src/functions/functions.ppp

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2010  Michael Tremer & Christian Schmidt                      #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 PPP_SUPPORTED_AUTH_METHODS="chap pap"
  23
  24 EXIT_PPPD_ERROR=${EXIT_ERROR}
  25 EXIT_PPPD_ERROR_FATAL=$(( ${EXIT_ERROR} + 1 ))
  26
  27 # This function monitors the pppd activity.
  28
  29 pppd_angel() {
  30         local device="${1}"
  31         assert isset device
  32
  33         local config_file="${2}"
  34         assert isset config_file
  35         shift 2
  36
  37         local holdoff_time
  38
  39         while [ $# -gt 0 ]; do
  40                 case "${1}" in
  41                         --holdoff-time=*)
  42                                 holdoff_time="$(cli_get_val "${1}")"
  43                                 ;;
  44                         *)
  45                                 warning "Unrecognized argument: ${1}"
  46                                 return ${EXIT_ERROR}
  47                                 ;;
  48                 esac
  49                 shift
  50         done
  51
  52         while :; do
  53                 # Execute ppp daemon.
  54                 pppd_exec "${device}" "${config_file}"
  55                 local ret=${?}
  56
  57                 case "${ret}" in
  58                         ${EXIT_OK})
  59                                 # pppd terminated gracefully. Propagating...
  60                                 return ${EXIT_OK}
  61                                 ;;
  62                         ${EXIT_PPPD_ERROR})
  63                                 # pppd has a (non-fatal) error, in which case we
  64                                 # restart it instantly, so it will try to re-establish
  65                                 # the connection.
  66                                 ;;
  67                         ${EXIT_PPPD_ERROR_FATAL})
  68                                 # pppd has a fatal error. We cannot go on from here
  69                                 # because there is either no chance to establish a connection
  70                                 # without any user interaction, or we will damage the system.
  71                                 log ERROR "Fatal error. Not going to restart pppd."
  72                                 return ${EXIT_ERROR}
  73                                 ;;
  74                         *)
  75                                 log ERROR "Invalid return code: ${ret}"
  76                                 return ${EXIT_ERROR}
  77                                 ;;
  78                 esac
  79
  80                 isset holdoff_time || continue
  81
  82                 # When we got here, we need to wait a little bit and restart the
  83                 # ppp daemon soon.
  84                 log INFO "Restarting pppd in ${holdoff_time}s"
  85                 sleep ${holdoff_time}
  86         done
  87 }
  88
  89 pppd_exec() {
  90         local device="${1}"
  91         assert isset device
  92
  93         local config_file="${2}"
  94         assert isset config_file
  95         shift 2
  96
  97         # Execute pppd.
  98         cmd "pppd file ${config_file} $@"
  99         local ret=$?
 100
 101         # Get the hook of the zone
 102         local hook
 103         if zone_exists "${device}"; then
 104                 hook="$(zone_get_hook "${zone}")"
 105         fi
 106
 107         log DEBUG "pppd exited with code: ${ret}"
 108
 109         # Evaluate return code.
 110         local error_code
 111         case "${ret},${hook}" in
 112                 0,*)
 113                         # Pppd has detached, or otherwise the connection was successfully
 114                         # established and terminated at the peer's request.
 115                         log DEBUG "pppd exited gracefully"
 116                         return ${EXIT_OK}
 117                         ;;
 118                 1,*)
 119                         # An immediately fatal error of some kind occurred, such as an
 120                         # essential system call failing, or running out of virtual memory.
 121                         log ERROR "pppd crashed for an unknown reason"
 122                         return ${EXIT_PPPD_ERROR_FATAL}
 123                         ;;
 124                 2,*)
 125                         # An error was detected in processing the options given, such as two
 126                         # mutually exclusive options being used.
 127                         log ERROR "pppd: Configuration error"
 128                         return ${EXIT_PPPD_ERROR_FATAL}
 129                         ;;
 130                 3,*)
 131                         # Pppd is not setuid-root and the invoking user is not root.
 132                         log ERROR "pppd: Launched with insufficient privileges"
 133                         return ${EXIT_PPPD_ERROR_FATAL}
 134                         ;;
 135                 4,*)
 136                         # The kernel does not support PPP, for example, the PPP kernel driver is
 137                         # not included or cannot be loaded.
