programs/_updown/_updown.in

   1 #! /bin/sh
   2 # iproute2 version, default updown script
   3 #
   4 # Copyright (C) 2003-2004 Nigel Meteringham
   5 # Copyright (C) 2003-2004 Tuomo Soini
   6 # Copyright (C) 2002-2004 Michael Richardson
   7 # Copyright (C) 2005-2006 Andreas Steffen <andreas.steffen@strongswan.org>
   8 #
   9 # This program is free software; you can redistribute it and/or modify it
  10 # under the terms of the GNU General Public License as published by the
  11 # Free Software Foundation; either version 2 of the License, or (at your
  12 # option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  13 #
  14 # This program is distributed in the hope that it will be useful, but
  15 # WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  16 # or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  17 # for more details.
  18 #
  19 # RCSID $Id: _updown.in,v 1.2 2006/04/17 15:06:29 as Exp $
  20
  21 # CAUTION:  Installing a new version of strongSwan will install a new
  22 # copy of this script, wiping out any custom changes you make.  If
  23 # you need changes, make a copy of this under another name, and customize
  24 # that, and use the (left/right)updown parameters in ipsec.conf to make
  25 # strongSwan use yours instead of this default one.
  26
  27 # things that this script gets (from ipsec_pluto(8) man page)
  28 #
  29 #      PLUTO_VERSION
  30 #              indicates  what  version of this interface is being
  31 #              used.  This document describes version  1.1.   This
  32 #              is upwardly compatible with version 1.0.
  33 #
  34 #       PLUTO_VERB
  35 #              specifies the name of the operation to be performed
  36 #              (prepare-host, prepare-client, up-host, up-client,
  37 #              down-host, or down-client).  If the address family
  38 #              for security gateway to security gateway communica
  39 #              tions is IPv6, then a suffix of -v6 is added to the
  40 #              verb.
  41 #
  42 #       PLUTO_CONNECTION
  43 #              is the name of the  connection  for  which  we  are
  44 #              routing.
  45 #
  46 #       PLUTO_NEXT_HOP
  47 #              is the next hop to which packets bound for the peer
  48 #              must be sent.
  49 #
  50 #       PLUTO_INTERFACE
  51 #              is the name of the ipsec interface to be used.
  52 #
  53 #       PLUTO_REQID
  54 #              is the requid of the ESP policy
  55 #
  56 #       PLUTO_ME
  57 #              is the IP address of our host.
  58 #
  59 #       PLUTO_MY_ID
  60 #              is the ID of our host.
  61 #
  62 #       PLUTO_MY_CLIENT
  63 #              is the IP address / count of our client subnet.  If
  64 #              the  client  is  just  the  host,  this will be the
  65 #              host's own IP address / max (where max  is  32  for
  66 #              IPv4 and 128 for IPv6).
  67 #
  68 #       PLUTO_MY_CLIENT_NET
  69 #              is the IP address of our client net.  If the client
  70 #              is just the host, this will be the  host's  own  IP
  71 #              address.
  72 #
  73 #       PLUTO_MY_CLIENT_MASK
  74 #              is  the  mask for our client net.  If the client is
  75 #              just the host, this will be 255.255.255.255.
  76 #
  77 #       PLUTO_MY_SOURCEIP
  78 #              if non-empty, then the source address for the route will be
  79 #              set to this IP address.
  80 #
  81 #       PLUTO_MY_PROTOCOL
  82 #              is the IP protocol that will be transported.
  83 #
  84 #       PLUTO_MY_PORT
  85 #              is  the  UDP/TCP  port  to  which  the IPsec SA  is
  86 #              restricted on our side.
  87 #
  88 #       PLUTO_PEER
  89 #              is the IP address of our peer.
  90 #
  91 #       PLUTO_PEER_ID
  92 #              is the ID of our peer.
  93 #
  94 #       PLUTO_PEER_CA
  95 #              is the CA which issued the cert of our peer.
