src/scripts/ipsec-interfaces

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2015 IPFire Team                                              #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 shopt -s nullglob
  23
  24 VPN_CONFIG="/var/ipfire/vpn/config"
  25
  26 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
  27 eval $(/usr/local/bin/readhash /var/ipfire/vpn/settings)
  28
  29 VARS=(
  30         id status name lefthost type ctype psk local local_id leftsubnets
  31         remote_id remote rightsubnets x3 x4 x5 x6 x7 x8 x9 x10 x11 x12
  32         x13 x14 x15 x16 x17 x18 x19 proto x20 x21 x22
  33         route x23 mode interface_mode interface_address interface_mtu rest
  34 )
  35
  36 log() {
  37         logger -t ipsec "$@"
  38 }
  39
  40 resolve_hostname() {
  41         local hostname="${1}"
  42
  43         dig +short A "${hostname}" | tail -n1
  44 }
  45
  46 main() {
  47         # Register local variables
  48         local "${VARS[@]}"
  49         local action
  50
  51         local interfaces=()
  52
  53         # We are done when IPsec is not enabled
  54         if [ "${ENABLED}" = "on" ]; then
  55                 while IFS="," read -r "${VARS[@]}"; do
  56                         # Check if the connection is enabled
  57                         [ "${status}" = "on" ] || continue
  58
  59                         # Check if this a net-to-net connection
  60                         [ "${type}" = "net" ] || continue
  61
  62                         # Determine the interface name
  63                         case "${interface_mode}" in
  64                                 gre|vti)
  65                                         local intf="${interface_mode}${id}"
  66                                         ;;
  67                                 *)
  68                                         continue
  69                                         ;;
  70                         esac
  71
  72                         # Add the interface to the list of all interfaces
  73                         interfaces+=( "${intf}" )
  74
  75                         # Compat for older connections
  76                         if [ "${local}" = "off" ]; then
  77                                 if [ "${VPN_IP}" = "%defaultroute" ]; then
  78                                         local=""
  79                                 else
  80                                         local="${VPN_IP}"
  81                                 fi
  82                         fi
  83
  84                         # Handle %defaultroute
  85                         if [ -z "${local}" ]; then
  86                                 if [ -r "/var/ipfire/red/local-ipaddress" ]; then
  87                                         local="$(</var/ipfire/red/local-ipaddress)"
  88
  89                                 elif [ "${RED_TYPE}" = "STATIC" -a -n "${RED_ADDRESS}" ]; then
  90                                         local="${RED_ADDRESS}"
  91                                 fi
  92                         fi
  93
  94                         # Resolve any hostnames
  95                         if [[ ! ${remote} =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
  96                                 remote="$(resolve_hostname "${remote}")"
  97                         fi
  98
  99                         local args=(
 100                                 "local" "${local}"
 101                                 "remote" "${remote}"
 102                         )
 103
 104                         case "${interface_mode}" in
 105                                 gre)
 106                                         # Add TTL
 107                                         args+=( "ttl" "255" )
 108                                         ;;
 109
 110                                 vti)
 111                                         # Add key for VTI
 112                                         args+=( "key" "${id}" )
 113                                         ;;
 114                         esac
 115
 116                         # Update the settings when the interface already exists
 117                         if [ -d "/sys/class/net/${intf}" ]; then
 118                                 ip link change dev "${intf}" \
 119                                         type "${interface_mode}" "${args[@]}" &>/dev/null
 120
 121                         # Create a new interface and bring it up
 122                         else
 123                                 log "Creating interface ${intf}"
 124                                 if ! ip link add name "${intf}" type "${interface_mode}" "${args[@]}"; then
 125                                         log "Could not create interface ${intf}"
 126                                         continue
 127                                 fi
 128                         fi
 129
 130                         # Add an IP address
 131                         ip addr flush dev "${intf}"
 132                         ip addr add "${interface_address}" dev "${intf}"
 133
 134                         # Set MTU
 135                         ip link set dev "${intf}" mtu "${interface_mtu}"
 136
 137                         # Bring up the interface
 138                         ip link set dev "${intf}" up
 139                 done < "${VPN_CONFIG}"
 140         fi
 141
 142         # Delete all other interfaces
 143         local intf
 144         for intf in /sys/class/net/gre[0-9]* /sys/class/net/vti[0-9]*; do
 145                 intf="$(basename "${intf}")"
 146
 147                 # Ignore a couple of interfaces that cannot be deleted
 148                 case "${intf}" in
 149                         gre0|gretap0)
 150                                 continue
 151                                 ;;
 152                 esac
 153
 154                 # Check if interface is on the list
 155                 local i found="false"
 156                 for i in ${interfaces[@]}; do
 157                         if [ "${intf}" = "${i}" ]; then
 158                                 found="true"
 159                                 break
 160                         fi
 161                 done
 162
 163                 # Nothing to do if interface was found
 164                 ${found} && continue
 165
 166                 # Delete the interface
 167                 log "Deleting interface ${intf}"
 168                 ip link del "${intf}" &>/dev/null
 169         done
 170 }
 171
 172 main || exit $?