 138                         log ERROR "pppd: Kernel does not support PPP"
 139                         return ${EXIT_PPPD_ERROR_FATAL}
 140                         ;;
 141                 5,*)
 142                         # Pppd terminated because it was sent a SIGINT, SIGTERM or SIGHUP signal.
 143                         log ERROR "pppd: Received SIGINT, SIGTERM or SIGHUP signal"
 144                         return ${EXIT_PPPD_ERROR}
 145                         ;;
 146                 6,*)
 147                         # The serial port could not be locked.
 148                         log ERROR "pppd: Serial port could not be locked"
 149                         return ${EXIT_PPPD_ERROR}
 150                         ;;
 151                 7,*)
 152                         # The serial port could not be opened.
 153                         log ERROR "pppd: Serial port could not be opened"
 154                         return ${EXIT_PPPD_ERROR}
 155                         ;;
 156                 8,pppoe)
 157                         # For PPPoE this tells us that we were not able to contact
 158                         # the DSLAM (i.e. timeout waiting for PADO packets)
 159                         log ERROR "pppd: Unable to contact the DSLAM"
 160                         return ${EXIT_PPPD_ERROR}
 161                         ;;
 162                 8,*)
 163                         # The connect script failed (returned a non-zero exit status).
 164                         log ERROR "pppd: Connect script failed"
 165                         return ${EXIT_PPPD_ERROR_FATAL}
 166                         ;;
 167                 9,*)
 168                         # The command specified as the argument to the pty option could not be run.
 169                         log ERROR "pppd: Could not run pty command"
 170                         return ${EXIT_PPPD_ERROR_FATAL}
 171                         ;;
 172                 10,*)
 173                         # The PPP negotiation failed, that is, it didn't reach the point where at
 174                         # least one network protocol (e.g. IP) was running.
 175                         log ERROR "pppd: Protocol negotiation failed"
 176                         return ${EXIT_PPPD_ERROR}
 177                         ;;
 178                 11,*)
 179                         # The peer system failed (or refused) to authenticate itself.
 180                         log ERROR "pppd: peer system failed (or refused) to authenticate itself"
 181                         return ${EXIT_PPPD_ERROR}
 182                         ;;
 183                 12,*)
 184                         # The link was established successfully and terminated because it was idle.
 185                         log ERROR "pppd: Terminated because of idleness"
 186                         return ${EXIT_PPPD_ERROR}
 187                         ;;
 188                 13,*)
 189                         # The link was established successfully and terminated because the connect time
 190                         # limit was reached.
 191                         log ERROR "pppd: connect time limit was reached"
 192                         return ${EXIT_PPPD_ERROR}
 193                         ;;
 194                 14,*)
 195                         # Callback was negotiated and an incoming call should arrive shortly.
 196                         # We should not be using this, so make it fatal that nobody is able to
 197                         # abuse the feature.
 198                         return ${EXIT_PPPD_ERROR_FATAL}
 199                         ;;
 200                 15,*)
 201                         # The link was terminated because the peer is not responding to echo requests.
 202                         log ERROR "pppd: Peer is not responding to echo requests"
 203                         return ${EXIT_PPPD_ERROR}
 204                         ;;
 205                 16,*)
 206                         # The link was terminated by the modem hanging up.
 207                         log ERROR "pppd: Modem hung up"
 208                         return ${EXIT_PPPD_ERROR}
 209                         ;;
 210                 17,*)
 211                         # The PPP negotiation failed because serial loopback was detected.
 212                         log ERROR "pppd: Serial loopback detected"
 213                         return ${EXIT_PPPD_ERROR_FATAL}
 214                         ;;
 215                 18,*)
 216                         # The init script failed (returned a non-zero exit status).
 217                         log ERROR "pppd: Init script failed"
 218                         return ${EXIT_PPPD_ERROR_FATAL}
 219                         ;;
 220                 19,*)
 221                         # We failed to authenticate ourselves to the peer.