  96 #
  97 #       PLUTO_PEER_CLIENT
  98 #              is the IP address / count of the peer's client sub
  99 #              net.   If the client is just the peer, this will be
 100 #              the peer's own IP address / max (where  max  is  32
 101 #              for IPv4 and 128 for IPv6).
 102 #
 103 #       PLUTO_PEER_CLIENT_NET
 104 #              is the IP address of the peer's client net.  If the
 105 #              client is just the peer, this will  be  the  peer's
 106 #              own IP address.
 107 #
 108 #       PLUTO_PEER_CLIENT_MASK
 109 #              is  the  mask  for  the  peer's client net.  If the
 110 #              client   is   just   the   peer,   this   will   be
 111 #              255.255.255.255.
 112 #
 113 #       PLUTO_PEER_PROTOCOL
 114 #              is the IP protocol that will be transported.
 115 #
 116 #       PLUTO_PEER_PORT
 117 #              is  the  UDP/TCP  port  to  which  the IPsec SA  is
 118 #              restricted on the peer side.
 119 #
 120
 121 # uncomment to log VPN connections
 122 VPN_LOGGING=1
 123 #
 124 # tag put in front of each log entry:
 125 TAG=vpn
 126 #
 127 # syslog facility and priority used:
 128 FAC_PRIO=local0.notice
 129 #
 130 # to create a special vpn logging file, put the following line into
 131 # the syslog configuration file /etc/syslog.conf:
 132 #
 133 # local0.notice                   -/var/log/vpn
 134 #
 135
 136 # check interface version
 137 case "$PLUTO_VERSION" in
 138 1.[0|1])        # Older Pluto?!?  Play it safe, script may be using new features.
 139         echo "$0: obsolete interface version \`$PLUTO_VERSION'," >&2
 140         echo "$0:       called by obsolete Pluto?" >&2
 141         exit 2
 142         ;;
 143 1.*)    ;;
 144 *)      echo "$0: unknown interface version \`$PLUTO_VERSION'" >&2
 145         exit 2
 146         ;;
 147 esac
 148
 149 # check parameter(s)
 150 case "$1:$*" in
 151 ':')                    # no parameters
 152         ;;
 153 iptables:iptables)      # due to (left/right)firewall; for default script only
 154         ;;
 155 custom:*)               # custom parameters (see above CAUTION comment)
 156         ;;
 157 *)      echo "$0: unknown parameters \`$*'" >&2
 158         exit 2
 159         ;;
 160 esac
 161
 162 # utility functions for route manipulation
 163 # Meddling with this stuff should not be necessary and requires great care.
 164 uproute() {
 165         doroute add
 166         ip route flush cache
 167 }
 168 downroute() {
 169         doroute delete
 170         ip route flush cache
 171 }
 172
 173 addsource() {
 174         st=0
 175         if ! ip -o route get ${PLUTO_MY_SOURCEIP%/*} | grep -q ^local
 176         then
 177             it="ip addr add ${PLUTO_MY_SOURCEIP%/*}/32 dev $PLUTO_INTERFACE"
 178             oops="`eval $it 2>&1`"
 179             st=$?
