Updated by Lubomir Bulej and Mads Kiilerich: it uses /etc/tinc/nets.boot and the VpnMask directive in the config files.
This commit is contained in:
Ivo Timmermans
parent
3a6ffe6895
commit
85e3c1f271
1 changed files with 183 additions and 84 deletions
267
redhat/tinc
267
redhat/tinc
|
|
@ -4,13 +4,13 @@
|
||||||
#
|
#
|
||||||
# chkconfig: 2345 46 54
|
# chkconfig: 2345 46 54
|
||||||
#
|
#
|
||||||
# version: 1.0.4
|
# version: 1.0.8
|
||||||
# author: Lubomir Bulej <pallas@kadan.cz>
|
# authors: Lubomir Bulej <pallas@kadan.cz>
|
||||||
# Modified for RPM by Mads Kiilerich <mads@kiilerich.com>
|
# Mads Kiilerich <mads@kiilerich.com>
|
||||||
#
|
#
|
||||||
# description: this script takes care of starting and setting up of VPNs \
|
# description: This script parses tinc configuration files for networks given \
|
||||||
# provided by tincd daemon. It parses the configuration files \
|
# in /etc/tinc/nets.boot and for each of the networks it sets up \
|
||||||
# in all VPN directories and sets up the interfaces and routing
|
# the interface and static routes and starts the tinc daemon.
|
||||||
#
|
#
|
||||||
# processname: tincd
|
# processname: tincd
|
||||||
|
|
||||||
|
|
@ -31,24 +31,84 @@ TCONF=/etc/tinc
|
||||||
TPIDS=/var/run
|
TPIDS=/var/run
|
||||||
#DEBUG=-dddd
|
#DEBUG=-dddd
|
||||||
|
|
||||||
|
NETSFILE=$TCONF/nets.boot
|
||||||
|
|
||||||
# Check the daemon
|
# Check the daemon
|
||||||
if [ ! -x $TINCD ]; then
|
if [ ! -x $TINCD ]; then
|
||||||
echo "**tinc: daemon $TINCD does not exist or is not executable!"
|
echo "**tinc: $TINCD does not exist or is not executable!" >&2
|
||||||
exit
|
exit
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# Check if ip-route is installed
|
# Check if ip-route is installed
|
||||||
if [ ! -f /sbin/ip ]; then
|
if [ ! -f /sbin/ip ]; then
|
||||||
echo "**tinc: ip-route utilities not installed!"
|
echo "**tinc: ip-route utilities not installed!" >&2
|
||||||
|
exit
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Check the kernel
|
||||||
|
if ! ip addr &> /dev/null; then
|
||||||
|
echo "**tinc: kernel not configured for use with ip-route!" >&2
|
||||||
exit
|
exit
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# Check the configuration directory
|
# Check the configuration directory
|
||||||
if [ ! -d $TCONF ]; then
|
if [ ! -d $TCONF ]; then
|
||||||
echo "**tinc: configuration directory ($TCONF) not found!"
|
echo "**tinc: configuration directory ($TCONF) not found!" >&2
|
||||||
exit
|
exit
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
# Check nets.boot
|
||||||
|
if [ ! -f $NETSFILE ]; then
|
||||||
|
echo "**tinc: file with list of VPNs to start ($NETSFILE) not found!" >&2
|
||||||
|
exit
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Load names of networks to be started
|
||||||
|
NETS="$(sed -e 's/#.*//; s/[[:space:]]//g; /^$/ d' $NETSFILE)"
|
