src/hooks/zones/ip-tunnel

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2010  Michael Tremer & Christian Schmidt                      #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 . /usr/lib/network/header-zone
  23
  24 SUPPORTED_IP_TUNNEL_MODES="gre sit vti"
  25
  26 HOOK_SETTINGS=(
  27         "MARK"
  28         "MODE"
  29         "PEER"
  30         "LOCAL_ADDRESS"
  31 )
  32
  33 # Default mode of the tunnel
  34 DEFAULT_MODE="gre"
  35
  36 hook_check_settings() {
  37         assert isset MODE && assert isoneof MODE ${SUPPORTED_IP_TUNNEL_MODES}
  38
  39         assert isset PEER && assert ip_is_valid "${PEER}"
  40
  41         # LOCAL_ADDRESS must be valid and match the protocol of PEER
  42         if isset LOCAL_ADDRESS; then
  43                 assert ip_is_valid "${LOCAL_ADDRESS}"
  44                 assert ip_protocol_match "${PEER}" "${LOCAL_ADDRESS}"
  45         fi
  46
  47         # Generate a random mark
  48         if ! isset MARK; then
  49                 MARK="$(( ${RANDOM} & 0xffffffff ))"
  50         fi
  51 }
  52
  53 hook_parse_cmdline() {
  54         while [ $# -gt 0 ]; do
  55                 case "${1}" in
  56                         --local-address=*)
  57                                 LOCAL_ADDRESS="$(cli_get_val "${1}")"
  58                                 ;;
  59
  60                         --mode=*)
  61                                 MODE="$(cli_get_val "${1}")"
  62
  63                                 # MODE must be on the list of supported protocols
  64                                 if ! isoneof MODE ${SUPPORTED_IP_TUNNEL_MODES}; then
  65                                         error "Unsupported mode: ${mode}"
  66                                         return ${EXIT_ERROR}
  67                                 fi
  68                                 ;;
  69
  70                         --peer=*)
  71                                 PEER="$(cli_get_val "${1}")"
  72                                 ;;
  73
  74                         *)
  75                                 error "Unknown option: ${1}"
  76                                 exit ${EXIT_ERROR}
  77                                 ;;
  78                 esac
  79                 shift
  80         done
  81
  82         # If PEER is set, it must be a valid IP address
  83         if isset PEER && ! ip_is_valid "${PEER}"; then
  84                 error "Peer ${PEER} is not a valid IP address"
  85                 return ${EXIT_ERROR}
  86         fi
  87
  88         # If LOCAL_ADDRESS is set, it must be a valid IP address
  89         # of the same protocol than PEER is
  90         if isset LOCAL_ADDRESS; then
  91                 if ! ip_is_valid "${LOCAL_ADDRESS}"; then
  92                         error "Local address ${LOCAL_ADDRESS} is not a valid IP address"
  93                         return ${EXIT_ERROR}
  94                 fi
  95
  96                 if ! ip_protocol_match "${PEER}" "${LOCAL_ADDRESS}"; then
  97                         error "Peer and local address are of different IP protocols"
  98                         return ${EXIT_ERROR}
  99                 fi
 100         fi
 101
 102         return ${EXIT_OK}
 103 }
 104
 105 hook_up() {
 106         local zone=${1}
 107         assert isset zone
 108
 109         # Read configuration
 110         if ! zone_settings_read "${zone}"; then
 111                 log ERROR "Could not read settings from ${zone}"
 112                 exit ${EXIT_ERROR}
 113         fi
 114
 115         # Create device if it doesn't exist, yet
 116         if ! device_exists "${zone}"; then
 117                 ip_tunnel_add "${zone}" \
 118                         --mode="${MODE}" \
 119                         --remote-address="${PEER}" \
 120                         --local-address="${LOCAL_ADDRESS}" \
 121                         --ikey="${MARK}" \
 122                         --okey="${MARK}"
 123         fi
 124
 125         # Bring up the device
 126         device_set_up "${zone}"
 127
 128         # Bring up all configurations
 129         zone_configs_up "${zone}"
 130
 131         exit ${EXIT_OK}
 132 }
 133
 134 hook_down() {
 135         local zone="${1}"
 136         assert isset zone
 137
 138         # Stop all the configs.
 139         zone_configs_down "${zone}"
 140
 141         # Remove the tunnel device
 142         ip_tunnel_del "${zone}" || exit $?
 143
 144         exit ${EXIT_OK}
 145 }
 146
 147 hook_status() {
 148         local zone=${1}
 149         assert isset zone
 150
 151         cli_device_headline "${zone}"
 152
 153         # Read configuration
 154         if ! zone_settings_read "${zone}"; then
 155                 error "Could not read settings from ${zone}"
 156                 exit ${EXIT_ERROR}
 157         fi
 158
 159         cli_print_fmt1 1 "Mode" "$(ip_tunnel_protocol_to_name "${MODE}")"
 160
 161         if isset PEER || isset LOCAL_ADDRESS; then
 162                 if isset PEER; then
 163                         cli_print_fmt1 1 "Peer" "${PEER}"
 164                 fi
 165
 166                 if isset LOCAL_ADDRESS; then
 167                         cli_print_fmt1 1 "Local Address" "${LOCAL_ADDRESS}"
 168                 fi
 169         fi
 170         cli_space
 171
 172         cli_headline 2 "Configurations"
 173         zone_configs_cmd status "${zone}"
 174         cli_space
 175
 176         exit ${EXIT_OK}
 177 }