 180             if test " $oops" = " " -a " $st" != " 0"
 181             then
 182                 oops="silent error, exit status $st"
 183             fi
 184             if test " $oops" != " " -o " $st" != " 0"
 185             then
 186                 echo "$0: addsource \`$it' failed ($oops)" >&2
 187             fi
 188         fi
 189         return $st
 190 }
 191
 192 doroute() {
 193         st=0
 194         parms="$PLUTO_PEER_CLIENT"
 195
 196         parms2=
 197         if [ -n "$PLUTO_NEXT_HOP" ]
 198         then
 199            parms2="via $PLUTO_NEXT_HOP"
 200         fi
 201         parms2="$parms2 dev $PLUTO_INTERFACE"
 202
 203         if [ -z "$PLUTO_MY_SOURCEIP" ]
 204         then
 205             if [ -f /etc/sysconfig/defaultsource ]
 206             then
 207                 . /etc/sysconfig/defaultsource
 208             fi
 209
 210             if [ -f /etc/conf.d/defaultsource ]
 211             then
 212                 . /etc/conf.d/defaultsource
 213             fi
 214
 215             if [ -n "$DEFAULTSOURCE" ]
 216             then
 217                 PLUTO_MY_SOURCEIP=$DEFAULTSOURCE
 218             fi
 219         fi
 220
 221         parms3=
 222         if test "$1" = "add" -a -n "$PLUTO_MY_SOURCEIP"
 223         then
 224             addsource
 225             parms3="$parms3 src ${PLUTO_MY_SOURCEIP%/*}"
 226         fi
 227
 228         case "$PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK" in
 229         "0.0.0.0/0.0.0.0")
 230                 # opportunistic encryption work around
 231                 # need to provide route that eclipses default, without
 232                 # replacing it.
 233                 it="ip route $1 0.0.0.0/1 $parms2 $parms3 &&
 234                         ip route $1 128.0.0.0/1 $parms2 $parms3"
 235                 ;;
 236         *)      it="ip route $1 $parms $parms2 $parms3"
 237                 ;;
 238         esac
 239         oops="`eval $it 2>&1`"
 240         st=$?
 241         if test " $oops" = " " -a " $st" != " 0"
 242         then
 243             oops="silent error, exit status $st"
 244         fi
 245         if test " $oops" != " " -o " $st" != " 0"
 246         then
 247             echo "$0: doroute \`$it' failed ($oops)" >&2
 248         fi
 249         return $st
 250 }
 251
 252 # in the presence of KLIPS and ipsecN interfaces do not use IPSEC_POLICY
 253 if [ `echo "$PLUTO_INTERFACE" | grep "ipsec"` ]
 254 then
 255         IPSEC_POLICY_IN=""
 256         IPSEC_POLICY_OUT=""
 257 else
 258         IPSEC_POLICY="-m policy --pol ipsec --proto esp --reqid $PLUTO_REQID"
 259         IPSEC_POLICY_IN="$IPSEC_POLICY --dir in"
 260         IPSEC_POLICY_OUT="$IPSEC_POLICY --dir out"
 261 fi
 262
 263 # are there port numbers?
 264 if [ "$PLUTO_MY_PORT" != 0 ]
 265 then
 266         S_MY_PORT="--sport $PLUTO_MY_PORT"
 267         D_MY_PORT="--dport $PLUTO_MY_PORT"
 268 fi
 269 if [ "$PLUTO_PEER_PORT" != 0 ]
 270 then
 271         S_PEER_PORT="--sport $PLUTO_PEER_PORT"
 272         D_PEER_PORT="--dport $PLUTO_PEER_PORT"
 273 fi
 274
 275 # the big choice
 276 case "$PLUTO_VERB:$1" in
 277 prepare-host:*|prepare-client:*)
 278         # delete possibly-existing route (preliminary to adding a route)
 279         case "$PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK" in
 280         "0.0.0.0/0.0.0.0")
 281                 # need to provide route that eclipses default, without
 282                 # replacing it.
 283                 parms1="0.0.0.0/1"
 284                 parms2="128.0.0.0/1"
 285                 it="ip route delete $parms1 2>&1 ; ip route delete $parms2 2>&1"
 286                 oops="`ip route delete $parms1 2>&1 ; ip route delete $parms2 2>&1`"
 287                 ;;
 288         *)
 289                 parms="$PLUTO_PEER_CLIENT"
 290                 it="ip route delete $parms 2>&1"
 291                 oops="`ip route delete $parms 2>&1`"
 292                 ;;
 293         esac
 294         status="$?"
 295         if test " $oops" = " " -a " $status" != " 0"
 296         then
 297                 oops="silent error, exit status $status"
 298         fi
 299         case "$oops" in
 300         *'RTNETLINK answers: No such process'*)
 301                 # This is what route (currently -- not documented!) gives
 302                 # for "could not find such a route".
