src/scripts/ipsec-interfaces

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2015 IPFire Team                                              #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 shopt -s nullglob
  23
  24 VPN_CONFIG="/var/ipfire/vpn/config"
  25
  26 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
  27 eval $(/usr/local/bin/readhash /var/ipfire/vpn/settings)
  28
  29 VARS=(
  30         id status name lefthost type ctype x1 x2 x3 leftsubnets
  31         remote righthost rightsubnets x5 x6 x7 x8 x9 x10 x11 x12
  32         x13 x14 x15 x16 x17 x18 x19 x20 x21 proto x22 x23 x24
  33         route x26 mode interface_mode interface_address interface_mtu rest
  34 )
  35
  36 log() {
  37         logger -t ipsec "$@"
  38 }
  39
  40 main() {
  41         # Register local variables
  42         local "${VARS[@]}"
  43         local action
  44
  45         local interfaces=()
  46         local vpn_ip
  47
  48         # Handle %defaultroute
  49         if [ "${VPN_IP}" = "%defaultroute" ]; then
  50                 if [ -r "/var/ipfire/red/local-ipaddress" ]; then
  51                         vpn_ip="$(</var/ipfire/red/local-ipaddress)"
  52
  53                 elif [ "${RED_TYPE}" = "STATIC" -a -n "${RED_ADDRESS}" ]; then
  54                         vpn_ip="${RED_ADDRESS}"
  55
  56                 fi
  57         else
  58                 vpn_ip="${VPM_IP}"
  59         fi
  60
  61         # We are done when IPsec is not enabled
  62         if [ "${ENABLED}" = "on" ]; then
  63                 while IFS="," read -r "${VARS[@]}"; do
  64                         # Check if the connection is enabled
  65                         [ "${status}" = "on" ] || continue
  66
  67                         # Check if this a net-to-net connection
  68                         [ "${type}" = "net" ] || continue
  69
  70                         # Determine the interface name
  71                         case "${interface_mode}" in
  72                                 gre|vti)
  73                                         local intf="${interface_mode}${id}"
  74                                         ;;
  75                                 *)
  76                                         continue
  77                                         ;;
  78                         esac
  79
  80                         # Add the interface to the list of all interfaces
  81                         interfaces+=( "${intf}" )
  82
  83                         local args=(
  84                                 "local" "${vpn_ip}"
  85                                 "remote" "${righthost}"
  86                                 "ttl" "255"
  87                         )
  88
  89                         # Add key for VTI
  90                         if [ "${interface_mode}" = "vti" ]; then
  91                                 args+=( key "${id}" )
  92                         fi
  93
  94                         # Update the settings when the interface already exists
  95                         if [ -d "/sys/class/net/${intf}" ]; then
  96                                 ip link change dev "${intf}" \
  97                                         type "${interface_mode}" "${args[@]}" &>/dev/null
  98
  99                         # Create a new interface and bring it up
 100                         else
 101                                 log "Creating interface ${intf}"
 102                                 if ! ip link add name "${intf}" type "${interface_mode}" "${args[@]}"; then
 103                                         log "Could not create interface ${intf}"
 104                                         continue
 105                                 fi
 106                         fi
 107
 108                         # Add an IP address
 109                         ip addr flush dev "${intf}"
 110                         ip addr add "${interface_address}" dev "${intf}"
 111
 112                         # Set MTU
 113                         ip link set dev "${intf}" mtu "${interface_mtu}"
 114
 115                         # Bring up the interface
 116                         ip link set dev "${intf}" up
 117                 done < "${VPN_CONFIG}"
 118         fi
 119
 120         # Delete all other interfaces
 121         local intf
 122         for intf in /sys/class/net/gre* /sys/class/net/vti*; do
 123                 intf="$(basename "${intf}")"
 124
 125                 # Ignore a couple of interfaces that cannot be deleted
 126                 case "${intf}" in
 127                         gre0|gretap0)
 128                                 continue
 129                                 ;;
 130                 esac
 131
 132                 # Check if interface is on the list
 133                 local i found="false"
 134                 for i in ${interfaces[@]}; do
 135                         if [ "${intf}" = "${i}" ]; then
 136                                 found="true"
 137                                 break
 138                         fi
 139                 done
 140
 141                 # Nothing to do if interface was found
 142                 ${found} && continue
 143
 144                 # Delete the interface
 145                 log "Deleting interface ${intf}"
 146                 ip link del "${intf}" &>/dev/null
 147         done
 148 }
 149
 150 main || exit $?