||||||
|
|
||||||
|
|
||||||
|
##############################################################################
|
||||||
|
# prefix_to_mask Converts prefix length to netmask
|
||||||
|
# eg. 17 -> 255.255.128.0
|
||||||
|
# $1 ... prefix
|
||||||
|
|
||||||
|
prefix_to_mask () {
|
||||||
|
_MSK=""; _len="$1"
|
||||||
|
for _dot in "." "." "." " "; do
|
||||||
|
if [ ${_len} -ge 8 ]; then
|
||||||
|
_fld=8
|
||||||
|
else
|
||||||
|
_fld="${_len}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
_MSK="${_MSK}$((255 & (255 << (8 - _fld))))${_dot}"
|
||||||
|
_len=$((_len - _fld))
|
||||||
|
done
|
||||||
|
|
||||||
|
echo ${_MSK}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
##############################################################################
|
||||||
|
# mask_to_prefix Converts netmask to prefix length
|
||||||
|
# eg. 255.255.192.0 -> 18
|
||||||
|
# $1 ... netmask
|
||||||
|
|
||||||
|
mask_to_prefix () {
|
||||||
|
_LEN=0; _msk="$1"
|
||||||
|
for _tmp in 1 2 3 4; do
|
||||||
|
_fld=${_msk%%.*}
|
||||||
|
_msk=${_msk#*.}
|
||||||
|
|
||||||
|
while [ ${_fld} -ne 0 ]; do
|
||||||
|
_fld=$(((_fld << 1) & 255))
|
||||||
|
_LEN=$((_LEN + 1))
|
||||||
|
done
|
||||||
|
done
|
||||||
|
|
||||||
|
echo ${_LEN}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
##############################################################################
|
##############################################################################
|
||||||
# vpn_load () Loads VPN configuration
|
# vpn_load () Loads VPN configuration
|
||||||
|
|
@ -57,56 +117,76 @@ fi
|
||||||
|
|
||||||
vpn_load () {
|
vpn_load () {
|
||||||
CFG="$TCONF/$1/tinc.conf"
|
CFG="$TCONF/$1/tinc.conf"
|
||||||
[ -f $CFG ] || { echo "**tinc: $CFG does not exist!" >&2; return 1; }
|
[ -f $CFG ] || { MSG="$CFG does not exist!"; return 1 }
|
||||||
|
|
||||||
# load TINCD config
|
# load TINCD config
|
||||||
DEV=`grep -i -e '^[[:space:]]*TapDevice' $CFG | sed 's/[[:space:]]//g; s/^.*=//g'`
|
DEV="$(grep -i -e '^[[:space:]]*TapDevice' $CFG | sed 's/[[:space:]]//g; s/^.*=//g')"
|
||||||
VPN=`grep -i -e '^[[:space:]]*(MyOwnVPNIP|MyVirtualIP)' -E $CFG | head -1 | sed 's/[[:space:]]//g; s/^.*=//g'`
|
VPN="$(grep -i -e '^[[:space:]]*(MyOwnVPNIP|MyVirtualIP)' -E $CFG | sed 's/[[:space:]]//g; s/^.*=//g')"
|
||||||
|
IFM="$(grep -i -e '^[[:space:]]*VPNMask' $CFG | sed 's/[[:space:]]//g; s/^.*=//g')"
|
||||||
|
|
||||||
# discourage empty and multiple entries
|
# TapDevice syntax validation
|
||||||
[ -z "$DEV" ] && \
|
[ -z "$DEV" ] && \
|
||||||
{ echo "**tinc: TapDevice required!" >&2; return 2; }
|
{ MSG="TapDevice required!"; return 1 }
|
||||||
echo $DEV | grep -q '^/dev/tap' ||
|
[ $(echo $DEV | wc -l) -gt 1 ] && \
|
||||||
{ echo "**tinc: TapDevice should be in form /dev/tapX" >&2; return 2; }
|
{ MSG="multiple TapDevice entries not allowed!"; return 1 }
|
||||||