 222                         log ERROR "pppd: Authentication failed"
 223                         return ${EXIT_PPPD_ERROR_FATAL}
 224                         ;;
 225                 *)
 226                         log ERROR "pppd: Unhandled exit code: ${ret}"
 227                         return ${EXIT_PPPD_ERROR_FATAL}
 228                         ;;
 229         esac
 230 }
 231
 232 pppd_start() {
 233         local device="${1}"
 234         assert isset device
 235
 236         # This will block until the connection has been established or
 237         # pppd exited.
 238         service_start "pppd@${device}.service"
 239 }
 240
 241 pppd_stop() {
 242         local device="${1}"
 243         assert isset device
 244
 245         service_stop "pppd@${device}.service"
 246 }
 247
 248 pppd_status() {
 249         local device="${1}"
 250         assert isset device
 251
 252         service_status "pppd@${device}.service"
 253 }
 254
 255 ppp_common_ip_pre_up() {
 256         local zone=${1}
 257         shift
 258
 259         if ! zone_exists ${zone}; then
 260                 error "Zone '${zone}' does not exist."
 261                 return ${EXIT_ERROR}
 262         fi
 263
 264         routing_db_from_ppp ${zone} ipv4
 265
 266         return ${EXIT_OK}
 267 }
 268
 269 ppp_common_ipv4_up() {
 270         local zone=${1}
 271         shift
 272
 273         if ! zone_exists ${zone}; then
 274                 error "Zone '${zone}' does not exist."
 275                 return ${EXIT_ERROR}
 276         fi
 277
 278         db_set "${zone}/ipv4/active" 1
 279
 280         routing_update ${zone} ipv4
 281         routing_default_update
 282
 283         return ${EXIT_OK}
 284 }
 285
 286 ppp_common_ipv4_down() {
 287         local zone=${1}
 288         shift
 289
 290         if ! zone_exists ${zone}; then
 291                 error "Zone '${zone}' does not exist."
 292                 return ${EXIT_ERROR}
 293         fi
 294
 295         # Remove the information about this zone from the routing database
 296         # and update the routing table.
 297         db_delete "${zone}/ipv4"
 298
 299         routing_update ${zone} ipv4
 300         routing_default_update
 301
 302         # Save accounting information
 303         ppp_accounting ${zone}
 304
 305         return ${EXIT_OK}
 306 }
 307
 308 ppp_common_ipv6_up() {
 309         local zone=${1}
 310         shift
 311
 312         if ! zone_exists ${zone}; then
 313                 error "Zone '${zone}' does not exist."
 314                 return ${EXIT_ERROR}
 315         fi
 316
 317         # Add information about this zone to the routing database.
 318         routing_db_from_ppp ${zone} ipv6
 319
 320         db_set "${zone}/ipv6/active" 1
 321
 322         routing_update ${zone} ipv6
 323         routing_default_update
 324
 325         return ${EXIT_OK}
 326 }
 327
 328 ppp_common_ipv6_down() {
 329         local zone=${1}
 330         shift
 331
 332         if ! zone_exists ${zone}; then
 333                 error "Zone '${zone}' does not exist."
 334                 return ${EXIT_ERROR}
 335         fi
 336
 337         # Remove the information about this zone from the routing database
 338         # and update the routing table.
