diff options
Diffstat (limited to 'scripts')
| -rwxr-xr-x | scripts/vpn-config.pl | 103 | ||||
| -rwxr-xr-x | scripts/vyatta-vti-config.pl | 146 |
2 files changed, 224 insertions, 25 deletions
diff --git a/scripts/vpn-config.pl b/scripts/vpn-config.pl index 3d104ae..c708724 100755 --- a/scripts/vpn-config.pl +++ b/scripts/vpn-config.pl @@ -401,6 +401,7 @@ if ( $vcVPN->exists('ipsec') ) { . " remote-users configured\n"; } my $prev_peer = ""; + my %marks = (); foreach my $peer (@peers) { my $peer_ike_group = $vcVPN->returnValue("ipsec site-to-site peer $peer ike-group"); @@ -494,37 +495,53 @@ if ( $vcVPN->exists('ipsec') ) { # # Name connection by peer and tunnel # + my $isVti = 0; my @tunnels = $vcVPN->listNodes("ipsec site-to-site peer $peer tunnel"); if ( @tunnels == 0 ) { - vpn_die(["vpn", "ipsec", "site-to-site","peer",$peer,"tunnel"], - "$vpn_cfg_err No tunnels configured for peer \"$peer\". At least" - . " one tunnel required per peer.\n"); + # + # Check if this is VTI + # + if ($vcVPN->exists("ipsec site-to-site peer $peer vti") ) { + $isVti = 1; + @tunnels = (@tunnels, "vti"); + } + if (@tunnels == 0) { + vpn_die(["vpn", "ipsec", "site-to-site","peer",$peer,"tunnel"], + "$vpn_cfg_err No tunnels configured for peer \"$peer\". At least" + . " one tunnel required per peer.\n"); + } } foreach my $tunnel (@tunnels) { my $needs_passthrough = 'false'; + my $tunKeyword; + if ($isVti == 1) { + $tunKeyword = 'vti'; + } else { + $tunKeyword = 'tunnel '."$tunnel"; + } # # Add support for tunnel disable. # if ( - $vcVPN->exists("ipsec site-to-site peer $peer tunnel $tunnel disable") ) + $vcVPN->exists("ipsec site-to-site peer $peer $tunKeyword disable") ) { next; } my $peer_tunnel_esp_group = $vcVPN->returnValue( - "ipsec site-to-site peer $peer tunnel $tunnel esp-group"); + "ipsec site-to-site peer $peer $tunKeyword esp-group"); $peer_tunnel_esp_group = '' if (!defined($peer_tunnel_esp_group)); if ( (!defined($peer_tunnel_esp_group) || $peer_tunnel_esp_group eq '') && (!defined($def_esp_group) || $def_esp_group eq '')) { - vpn_die(["vpn","ipsec","site-to-site","peer",$peer,"tunnel",$tunnel,"esp-group"], + vpn_die(["vpn","ipsec","site-to-site","peer",$peer,$tunKeyword,"esp-group"], "$vpn_cfg_err No ESP group specified for peer \"$peer\" " - . "tunnel $tunnel.\n"); + . "$tunKeyword.\n"); } elsif ( !$vcVPN->exists("ipsec esp-group $peer_tunnel_esp_group") ) { - vpn_die(["vpn","ipsec","site-to-site","peer",$peer,"tunnel",$tunnel,"esp-group"], + vpn_die(["vpn","ipsec","site-to-site","peer",$peer,$tunKeyword,"esp-group"], "$vpn_cfg_err The ESP group \"$peer_tunnel_esp_group\" specified " - . "for peer \"$peer\" tunnel $tunnel has not been configured.\n"); + . "for peer \"$peer\" $tunKeyword has not been configured.\n"); } my $conn_head = "\nconn peer-$peer-tunnel-$tunnel\n"; @@ -553,6 +570,11 @@ if ( $vcVPN->exists('ipsec') ) { # if ( defined($lip) ) { if ( $lip eq 'any' ) { + if ($isVti) { + vpn_die(["vpn","ipsec","site-to-site","peer",$peer,$tunKeyword,"local-address"], + "$vpn_cfg_err The local interface must be specified " + . "for peer \"$peer\" $tunKeyword.\n"); + } $genout .= "\tleft=%defaultroute\n"; # no need for leftsourceip as a defaultroute is must for this to work } else { @@ -562,6 +584,7 @@ if ( $vcVPN->exists('ipsec') ) { $genout .