add unreachable to configuration entry when it is set.
197 for arg
in unreachable prohibit blackhole
; do
198 if enabled
${arg}; then
199 list_append line
"${arg}=\"true\""
206 list_append line
"mtu=\"${mtu}\""
209 # Write line to file.
210 print
"${line}" >> ${NETWORK_CONFIG_ROUTES}
212 log INFO
"New route to network '${network}' has been added."
218 local error
=${EXIT_OK}
220 for _network
in $@
; do
222 if ! ip_net_is_valid
${_network} && ! ip_is_valid
${_network}; then
223 error
"Invalid IP address or network: ${_network}"
230 local ${NETWORK_CONFIG_ROUTES_PARAMS}
233 route_parse_line
${line}
234 [ $?
-eq ${EXIT_OK} ] ||
continue
236 # Skip the rule, we want to delete.
237 if [ "${network}" = "${_network}" ]; then
243 done < ${NETWORK_CONFIG_ROUTES} > ${NETWORK_CONFIG_ROUTES}.tmp
244 mv ${NETWORK_CONFIG_ROUTES}{.tmp
,}
246 if enabled found
; then
247 log INFO
"Route to network '${_network}' has been removed."
249 error
"No route to network '${_network}' was found."
260 while [ $# -gt 0 ]; do
263 protocol
=$
(cli_get_val
${1})
266 warning
"Unrecognized argument: ${1}"
272 if [ ! -r "${NETWORK_CONFIG_ROUTES}" ]; then
273 print
"No static routes defined."
277 local format
="%-40s %-20s %-4s"
278 print
"${format}" "NETWORK/HOST" "GATEWAY" "MTU"
280 local ${NETWORK_CONFIG_ROUTES_PARAMS}
283 route_parse_line
${line}
284 [ $?
-eq ${EXIT_OK} ] ||
continue
287 for arg
in unreachable prohibit blackhole
; do
288 if enabled
${arg}; then
294 # Filter all entries with a wrong protocol.
295 if isset protocol
; then
296 local proto
=$
(ip_detect_protocol
${network})
297 [ "${protocol}" = "${proto}" ] ||
continue
300 # Print something when no MTU was set.
305 print
"${format}" "${network}" "${gateway}" "${mtu}"
306 done < ${NETWORK_CONFIG_ROUTES}
309 route_find_duplicate
() {
312 [ -r "${NETWORK_CONFIG_ROUTES}" ] ||
return ${EXIT_FALSE}
314 local ${NETWORK_CONFIG_ROUTES_PARAMS}
317 route_parse_line
${line}
318 [ $?
-eq ${EXIT_OK} ] ||
continue
320 # Check if the network is already in use.
321 [ "${network}" = "${_network}" ] && return ${EXIT_TRUE}
322 done < ${NETWORK_CONFIG_ROUTES}
330 # Reset all possible settings.
331 for arg in ${NETWORK_CONFIG_ROUTES_PARAMS}; do
332 printf -v ${arg} "%s
" ""
338 network=$(cli_get_val ${arg})
341 gateway=$(cli_get_val ${arg})
344 unreachable=$(cli_get_val ${arg})
347 prohibit=$(cli_get_val ${arg})
350 blackhole=$(cli_get_val ${arg})
353 mtu=$(cli_get_val ${arg})
356 done <<< "$
(args $@
)"
358 ### Check if all values are correctly set.
360 # network must be set.
361 isset network || return ${EXIT_ERROR}
363 # Is network or IP valid?
364 if ! ip_net_is_valid ${network} && ! ip_is_valid ${network}; then
365 error "The given network is invalid
: ${network}"
369 # Check gateway settings.
370 if isset gateway; then
371 # When gateway is set, unreachable cannot be set.
372 isset unreachable && return ${EXIT_ERROR}
374 # Must be a valid IP address.
375 ip_is_valid ${gateway} || return ${EXIT_ERROR}
377 # Check if the gateway is part of the statically routed network
378 if ip_network_is_subset_of ${gateway} ${network}; then
382 # Check if exactly one of unreachable, prohibit or blackhole is set.
383 local counter=$(list_count true ${unreachable} ${prohibit} ${blackhole})
384 [ ${counter} -eq 1 ] || return ${EXIT_ERROR}
387 # mtu must be an integer number.
389 isinteger mtu || return ${EXIT_ERROR}
399 log DEBUG "Applying static routes...
"
401 # Flush the routing table.
402 route_table_flush ${table}
404 local ${NETWORK_CONFIG_ROUTES_PARAMS}
407 route_parse_line ${line}
408 [ $? -eq ${EXIT_OK} ] || continue
412 for arg in unreachable prohibit blackhole; do
413 if enabled ${arg}; then
420 route_entry_add ${network} --table="static
" --proto="static
" \
421 --type="${type}" --gateway="${gateway}" --mtu="${mtu}"
424 if [ ${ret} -ne ${EXIT_OK} ]; then
425 log WARNING "Could not
set route
'${network}'.
