src/scripts/ipsec-interfaces

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2015 IPFire Team                                              #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 shopt -s nullglob
  23
  24 VPN_CONFIG="/var/ipfire/vpn/config"
  25
  26 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
  27 eval $(/usr/local/bin/readhash /var/ipfire/vpn/settings)
  28
  29 VARS=(
  30         id status name lefthost type ctype psk local local_id leftsubnets
  31         remote_id remote rightsubnets x3 x4 x5 x6 x7 x8 x9 x10 x11 x12
  32         x13 x14 x15 x16 x17 x18 x19 proto x20 x21 x22
  33         route x23 mode interface_mode interface_address interface_mtu rest
  34 )
  35
  36 log() {
  37         logger -t ipsec "$@"
  38 }
  39
  40 main() {
  41         # Register local variables
  42         local "${VARS[@]}"
  43         local action
  44
  45         local interfaces=()
  46
  47         # We are done when IPsec is not enabled
  48         if [ "${ENABLED}" = "on" ]; then
  49                 while IFS="," read -r "${VARS[@]}"; do
  50                         # Check if the connection is enabled
  51                         [ "${status}" = "on" ] || continue
  52
  53                         # Check if this a net-to-net connection
  54                         [ "${type}" = "net" ] || continue
  55
  56                         # Determine the interface name
  57                         case "${interface_mode}" in
  58                                 gre|vti)
  59                                         local intf="${interface_mode}${id}"
  60                                         ;;
  61                                 *)
  62                                         continue
  63                                         ;;
  64                         esac
  65
  66                         # Add the interface to the list of all interfaces
  67                         interfaces+=( "${intf}" )
  68
  69                         # Compat for older connections
  70                         if [ "${local}" = "off" ]; then
  71                                 if [ "${VPN_IP}" = "%defaultroute" ]; then
  72                                         local=""
  73                                 else
  74                                         local="${VPN_IP}"
  75                                 fi
  76                         fi
  77
  78                         # Handle %defaultroute
  79                         if [ -z "${local}" ]; then
  80                                 if [ -r "/var/ipfire/red/local-ipaddress" ]; then
  81                                         local="$(</var/ipfire/red/local-ipaddress)"
  82
  83                                 elif [ "${RED_TYPE}" = "STATIC" -a -n "${RED_ADDRESS}" ]; then
  84                                         local="${RED_ADDRESS}"
  85                                 fi
  86                         fi
  87
  88                         local args=(
  89                                 "local" "${local}"
  90                                 "remote" "${remote}"
  91                         )
  92
  93                         case "${interface_mode}" in
  94                                 gre)
  95                                         # Add TTL
  96                                         args+=( "ttl" "255" )
  97                                         ;;
  98
  99                                 vti)
 100                                         # Add key for VTI
 101                                         args+=( "key" "${id}" )
 102                                         ;;
 103                         esac
 104
 105                         # Update the settings when the interface already exists
 106                         if [ -d "/sys/class/net/${intf}" ]; then
 107                                 ip link change dev "${intf}" \
 108                                         type "${interface_mode}" "${args[@]}" &>/dev/null
 109
 110                         # Create a new interface and bring it up
 111                         else
 112                                 log "Creating interface ${intf}"
 113                                 if ! ip link add name "${intf}" type "${interface_mode}" "${args[@]}"; then
 114                                         log "Could not create interface ${intf}"
 115                                         continue
 116                                 fi
 117                         fi
 118
 119                         # Add an IP address
 120                         ip addr flush dev "${intf}"
 121                         ip addr add "${interface_address}" dev "${intf}"
 122
 123                         # Set MTU
 124                         ip link set dev "${intf}" mtu "${interface_mtu}"
 125
 126                         # Bring up the interface
 127                         ip link set dev "${intf}" up
 128                 done < "${VPN_CONFIG}"
 129         fi
 130
 131         # Delete all other interfaces
 132         local intf
 133         for intf in /sys/class/net/gre[0-9]* /sys/class/net/vti[0-9]*; do
 134                 intf="$(basename "${intf}")"
 135
 136                 # Ignore a couple of interfaces that cannot be deleted
 137                 case "${intf}" in
 138                         gre0|gretap0)
 139                                 continue
 140                                 ;;
 141                 esac
 142
 143                 # Check if interface is on the list
 144                 local i found="false"
 145                 for i in ${interfaces[@]}; do
 146                         if [ "${intf}" = "${i}" ]; then
 147                                 found="true"
 148                                 break
 149                         fi
 150                 done
 151
 152                 # Nothing to do if interface was found
 153                 ${found} && continue
 154
 155                 # Delete the interface
 156                 log "Deleting interface ${intf}"
 157                 ip link del "${intf}" &>/dev/null
 158         done
 159 }
 160
 161 main || exit $?