[ `echo $DEV | wc -l` -gt 1 ] && \
|
echo $DEV | grep -q -x -E '/dev/tap[[:digit:]]+' ||
|
||||||
{ echo "**tinc: multiple TapDevice entries not allowed!" >&2; return 3; }
|
{ MSG="TapDevice should be in form /dev/tapX!"; return 1 }
|
||||||
|
|
||||||
|
# MyOwnVPNIP/MyVirtualIP syntax validation
|
||||||
[ -z "$VPN" ] && \
|
[ -z "$VPN" ] && \
|
||||||
{ echo "**tinc: MyOwnVPNIP/MyVirtualIP required!" >&2; return 2; }
|
{ MSG="MyOwnVPNIP/MyVirtualIP required!"; return 1 }
|
||||||
[ `echo $VPN | wc -l` -gt 1 ] && \
|
[ $(echo $VPN | wc -l) -gt 1 ] && \
|
||||||
{ echo "**tinc: multiple MyOwnVPNIP/MyVirtualIP entries not allowed!" >&2; return 3; }
|
{ MSG="multiple MyOwnVPNIP/MyVirtualIP entries not allowed!"; return 1 }
|
||||||
echo $VPN | grep -q -x \
|
echo $VPN | grep -q -x -E \
|
||||||
'\([[:digit:]]\{1,3\}\.\)\{3\}[[:digit:]]\{1,3\}/[[:digit:]]\{1,2\}' || \
|
'([[:digit:]]{1,3}\.){3}[[:digit:]]{1,3}/[[:digit:]]{1,2}' || \
|
||||||
{ echo "**tinc: badly formed MyOwnVPNIP/MyVirtualIP address $VPN!"; return 3; }
|
{ MSG="badly formed MyOwnVPNIP/MyVirtualIP address $VPN!"; return 1 }
|
||||||
|
|
||||||
|
# VPNMask syntax validation
|
||||||
|
[ $(echo $IFM | wc -l) -gt 1 ] && \
|
||||||
|
{ MSG="multiple VPNMask entries not allowed!"; return 1 }
|
||||||
|
|
||||||
|
|
||||||
|
# device & IP address extraction
|
||||||
|
TAP=${DEV##*/}
|
||||||
|
NUM=${TAP#tap}
|
||||||
|
ADR=${VPN%%/*}
|
||||||
|
|
||||||
|
# netmask is calculated from MyVirtualIP netmask prefix length, except when
|
||||||
|
# VPNMask is specified, in which case it is used instead of default prefix
|
||||||
|
|
||||||
|
# VPNMask not specified
|
||||||
|
if [ -z "$IFM" ]; then
|
||||||
|
LEN=${VPN##*/}
|
||||||
|
MSK=$(prefix_to_mask $LEN)
|
||||||
|
|
||||||
|
# VPNMask is prefix length, convert it to netmask for MSK
|
||||||
|
elif echo $IFM | grep -q -x -E '[[:digit:]]{1,2}'; then
|
||||||
|
VPN="$ADR/$IFM"
|
||||||
|
MSK=$(prefix_to_mask $IFM)
|
||||||
|
|
||||||
|
# VPNMask is netmask, convert it to prefix length for VPN
|
||||||
|
elif echo $IFM | grep -q -x -E '([[:digit:]]{1,3}\.){3}[[:digit:]]{1,3}'; then
|
||||||
|
VPN="$ADR/$(mask_to_prefix $IFM)"
|
||||||
|
MSK="$IFM"
|
||||||
|
|
||||||
|
else
|
||||||
|
MSG="badly formed interface netmask (VPNMask=$IFM)!"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
# network device
|
|
||||||
TAP=`echo $DEV | cut -d"/" -f3`
|
|
||||||
NUM=`echo $TAP | sed 's/tap//'`
|
|
||||||
|
|
||||||
# IP address, netmask length
|
|
||||||
ADR=`echo $VPN | cut -d"/" -f1`
|
|
||||||
LEN=`echo $VPN | cut -d"/" -f2`
|
|
||||||
|
|
||||||
# Expand bitlength to netmask
|
|
||||||
MSK=""; len=$LEN
|
|
||||||
for cnt in 1 1 1 0; do
|
|
||||||
if [ $len -ge 8 ]; then
|
|
||||||
msk=8
|
|
||||||
else
|
|
||||||
msk=$len
|
|
||||||
fi
|
|
||||||
|
|
||||||
MSK="$MSK$((255 & (255 << (8 - msk))))"
|
|
||||||
[ $cnt -ne 0 ] && MSK="$MSK."
