src/hooks/zones/ip-tunnel

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2010  Michael Tremer & Christian Schmidt                      #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 . /usr/lib/network/header-zone
  23
  24 SUPPORTED_IP_TUNNEL_MODES="gre vti"
  25
  26 HOOK_SETTINGS="HOOK MARK MODE PEER LOCAL_ADDRESS"
  27
  28 # Default mode of the tunnel
  29 DEFAULT_MODE="gre"
  30
  31 hook_check_settings() {
  32         assert isset MODE && assert isoneof MODE ${SUPPORTED_IP_TUNNEL_MODES}
  33
  34         assert isset PEER && assert ip_is_valid "${PEER}"
  35
  36         # LOCAL_ADDRESS must be valid and match the protocol of PEER
  37         if isset LOCAL_ADDRESS; then
  38                 assert ip_is_valid "${LOCAL_ADDRESS}"
  39                 assert ip_protocol_match "${PEER}" "${LOCAL_ADDRESS}"
  40         fi
  41
  42         # Generate a random mark
  43         if ! isset MARK; then
  44                 MARK="$(( ${RANDOM} & 0xffffffff ))"
  45         fi
  46 }
  47
  48 hook_parse_cmdline() {
  49         while [ $# -gt 0 ]; do
  50                 case "${1}" in
  51                         --local-address=*)
  52                                 LOCAL_ADDRESS="$(cli_get_val "${1}")"
  53                                 ;;
  54
  55                         --mode=*)
  56                                 MODE="$(cli_get_val "${1}")"
  57
  58                                 # MODE must be on the list of supported protocols
  59                                 if ! isoneof MODE ${SUPPORTED_IP_TUNNEL_MODES}; then
  60                                         error "Unsupported mode: ${mode}"
  61                                         return ${EXIT_ERROR}
  62                                 fi
  63                                 ;;
  64
  65                         --peer=*)
  66                                 PEER="$(cli_get_val "${1}")"
  67                                 ;;
  68
  69                         *)
  70                                 error "Unknown option: ${1}"
  71                                 exit ${EXIT_ERROR}
  72                                 ;;
  73                 esac
  74                 shift
  75         done
  76
  77         # If PEER is set, it must be a valid IP address
  78         if isset PEER && ! ip_is_valid "${PEER}"; then
  79                 error "Peer ${PEER} is not a valid IP address"
  80                 return ${EXIT_ERROR}
  81         fi
  82
  83         # If LOCAL_ADDRESS is set, it must be a valid IP address
  84         # of the same protocol than PEER is
  85         if isset LOCAL_ADDRESS; then
  86                 if ! ip_is_valid "${LOCAL_ADDRESS}"; then
  87                         error "Local address ${LOCAL_ADDRESS} is not a valid IP address"
  88                         return ${EXIT_ERROR}
  89                 fi
  90
  91                 if ! ip_protocol_match "${PEER}" "${LOCAL_ADDRESS}"; then
  92                         error "Peer and local address are of different IP protocols"
  93                         return ${EXIT_ERROR}
  94                 fi
  95         fi
  96
  97         return ${EXIT_OK}
  98 }
  99
 100 hook_up() {
 101         local zone=${1}
 102         assert isset zone
 103
 104         # Read configuration
 105         if ! zone_settings_read "${zone}"; then
 106                 log ERROR "Could not read settings from ${zone}"
 107                 exit ${EXIT_ERROR}
 108         fi
 109
 110         # Create device if it doesn't exist, yet
 111         if ! device_exists "${zone}"; then
 112                 ip_tunnel_add "${zone}" \
 113                         --mode="${MODE}" \
 114                         --remote-address="${PEER}" \
 115                         --local-address="${LOCAL_ADDRESS}" \
 116                         --ikey="${MARK}" \
 117                         --okey="${MARK}"
 118         fi
 119
 120         # Bring up the device
 121         device_set_up "${zone}"
 122
 123         # Bring up all configurations
 124         zone_configs_up "${zone}"
 125
 126         exit ${EXIT_OK}
 127 }
 128
 129 hook_down() {
 130         local zone="${1}"
 131         assert isset zone
 132
 133         # Stop all the configs.
 134         zone_configs_down "${zone}"
 135
 136         # Remove the tunnel device
 137         ip_tunnel_del "${zone}" || exit $?
 138
 139         exit ${EXIT_OK}
 140 }
 141
 142 hook_status() {
 143         local zone=${1}
 144         assert isset zone
 145
 146         cli_device_headline "${zone}"
 147
 148         # Read configuration
 149         if ! zone_settings_read "${zone}"; then
 150                 error "Could not read settings from ${zone}"
 151                 exit ${EXIT_ERROR}
 152         fi
 153
 154         cli_print_fmt1 1 "Mode" "$(ip_tunnel_protocol_to_name "${MODE}")"
 155
 156         if isset PEER || isset LOCAL_ADDRESS; then
 157                 if isset PEER; then
 158                         cli_print_fmt1 1 "Peer" "${PEER}"
 159                 fi
 160
 161                 if isset LOCAL_ADDRESS; then
 162                         cli_print_fmt1 1 "Local Address" "${LOCAL_ADDRESS}"
 163                 fi
 164         fi
 165         cli_space
 166
 167         cli_headline 2 "Configurations"
 168         zone_configs_cmd status "${zone}"
 169         cli_space
 170
 171         exit ${EXIT_OK}
 172 }