webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-17 14:33:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

Padlock und DMA Patch fuer die VIA Boards hinzugefuegt.

Browse Source 
Ausgehende Firewall-Script gefixt.
IMQ wieder im Kernel aktiviert. Leider nicht fuer XEN.
VPN-Watch aktualisiert - noch nicht getestet.
IPSec sollte nun auch funzen.


git-svn-id: http://svn.ipfire.org/svn/ipfire/trunk@620 ea5c0bd1-69bd-2848-81d8-4f18e57aeed8
This commit is contained in:
ms
2007-06-09 20:43:13 +00:00
parent 621b327e2c
commit 2b0b368950
11 changed files with 3204 additions and 162 deletions
Download Patch File Download Diff File Expand all files Collapse all files

368
src/scripts/vpn-watch
View File

@@ -1,171 +1,239 @@
#!/bin/sh
#
# IPFire script - vpn-watch
#
# This code is distributed under the terms of the GPL
#
# (c) Daniel Berlin <daniel berlin_itechnology de> - Check for
# remote peer with dynamic IPs and restart when change
# is detected. Works with DPD which is not perfect!
#
# 2006: Franck - adapted original script to fit in IPCop 1.4
# 2007: Michael Tremer - mitch@ipfire.org - Merged into IPFire
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
#!/bin/sh
##################################################
##### VPN-Watch.sh Version 1.6.3 #####
##################################################
#
# Configuration
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
VPN_CONFIG='/var/ipfire/vpn/config' # Location of IPFire's vpn configuration file
SETTINGS='/var/ipfire/vpn/settings' # and settings
# Written by: Daniel Berlin <daniel.berlin@itechnology.de>.
# Download: http://www.itechnology.de/front_content.php?idcat=87
#
CHECK_INTERVAL='60' # Check this often (in seconds)
DNS_RESOLVE_TRIES='4' # Try to resolve IPs this often (each try takes max. 2 seconds)
NICENESS='+5' # Adjust niceness of child processes: '-20' ... '+19'; '0' is default
case "$1" in
'start' | '--start')
eval $(/usr/local/bin/readhash $SETTINGS)
test "${VPN_WATCH}" != "on" && exit 1 # not activated, cannot start!
# changed by: R<>diger Sobeck
# last changed: 31-01-2006
if test ! -r "$VPN_CONFIG"; then
echo 'Error: cannot read IPFire VPN configuration file; exit.' >&2
exit 1
fi
# Configuration
#
CHECK_INTERVAL='120' # Check this often (in seconds)
DNS_RESOLVE_TRIES='3' # Try to resolve IPs this often (each try takes max. 2 seconds)
NICENESS='+5' # Adjust niceness of child processes: '-20' ... '+19'; '0' is default
ipfire_VPN_CONFIG='/var/ipfire/vpn/config' # Location of ipfire's vpn configuration file
ipfire_VPN_SETTINGS='/var/ipfire/vpn/settings' # Location of ipfire's vpn settings file
VERSION='1.6.3'
if /usr/bin/test -p /var/run/$(basename $0); then
if ps --no-heading axw | grep -v 'grep' | grep -q "$(basename $0) conn: "; then
echo "Error: use '$(basename $0) stop' please; exit." >&2
exit 1
else
rm /var/run/$(basename $0) # pipe was left alone, correct error condition
fi
fi
# Workaround for nonexistent "nl" command on ipfire 1.4.x
nl --help >/dev/null 2>&1
if test $? -ne 0; then
alias nl='cat'
fi
# the pipe serves for "-status" but is not used yet
/bin/mknod -m 0660 "/var/run/$(basename $0)" p >/dev/null 2>&1 # Create pipe for status-information
MyHost=`grep VPN_IP /var/ipfire/vpn/settings | cut --delimiter='=' --output-delimiter=' ' -f2`
MyIP=`cat /var/ipfire/red/local-ipaddress`
MyDynDnsIP=`ping -c 1 "$1" 2>/dev/null | head -n1 | awk '{print $3}' | tr -d '()' | tr -d ':'`
#
# Read VPN configuration and fork a child process for each VPN connection active, net-to-net & RED
#
while read line; do
VPN=($(echo $line | cut --delimiter=',' --output-delimiter=' ' -f2,3,5,12,28 )) # Activated, Name, Host/Net-to-net, Remote, ITF.
test "${VPN[0]}" != "on" && continue # Ignore: deactivated connections
test "${VPN[2]}" = "host" && continue # Ignore: roadwarriors
## test "${VPN[4]}" != "RED" && continue # Ignore: local vpns needed or not ?
echo -n "${VPN[3]}" | grep -q '^[[:digit:]\.]\+$' && continue #If fixed remote IP, no need to watch!
