src/helpers/ipsec-updown

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2017  IPFire Network Development Team                         #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 LOG_DISABLE_STDOUT="true"
  23
  24 . /usr/lib/network/functions
  25
  26 # Read network settings
  27 network_settings_read
  28
  29 # Make sure we are called by strongSwan
  30 assert isset PLUTO_VERSION
  31
  32 if enabled DEBUG; then
  33         while read line; do
  34                 [[ ${line} =~ ^PLUTO_ ]] || continue
  35                 log DEBUG "  ${line}"
  36         done <<< "$(printenv | sort)"
  37 fi
  38
  39 CONNECTION="${PLUTO_CONNECTION}"
  40
  41 if ! ipsec_connection_read_config "${CONNECTION}"; then
  42         log ERROR "Could not read configuration for ${CONNECTION}"
  43         exit ${EXIT_ERROR}
  44 fi
  45
  46 log DEBUG "${0} called for ${CONNECTION}: ${PLUTO_VERB}"
  47
  48 case "${PLUTO_VERB}" in
  49         up-client|up-client-v6|up-host|up-host-v6)
  50                 if isset ZONE && zone_exists "${ZONE}"; then
  51                         # Bring up the zone if not done, yet
  52                         if ! zone_is_up "${ZONE}"; then
  53                                 zone_up "${ZONE}"
  54                         fi
  55
  56                         # Update peer and local address
  57                         if ! ip_tunnel_change "${ZONE}" \
  58                                         --remote="${PLUTO_PEER}" --local="${PLUTO_ME}"; then
  59                                 return ${EXIT_ERROR}
  60                         fi
  61                 fi
  62
  63                 # Get source IP for routes
  64                 SRC_IP=($(ip_get_assigned_addresses_from_net \
  65                         "${PLUTO_MY_CLIENT}" "permanent"))
  66
  67                 # We take the lowest source IP we found,
  68                 # which is ugly because the value is unpredictable.
  69                 SRC_IP=${SRC_IP[0]}
  70
  71                 # Add routes to reach the remote subnet(s)
  72                 if isset ZONE; then
  73                         if ! cmd ip route add "${PLUTO_PEER_CLIENT}" proto static dev "${ZONE}" src "${SRC_IP}"; then
  74                                 log ERROR "Could not create route for ${PLUTO_PEER_CLIENT}"
  75                         fi
  76                 else
  77                         if ! cmd ip route add "${PLUTO_PEER_CLIENT}" proto static via "${PLUTO_PEER}" src "${SRC_IP}"; then
  78                                 log ERROR "Could not create route for ${PLUTO_PEER_CLIENT} via ${PLUTO_PEER}"
  79                         fi
  80                 fi
  81                 ;;
  82
  83         down-client|down-client-v6|down-host|down-host-v6)
  84                 # Remove routes
  85                 cmd ip route del "${PLUTO_PEER_CLIENT}"
  86                 ;;
  87 esac
  88
  89 exit ${EXIT_OK}