|
|
||||||
len=$((len-msk))
|
|
||||||
done
|
|
||||||
|
|
||||||
# Network & broadcast addresses
|
# Network & broadcast addresses
|
||||||
BRD=`ipcalc --broadcast $ADR $MSK | cut -d"=" -f2`
|
BRD=$(ipcalc --broadcast $ADR $MSK | cut -d"=" -f2)
|
||||||
NET=`ipcalc --network $ADR $MSK | cut -d"=" -f2`
|
NET=$(ipcalc --network $ADR $MSK | cut -d"=" -f2)
|
||||||
|
|
||||||
# MAC address
|
# MAC address
|
||||||
MAC=`printf "fe:fd:%0.2x:%0.2x:%0.2x:%0.2x" $(echo $ADR | sed 's/\./ /g')`
|
MAC=$(printf "fe:fd:%0.2x:%0.2x:%0.2x:%0.2x" $(echo $ADR | { IFS=. ; read a b c d; echo $a $b $c $d }))
|
||||||
# echo "TAP $TAP NUM $NUM ADR $ADR LEN $LEN MSK $MSK BRD $BRD NET $NET MAC $MAC" >&2
|
|
||||||
|
# debugging
|
||||||
|
# echo >&2
|
||||||
|
# echo "VPN $VPN TAP $TAP NUM $NUM MAC $MAC IFM $IFM" >&2
|
||||||
|
# echo "ADR $ADR MSK $MSK NET $NET BRD $BRD" >&2
|
||||||
|
|
||||||
return 0
|
return 0
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
@ -117,8 +197,8 @@ vpn_load () {
|
||||||
# $1 ... VPN to start
|
# $1 ... VPN to start
|
||||||
|
|
||||||
vpn_start () {
|
vpn_start () {
|
||||||
|
MSG=""; ERR=""
|
||||||
vpn_load $1 || { echo "**tinc: could not vpn_load $1" >&2; return 1; }
|
vpn_load $1 || return 1
|
||||||
|
|
||||||
# create device file
|
# create device file
|
||||||
if [ ! -c $DEV ]; then
|
if [ ! -c $DEV ]; then
|
||||||
|
|
@ -127,24 +207,24 @@ vpn_start () {
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# load device module
|
# load device module
|
||||||
{ insmod ethertap --name="ethertap$NUM" unit="$NUM" 2>&1 || \
|
ERR="$(insmod ethertap -o "ethertap$NUM" unit="$NUM" 2>&1 1> /dev/null)" ||
|
||||||
{ echo "**tinc: cannot insmod ethertap$NUM" >&2; return 2; }
|
{ MSG="could not insmod ethertap as unit $NUM!"; return 2 }
|
||||||
} | grep -v '^Us'
|
|
||||||
|
|
||||||
# configure the interface
|
# configure the interface
|
||||||
ip link set $TAP address $MAC
|
ERR="$(ip link set $TAP address $MAC 2>&1)" ||
|
||||||
ip link set $TAP up
|
{ MSG="could not set address for device $TAP!"; return 3 }
|
||||||
ip addr flush dev $TAP 2>&1 | grep -v -x '^Nothing to flush.'
|
|
||||||
ip addr add $VPN brd $BRD dev $TAP
|
ERR="$(ip link set $TAP up 2>&1)" ||
|
||||||
|
{ MSG="could not bring up device $TAP!"; return 3 }
|
||||||
|
|
||||||
|
ERR="$(ip addr add $VPN brd $BRD dev $TAP 2>&1)" ||
|
||||||
|
{ MSG="could not set IP address for device $TAP!"; return 3 }
|
||||||
|
|
||||||
# start tincd
|
# start tincd
|
||||||
$TINCD --net="$1" $DEBUG || \
|
$TINCD --net="$1" $DEBUG || \
|
||||||
{ echo "**tinc: could not start $TINCD" >&2; return 3; }
|
{ MSG="could not start daemon for network $1"; return 3 }
|
||||||
|
|
||||||
# default interface route
|
# setup custom static routes
|
||||||
# ip route add $NET/$LEN dev $TAP
|
|
||||||
|
|
||||||
# setup routes
|
|
||||||
/etc/sysconfig/network-scripts/ifup-routes $TAP
|
/etc/sysconfig/network-scripts/ifup-routes $TAP
|
||||||
|
|
||||||
return 0
|
return 0
|
||||||
|
|
@ -157,12 +237,9 @@ vpn_start () {
|
||||||
# $1 ... VPN to stop
|
# $1 ... VPN to stop
|
||||||
|
|
||||||
vpn_stop () {
|
vpn_stop () {
|
||||||
|
MSG=""; ERR=""
|
||||||
vpn_load $1 || return 1
|
vpn_load $1 || return 1
|
||||||
|
|
||||||
# flush the routing table
|
|
||||||
# ip route flush dev $TAP &> /dev/null
|
|
||||||
|
|
||||||
# kill the tincd daemon
|
# kill the tincd daemon
|
||||||
PID="$TPIDS/tinc.$1.pid"
|
PID="$TPIDS/tinc.$1.pid"
|
||||||
if [ -f $PID ]; then
|
if [ -f $PID ]; then
|
||||||
|
|
@ -173,14 +250,16 @@ vpn_stop () {
|
||||||
dly=0
|
dly=0
|
||||||
while [ $dly -le 5 ]; do
|
while [ $dly -le 5 ]; do
|
||||||
[ -f $PID ] || break
|
[ -f $PID ] || break
|
||||||
sleep 1; dly=$((dly+1))
|
sleep 1; dly=$((dly + 1))