$0 'conn:' "${VPN[1]}" "${VPN[3]}">/dev/null 2>&1 & #Fork child process (parameters: "conn: NAME RIGHT")
done < "$VPN_CONFIG"
exit 0 # Parent dies here... RIP
;;
case "$1" in
'start' | '--start')
if test ! -r "$ipfire_VPN_CONFIG"; then
echo 'Error: cannot read ipfire VPN configuration file; exit.' >&2
exit 1
fi
'stop' | '--stop')
# Terminate processes
for proc in $(pidof -x -o %PPID $(basename $0)); do
kill -s SIGTERM -- "$proc"
done
sleep 1
mknod -m 0660 "/var/run/$(basename $0)" p >/dev/null 2>&1 # Create pipe for status-information
# Kill remaining processes
for proc in $(/bin/pidof -x -o %PPID $(basename $0)); do
kill -s SIGKILL -- "$proc"
done
rm -f "/var/run/$(basename $0)" # Remove pipe
exit 0
;;
# Read VPN configuration and fork a child process for each VPN connection
#
while read line; do
VPN=($(echo $line | cut --delimiter=',' --output-delimiter=' ' -f1,2,3,5,6,12)) #
CONNR=${VPN[0]} # connection number
CONACTIVE=${VPN[1]} # active (on|off)
CONNAME=${VPN[2]} # connection name
CONTYPE=${VPN[3]} # connection type (host|net)
CONCERTPSK=${VPN[4]} # key type (cert|psk)
CONDNSNAME=${VPN[5]} # FQDN name of other side
echo -n "${CONACTIVE}" | grep -qi '^off$' && continue # Ignore: deactivated connections
echo -n "${CONTYPE}" | grep -qi '^host$' && continue # Ignore: Roadwarriors (->DPD)
# echo -n "${VPN[1]}${MyHost}" | grep -q '^[[:digit:]\.]\+$' && continue # Ignore: "left" and "right" side set to an IP
#'status' | '--status')
# echo "VPN-Watch"
# if ps --no-heading axw | grep -v 'grep' | grep -q "$(basename $0) conn: "; then
# trap '' USR1
# killall -q -g -s USR1 -- $(basename $0)
# sleep 1
# cat "/var/run/$(basename $0)" | sort # Read children's info from pipe
# else
# echo ' no instance running.'
# fi
# exit 0
# ;;
$0 'conn:' "${CONNAME}" "${MyHost}" "${CONDNSNAME}" "${CONNR}" >/dev/null 2>&1 & # Fork child process (parameters: "conn: NAME LEFT RIGHT NUMBER")
echo -n 'S'
done < "$ipfire_VPN_CONFIG"
echo <20>"<22>Starte VPN-Watch"
exit 0 # Parent dies here... RIP
;;
'stop' | '--stop')
# Terminate processes
for proc in $(pidof -x -o %PPID $(basename $0)); do
kill -15 $proc
echo -n 'T'
done
sleep 1
# Kill remaining processes
for proc in $(pidof -x -o %PPID $(basename $0)); do
kill -9 $proc
echo -n 'K'
done
rm -f "/var/run/$(basename $0)" # Remove pipe
echo "Stoppe VPN-Watch"
exit 0
;;
'restart' | '--restart')
$0 stop
$0 start
exit 0
;;
'status' | '--status')
echo "VPN-Watch ${VERSION} (mail: daniel@itechnology.de, web: www.itechnology.de/vpn-watch)"
if ps --no-heading axw | grep -v 'grep' | grep -q "$(basename $0) conn: "; then
trap '' USR1
killall -q -g -s USR1 -- $(basename $0)
sleep 1
cat "/var/run/$(basename $0)" | sort | nl # Read children's info from pipe
else
echo ' no instances running.'