 339         db_delete "${zone}/ipv6"
 340
 341         routing_update ${zone} ipv6
 342         routing_default_update
 343
 344         # Save accounting information
 345         ppp_accounting ${zone}
 346
 347         return ${EXIT_OK}
 348 }
 349
 350 ppp_secret() {
 351         local USER=${1}
 352         local SECRET=${2}
 353         local a
 354         local secret
 355         local user
 356
 357         # Updateing secret file
 358         > ${PPP_SECRETS}.tmp
 359         while read user a secret; do
 360                 if [ "'${USER}'" != "${user}" ]; then
 361                         echo "${user} ${a} ${secret}" >> ${PPP_SECRETS}.tmp
 362                 fi
 363         done < ${PPP_SECRETS}
 364         echo "'${USER}' * '${SECRET}'" >> ${PPP_SECRETS}.tmp
 365         cat ${PPP_SECRETS}.tmp > ${PPP_SECRETS}
 366         rm -f ${PPP_SECRETS}.tmp
 367 }
 368
 369 ppp_accounting() {
 370         local zone=${1}
 371         shift
 372
 373         db_ppp_update ${zone} --duration="${CONNECT_TIME}" \
 374                 --rcvd="${BYTES_RCVD}" --sent="${BYTES_SENT}"
 375 }
 376
 377 pppd_write_config() {
 378         local file=${1}; shift
 379         assert isset file
 380
 381         local auth
 382         local baudrate
 383         local connect_cmd
 384         local default_asyncmap="true"
 385         local interface
 386         local ipv6="true"
 387         local lcp_echo_failure=3
 388         local lcp_echo_interval=20
 389         local linkname
 390         local mtu mru
 391         local password
 392         local plugin plugin_options
 393         local pty
 394         local refuses
 395         local serial="false"
 396         local username
 397         local value
 398
 399         while [ $# -gt 0 ]; do
 400                 case "${1}" in
 401                         --auth=*)
 402                                 auth=$(cli_get_val ${1})
 403                                 ;;
 404                         --baudrate=*)
 405                                 baudrate=$(cli_get_val ${1})
 406                                 assert isoneof baudrate ${SERIAL_BAUDRATES}
 407                                 ;;
 408                         --connect-command=*)
 409                                 connect_cmd=$(cli_get_val ${1})
 410                                 ;;
 411                         # Enable or disable the use of the default asyncmap.
 412                         --default-asyncmap=*)
 413                                 value=$(cli_get_val ${1})
 414                                 if enabled value; then
 415                                         default_asyncmap="true"
 416                                 else
 417                                         default_asyncmap="false"
 418                                 fi
 419                                 ;;
 420                         # The name of the created ppp interface.
 421                         --interface=*)
 422                                 interface=$(cli_get_val ${1})
 423                                 ;;
 424                         # IPv6
 425                         --ipv6=*)
 426                                 ipv6="$(cli_get_val ${1})"
 427                                 ;;
 428                         # LCP echo failure.
 429                         --lcr-echo-failure=*)
 430                                 lcr_echo_failure=$(cli_get_val ${1})
 431
 432                                 if ! isinteger ${lcr_echo_failure}; then
 433                                         error "--lcr-echo-failure= requires a number"
 434                                         return ${EXIT_ERROR}
 435                                 fi
 436                                 ;;
 437                         # LCP echo interval.
 438                         --lcr-echo-interval=*)
 439                                 lcr_echo_interval=$(cli_get_val ${1})
 440
 441                                 if ! isinteger ${lcr_echo_failure}; then
 442                                         error "--lcr-echo-interval= requires a number"
 443                                         return ${EXIT_ERROR}
 444                                 fi
 445                                 ;;
 446                         # Maximum Transmission Unit
 447                         --mtu=*)
 448                                 mtu=$(cli_get_val ${1})
 449                                 ;;
 450                         # Maximum Receive Unit
 451                         --mru=*)
 452                                 mru=$(cli_get_val ${1})
 453                                 ;;
 454                         --password=*)
 455                                 password=$(cli_get_val ${1})
 456                                 ;;
 457                         --plugin=*)
 458                                 plugin=$(cli_get_val ${1})
 459                                 ;;
 460                         --plugin-options=*)
 461                                 plugin_options=$(cli_get_val ${1})
 462                                 ;;
 463                         --pty=*)
 464                                 pty=$(cli_get_val ${1})
 465                                 ;;
 466                         # Refused authentication methods
 467                         --refuse=*)
 468                                 list_append refuses "$(cli_get_val "${1}")"
 469                                 error_log "REFUSES $refuses $1"
 470                                 ;;
 471                         # Sets if the modem is a serial device.
