firewall: Add global ICMP filter table.

[people/stevee/network.git] / functions.route

diff --git a/functions.route b/functions.route
index 8cac6ed1e5acc23d05d18a1f466dbeb0c0212347..d72a1071ef017607bf2d5afb5defa73057b6e2db 100644 (file)
--- a/functions.route
+++ b/functions.route
@@ -40,6 +40,15 @@ function route_add() {
                        --unreachable)
                                unreachable="true"
                                ;;
+                       --prohibit)
+                               prohibit="true"
+                               ;;
+                       --blackhole)
+                               blackhole="true"
+                               ;;
+                       --mtu=*)
+                               mtu=$(cli_get_val ${1})
+                               ;;
                        *)
                                network=${1}
                                ;;
@@ -60,13 +69,23 @@ function route_add() {
        fi
 
        # Check if gateway and unreachable are both enabled.
-       if isset gateway && enabled unreachable; then
-               error "You cannot use both, --gateway=${gateway} and --unreachable at the same time."
-               return ${EXIT_ERROR}
-       fi
-
-       # Check if network and gateway IP protocol version match.
        if isset gateway; then
+               if enabled unreachable; then
+                       error "You cannot use both, --gateway=${gateway} and --unreachable at the same time."
+                       return ${EXIT_ERROR}
+               fi
+
+               if enabled prohibit; then
+                       error "You cannot use both, --gateway=${gateway} and --prohibit at the same time."
+                       return ${EXIT_ERROR}
+               fi
+
+               if enabled blackhole; then
+                       error "You cannot use both, --gateway=${gateway} and --blackhole at the same time."
+                       return ${EXIT_ERROR}
+               fi
+
+               # Check if network and gateway IP protocol version match.
                if ! ip_is_valid ${gateway}; then
                        error "--gateway= is not a valid IP address."
                        return ${EXIT_ERROR}
@@ -79,6 +98,18 @@ function route_add() {
                        error "The IP protocol version of the given network and gateway did not match."
                        return ${EXIT_ERROR}
                fi
+
+       else
+               local counter=$(list_count true ${unreachable} ${prohibit} ${blackhole})
+               if [ ${counter} -gt 1 ]; then
+                       error "You can only use one of --unreachable, --prohibit or --blackhole."
+                       return ${EXIT_ERROR}
+               fi
+       fi
+
+       if isset mtu && ! isinteger mtu; then
+               error "MTU must be an integer number: ${mtu}"
+               return ${EXIT_ERROR}
        fi
 
        local line
@@ -90,8 +121,17 @@ function route_add() {
        fi
 
        # Add unreachable to configuration entry when it is set.
-       if enabled unreachable; then
-               list_append line "unreachable=\"true\""
+       local arg
+       for arg in unreachable prohibit blackhole; do
+               if enabled ${arg}; then
+                       list_append line "${arg}=\"true\""
+                       break
+               fi
+       done
+
+       # Add MTU (if set).
+       if isset mtu; then
+               list_append line "mtu=\"${mtu}\""
        fi
 
        # Write line to file.
@@ -153,8 +193,8 @@ function route_list() {
                return ${EXIT_OK}
        fi
 
-       local format="%-40s %-20s"
-       print "${format}" "NETWORK/HOST" "GATEWAY"
+       local format="%-40s %-20s %-4s"
+       print "${format}" "NETWORK/HOST" "GATEWAY" "MTU"
 
        local ${NETWORK_CONFIG_ROUTES_PARAMS}
        local line
@@ -162,9 +202,13 @@ function route_list() {
                route_parse_line ${line}
                [ $? -eq ${EXIT_OK} ] || continue
 
-               if enabled unreachable; then
-                       gateway="<unreachable>"
-               fi
+               local arg
+               for arg in unreachable prohibit blackhole; do
+                       if enabled ${arg}; then
+                               gateway="<${arg}>"
+                               break
+                       fi
+               done
 
                # Filter all entries with a wrong protocol.
                if isset protocol; then
@@ -172,7 +216,12 @@ function route_list() {
                        [ "${protocol}" = "${proto}" ] || continue
                fi
 
-               print "${format}" "${network}" "${gateway}"
+               # Print something when no MTU was set.
+               if ! isset mtu; then
+                       mtu="-"
+               fi
+
+               print "${format}" "${network}" "${gateway}" "${mtu}"
        done < ${NETWORK_CONFIG_ROUTES}
 }
 
@@ -213,6 +262,15 @@ function route_parse_line() {
                        unreachable=*)
                                unreachable=$(cli_get_val ${arg})
                                ;;
+                       prohibit=*)
+                               prohibit=$(cli_get_val ${arg})
+                               ;;
+                       blackhole=*)
+                               blackhole=$(cli_get_val ${arg})
+                               ;;
+                       mtu=*)
+                               mtu=$(cli_get_val ${arg})
+                               ;;
                esac
        done <<< "$(args $@)"
 
@@ -232,8 +290,14 @@ function route_parse_line() {
                # Must be a valid IP address.
                ip_is_valid ${gateway} || return ${EXIT_ERROR}
        else
-               # Either gateway or unreachable must be set.
-               isset unreachable || return ${EXIT_ERROR}
+               # Check if exactly one of unreachable, prohibit or blackhole is set.
+               local counter=$(list_count true ${unreachable} ${prohibit} ${blackhole})
+               [ ${counter} -eq 1 ] || return ${EXIT_ERROR}
+       fi
+
+       # mtu must be an integer number.
+       if isset mtu; then
+               isinteger mtu || return ${EXIT_ERROR}
        fi
 
        return ${EXIT_OK}
@@ -243,6 +307,8 @@ function route_apply() {
        local table="static"
        local type
 
+       log INFO "Applying static routes..."
+
        # Flush the routing table.
        route_table_flush ${table}
 
@@ -253,13 +319,17 @@ function route_apply() {
                [ $? -eq ${EXIT_OK} ] || continue
 
                type="unicast"
-               if enabled unreachable; then
-                       type="unreachable"
-               fi
+               local arg
+               for arg in unreachable prohibit blackhole; do
+                       if enabled ${arg}; then
+                               type="${arg}"
+                               break
+                       fi
+               done
 
                # Add the route.
                route_entry_add ${network} --table="static" --proto="static" \
-                       --type="${type}" --gateway="${gateway}"
+                       --type="${type}" --gateway="${gateway}" --mtu="${mtu}"
                local ret=$?
 
                if [ ${ret} -ne ${EXIT_OK} ]; then
@@ -277,6 +347,7 @@ function route_entry_add() {
        local proto
        local table
        local type="unicast"
+       local mtu
 
        local command
 
@@ -294,6 +365,9 @@ function route_entry_add() {
                        --proto=*)
                                proto=$(cli_get_val ${1})
                                ;;
+                       --mtu=*)
+                               mtu=$(cli_get_val ${1})
+                               ;;
                        *)
                                if isset network; then
                                        warning "Unrecognized argument: ${1}"
@@ -308,6 +382,9 @@ function route_entry_add() {
        # Validate input.
        assert isoneof type unicast broadcast unreachable prohibit blackhole
        assert ip_is_network ${network}
+       if isset mtu; then
+               assert isinteger mtu
+       fi
 
        # Detect the protocol of the given network.
        local protocol=$(ip_detect_protocol ${network})
@@ -347,7 +424,12 @@ function route_entry_add() {
                list_append command "proto ${proto}"
        fi
 
-       cmd "${command}"
+       # Add MTU.
+       if isset mtu; then
+               list_append command "mtu ${mtu}"
+       fi
+
+       cmd_quiet "${command}"
 }
 
 function route_table_create() {