src/scripts/ipsec-interfaces

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2015 IPFire Team                                              #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 shopt -s nullglob
  23
  24 VPN_CONFIG="/var/ipfire/vpn/config"
  25
  26 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
  27 eval $(/usr/local/bin/readhash /var/ipfire/vpn/settings)
  28
  29 VARS=(
  30         id status name lefthost type ctype psk local local_id leftsubnets
  31         remote_id remote rightsubnets x3 x4 x5 x6 x7 x8 x9 x10 x11 x12
  32         x13 x14 x15 x16 x17 x18 x19 proto x20 x21 x22
  33         route x23 mode interface_mode interface_address interface_mtu rest
  34 )
  35
  36 log() {
  37         logger -t ipsec "$@"
  38 }
  39
  40 main() {
  41         # Register local variables
  42         local "${VARS[@]}"
  43         local action
  44
  45         local interfaces=()
  46
  47         # Compat for older connections
  48         if [ "${local}" = "off" ]; then
  49                 local=""
  50         fi
  51
  52         # Handle %defaultroute
  53         if [ -z "${local}" ]; then
  54                 if [ -r "/var/ipfire/red/local-ipaddress" ]; then
  55                         local="$(</var/ipfire/red/local-ipaddress)"
  56
  57                 elif [ "${RED_TYPE}" = "STATIC" -a -n "${RED_ADDRESS}" ]; then
  58                         local="${RED_ADDRESS}"
  59                 fi
  60         fi
  61
  62         # We are done when IPsec is not enabled
  63         if [ "${ENABLED}" = "on" ]; then
  64                 while IFS="," read -r "${VARS[@]}"; do
  65                         # Check if the connection is enabled
  66                         [ "${status}" = "on" ] || continue
  67
  68                         # Check if this a net-to-net connection
  69                         [ "${type}" = "net" ] || continue
  70
  71                         # Determine the interface name
  72                         case "${interface_mode}" in
  73                                 gre|vti)
  74                                         local intf="${interface_mode}${id}"
  75                                         ;;
  76                                 *)
  77                                         continue
  78                                         ;;
  79                         esac
  80
  81                         # Add the interface to the list of all interfaces
  82                         interfaces+=( "${intf}" )
  83
  84                         local args=(
  85                                 "local" "${local}"
  86                                 "remote" "${remote}"
  87                         )
  88
  89                         case "${interface_mode}" in
  90                                 gre)
  91                                         # Add TTL
  92                                         args+=( "ttl" "255" )
  93                                         ;;
  94
  95                                 vti)
  96                                         # Add key for VTI
  97                                         args+=( "key" "${id}" )
  98                                         ;;
  99                         esac
 100
 101                         # Update the settings when the interface already exists
 102                         if [ -d "/sys/class/net/${intf}" ]; then
 103                                 ip link change dev "${intf}" \
 104                                         type "${interface_mode}" "${args[@]}" &>/dev/null
 105
 106                         # Create a new interface and bring it up
 107                         else
 108                                 log "Creating interface ${intf}"
 109                                 if ! ip link add name "${intf}" type "${interface_mode}" "${args[@]}"; then
 110                                         log "Could not create interface ${intf}"
 111                                         continue
 112                                 fi
 113                         fi
 114
 115                         # Add an IP address
 116                         ip addr flush dev "${intf}"
 117                         ip addr add "${interface_address}" dev "${intf}"
 118
 119                         # Set MTU
 120                         ip link set dev "${intf}" mtu "${interface_mtu}"
 121
 122                         # Bring up the interface
 123                         ip link set dev "${intf}" up
 124                 done < "${VPN_CONFIG}"
 125         fi
 126
 127         # Delete all other interfaces
 128         local intf
 129         for intf in /sys/class/net/gre[0-9]* /sys/class/net/vti[0-9]*; do
 130                 intf="$(basename "${intf}")"
 131
 132                 # Ignore a couple of interfaces that cannot be deleted
 133                 case "${intf}" in
 134                         gre0|gretap0)
 135                                 continue
 136                                 ;;
 137                 esac
 138
 139                 # Check if interface is on the list
 140                 local i found="false"
 141                 for i in ${interfaces[@]}; do
 142                         if [ "${intf}" = "${i}" ]; then
 143                                 found="true"
 144                                 break
 145                         fi
 146                 done
 147
 148                 # Nothing to do if interface was found
 149                 ${found} && continue
 150
 151                 # Delete the interface
 152                 log "Deleting interface ${intf}"
 153                 ip link del "${intf}" &>/dev/null
 154         done
 155 }
 156
 157 main || exit $?