 303                 oops=
 304                 status=0
 305                 ;;
 306         esac
 307         if test " $oops" != " " -o " $status" != " 0"
 308         then
 309                 echo "$0: \`$it' failed ($oops)" >&2
 310         fi
 311         exit $status
 312         ;;
 313 route-host:*|route-client:*)
 314         # connection to me or my client subnet being routed
 315         uproute
 316         ;;
 317 unroute-host:*|unroute-client:*)
 318         # connection to me or my client subnet being unrouted
 319         downroute
 320         ;;
 321 up-host:)
 322         # connection to me coming up
 323         # If you are doing a custom version, firewall commands go here.
 324         ;;
 325 down-host:)
 326         # connection to me going down
 327         # If you are doing a custom version, firewall commands go here.
 328         ;;
 329 up-client:)
 330         # connection to my client subnet coming up
 331         # If you are doing a custom version, firewall commands go here.
 332         ;;
 333 down-client:)
 334         # connection to my client subnet going down
 335         # If you are doing a custom version, firewall commands go here.
 336         ;;
 337 up-host:iptables)
 338         # connection to me, with (left/right)firewall=yes, coming up
 339         # This is used only by the default updown script, not by your custom
 340         # ones, so do not mess with it; see CAUTION comment up at top.
 341         iptables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
 342             -s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $S_PEER_PORT \
 343             -d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
 344         iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
 345             -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
 346             -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $D_PEER_PORT -j ACCEPT
 347         #
 348         # log IPsec host connection setup
 349         if [ $VPN_LOGGING ]
 350         then
 351           if [ "$PLUTO_PEER_CLIENT" == "$PLUTO_PEER/32" ]
 352           then
 353             logger -t $TAG -p $FAC_PRIO \
 354               "+ `echo -e $PLUTO_PEER_ID` $PLUTO_PEER -- $PLUTO_ME"
 355           else
 356             logger -t $TAG -p $FAC_PRIO \
 357               "+ `echo -e $PLUTO_PEER_ID` $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
 358           fi
 359         fi
 360         ;;
 361 down-host:iptables)
 362         # connection to me, with (left/right)firewall=yes, going down
 363         # This is used only by the default updown script, not by your custom
 364         # ones, so do not mess with it; see CAUTION comment up at top.
 365         iptables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
 366             -s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $S_PEER_PORT \
 367             -d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
 368         iptables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
 369             -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
 370             -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $D_PEER_PORT -j ACCEPT
 371         #
 372         # log IPsec host connection teardown
 373         if [ $VPN_LOGGING ]
 374         then
 375           if [ "$PLUTO_PEER_CLIENT" == "$PLUTO_PEER/32" ]
 376           then
 377             logger -t $TAG -p $FAC_PRIO -- \
 378               "- `echo -e $PLUTO_PEER_ID` $PLUTO_PEER -- $PLUTO_ME"
 379           else
 380             logger -t $TAG -p $FAC_PRIO -- \
 381             "- `echo -e $PLUTO_PEER_ID` $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
 382           fi
 383         fi
 384         ;;
 385 up-client:iptables)
 386         # connection to client subnet, with (left/right)firewall=yes, coming up
 387         # This is used only by the default updown script, not by your custom
 388         # ones, so do not mess with it; see CAUTION comment up at top.