= "\tleftid=$authid\n" if defined $authid; } + # @SM Todo: must have explicit settings for VTI. my $any_peer = 0; my $right; my $rightid = undef; @@ -577,6 +600,11 @@ if ( $vcVPN->exists('ipsec') ) { or ( $peer eq '0.0.0.0' ) or $any_peer == 1 ) { + if ($isVti) { + vpn_die(["vpn","ipsec","site-to-site","peer",$peer], + "$vpn_cfg_err The \"$peer\" is invalid " + . "ip address must be specified for $tunKeyword.\n"); + } $right = '%any'; $any_peer = 1; } else { @@ -592,8 +620,8 @@ if ( $vcVPN->exists('ipsec') ) { # Write tunnel configuration # my $leftsubnet = $vcVPN->returnValue( - "ipsec site-to-site peer $peer tunnel $tunnel local prefix"); - if ( defined($leftsubnet) && $leftsubnet eq 'any' ) { + "ipsec site-to-site peer $peer $tunKeyword local prefix"); + if ( (defined($leftsubnet) && $leftsubnet eq 'any') || $isVti == 1 ) { $leftsubnet = '0.0.0.0/0'; } @@ -620,12 +648,15 @@ if ( $vcVPN->exists('ipsec') ) { } my $remotesubnet = $vcVPN->returnValue( - "ipsec site-to-site peer $peer tunnel $tunnel remote prefix"); + "ipsec site-to-site peer $peer $tunKeyword remote prefix"); + if ($isVti) { + $remotesubnet = 'any'; + } # Check local and remote prefix protocol consistency my $leftsubnet_proto = is_ip_v4_or_v6($leftsubnet); my $remotesubnet_proto = is_ip_v4_or_v6($remotesubnet); - if ($leftsubnet_proto != $remotesubnet_proto) { + if ( !$isVti && ($leftsubnet_proto != $remotesubnet_proto) ) { vpn_die(["vpn", "ipsec", "site-to-site", "peer", $peer, "tunnel", $tunnel], "$vpn_cfg_err The 'remote prefix' and 'local prefix' protocols ". "do not match"); @@ -643,9 +674,9 @@ if ( $vcVPN->exists('ipsec') ) { my $rightsubnet; my $allow_nat_networks = $vcVPN->returnValue( - "ipsec site-to-site peer $peer tunnel $tunnel allow-nat-networks"); + "ipsec site-to-site peer $peer $tunKeyword allow-nat-networks"); my $allow_public_networks = $vcVPN->returnValue( - "ipsec site-to-site peer $peer tunnel $tunnel allow-public-networks"); + "ipsec site-to-site peer $peer $tunKeyword allow-public-networks"); if ( defined($allow_nat_networks) && $allow_nat_networks eq 'enable' ) { if ( defined($remotesubnet) && $remotesubnet ne "" ) { @@ -660,7 +691,7 @@ if ( $vcVPN->exists('ipsec') ) { if ( @allowed_network == 0 ) { vpn_die(["vpn","ipsec","site-to-site","peer",$peer,"tunnel", $tunnel], "$vpn_cfg_err While 'allow-nat-networks' has been enabled for peer" - . " \"$peer\" tunnel $tunnel, no global allowed NAT networks have" + . " \"$peer\" $tunKeyword, no global allowed NAT networks have" . " been configured.\n"); } @@ -672,7 +703,7 @@ if ( $vcVPN->exists('ipsec') ) { vpn_die(["vpn","ipsec","site-to-site","peer",$peer,"tunnel", $tunnel], "$vpn_cfg_err The 'remote-subnet' has been specified while " . "'allow-public-networks' has been enabled for peer \"$peer\" " - . "tunnel $tunnel. Both not allowed at once.\n"); + . "$tunKeyword. Both not allowed at once.\n"); } $rightsubnet .= ",%no"; } @@ -703,13 +734,13 @@ if ( $vcVPN->exists('ipsec') ) { # Protocol/port # my $protocol = $vcVPN->returnValue( - "ipsec site-to-site peer $peer tunnel $tunnel protocol"); + "ipsec site-to-site peer $peer $tunKeyword protocol"); my $lprotoport = ''; if (defined($protocol)){ $lprotoport .= $protocol; } my $lport = $vcVPN->returnValue( - "ipsec site-to-site peer $peer tunnel $tunnel local port"); + "ipsec site-to-site peer $peer $tunKeyword local port"); if (defined($lport)){ if (!defined($protocol)){ $lprotoport .= "0/$lport"; @@ -729,7 +760,7 @@ if ( $vcVPN->exists('ipsec') ) { $rprotoport .