src/hooks/zones/ip-tunnel

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2010  Michael Tremer & Christian Schmidt                      #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 . /usr/lib/network/header-zone
  23
  24 SUPPORTED_IP_TUNNEL_MODES="gre vti"
  25
  26 HOOK_SETTINGS="HOOK MARK MODE PEER LOCAL_ADDRESS"
  27
  28 # Default mode of the tunnel
  29 MODE="gre"
  30
  31 # The IP address of the tunnel endpoint where to connect to
  32 PEER=
  33
  34 # The local IP address of the tunnel endpoint
  35 LOCAL_ADDRESS=
  36
  37 hook_check_settings() {
  38         assert isset MODE && assert isoneof MODE ${SUPPORTED_IP_TUNNEL_MODES}
  39
  40         assert isset PEER && assert ip_is_valid "${PEER}"
  41
  42         # LOCAL_ADDRESS must be valid and match the protocol of PEER
  43         if isset LOCAL_ADDRESS; then
  44                 assert ip_is_valid "${LOCAL_ADDRESS}"
  45                 assert ip_protocol_match "${PEER}" "${LOCAL_ADDRESS}"
  46         fi
  47
  48         # Generate a random mark
  49         if ! isset MARK; then
  50                 MARK="$(( ${RANDOM} & 0xffffffff ))"
  51         fi
  52 }
  53
  54 hook_parse_cmdline() {
  55         while [ $# -gt 0 ]; do
  56                 case "${1}" in
  57                         --local-address=*)
  58                                 LOCAL_ADDRESS="$(cli_get_val "${1}")"
  59                                 ;;
  60
  61                         --mode=*)
  62                                 MODE="$(cli_get_val "${1}")"
  63
  64                                 # MODE must be on the list of supported protocols
  65                                 if ! isoneof MODE ${SUPPORTED_IP_TUNNEL_MODES}; then
  66                                         error "Unsupported mode: ${mode}"
  67                                         return ${EXIT_ERROR}
  68                                 fi
  69                                 ;;
  70
  71                         --peer=*)
  72                                 PEER="$(cli_get_val "${1}")"
  73                                 ;;
  74
  75                         *)
  76                                 error "Unknown option: ${1}"
  77                                 exit ${EXIT_ERROR}
  78                                 ;;
  79                 esac
  80                 shift
  81         done
  82
  83         # PEER must be set
  84         if ! isset PEER; then
  85                 error "Peer is not set"
  86                 return ${EXIT_ERROR}
  87         fi
  88
  89         # PEER must be a valid IP address
  90         if ! ip_is_valid "${PEER}"; then
  91                 error "Peer ${PEER} is not a valid IP address"
  92                 return ${EXIT_ERROR}
  93         fi
  94
  95         # If LOCAL_ADDRESS is set, it must be a valid IP address
  96         # of the same protocol than PEER is
  97         if isset LOCAL_ADDRESS; then
  98                 if ! ip_is_valid "${LOCAL_ADDRESS}"; then
  99                         error "Local address ${LOCAL_ADDRESS} is not a valid IP address"
 100                         return ${EXIT_ERROR}
 101                 fi
 102
 103                 if ! ip_protocol_match "${PEER}" "${LOCAL_ADDRESS}"; then
 104                         error "Peer and local address are of different IP protocols"
 105                         return ${EXIT_ERROR}
 106                 fi
 107         fi
 108
 109         return ${EXIT_OK}
 110 }
 111
 112 hook_up() {
 113         local zone=${1}
 114         assert isset zone
 115
 116         # Read configuration
 117         if ! zone_settings_read "${zone}"; then
 118                 log ERROR "Could not read settings from ${zone}"
 119                 exit ${EXIT_ERROR}
 120         fi
 121
 122         # Create device if it doesn't exist, yet
 123         if ! device_exists "${zone}"; then
 124                 ip_tunnel_add "${zone}" \
 125                         --mode="${MODE}" \
 126                         --remote-address="${PEER}" \
 127                         --local-address="${LOCAL_ADDRESS}" \
 128                         --ikey="${MARK}" \
 129                         --okey="${MARK}"
 130         fi
 131
 132         # Bring up the device
 133         device_set_up "${zone}"
 134
 135         # Bring up all configurations
 136         zone_configs_up "${zone}"
 137
 138         exit ${EXIT_OK}
 139 }
 140
 141 hook_down() {
 142         local zone="${1}"
 143         assert isset zone
 144
 145         # Stop all the configs.
 146         zone_configs_down "${zone}"
 147
 148         # Remove the tunnel device
 149         ip_tunnel_del "${zone}" || exit $?
 150
 151         exit ${EXIT_OK}
 152 }
 153
 154 hook_status() {
 155         local zone=${1}
 156         assert isset zone
 157
 158         cli_device_headline "${zone}"
 159
 160         # Read configuration
 161         if ! zone_settings_read "${zone}"; then
 162                 error "Could not read settings from ${zone}"
 163                 exit ${EXIT_ERROR}
 164         fi
 165
 166         cli_headline 2 "Configuration"
 167         cli_print_fmt1 2 "Mode" "$(ip_tunnel_protocol_to_name "${MODE}")"
 168         cli_print_fmt1 2 "Peer" "${PEER}"
 169         if isset LOCAL_ADDRESS; then
 170                 cli_print_fmt1 2 "Local Address" "${LOCAL_ADDRESS}"
 171         fi
 172         cli_space
 173
 174         cli_headline 2 "Configurations"
 175         zone_configs_cmd status "${zone}"
 176         cli_space
 177
 178         exit ${EXIT_OK}
 179 }