|
||||||
done
|
done
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
# remove stale PID file
|
||||||
[ -f $PID ] && rm -f $PID
|
[ -f $PID ] && rm -f $PID
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# bring the interface down
|
# bring the interface down
|
||||||
|
ip addr flush dev $TAP &> /dev/null
|
||||||
ip link set $TAP down &> /dev/null
|
ip link set $TAP down &> /dev/null
|
||||||
|
|
||||||
# remove ethertap module
|
# remove ethertap module
|
||||||
|
|
@ -190,21 +269,44 @@ vpn_stop () {
|
||||||
} # vpn_stop
|
} # vpn_stop
|
||||||
|
|
||||||
|
|
||||||
|
# Check if there is anything to start
|
||||||
|
if [ ! -z "$1" -a "$1" != "status" -a -z "$NETS" ]; then
|
||||||
|
echo "**tinc: no networks found in $NETSFILE!" >&2
|
||||||
|
exit
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
# See how we were called.
|
# See how we were called.
|
||||||
case "$1" in
|
case "$1" in
|
||||||
start)
|
start)
|
||||||
for vpn in `ls -1 $TCONF`; do
|
for vpn in $NETS; do
|
||||||
echo -n "Bringing up VPN $vpn: "
|
echo -n "Bringing up TINC network $vpn: "
|
||||||
vpn_start $vpn && action "" /bin/true
|
vpn_start $vpn && \
|
||||||
|
success "startup of network $vpn" || \
|
||||||
|
failure "startup of network $vpn"
|
||||||
|
echo
|
||||||
|
|
||||||
|
if [ ! -z "$MSG" ]; then
|
||||||
|
[ ! -z "$ERR" ] && echo "$ERR" >&2
|
||||||
|
echo "**tinc: $MSG" >&2
|
||||||
|
fi
|
||||||
done
|
done
|
||||||
|
|
||||||
touch /var/lock/subsys/tinc
|
touch /var/lock/subsys/tinc
|
||||||
;;
|
;;
|
||||||
|
|
||||||
stop)
|
stop)
|
||||||
for vpn in `ls -1 $TCONF`; do
|
for vpn in $NETS; do
|
||||||
echo -n "Shutting down VPN $vpn: "
|
echo -n "Shutting down TINC network $vpn: "
|
||||||
vpn_stop $vpn && action "" /bin/true
|
vpn_stop $vpn && \
|
||||||
|
success "shutdown of network $vpn" || \
|
||||||
|
failure "shutdown of network $vpn"
|
||||||
|
echo
|
||||||
|
|
||||||
|
if [ ! -z "$MSG" ]; then
|
||||||
|
[ ! -z "$ERR" ] && echo "$ERR" >&2
|
||||||
|
echo "**tinc: $MSG" >&2
|
||||||
|
fi
|
||||||
done
|
done
|
||||||
|
|
||||||
rm -f /var/lock/subsys/tinc
|
rm -f /var/lock/subsys/tinc
|
||||||
|
|
@ -212,15 +314,12 @@ case "$1" in
|
||||||
|
|
||||||
status)
|
status)
|
||||||
echo -n "Configured VPNs: "
|
echo -n "Configured VPNs: "
|
||||||
for vpn in `ls -1 $TCONF`; do
|
for vpn in $NETS; do
|
||||||
PID="$TPIDS/tinc.$vpn.pid"
|
PID="$TPIDS/tinc.$vpn.pid"
|
||||||
echo -n "$vpn:"
|
|
||||||
if [ -f $PID -a `ps ax | grep "^ *$(cat $PID)" | wc -l` -eq 1 ]
|
[ -f $PID ] && PID="$(cat $PID)" || PID="-dead-"
|
||||||
then
|
ps ax | grep "^[[:space:]]*$PID" && STS="OK" || STS="DEAD"
|
||||||
echo -n "OK "
|
echo -n "$vpn:$STS "
|
||||||
else
|
|
||||||
echo -n "DEAD "
|
|
||||||
fi
|
|
||||||
done
|
done
|
||||||
echo
|
echo
|
||||||
;;
|
;;
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue