src/functions/functions.ip-tunnel

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2012-2013  IPFire Network Development Team                    #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 IP_TUNNEL_MODES="gre sit vti"
  23
  24 # This function converts our modes into the type
  25 # the iproute2 tool uses
  26 ip_tunnel_convert_mode_to_iproute2_mode() {
  27         local mode=${1}
  28         local protocol=${2}
  29
  30         if ! isset mode || ! isset protocol; then
  31                 log ERROR "Did not get mode and/or protocol"
  32                 return ${EXIT_ERROR}
  33         fi
  34
  35         if [[ "${protocol}" = "ipv4" ]]; then
  36                 # When we use IPv4 we can use our modes
  37                 echo "${mode}"
  38         fi
  39
  40         if [[ "${protocol}" = "ipv6" ]]; then
  41                 # When we use IPv6 we have to convert
  42                 case "${mode}" in
  43                         "vti")
  44                                 echo "vti6"
  45                                 ;;
  46                         "gre")
  47                                 echo "ip6gre"
  48                 esac
  49         fi
  50 }
  51
  52 ip_tunnel_add() {
  53         local device=${1}
  54         shift
  55
  56         local mode
  57         local ttl
  58
  59         local remote_address
  60         local local_address
  61
  62         local ikey
  63         local okey
  64
  65         while [ $# -gt 0 ]; do
  66                 case "${1}" in
  67                         --mode=*)
  68                                 mode="$(cli_get_val "${1}")"
  69                                 ;;
  70                         --ttl=*)
  71                                 ttl="$(cli_get_val "${1}")"
  72                                 ;;
  73                         --remote-address=*)
  74                                 remote_address="$(cli_get_val "${1}")"
  75                                 ;;
  76                         --local-address=*)
  77                                 local_address="$(cli_get_val "${1}")"
  78                                 ;;
  79
  80                         # Keys for VTI
  81                         --ikey=*)
  82                                 ikey="$(cli_get_val "${1}")"
  83                                 ;;
  84                         --okey=*)
  85                                 okey="$(cli_get_val "${1}")"
  86                                 ;;
  87                 esac
  88                 shift
  89         done
  90
  91         if ! isset mode; then
  92                 error "--mode= is not set. Must be one of ${IP_TUNNEL_MODES}"
  93                 return ${EXIT_ERROR}
  94         fi
  95
  96         if ! isoneof mode ${IP_TUNNEL_MODES}; then
  97                 error "Invalid mode: ${mode}"
  98                 return ${EXIT_ERROR}
  99         fi
 100
 101         # Detect the IP protocol, which is important to decide which mode we have to use
 102         local remote_address_protocol="$(ip_detect_protocol "${remote_address}")"
 103
 104         # If we could not detect the IP protocol something with
 105         # ${remote_address} is wrong
 106         if ! isset remote_address_protocol; then
 107                 log ERROR "Could not determine remote address IP protocol"
 108                 return ${EXIT_ERROR}
 109         fi
 110
 111         # We cannot mix IPv6 and IPv4
 112         if [[ "${remote_address_protocol}" != \
 113                 "$(ip_detect_protocol "${local_address}")" ]] ; then
 114                 log ERROR "Local and remote address\
 115                         are not from the same IP protocol"
 116                 return ${EXIT_ERROR}
 117         fi
 118
 119         # ikey and okey must be set for VTI devices
 120         if [ "${mode}" = "vti" ] && (! isset ikey || ! isset okey); then
 121                 error "--ikey= and --okey= must be set for VTI device"
 122                 return ${EXIT_ERROR}
 123         fi
 124
 125         # If TTL is set, make sure it is an integer.
 126         if isset ttl && ! isinteger ttl; then
 127                 error "TTL must be an integer: ${ttl}"
 128                 return ${EXIT_ERROR}
 129         fi
 130
 131         local cmd_args
 132
 133         # Apply TTL if a value has been set.
 134         if isset ttl; then
 135                 cmd_args="${cmd_args} ttl ${ttl}"
 136         fi
 137
 138         # Apply local address if a value has been set.
 139         if isset local_address; then
 140                 cmd_args="${cmd_args} local ${local_address}"
 141         fi
 142
 143         # Apply remote address if a value has been set.
 144         if isset remote_address; then
 145                 cmd_args="${cmd_args} remote ${remote_address}"
 146         fi
 147
 148         # Add ikey and okey for VTI devices
 149         if [ "${mode}" = "vti" ]; then
 150                 cmd_args="${cmd_args} ikey ${ikey} okey ${okey}"
 151         fi
 152
 153         log DEBUG "Creating tunnel device '${device}' (mode=${mode})..."
 154
 155         # Create the device.
 156         if ! cmd ip link add name ${device} type ${mode} ${cmd_args}; then
 157                 error "Could not create tunnel device ${device}"
 158                 return ${EXIT_ERROR}
 159         fi
 160
 161         # Disable policy lookups for VTI devices
 162         if [ "${mode}" = "vti" ]; then
 163                 sysctl_set "net.ipv4.conf.${device}.disable_policy" "1"
 164         fi
 165
 166         return ${EXIT_OK}
 167 }
 168
 169 ip_tunnel_del() {
 170         device_delete "$@"
 171 }
 172
 173 ip_tunnel_change_keys() {
 174         local device="${1}"
 175         shift
 176
 177         if ! isset device; then
 178                 error "No device given"
 179                 return ${EXIT_ERROR}
 180         fi
 181
 182         local ikey
 183         local okey
 184
 185         while [ $# -gt 0 ]; do
 186                 case "${1}" in
 187                         --ikey=*)
 188                                 ikey="$(cli_get_val ${1})"
 189                                 ;;
 190                         --okey=*)
 191                                 okey="$(cli_get_val ${1})"
 192                                 ;;
 193                         *)
 194                                 error "Invalid argument: ${1}"
 195                                 return ${EXIT_ERROR}
 196                                 ;;
 197                 esac
 198                 shift
 199         done
 200
 201         if ! isset ikey || ! isset okey; then
 202                 error "You need to set --ikey= and --okey="
 203                 return ${EXIT_ERROR}
 204         fi
 205
 206         if ! device_exists "${device}"; then
 207                 error "No such device: ${device}"
 208                 return ${EXIT_ERROR}
 209         fi
 210
 211         if ! cmd ip link change dev "${device}" \
 212                 type vti ikey "${ikey}" okey "${okey}"; then
 213                 log ERROR "Could not change keys of device ${device}"
 214                 return ${EXIT_ERROR}
 215         fi
 216
 217         return ${EXIT_OK}
 218 }