 472                         --serial=*)
 473                                 serial=$(cli_get_val ${1})
 474                                 ;;
 475                         --serial-device=*)
 476                                 serial_device=$(cli_get_val ${1})
 477                                 ;;
 478                         --username=*)
 479                                 username=$(cli_get_val ${1})
 480                                 ;;
 481                         *)
 482                                 log WARNING "Unhandled argument: ${1}"
 483                                 ;;
 484                 esac
 485                 shift
 486         done
 487
 488         if [ -z "${interface}" ]; then
 489                 log ERROR "You need to set the interface name: ${interface}"
 490                 return ${EXIT_ERROR}
 491         fi
 492         linkname="${interface}"
 493
 494         if isset auth; then
 495                 if ! isoneof ${auth} ${PPP_SUPPORTED_AUTH_METHODS}; then
 496                         log ERROR "Unsupported auth method: ${auth}"
 497                         return ${EXIT_ERROR}
 498                 fi
 499         fi
 500
 501         if enabled serial; then
 502                 assert isset serial_device
 503                 assert [ -c "${serial_device}" ]
 504         fi
 505
 506         # Set the user credentials.
 507         ppp_secret "${username}" "${password}"
 508
 509         # Write the configuration header.
 510         mkdir -p $(dirname ${file}) 2>/dev/null
 511         config_header "PPP daemon configuration file" > ${file}
 512
 513         # At first, set the name of the link.
 514         print "linkname ${linkname}\n" >> ${file}
 515
 516         # Configure the interface/zone name.
 517         (
 518                 print "# Interface name"
 519                 print "ifname ${interface}"
 520                 print
 521         ) >> ${file}
 522
 523         # Plugin settings
 524         if isset plugin; then
 525                 (
 526                         print "# Plugin settings"
 527                         print "plugin ${plugin} ${plugin_options}"
 528                         print
 529                 ) >> ${file}
 530         fi
 531
 532         # pty settings
 533         if isset pty; then
 534                 (
 535                         print "# pty settings"
 536                         print "pty \"${pty}\""
 537                         print
 538                  ) >> ${file}
 539         fi
 540
 541         # User authentication
 542         if isset username; then
 543                 (
 544                         print "# User authentication"
 545                         print "user ${username}"
 546
 547                         print "noauth"
 548                         if isset auth; then
 549                                 print "require-${auth}"
 550                         fi
 551
 552                         # Refused authentication methods
 553                         for refuse in ${refuses}; do
 554                                 print "refuse-${refuse}"
 555                         done
 556                         print
 557                 ) >> ${file}
 558         fi
 559
 560         # DNS
 561         (
 562                 print "# DNS"
 563                 print "usepeerdns"
 564                 print
 565         ) >> ${file}
 566
 567         # IPv6
 568         if enabled ipv6; then
 569                 (
 570                         print "# IPv6 support"
 571                         print "+ipv6"
 572                         print
 573                 ) >> ${file}
 574         fi
 575
 576         # MTU/MRU settings
 577         if isset mtu; then
 578                 isset mru || mru=${mtu}
 579
 580                 (
 581                         print "# MTU/MRU settings"
 582                         print "mtu ${mtu}"
 583                         print "mru ${mru}"
 584                         print
 585                 ) >> ${file}
 586         fi
 587
 588         if enabled serial; then
 589                 (
 590                         print "# Serial modem settings"
 591                         print "${serial_device} ${baudrate}"
 592                         print "crtscts"
 593                         print "lock"
 594                         print "modem"
 595                         print
 596                 ) >> ${file}
 597
 598                 # Connect command
 599                 if isset connect_cmd; then
 600                         (
 601                                 print "# Connect command"
 602                                 print "connect \"${connect_cmd}\""
 603                                 print
 604                         ) >> ${file}
 605                 fi
 606         fi
 607
 608         # Default asyncmap.
 609         if enabled default_asyncmap; then
 610                 (
 611                         print "# Use the default asyncmap."
 612                         print "default-asyncmap"
 613                         print
 614                 ) >> ${file}
 615         fi
 616
 617         # LCP settings.
 618         (
 619                 print "# LCP settings"
 620                 print "lcp-echo-failure ${lcp_echo_failure}"
 621                 print "lcp-echo-interval ${lcp_echo_interval}"
 622                 print
 623         ) >> ${file}
 624
 625         # Add the default settings.
 626         (
 627                 print "# Disable the compression"
 628                 print "noccp noaccomp nodeflate nopcomp novj novjccomp nobsdcomp nomppe"
 629
 630                 print "noipdefault nodetach debug"
 631         ) >> ${file}
 632
 633         return ${EXIT_OK}
 634 }