= $protocol; } my $rport = $vcVPN->returnValue( - "ipsec site-to-site peer $peer tunnel $tunnel remote port"); + "ipsec site-to-site peer $peer $tunKeyword remote port"); if (defined($rport)){ if (!defined($protocol)){ $rprotoport .= "0/$rport"; @@ -749,7 +780,7 @@ if ( $vcVPN->exists('ipsec') ) { # check if passthrough connection is needed # needed when remote-subnet encompasses local-subnet # - if (defined $leftsubnet && defined $rightsubnet) { + if (!$isVti && defined $leftsubnet && defined $rightsubnet) { # validate that these values are ipv4net my $valid_leftsubnet = 'false'; my $valid_rightsubnet = 'false'; @@ -817,7 +848,7 @@ if ( $vcVPN->exists('ipsec') ) { } elsif ( $dh_group ne '' ) { vpn_die(["vpn","ipsec","site-to-site","peer",$peer,"tunnel", $tunnel], "$vpn_cfg_err Invalid 'dh-group' $dh_group specified for " - . "peer \"$peer\" tunnel $tunnel. Only 2 or 5 accepted.\n"); + . "peer \"$peer\" $tunKeyword. Only 2 or 5 accepted.\n"); } } } @@ -859,7 +890,7 @@ if ( $vcVPN->exists('ipsec') ) { my $esplifetime = ESPLIFETIME_DEFAULT; $genout .= "\tesp="; my $esp_group = $vcVPN->returnValue( - "ipsec site-to-site peer $peer tunnel $tunnel esp-group"); + "ipsec site-to-site peer $peer $tunKeyword esp-group"); if (!defined($esp_group) || $esp_group eq ''){ $esp_group = $vcVPN->returnValue( "ipsec site-to-site peer $peer default-esp-group"); @@ -927,10 +958,14 @@ if ( $vcVPN->exists('ipsec') ) { } if ( $espmode eq "transport" ) { if ( defined $leftsubnet or defined $rightsubnet ) { - vpn_die(["vpn","ipsec","site-to-site","peer",$peer,"tunnel", $tunnel], + vpn_die(["vpn","ipsec","site-to-site","peer",$peer,"$tunKeyword"], "$vpn_cfg_err Can not use local-subnet or remote-subnet when " . "using transport mode\n"); } + if ( $isVti == 1) { + vpn_die(["vpn","ipsec","site-to-site","peer",$peer,"$tunKeyword"], + "$vpn_cfg_err Can not use transport mode for \"$peer\" with vti\n"); + } } $genout .= "\ttype=$espmode\n"; @@ -1101,6 +1136,25 @@ if ( $vcVPN->exists('ipsec') ) { } # + # Mark setting for vti. + # + if ($isVti) { + my $mark = $vcVPN->returnValue("ipsec site-to-site peer $peer vti mark"); + if (!defined($mark) || $mark eq '' || $mark eq "0") { + vpn_die(["vpn","ipsec","site-to-site","peer",$peer,"vti","mark"], + "$vpn_cfg_err No mark specified for peer \"$peer\" vti\n"); + } else { + if (defined($marks{ $mark })) { + vpn_die(["vpn","ipsec","site-to-site","peer",$peer,"vti","mark"], + "$vpn_cfg_err vti mark $mark already used.\n"); + } else { + $marks{ $mark } = 1; + $genout .= "\tmark=$mark\n"; + } + } + } + + # # Start automatically # if ($any_peer) { @@ -1143,7 +1197,6 @@ if ( $vcVPN->exists('ipsec') ) { $genout .= "#$passthrough_conn_head"; } - } } } else { diff --git a/scripts/vyatta-vti-config.pl b/scripts/vyatta-vti-config.pl new file mode 100755 index 0000000..94c2edf --- /dev/null +++ b/scripts/vyatta-vti-config.pl @@ -0,0 +1,146 @@ +#!/usr/bin/perl -w +# +# Module: vpn-config.pl +# +# **** License **** +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# This code was originally developed by Vyatta, Inc. +# Portions created by Vyatta are Copyright (C) 2006, 2007, 2008, 2009 Vyatta, Inc. +# All Rights Reserved. +# +# Authors: Justin Fletcher, Marat Nepomnyashy +# Date: 2012 +# Description: setup the vti tunnel +# +# **** End License **** +# +# +# For each VTI tunnel (vpn ipsec site-to-site peer ip-address sti); find the vti tunnel, local address, mark. +# Find the corresponding tunnel (interfaces vti vtiXXX), tunnel address, disable, mtu +# if not configured: ip tunnel add vtiXXX mode esp local $local remote $remote i_key $mark +# if (mtu): configure mtu +# if (tunnel-addres): configur ip link vtiXXX address +# if (!disable): enable the interface. +# + +use strict; +use lib "/opt/vyatta/share/perl5"; + +use Vyatta::TypeChecker; +use Vyatta::VPN::Util; +use Getopt::Long; +use Vyatta::Misc; +use NetAddr::IP; + + +my $vti_cfg_err = "VPN VTI configuration error:"; +my $gencmds = ""; +my $result = 0; + +# +# Prepare Vyatta::Config object +# +use Vyatta::Config; +my $vcIntf = new Vyatta::Config(); +my $vcVPN = new Vyatta::Config(); +$vcVPN->setLevel('vpn'); +$vcIntf->setLevel('interfaces'); + +if (!$vcVPN->exists('ipsec') ) { + exit $result; +} +if (!$vcVPN->exists('ipsec site-to-site') ) { + exit $result; +} + +my @peers = $vcVPN->listNodes('ipsec site-to-site peer'); +if (@peers == 0) { + exit $result; +} + foreach my $peer (@peers) { + if (! $vcVPN->exists("ipsec site-to-site peer $peer vti")) { + next; + } + # + # we have the vti configured. + # + my $lip = $vcVPN->returnValue("ipsec site-to-site peer $peer local-address"); + my $mark = $vcVPN->returnValue("ipsec site-to-site peer $peer vti mark"); + my $tunName = $vcVPN->returnValue("ipsec site-to-site peer $peer vti bind"); + + # Check local address is valid. + if (!defined($lip)) { + print STDERR "$vti_cfg_err local-address not defined.\n"; + exit -1; + } + + if ($lip eq "" || $lip eq "0.0.0.0") { + print STDERR "$vti_cfg_err Invalid local-address \"$lip\".\n"; + exit -1; + } + # Check mark is valid. + if (!defined($mark) || $mark eq "" || $mark eq "0") { + print STDERR "$vti_cfg_err Invalid mark \"$mark\".\n"; + exit -1; + } + # Check tunName is valid. + if (!defined($tunName) || $tunName eq "" || ! $vcIntf->exists("vti $tunName") ) { + print STDERR "$vti_cfg_err Invalid tunnel name vti \"$tunName\".\n"; + exit -1; + } + # + # Get the tunnel parameters. + # + # ip address's + my @tunIPs = $vcIntf->returnValues("vti $tunName address"); + # mtu + my $mtu = $vcIntf->returnValue("vti $tunName mtu"); + if (!defined($mtu) || $mtu eq "") { + $mtu = 1500; + } + # disabled or not. + my $disabled = $vcIntf->exists("vti $tunName disabled"); + #my $exists = `ls -l /sys/class/net/$tunName &> /dev/null`; + + # description. + my $description = $vcIntf->returnValue("vti $tunName description"); + + # + # Set the configuration into the output string. + # + # By default we delete the tunnel... + $gencmds .= "sudo /sbin/ip tunnel del $tunName &> /dev/null\n"; + $gencmds .= "sudo /sbin/ip tunnel add $tunName mode esp remote $peer local $lip ikey $mark\n"; + foreach my $tunIP (@tunIPs) { + $gencmds .= "sudo /sbin/ip addr add $tunIP dev $tunName\n"; + } + $gencmds .= "sudo /sbin/ip link set $tunName mtu $mtu\n"; + + if (! $disabled) { + # @SM TODO: Don not bring the tunnel link-state up till strongswan does it. + $gencmds .= "sudo /sbin/ip link set $tunName up\n"; + # @SM TODO: Add the static routes over this tunnel... + } + if (defined($description)) { + $gencmds .= "sudo /sbin/ip tunnel show $tunName || sudo echo \"$description\" > /sys/class/net/$tunName/ifalias\n"; + } + } + +if ($gencmds ne "") { + open my $output_config, '>', '/tmp/vti_config' or die "Can't open /tmp/vti_config $!"; + print ${output_config} "#!/bin/sh\n"; + print ${output_config} $gencmds; + close $output_config; + `chmod 755 /tmp/vti_config`; + #$result=`/tmp/vti_config`; + #@SM TODO: remove /tmp/vti_config; +} +exit $result; |