src/scripts/ipsec-interfaces

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2015 IPFire Team                                              #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 shopt -s nullglob
  23
  24 VPN_CONFIG="/var/ipfire/vpn/config"
  25
  26 eval $(/usr/local/bin/readhash /var/ipfire/vpn/settings)
  27
  28 VARS=(
  29         id status name lefthost type ctype x1 x2 x3 leftsubnets
  30         remote righthost rightsubnets x5 x6 x7 x8 x9 x10 x11 x12
  31         x13 x14 x15 x16 x17 x18 x19 x20 x21 proto x22 x23 x24
  32         route x26 mode interface_mode interface_address interface_mtu rest
  33 )
  34
  35 log() {
  36         logger -t ipsec "$@"
  37 }
  38
  39 main() {
  40         # Register local variables
  41         local "${VARS[@]}"
  42         local action
  43
  44         local interfaces=()
  45
  46         # We are done when IPsec is not enabled
  47         if [ "${ENABLED}" = "on" ]; then
  48                 while IFS="," read -r "${VARS[@]}"; do
  49                         # Check if the connection is enabled
  50                         [ "${status}" = "on" ] || continue
  51
  52                         # Check if this a net-to-net connection
  53                         [ "${type}" = "net" ] || continue
  54
  55                         # Determine the interface name
  56                         case "${interface_mode}" in
  57                                 gre|vti)
  58                                         local intf="${interface_mode}${id}"
  59                                         ;;
  60                                 *)
  61                                         continue
  62                                         ;;
  63                         esac
  64
  65                         # Add the interface to the list of all interfaces
  66                         interfaces+=( "${intf}" )
  67
  68                         local args=(
  69                                 "local" "${VPN_IP}"
  70                                 "remote" "${righthost}"
  71                                 "ttl" "255"
  72                         )
  73
  74                         # Add key for VTI
  75                         if [ "${interface_mode}" = "vti" ]; then
  76                                 args+=( key "${id}" )
  77                         fi
  78
  79                         # Update the settings when the interface already exists
  80                         if [ -d "/sys/class/net/${intf}" ]; then
  81                                 ip link change dev "${intf}" \
  82                                         type "${interface_mode}" "${args[@]}" &>/dev/null
  83
  84                         # Create a new interface and bring it up
  85                         else
  86                                 log "Creating interface ${intf}"
  87                                 ip link add name "${intf}" type "${interface_mode}" "${args[@]}"
  88                         fi
  89
  90                         # Add an IP address
  91                         ip addr flush dev "${intf}"
  92                         ip addr add "${interface_address}" dev "${intf}"
  93
  94                         # Set MTU
  95                         ip link set dev "${intf}" mtu "${interface_mtu}"
  96
  97                         # Bring up the interface
  98                         ip link set dev "${intf}" up
  99                 done < "${VPN_CONFIG}"
 100         fi
 101
 102         # Delete all other interfaces
 103         local intf
 104         for intf in /sys/class/net/gre* /sys/class/net/vti*; do
 105                 intf="$(basename "${intf}")"
 106
 107                 # Ignore a couple of interfaces that cannot be deleted
 108                 case "${intf}" in
 109                         gre0|gretap0)
 110                                 continue
 111                                 ;;
 112                 esac
 113
 114                 # Check if interface is on the list
 115                 local i found="false"
 116                 for i in ${interfaces[@]}; do
 117                         if [ "${intf}" = "${i}" ]; then
 118                                 found="true"
 119                                 break
 120                         fi
 121                 done
 122
 123                 # Nothing to do if interface was found
 124                 ${found} && continue
 125
 126                 # Delete the interface
 127                 log "Deleting interface ${intf}"
 128                 ip link del "${intf}" &>/dev/null
 129         done
 130 }
 131
 132 main || exit $?