src/functions/functions.route

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2012  IPFire Network Development Team                         #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21 #
  22 # Functions for static routing.
  23 #
  24
  25 cli_route() {
  26         if cli_help_requested "$@"; then
  27                 cli_show_man network-route
  28                 exit ${EXIT_OK}
  29         fi
  30
  31         local action=${1}
  32         shift
  33
  34         case "${action}" in
  35                 static)
  36                         cli_route_static "$@"
  37                         ;;
  38                 *)
  39                         error "Unrecognized action: ${action}"
  40                         cli_run_help network route
  41
  42                         exit ${EXIT_ERROR}
  43                         ;;
  44         esac
  45
  46         exit ${EXIT_OK}
  47 }
  48
  49 cli_route_static() {
  50         if cli_help_requested "$@"; then
  51                 cli_show_man network-route-static
  52                 exit ${EXIT_OK}
  53         fi
  54
  55         local action=${1}
  56         shift
  57
  58         case "${action}" in
  59                 # Add a new route.
  60                 add)
  61                         route_add "$@"
  62                         ;;
  63                 # Remove an existing route.
  64                 remove)
  65                         route_remove "$@"
  66                         ;;
  67                 # List all routes.
  68                 list)
  69                         route_list "$@"
  70                         return ${EXIT_OK}
  71                         ;;
  72                 # Reload all routes
  73                 reload)
  74                         route_apply "$@"
  75                         ;;
  76                 *)
  77                         error "Unrecognized action: ${action}"
  78                         cli_run_help network route
  79
  80                         exit ${EXIT_ERROR}
  81                 ;;
  82         esac
  83
  84         # Applying all routes.
  85         route_apply
  86
  87         exit ${EXIT_OK}
  88 }
  89
  90 route_add() {
  91         local ${NETWORK_CONFIG_ROUTES_PARAMS}
  92
  93         while [ $# -gt 0 ]; do
  94                 case "${1}" in
  95                         --gateway=*)
  96                                 gateway=$(cli_get_val "${1}")
  97                                 ;;
  98                         --unreachable)
  99                                 unreachable="true"
 100                                 ;;
 101                         --prohibit)
 102                                 prohibit="true"
 103                                 ;;
 104                         --blackhole)
 105                                 blackhole="true"
 106                                 ;;
 107                         --mtu=*)
 108                                 mtu=$(cli_get_val "${1}")
 109                                 ;;
 110                         *)
 111                                 if isset network; then
 112                                         error "Bad number of arguments. Network passed twice or more"
 113                                         return ${EXIT_ERROR}
 114                                 else
 115                                         network=${1}
 116                                 fi
 117                                 ;;
 118                 esac
 119                 shift
 120         done
 121
 122         assert isset network
 123
 124         if ! ip_net_is_valid ${network} && ! ip_is_valid ${network}; then
 125                 error "The given network is invalid: ${network}"
 126                 return ${EXIT_ERROR}
 127         fi
 128
 129         if route_find_duplicate ${network}; then
 130                 error "A route to ${network} does already exist."
 131                 return ${EXIT_ERROR}
 132         fi
 133
 134         # Check if gateway and unreachable are both enabled.
 135         if isset gateway; then
 136                 if enabled unreachable; then
 137                         error "You cannot use both, --gateway=${gateway} and --unreachable at the same time."
 138                         return ${EXIT_ERROR}
 139                 fi
 140
 141                 if enabled prohibit; then
 142                         error "You cannot use both, --gateway=${gateway} and --prohibit at the same time."
 143                         return ${EXIT_ERROR}
 144                 fi
 145
 146                 if enabled blackhole; then
 147                         error "You cannot use both, --gateway=${gateway} and --blackhole at the same time."
 148                         return ${EXIT_ERROR}
 149                 fi
 150
 151                 # Check if network and gateway IP protocol version match.
 152                 if ! ip_is_valid ${gateway}; then
 153                         error "--gateway= is not a valid IP address."
 154                         return ${EXIT_ERROR}
 155                 fi
 156
 157                 # Check if the gateway is part of the statically routed network
 158                 if ip_network_is_subset_of ${gateway} ${network}; then
 159                         error "The gateway is in the routed network"
 160                         return ${EXIT_ERROR}
 161                 fi
 162
 163                 local network_proto=$(ip_detect_protocol ${network})
 164                 assert isset network_proto
 165
 166                 local gateway_proto=$(ip_detect_protocol ${gateway})
 167                 assert isset gateway_proto
 168
 169                 if [ "${network_proto}" != "${gateway_proto}" ]; then
 170                         error "The IP protocol version of the given network and gateway did not match."