"
427 done < ${NETWORK_CONFIG_ROUTES}
429 # Create a lookup rule for the static routing table.
430 route_rule_add --lookup="static
" --priority=1000
443 while [ $# -gt 0 ]; do
446 gateway=$(cli_get_val ${1})
449 table=$(cli_get_val ${1})
452 type=$(cli_get_val ${1})
455 proto=$(cli_get_val ${1})
458 mtu=$(cli_get_val ${1})
461 if isset network; then
462 warning "Unrecognized argument
: ${1}"
472 assert isoneof type unicast broadcast unreachable prohibit blackhole
476 if ! ip_net_is_valid ${network} && ! ip_is_valid ${network}; then
477 error "The given network is invalid
: ${network}"
485 # Detect the protocol of the given network.
486 local protocol=$(ip_detect_protocol ${network})
488 case "${protocol}" in
490 command="ip
-6 route add
"
493 command="ip route add
"
496 log ERROR "Could not detect protocol
for ${network}"
502 list_append command "${type}"
504 # Add network/prefix.
505 list_append command "${network}"
507 if [ "${type}" = "unicast
" ]; then
509 assert ip_is_valid ${gateway}
511 list_append command "via
${gateway}"
514 # Add table (if any).
516 # Create routing table, if it does not exist, yet.
517 route_table_create ${table}
519 list_append command "table
${table}"
524 list_append command "proto
${proto}"
529 list_append command "mtu
${mtu}"
535 route_table_create() {
539 if route_table_exists ${table}; then
543 # Get the next free id.
544 local id=$(_route_table_next_id)
547 # Write everything to file.
548 print "%d
\t%s
" "${id}" "${table}" >> /etc/iproute2/rt_tables
550 log DEBUG "Created routing table
'${table}'.
"
555 _route_table_next_id() {
556 # The Linux kernel is able to manage 255 routing tables (1-255).
557 # This function returns the next free id, starting from 255.
560 for next_id in {255..1}; do
561 if ! route_table_exists --id="${next_id}"; then
570 route_table_flush() {
574 while [ $# -gt 0 ]; do
577 protocol=$(cli_get_val ${1})
586 # If the table does not exists, there is nothing to
588 route_table_exists ${table} || return ${EXIT_OK}
592 for proto in ${IP_SUPPORTED_PROTOCOLS}; do
593 # Skip unwanted protocols.
594 if isset protocol; then
595 [ "${protocol}" = "${proto}" ] || continue
601 command="ip
-6 route flush
"
604 command="ip route flush
"
609 list_append command "table
${table}"
618 route_table_exists() {
621 while [ $# -gt 0 ]; do
624 _id=$(cli_get_val ${1})
635 while read -r id table; do
637 [ "${id:0:1}" = "#" ] && continue
639 if [ "${_table}" = "${table}" ] || [ "${_id}" = "${id}" ]; then
643 done < /etc
/iproute
2/rt_tables
650 local protocols
=${IP_SUPPORTED_PROTOCOLS}
653 while [ $# -gt 0 ]; do
656 lookup
=$
(cli_get_val
${1})
659 priority
=$
(cli_get_val
${1})
662 protocols
=$
(cli_get_val
${1})
664 assert isoneof protocols
${IP_SUPPORTED_PROTOCOLS}
667 warning
"Unhandled argument: ${1}"
673 local command options
675 if isset lookup
; then
676 route_table_create
${lookup}
678 list_append options
"lookup ${lookup}"
681 if isset priority
; then
682 assert isinteger priority
684 list_append options
"prio ${priority}"
688 for proto
in ${protocols}; do
692 command="ip -6 rule add ${options}"
695 command="ip rule add ${options}"
700 # Skip, if the rule does already exist.
702 --protocol=${proto} \
704 --priority=${priority} \
711 route_rule_exists
() {
717 while [ $# -gt 0 ]; do
720 from
=$
(cli_get_val
${1})
723 lookup
=$
(cli_get_val
${1})
726 prio
=$
(cli_get_val
${1})
729 proto
=$
(cli_get_val
${1})
732 warning
"Unrecognized argument: ${1}"
741 command="ip -6 rule show"
744 command="ip rule show"
749 local _lookup _from _prio
751 while read -r line
; do
752 _route_rule_exists_parse
${line}
755 [ "${from}" = "${_from}" ] ||
continue
759 [ "${prio}" = "${_prio}" ] ||
continue
762 if isset lookup
; then
763 [ "${lookup}" = "${_lookup}" ] ||
continue
767 done <<< "$(${command})"
772 _route_rule_exists_parse
() {
773 # Reset all variables.
778 while [ $# -gt 0 ]; do
793 # Skip unknown arguments.