 389         if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/32" ]
 390         then
 391           iptables -I FORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
 392               -s $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK $S_MY_PORT \
 393               -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $D_PEER_PORT \
 394                  $IPSEC_POLICY_OUT -j ACCEPT
 395           iptables -I FORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
 396               -s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $S_PEER_PORT \
 397               -d $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK $D_MY_PORT \
 398                  $IPSEC_POLICY_IN -j ACCEPT
 399         fi
 400         #
 401         # a virtual IP requires an INPUT and OUTPUT rule on the host
 402         # or sometimes host access via the internal IP is needed
 403         if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
 404         then
 405           iptables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
 406               -s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $S_PEER_PORT \
 407               -d $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK $D_MY_PORT \
 408                  $IPSEC_POLICY_IN -j ACCEPT
 409           iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
 410               -s $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK $S_MY_PORT \
 411               -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $D_PEER_PORT \
 412                  $IPSEC_POLICY_OUT -j ACCEPT
 413         fi
 414         #
 415         # log IPsec client connection setup
 416         if [ $VPN_LOGGING ]
 417         then
 418           if [ "$PLUTO_PEER_CLIENT" == "$PLUTO_PEER/32" ]
 419           then
 420             logger -t $TAG -p $FAC_PRIO \
 421               "+ `echo -e $PLUTO_PEER_ID` $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
 422           else
 423             logger -t $TAG -p $FAC_PRIO \
 424               "+ `echo -e $PLUTO_PEER_ID` $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
 425           fi
 426         fi
 427         ;;
 428 down-client:iptables)
 429         # connection to client subnet, with (left/right)firewall=yes, going down
 430         # This is used only by the default updown script, not by your custom
 431         # ones, so do not mess with it; see CAUTION comment up at top.
 432         if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/32" ]
 433         then
 434           iptables -D FORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
 435               -s $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK $S_MY_PORT \
 436               -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $D_PEER_PORT \
 437                  $IPSEC_POLICY_OUT -j ACCEPT
 438           iptables -D FORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
 439               -s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $S_PEER_PORT \
 440               -d $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK $D_MY_PORT \
 441                  $IPSEC_POLICY_IN -j ACCEPT
 442         fi
 443         #
 444         # a virtual IP requires an INPUT and OUTPUT rule on the host
 445         # or sometimes host access via the internal IP is needed
 446         if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
 447         then
 448           iptables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
 449               -s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $S_PEER_PORT \
 450               -d $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK $D_MY_PORT \
 451                  $IPSEC_POLICY_IN -j ACCEPT
 452           iptables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
 453               -s $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK $S_MY_PORT \
 454               -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $D_PEER_PORT \
 455                  $IPSEC_POLICY_OUT -j ACCEPT
 456         fi
 457         #
 458         # log IPsec client connection teardown
 459         if [ $VPN_LOGGING ]
 460         then
 461           if [ "$PLUTO_PEER_CLIENT" == "$PLUTO_PEER/32" ]
 462           then
 463             logger -t $TAG -p $FAC_PRIO -- \
 464               "- `echo -e $PLUTO_PEER_ID` $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
 465           else
 466             logger -t $TAG -p $FAC_PRIO -- \
 467               "- `echo -e $PLUTO_PEER_ID` $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
 468           fi
 469         fi
 470         ;;
 471 #
 472 # IPv6
 473 #
 474 prepare-host-v6:*|prepare-client-v6:*)
 475         ;;
 476 route-host-v6:*|route-client-v6:*)
 477         # connection to me or my client subnet being routed
 478         #uproute_v6
 479         ;;
 480 unroute-host-v6:*|unroute-client-v6:*)
 481         # connection to me or my client subnet being unrouted
 482         #downroute_v6
 483         ;;
 484 up-host-v6:*)
 485         # connection to me coming up
 486         # If you are doing a custom version, firewall commands go here.
 487         ;;
 488 down-host-v6:*)
 489         # connection to me going down
 490         # If you are doing a custom version, firewall commands go here.
 491         ;;
 492 up-client-v6:)
 493         # connection to my client subnet coming up
 494         # If you are doing a custom version, firewall commands go here.
 495         ;;
 496 down-client-v6:)
 497         # connection to my client subnet going down
 498         # If you are doing a custom version, firewall commands go here.
 499         ;;
 500 *)      echo "$0: unknown verb \`$PLUTO_VERB' or parameter \`$1'" >&2
 501         exit 1
 502         ;;
 503 esac