 171                         return ${EXIT_ERROR}
 172                 fi
 173
 174         else
 175                 local counter=$(list_count true ${unreachable} ${prohibit} ${blackhole})
 176                 if [ ${counter} -gt 1 ]; then
 177                         error "You can only use one of --unreachable, --prohibit or --blackhole."
 178                         return ${EXIT_ERROR}
 179                 fi
 180         fi
 181
 182         if isset mtu && ! isinteger mtu; then
 183                 error "MTU must be an integer number: ${mtu}"
 184                 return ${EXIT_ERROR}
 185         fi
 186
 187         local line
 188         list_append line "network=\"${network}\""
 189
 190         # Add gateway to configuration entry when it is set.
 191         if isset gateway; then
 192                 list_append line "gateway=\"${gateway}\""
 193         fi
 194
 195         # Add unreachable to configuration entry when it is set.
 196         local arg
 197         for arg in unreachable prohibit blackhole; do
 198                 if enabled ${arg}; then
 199                         list_append line "${arg}=\"true\""
 200                         break
 201                 fi
 202         done
 203
 204         # Add MTU (if set).
 205         if isset mtu; then
 206                 list_append line "mtu=\"${mtu}\""
 207         fi
 208
 209         # Write line to file.
 210         print "${line}" >> ${NETWORK_CONFIG_ROUTES}
 211
 212         log INFO "New route to network '${network}' has been added."
 213         return ${EXIT_OK}
 214 }
 215
 216 route_remove() {
 217         local _network
 218         local error=${EXIT_OK}
 219
 220         for _network in "$@"; do
 221                 # Validate input
 222                 if ! ip_net_is_valid ${_network} && ! ip_is_valid ${_network}; then
 223                         error "Invalid IP address or network: ${_network}"
 224                         error=${EXIT_ERROR}
 225                         continue
 226                 fi
 227
 228                 local found="false"
 229
 230                 local ${NETWORK_CONFIG_ROUTES_PARAMS}
 231                 local line
 232                 while read line; do
 233                         route_parse_line ${line}
 234                         [ $? -eq ${EXIT_OK} ] || continue
 235
 236                         # Skip the rule, we want to delete.
 237                         if [ "${network}" = "${_network}" ]; then
 238                                 found="true"
 239                                 continue
 240                         fi
 241
 242                         print "${line}"
 243                 done < ${NETWORK_CONFIG_ROUTES} > ${NETWORK_CONFIG_ROUTES}.tmp
 244                 mv ${NETWORK_CONFIG_ROUTES}{.tmp,}
 245
 246                 if enabled found; then
 247                         log INFO "Route to network '${_network}' has been removed."
 248                 else
 249                         error "No route to network '${_network}' was found."
 250                         error=${EXIT_ERROR}
 251                 fi
 252         done
 253
 254         return ${error}
 255 }
 256
 257 route_list() {
 258         local protocol
 259
 260         while [ $# -gt 0 ]; do
 261                 case "${1}" in
 262                         --protocol=*)
 263                                 protocol=$(cli_get_val "${1}")
 264                                 ;;
 265                         *)
 266                                 warning "Unrecognized argument: ${1}"
 267                                 ;;
 268                 esac
 269                 shift
 270         done
 271
 272         if [ ! -r "${NETWORK_CONFIG_ROUTES}" ]; then
 273                 print "No static routes defined."
 274                 return ${EXIT_OK}
 275         fi
 276
 277         local format="%-40s %-20s %-4s"
 278         print "${format}" "NETWORK/HOST" "GATEWAY" "MTU"
 279
 280         local ${NETWORK_CONFIG_ROUTES_PARAMS}
 281         local line
 282         while read line; do
 283                 route_parse_line ${line}
 284                 [ $? -eq ${EXIT_OK} ] || continue
 285
 286                 local arg
 287                 for arg in unreachable prohibit blackhole; do
 288                         if enabled ${arg}; then
 289                                 gateway="<${arg}>"
 290                                 break
 291                         fi
 292                 done
 293
 294                 # Filter all entries with a wrong protocol.
 295                 if isset protocol; then
 296                         local proto=$(ip_detect_protocol ${network})
 297                         [ "${protocol}" = "${proto}" ] || continue
 298                 fi
 299
 300                 # Print something when no MTU was set.
 301                 if ! isset mtu; then
 302                         mtu="-"
 303                 fi
 304
 305                 print "${format}" "${network}" "${gateway}" "${mtu}"
 306         done < ${NETWORK_CONFIG_ROUTES}
 307 }
 308
 309 route_find_duplicate() {
 310         local _network=${1}
 311
 312         [ -r "${NETWORK_CONFIG_ROUTES}" ] || return ${EXIT_FALSE}
 313
 314         local ${NETWORK_CONFIG_ROUTES_PARAMS}
 315         local line
 316         while read line; do
 317                 route_parse_line ${line}
 318                 [ $? -eq ${EXIT_OK} ] || continue
 319
 320                 # Check if the network is already in use.
 321                 [ "${network}" = "${_network}" ] && return ${EXIT_TRUE}
 322         done < ${NETWORK_CONFIG_ROUTES}
 323
 324         return ${EXIT_FALSE}
 325 }
 326
 327 route_parse_line() {
 328         local arg
 329
 330         # Reset all possible settings.
 331         for arg in ${NETWORK_CONFIG_ROUTES_PARAMS}; do
 332                 printf -v ${arg} "%s" ""
 333         done
 334
 335         while read arg; do
 336                 case "${arg}" in
 337                         network=*)
 338                                 network=$(cli_get_val "${arg}")
 339                                 ;;
 340                         gateway=*)
 341                                 gateway=$(cli_get_val "${arg}")
 342                                 ;;
 343                         unreachable=*)
 344                                 unreachable=$(cli_get_val "${arg}")
 345                                 ;;
 346                         prohibit=*)
 347                                 prohibit=$(cli_get_val "${arg}")
 348                                 ;;
 349                         blackhole=*)
 350                                 blackhole=$(cli_get_val "${arg}")
 351                                 ;;
 352                         mtu=*)
 353                                 mtu=$(cli_get_val "${arg}")
 354                                 ;;
 355                 esac
 356         done <<< "$(args "$@")"
 357
 358         ### Check if all values are correctly set.
 359
 360         # network must be set.
 361         isset network || return ${EXIT_ERROR}
 362
 363         # Is network or IP valid?
 364         if ! ip_net_is_valid ${network} && ! ip_is_valid ${network}; then
 365                 error "The given network is invalid: ${network}"
 366                 return ${EXIT_ERROR}
 367         fi
 368
 369         # Check gateway settings.
 370         if isset gateway; then
 371                 # When gateway is set, unreachable cannot be set.
 372                 isset unreachable && return ${EXIT_ERROR}
 373
 374                 # Must be a valid IP address.
 375                 ip_is_valid ${gateway} || return ${EXIT_ERROR}
 376
 377                 # Check if the gateway is part of the statically routed network
 378                 if ip_network_is_subset_of ${gateway} ${network}; then
 379                         return ${EXIT_ERROR}
 380                 fi
 381         else
 382                 # Check if exactly one of unreachable, prohibit or blackhole is set.
 383                 local counter=$(list_count true ${unreachable} ${prohibit} ${blackhole})
 384                 [ ${counter} -eq 1 ] || return ${EXIT_ERROR}
 385         fi
 386
 387         # mtu must be an integer number.
 388         if isset mtu; then
 389                 isinteger mtu || return ${EXIT_ERROR}
 390         fi
 391
 392         return ${EXIT_OK}
 393 }
 394
 395 route_apply() {
 396         # Update bird
 397         bird_update
 398 }
 399
 400 route_entry_add() {
 401         local gateway
 402         local network
 403         local proto
 404         local table
 405         local type="unicast"
 406         local mtu
 407
 408         local command
 409
 410         while [ $# -gt 0 ]; do
 411                 case "${1}" in
 412                         --gateway=*)
 413                                 gateway=$(cli_get_val "${1}")
 414                                 ;;
 415                         --table=*)
 416                                 table=$(cli_get_val "${1}")
 417                                 ;;
 418                         --type=*)
 419                                 type=$(cli_get_val "${1}")
 420                                 ;;
 421                         --proto=*)
 422                                 proto=$(cli_get_val "${1}")
 423                                 ;;
 424                         --mtu=*)
 425                                 mtu=$(cli_get_val "${1}")
 426                                 ;;
 427                         *)
 428                                 if isset network; then
 429                                         warning "Unrecognized argument: ${1}"
 430                                 else
 431                                         network=${1}
 432                                 fi
 433                                 ;;
 434                 esac
 435                 shift
 436         done
 437
 438         # Validate input.
 439         assert isoneof type unicast broadcast unreachable prohibit blackhole
 440
 441         assert isset network
 442
 443         if ! ip_net_is_valid ${network} && ! ip_is_valid ${network}; then
 444                 error "The given network is invalid: ${network}"
 445                 return ${EXIT_ERROR}
 446         fi
 447
 448         if isset mtu; then
 449                 assert isinteger mtu
 450         fi
 451
 452         # Detect the protocol of the given network.
 453         local protocol=$(ip_detect_protocol ${network})
 454
 455         case "${protocol}" in
 456                 ipv6)
 457                         command="ip -6 route add"
 458                         ;;
 459                 ipv4)
 460                         command="ip route add"
 461                         ;;
 462                 *)
 463                         log ERROR "Could not detect protocol for ${network}"
 464                         return ${EXIT_ERROR}
 465                         ;;
 466         esac
 467
 468         # Add type.
 469         list_append command "${type}"
 470
 471         # Add network/prefix.
 472         list_append command "${network}"
 473
 474         if [ "${type}" = "unicast" ]; then
 475                 assert isset gateway
 476                 assert ip_is_valid ${gateway}
 477
 478                 list_append command "via ${gateway}"
 479         fi
 480
 481         # Add table (if any).
 482         if isset table; then
 483                 # Create routing table, if it does not exist, yet.
 484                 route_table_create ${table}
 485
 486                 list_append command "table ${table}"
 487         fi
 488
 489         # Add proto.
 490         if isset proto; then
 491                 list_append command "proto ${proto}"
 492         fi
 493
 494         # Add MTU.
 495         if isset mtu; then
 496                 list_append command "mtu ${mtu}"
 497         fi
 498
 499         cmd "${command}"
 500 }
 501
 502 route_table_create() {
 503         local table=${1}
 504         assert isset table
 505
 506         if route_table_exists ${table}; then
 507                 return ${EXIT_OK}
 508         fi
 509
 510         # Get the next free id.
 511         local id=$(_route_table_next_id)
 512         assert isset id
 513
 514         # Write everything to file.
 515         print "%d\t%s" "${id}" "${table}" >> /etc/iproute2/rt_tables
 516
 517         log DEBUG "Created routing table '${table}'."
 518
 519         return ${EXIT_OK}
 520 }
 521
 522 _route_table_next_id() {
 523         # The Linux kernel is able to manage 255 routing tables (1-255).
 524         # This function returns the next free id, starting from 255.
 525         local next_id
 526
 527         for next_id in {255..1}; do
 528                 if ! route_table_exists --id="${next_id}"; then
 529                         print "${next_id}"
 530                         return ${EXIT_OK}
 531                 fi
 532         done
 533
 534         return ${EXIT_FALSE}
 535 }
 536
 537 route_table_flush() {
 538         local protocol
 539         local table
 540
 541         while [ $# -gt 0 ]; do
 542                 case "${1}" in
 543                         --protocol=*)
 544                                 protocol=$(cli_get_val "${1}")
 545                                 ;;
 546                         *)
 547                                 table="${1}"
 548                                 ;;
 549                 esac
 550                 shift
 551         done
 552
 553         # If the table does not exists, there is nothing to
 554         # flush.
 555         route_table_exists ${table} || return ${EXIT_OK}
 556
 557         local command
 558         local proto
 559         for proto in ${IP_SUPPORTED_PROTOCOLS}; do
 560                 # Skip unwanted protocols.
 561                 if isset protocol; then
 562                         [ "${protocol}" = "${proto}" ] || continue
 563                 fi
 564
 565                 command=""
 566                 case "${proto}" in
 567                         ipv6)
 568                                 command="ip -6 route flush"
 569                                 ;;
 570                         ipv4)
 571                                 command="ip route flush"
 572                                 ;;
 573                 esac
 574                 assert isset command
 575
 576                 list_append command "table ${table}"
 577
 578                 # Execute command.
 579                 cmd "${command}"
 580         done
 581
 582         return ${EXIT_OK}
 583 }
 584
 585 route_table_exists() {
 586         local _id _table
 587
 588         while [ $# -gt 0 ]; do
 589                 case "${1}" in
 590                         --id=*)
 591                                 _id=$(cli_get_val "${1}")
 592                                 ;;
 593                         *)
 594                                 _table=${1}
 595                                 break
 596                                 ;;
 597                 esac
 598                 shift
 599         done
 600
 601         local id table
 602         while read -r id table; do
 603                 # Skip all comments.
 604                 [ "${id:0:1}" = "#" ] && continue
 605
 606                 if [ "${_table}" = "${table}" ] || [ "${_id}" = "${id}" ]; then
 607                         # Found a match.
 608                         return ${EXIT_TRUE}
 609                 fi
 610         done < /etc/iproute2/rt_tables
 611
 612         return ${EXIT_FALSE}
 613 }
 614
 615 route_rule_add() {
 616         local priority
 617         local protocols=${IP_SUPPORTED_PROTOCOLS}
 618         local lookup
 619
 620         while [ $# -gt 0 ]; do
 621                 case "${1}" in
 622                         --lookup=*)
 623                                 lookup=$(cli_get_val "${1}")
 624                                 ;;
 625                         --priority=*)
 626                                 priority=$(cli_get_val "${1}")
 627                                 ;;
 628                         --protocol=*)
 629                                 protocols=$(cli_get_val "${1}")
 630
 631                                 assert isoneof protocols ${IP_SUPPORTED_PROTOCOLS}
 632                                 ;;
 633                         *)
 634                                 warning "Unhandled argument: ${1}"
 635                                 ;;
 636                 esac
 637                 shift
 638         done
 639
 640         local command options
 641
 642         if isset lookup; then
 643                 route_table_create ${lookup}
 644
 645                 list_append options "lookup ${lookup}"
 646         fi
 647
 648         if isset priority; then
 649                 assert isinteger priority
 650
 651                 list_append options "prio ${priority}"
 652         fi
 653
 654         local proto
 655         for proto in ${protocols}; do
 656                 command=
 657                 case "${proto}" in
 658                         ipv6)
 659                                 command="ip -6 rule add  ${options}"
 660                                 ;;
 661                         ipv4)
 662                                 command="ip rule add ${options}"
 663                                 ;;
 664                 esac
 665                 assert isset command
 666
 667                 # Skip, if the rule does already exist.
 668                 route_rule_exists \
 669                         --protocol=${proto} \
 670                         --lookup=${lookup} \
 671                         --priority=${priority} \
 672                         && continue
 673
 674                 cmd "${command}"
 675         done
 676 }
 677
 678 route_rule_exists() {
 679         local from
 680         local lookup
 681         local proto
 682         local prio
 683
 684         while [ $# -gt 0 ]; do
 685                 case "${1}" in
 686                         --from=*)
 687                                 from=$(cli_get_val "${1}")
 688                                 ;;
 689                         --lookup=*)
 690                                 lookup=$(cli_get_val "${1}")
 691                                 ;;
 692                         --priority=*)
 693                                 prio=$(cli_get_val "${1}")
 694                                 ;;
 695                         --protocol=*)
 696                                 proto=$(cli_get_val "${1}")
 697                                 ;;
 698                         *)
 699                                 warning "Unrecognized argument: ${1}"
 700                                 ;;
 701                 esac
 702                 shift
 703         done
 704
 705         local command
 706         case "${proto}" in
 707                 ipv6)
 708                         command="ip -6 rule show"
 709                         ;;
 710                 ipv4)
 711                         command="ip rule show"
 712                         ;;
 713         esac
 714         assert isset command
 715
 716         local _lookup _from _prio
 717         local line
 718         while read -r line; do
 719                 _route_rule_exists_parse ${line}
 720
 721                 if isset from; then
 722                         [ "${from}" = "${_from}" ] || continue
 723                 fi
 724
 725                 if isset prio; then
 726                         [ "${prio}" = "${_prio}" ] || continue
 727                 fi
 728
 729                 if isset lookup; then
 730                         [ "${lookup}" = "${_lookup}" ] || continue
 731                 fi
 732
 733                 return ${EXIT_TRUE}
 734         done <<< "$(${command})"
 735
 736         return ${EXIT_FALSE}
 737 }
 738
 739 _route_rule_exists_parse() {
 740         # Reset all variables.
 741         _lookup=
 742         _from=
 743         _prio=
 744
 745         while [ $# -gt 0 ]; do
 746                 case "${1}" in
 747                         lookup)
 748                                 _lookup=${2}
 749                                 shift 2
 750                                 ;;
 751                         from)
 752                                 _from=${2}
 753                                 shift 2
 754                                 ;;
 755                         *:)
 756                                 _prio=${1//:/}
 757                                 shift
 758                                 ;;
 759                         *)
 760                                 # Skip unknown arguments.
 761                                 shift
 762                                 ;;
 763                 esac
 764         done
 765 }