src/hooks/zones/ip-tunnel

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2010  Michael Tremer & Christian Schmidt                      #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 . /usr/lib/network/header-zone
  23
  24 SUPPORTED_IP_TUNNEL_MODES="gre vti"
  25
  26 HOOK_SETTINGS="HOOK MARK MODE PEER LOCAL_ADDRESS"
  27
  28 # Default mode of the tunnel
  29 MODE="gre"
  30
  31 # The IP address of the tunnel endpoint where to connect to
  32 PEER=
  33
  34 # The local IP address of the tunnel endpoint
  35 LOCAL_ADDRESS=
  36
  37 hook_check_settings() {
  38         assert isset MODE && assert isoneof MODE ${SUPPORTED_IP_TUNNEL_MODES}
  39
  40         assert isset PEER && assert ip_is_valid "${PEER}"
  41
  42         # LOCAL_ADDRESS must be valid and match the protocol of PEER
  43         if isset LOCAL_ADDRESS; then
  44                 assert ip_is_valid "${LOCAL_ADDRESS}"
  45                 assert ip_protocol_match "${PEER}" "${LOCAL_ADDRESS}"
  46         fi
  47
  48         # Generate a random mark
  49         if ! isset MARK; then
  50                 MARK="$(( ${RANDOM} & 0xffffffff ))"
  51         fi
  52 }
  53
  54 hook_parse_cmdline() {
  55         while [ $# -gt 0 ]; do
  56                 case "${1}" in
  57                         --local-address=*)
  58                                 LOCAL_ADDRESS="$(cli_get_val "${1}")"
  59                                 ;;
  60
  61                         --mode=*)
  62                                 MODE="$(cli_get_val "${1}")"
  63
  64                                 # MODE must be on the list of supported protocols
  65                                 if ! isoneof MODE ${SUPPORTED_IP_TUNNEL_MODES}; then
  66                                         error "Unsupported mode: ${mode}"
  67                                         return ${EXIT_ERROR}
  68                                 fi
  69                                 ;;
  70
  71                         --peer=*)
  72                                 PEER="$(cli_get_val "${1}")"
  73                                 ;;
  74
  75                         *)
  76                                 error "Unknown option: ${1}"
  77                                 exit ${EXIT_ERROR}
  78                                 ;;
  79                 esac
  80                 shift
  81         done
  82
  83         # If PEER is set, it must be a valid IP address
  84         if isset PEER && ! ip_is_valid "${PEER}"; then
  85                 error "Peer ${PEER} is not a valid IP address"
  86                 return ${EXIT_ERROR}
  87         fi
  88
  89         # If LOCAL_ADDRESS is set, it must be a valid IP address
  90         # of the same protocol than PEER is
  91         if isset LOCAL_ADDRESS; then
  92                 if ! ip_is_valid "${LOCAL_ADDRESS}"; then
  93                         error "Local address ${LOCAL_ADDRESS} is not a valid IP address"
  94                         return ${EXIT_ERROR}
  95                 fi
  96
  97                 if ! ip_protocol_match "${PEER}" "${LOCAL_ADDRESS}"; then
  98                         error "Peer and local address are of different IP protocols"
  99                         return ${EXIT_ERROR}
 100                 fi
 101         fi
 102
 103         return ${EXIT_OK}
 104 }
 105
 106 hook_up() {
 107         local zone=${1}
 108         assert isset zone
 109
 110         # Read configuration
 111         if ! zone_settings_read "${zone}"; then
 112                 log ERROR "Could not read settings from ${zone}"
 113                 exit ${EXIT_ERROR}
 114         fi
 115
 116         # Create device if it doesn't exist, yet
 117         if ! device_exists "${zone}"; then
 118                 ip_tunnel_add "${zone}" \
 119                         --mode="${MODE}" \
 120                         --remote-address="${PEER}" \
 121                         --local-address="${LOCAL_ADDRESS}" \
 122                         --ikey="${MARK}" \
 123                         --okey="${MARK}"
 124         fi
 125
 126         # Bring up the device
 127         device_set_up "${zone}"
 128
 129         # Bring up all configurations
 130         zone_configs_up "${zone}"
 131
 132         exit ${EXIT_OK}
 133 }
 134
 135 hook_down() {
 136         local zone="${1}"
 137         assert isset zone
 138
 139         # Stop all the configs.
 140         zone_configs_down "${zone}"
 141
 142         # Remove the tunnel device
 143         ip_tunnel_del "${zone}" || exit $?
 144
 145         exit ${EXIT_OK}
 146 }
 147
 148 hook_status() {
 149         local zone=${1}
 150         assert isset zone
 151
 152         cli_device_headline "${zone}"
 153
 154         # Read configuration
 155         if ! zone_settings_read "${zone}"; then
 156                 error "Could not read settings from ${zone}"
 157                 exit ${EXIT_ERROR}
 158         fi
 159
 160         cli_print_fmt1 1 "Mode" "$(ip_tunnel_protocol_to_name "${MODE}")"
 161
 162         if isset PEER || isset LOCAL_ADDRESS; then
 163                 if isset PEER; then
 164                         cli_print_fmt1 1 "Peer" "${PEER}"
 165                 fi
 166
 167                 if isset LOCAL_ADDRESS; then
 168                         cli_print_fmt1 1 "Local Address" "${LOCAL_ADDRESS}"
 169                 fi
 170         fi
 171         cli_space
 172
 173         cli_headline 2 "Configurations"
 174         zone_configs_cmd status "${zone}"
 175         cli_space
 176
 177         exit ${EXIT_OK}
 178 }