fi
exit 0
;;
'conn:')
# Children proceed here...
renice ${NICENESS:-0} -p $$ >/dev/null 2>&1 # Adjust niceness
shift # Remove the first positional parameter ("conn:"), as we don't need it anymore
;;
*)
echo "Usage: $0 { start | stop | restart | status }" >&2
exit 1
;;
esac
'conn:')
# Children proceed here...
renice ${NICENESS:-0} -p $$ >/dev/null 2>&1 # Adjust niceness
shift # Remove the first positional parameter ("conn:"), as we don't need it anymore
;;
*)
/bin/echo "Usage: $0 { start | stop }" >&2
exit 1
;;
esac
# Logging, signal handlers
#
alias log="logger -t '$(basename $0 | cut -d '.' -f 1) ${VERSION}' \(${1}\)"
trap 'log "terminated after ${RESTART_COUNT} restarts."' EXIT
trap 'echo "connection \"${1}\" restarted ${RESTART_COUNT} times" >>/var/run/$(basename $0)' USR1
# Logging, signal handlers
alias log="logger -t vpn-watch \'${1}\':"
log "started"
trap 'log "terminated after ${RESTART_COUNT} restarts."' EXIT
#trap 'echo "connection \"${1}\" restarted ${RESTART_COUNT} times" >>/var/run/$(basename $0)' USR1
# Get IP of a FQDN... using 'arp', 'traceroute' or 'ping',
# because ipfire has no 'nslookup', 'host' or 'dig' command.
#
function get_ip () {
local RESULT=''
for ((i=1; ${i} <= ${DNS_RESOLVE_TRIES}; i++)); do
if which arp >/dev/null 2>&1; then
RESULT=$(arp "$1" 2>/dev/null | awk '{ print $2 }' | tr -d '()')
elif which traceroute >/dev/null 2>&1; then
RESULT=$(traceroute -m1 -q1 "$1" 2>/dev/null | head -n1 | awk '{ print $4 }' | tr -d '(),')
else
RESULT=$(ping -c 1 "$1" 2>/dev/null | head -n1 | awk '{print $3}' | tr -d '()' | tr -d ':')
fi
test -n "$RESULT" && break
done
test -z "$RESULT" && log "Warning: could not resolve ${1} after ${DNS_RESOLVE_TRIES} tries..."
echo -n "$RESULT"
}
#
# Get IP of a FQDN... using 'host' command. Everything is ok when dns server responds.
# If no response,
# -maybe RED is down. The script can terminate. It will restart with rc.updatered.
# or
# -the dns server is down. In this case, terminate the script is not a good idea...
# Thus 4 retries before returning response 'stop'
#
function get_ip () {
local RESULT=''
# delay divided by two for each loop
delay=8
for ((i=1; ${i} <= ${DNS_RESOLVE_TRIES}; i++)); do
function get_tunnelip () {
file=/var/tmp/$1.remoteip
local TRESULT=''
TVPN=`grep "$1" /var/ipfire/vpn/config| awk 'BEGIN{FS=","}{print $2}'`
DYNHOST=`grep "$1" /var/ipfire/vpn/config| awk 'BEGIN{FS=","}{print $12}'`
CONNR=`grep "$1" /var/ipfire/vpn/config| awk 'BEGIN{FS=","}{print $1}'`
REMOTEIP=`/usr/bin/ping -c 1 "$DYNHOST" 2>/dev/null | head -n1 | awk '{print $3}' | tr -d '()' | tr -d ':'`
if ! test -f $file; then
cat $REMOTEIP > $file
fi
OLDIP=`cat $file`
TUNIP=`ipsec whack --status | grep "$1"`
if [ "$TUNIP" != "" ]; then
TUNIP=`ipsec whack --status | grep "$1" | awk 'BEGIN{FS="["}{print $2}' | awk 'BEGIN{FS="---"}{print $3}'`
log "currently used tunnel IP = $TUNIP, current remote IP = $REMOTEIP"
echo $REMOTEIP > $file
TRESULT=${TUNIP}
fi
# extract IP address
RESULT=$(/usr/bin/host "$1" 2>/dev/null| awk '{ print $4 }')
if echo -n $RESULT | /bin/grep -q '^[[:digit:]\.]\+$' ; then
echo -n $RESULT
return
fi
test -n "$TRESULT" && break
test -z "$TRESULT" && log "Warning: could not retrieve last used VPN tunnel IP..."
echo -n "$TRESULT"
}
sleep $delay
delay=$((delay>>1))
done
# Change 'stop' to something else to let the script running
echo -n "stop" # stop: the script will terminate
# Restarts a VPN connection
#
function restart_vpn () {
if test -x /usr/local/bin/ipsecctrl; then
/usr/local/bin/ipsecctrl D "$1" # This works for ipfire 1.4.x
/usr/local/bin/ipsecctrl R # re-read secrets
/usr/local/bin/ipsecctrl S "$1" # start tunnel
else
ipsec auto --down "$1" # This works for ipfire 1.3.x
ipsec auto --unroute "$1"
ipsec auto --delete "$1"
ipsec auto --rereadall
ipsec auto --add "$1"
ipsec auto --route "$1"
ipsec auto --up "$1"
fi
}
}
# Get left and right IP
#
LEFT_IP_OLD=$MyIP
RIGHT_IP_OLD=$(get_ip $3)
# Infinite loop; checks, whether the IP of FQDN has changed.
# If so, the affected connection gets restarted.
#
RESTART_COUNT=0
REMOTE_IP_OLD=$(get_ip $2)
log "start watching $REMOTE_IP_OLD"
# Infinite loop; checks, whether the IP of a left or right FQDN has changed.
# If so, the affected connection gets restarted; this is logged to syslog.
#
RESTART_COUNT=0
while :; do
sleep $CHECK_INTERVAL
while [ $REMOTE_IP_OLD != 'stop' ] ; do
sleep $CHECK_INTERVAL
# Skip check until IPSec is running. Update IP_OLD while our ipsec is down
/usr/sbin/ipsec auto --status >/dev/null 2>&1 || {
REMOTE_IP_OLD=$(get_ip $2)
continue
}
# Skip check until IPSec is running
ipsec auto --status >/dev/null 2>&1 || continue
REMOTE_IP_NEW=$(get_ip $2)
# get own IP (may have changed)
ThisHostIP=`cat /var/ipfire/red/local-ipaddress`
# this our own IP as reported in /var/ipfire/ppp/local-ipadress
LEFT_IP_NEW=$ThisHostIP
# check our own DYNDNS IP
LEFT_IP_DYN=$(get_ip $MyHost)
# this is DYNDNS IP of other side
RIGHT_IP_NEW=$(get_ip $3)
# this the last used (right) IP for VPN-Tunnel
RIGHT_TUN_IP_OLD=$(get_tunnelip $1)
# for whatever reason, ipsec did not notice our own IP has changed for this connection
if [ "${LEFT_IP_NEW}" != "${LEFT_IP_DYN}" ]; then
restart_vpn "$4"
let RESTART_COUNT++
log "Red IP = $LEFT_IP_NEW, IP by DynDNS = $LEFT_IP_DYN"
log 'incorrect dynamic IP in tunnel used: restarting connection...'
fi
# left or right IP has changed...
if test "${LEFT_IP_OLD} ${RIGHT_IP_OLD}" != "${LEFT_IP_NEW} ${RIGHT_IP_NEW}"; then
restart_vpn "$4"
let RESTART_COUNT++
log 'left or right IP has changed: restarting connection...'
fi
# right IP / IP of tunnel endpoint has changed...
if [ "$RIGHT_TUN_IP_OLD" != "" ]; then
if test "${RIGHT_TUN_IP_OLD}" != "${RIGHT_IP_NEW}"; then
restart_vpn "$4"
let RESTART_COUNT++
log 'VPN tunnel IP has changed: restarting connection...'
fi
fi
LEFT_IP_OLD=$LEFT_IP_NEW
RIGHT_IP_OLD=$RIGHT_IP_NEW
done
if test "${REMOTE_IP_OLD}" != "${REMOTE_IP_NEW}"; then
/usr/sbin/ipsec auto --down $1
/usr/sbin/ipsec auto --replace $1
/usr/sbin/ipsec auto --rereadsecrets
/usr/sbin/ipsec auto --up $1
let RESTART_COUNT++
log "Remote IP has changed from $REMOTE_IP_OLD to $REMOTE_IP_NEW. Connection restarted (#$RESTART_COUNT times)."
REMOTE_IP_OLD=$REMOTE_IP_NEW
fi
done