ipsec-updown-ipmasq



#! /bin/sh
# default updown script
# Copyright (C) 2000, 2001  D. Hugh Redelmeier, Henry Spencer
# 
# This program is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2 of the License, or (at your
# option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
# 
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
# or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
# for more details.


# This script is a derivative of the one by Hugh Redelmeier and Henry
# Spencer. It uses ipmasq as the firewallscript, and should be used 
# together with some modifications to ipmasq.
#
# It is modified by Jonas Smedegaard <jonas@jones.dk>, and Juri Jensen
# <juri@xenux.dk>.
# 
# Features:
#
# * Dynamic creation of firewall rules to RW connections
# * Setup of proper source address makes it possible to ping from the
#   SGW itself to a remote subnet, without a separate tunnel. Remember
#   to change the reference of a 10.0.x.x network below to the IP range
#   you're using!
#
# RCSID $Id: ipsec-updown-ipmasq,v 1.3 2006-07-16 12:34:00 jonas Exp $


# CAUTION:  Installing a new version of FreeS/WAN will install a new
# copy of this script, wiping out any custom changes you make.  If
# you need changes, make a copy of this under another name, and customize
# that, and use the (left/right)updown parameters in ipsec.conf to make
# FreeS/WAN use yours instead of this default one.


# check interface version
case "$PLUTO_VERSION" in
1.[0])  # Older Pluto?!?  Play it safe, script may be using new features.
    echo "$0: obsolete interface version \`$PLUTO_VERSION'," >&2
    echo "$0:   called by obsolete Pluto?" >&2
    exit 2
    ;;
1.*)    ;;
*)  echo "$0: unknown interface version \`$PLUTO_VERSION'" >&2
    exit 2
    ;;
esac

# check parameter(s)
case "$1:$*" in
':')            # no parameters
    ;;
ipfwadm:ipfwadm)    # due to (left/right)firewall; for default script only
    ;;
custom:*)       # custom parameters (see above CAUTION comment)
    ;;
*)  echo "$0: unknown parameters \`$*'" >&2
    exit 2
    ;;
esac

# utility functions for route manipulation
# Meddling with this stuff should not be necessary and requires great care.
uproute() {
    doroute add
}
downroute() {
    doroute del
}
doroute() {
    parms="-net $PLUTO_PEER_CLIENT_NET netmask $PLUTO_PEER_CLIENT_MASK"
    parms2="dev $PLUTO_INTERFACE gw $PLUTO_NEXT_HOP"
    case "$PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK" in
    "0.0.0.0/0.0.0.0")
        # horrible kludge for obscure routing bug with opportunistic
        it="route $1 -net 0.0.0.0 netmask 128.0.0.0 $parms2 &&"
        it="$it route $1 -net 128.0.0.0 netmask 128.0.0.0 $parms2"
        route $1 -net 0.0.0.0 netmask 128.0.0.0 $parms2 &&
            route $1 -net 128.0.0.0 netmask 128.0.0.0 $parms2
        ;;
    *)  it="route $1 $parms $parms2"
        route $1 $parms $parms2
        ;;
    esac
    st=$?
    src="`ifconfig | egrep "^[[:space:]]*inet addr:10\.0\." | cut -f2 -d: | cut -f1 -d' ' | head -n 1`"
    if test "$src" ; then
        ip ro ls | egrep "^10\.0\..* dev ipsec" | egrep -v " src " |
            while read ; do
                ip ro change $REPLY src $src
            done
    fi
    if test $st -ne 0
    then
        # route has already given its own cryptic message
        echo "$0: \`$it' failed" >&2
        if test " $1 $st" = " add 7"
        then
            # another totally undocumented interface -- 7 and
            # "SIOCADDRT: Network is unreachable" means that
            # the gateway isn't reachable.
            echo "$0: (incorrect or missing nexthop setting??)" >&2
        fi
    fi
    return $st
}


# the big choice
case "$PLUTO_VERB:$1" in
prepare-host:*|prepare-client:*)
    # delete possibly-existing route (preliminary to adding a route)
    case "$PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK" in
    "0.0.0.0/0.0.0.0")
        # horrible kludge for obscure routing bug with opportunistic
        parms1="-net 0.0.0.0 netmask 128.0.0.0"
        parms2="-net 128.0.0.0 netmask 128.0.0.0"
        it="route del $parms1 2>&1 ; route del $parms2 2>&1"
        oops="`route del $parms1 2>&1 ; route del $parms2 2>&1`"
        ;;
    *)
        parms="-net $PLUTO_PEER_CLIENT_NET netmask $PLUTO_PEER_CLIENT_MASK"
        it="route del $parms 2>&1"
        oops="`route del $parms 2>&1`"
        ;;
    esac
    status="$?"
    if test " $oops" = " " -a " $status" != " 0"
    then
        oops="silent error, exit status $status"
    fi
    case "$oops" in
    'SIOCDELRT: No such process'*)
        # This is what route (currently -- not documented!) gives
        # for "could not find such a route".
        oops=
        status=0
        ;;
    esac
    if test " $oops" != " " -o " $status" != " 0"
    then
        echo "$0: \`$it' failed ($oops)" >&2
    fi
    exit $status
    ;;
route-host:*|route-client:*)
    # connection to me or my client subnet being routed
    uproute
    ;;
unroute-host:*|unroute-client:*)
    # connection to me or my client subnet being unrouted
    downroute
    ;;
up-host:*)
    # connection to me coming up
    # If you are doing a custom version, firewall commands go here.
    /usr/sbin/ipmasq
    ;;
down-host:*)
    # connection to me going down
    # If you are doing a custom version, firewall commands go here.
    /usr/sbin/ipmasq
    ;;
up-client:)
    # connection to my client subnet coming up
    # If you are doing a custom version, firewall commands go here.
    /usr/sbin/ipmasq
    ;;
down-client:)
    # connection to my client subnet going down
    # If you are doing a custom version, firewall commands go here.
    /usr/sbin/ipmasq
    ;;
up-client:ipfwadm)
    # connection to client subnet, with (left/right)firewall=yes, coming up
    # This is used only by the default updown script, not by your custom
    # ones, so do not mess with it; see CAUTION comment up at top.
    ipfwadm -F -i accept -b -S $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \
        -D $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK
    ;;
down-client:ipfwadm)
    # connection to client subnet, with (left/right)firewall=yes, going down
    # This is used only by the default updown script, not by your custom
    # ones, so do not mess with it; see CAUTION comment up at top.
    ipfwadm -F -d accept -b -S $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \
        -D $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK
    ;;
*)  echo "$0: unknown verb \`$PLUTO_VERB' or parameter \`$1'" >&2
    exit 1
    ;;
esac