This adds support for configuring VTI interfaces within /etc/config/network. VTI interfaces are used to create IPsec tunnel interfaces. These interfaces may be used for routing and other purposes. Example config: config interface 'vti1' option proto 'vti' option mtu '1500' option tunlink 'wan' option peeraddr '192.168.5.16' option zone 'VPN' option ikey 2 option okey 2 config interface 'vti1_static' option proto 'static' option ifname '@vti1' option ipaddr '192.168.7.2/24' The options ikey and okey correspond to the fwmark value of a ipsec policy. The may be null if you do not want fwmarks. Also peeraddr may be 0.0.0 if you want all ESP packets go through the interface. Example strongswan config: conn vti left=%any leftcert=peer2.test.der leftid=@peer2.test right=192.168.5.16 rightid=@peer3.test leftsubnet=0.0.0.0/0 rightsubnet=0.0.0.0/0 mark=2 auto=route Signed-off-by: André Valentin <avalentin@marcant.net> SVN-Revision: 48274master
parent
eb1ac66ce7
commit
e2e8cb8347
@ -0,0 +1,65 @@ |
||||
#
|
||||
# Copyright (C) 2014 OpenWrt.org
|
||||
#
|
||||
# This is free software, licensed under the GNU General Public License v2.
|
||||
# See /LICENSE for more information.
|
||||
#
|
||||
|
||||
include $(TOPDIR)/rules.mk |
||||
|
||||
PKG_NAME:=vti
|
||||
PKG_VERSION:=1
|
||||
PKG_RELEASE:=1
|
||||
PKG_LICENSE:=GPL-2.0
|
||||
|
||||
include $(INCLUDE_DIR)/package.mk |
||||
|
||||
define Package/vti/Default |
||||
SECTION:=net
|
||||
CATEGORY:=Network
|
||||
MAINTAINER:=Andre Valentin <avalentin@marcant.net>
|
||||
endef |
||||
|
||||
define Package/vti |
||||
$(call Package/vti/Default) |
||||
TITLE:=Virtual IPsec Tunnel Interface config support
|
||||
endef |
||||
|
||||
define Package/vti/description |
||||
Virtual IPsec Tunnel Interface config support (IPv4 and IPv6) in /etc/config/network.
|
||||
endef |
||||
|
||||
define Package/vtiv4 |
||||
$(call Package/vti/Default) |
||||
TITLE:=Virtual IPsec Tunnel Interface (IPv4) config support
|
||||
DEPENDS:=@(PACKAGE_vti) +kmod-ip_vti
|
||||
endef |
||||
|
||||
define Package/vtiv4/description |
||||
Virtual IPsec Tunnel Interface config support (IPv4) in /etc/config/network.
|
||||
endef |
||||
|
||||
define Package/vtiv6 |
||||
$(call Package/vti/Default) |
||||
TITLE:=Virtual IPsec Tunnel Interface (IPv6) config support
|
||||
DEPENDS:=@(PACKAGE_vti) @IPV6 +kmod-ip6_vti
|
||||
endef |
||||
|
||||
define Package/vtiv6/description |
||||
Virtual IPsec Tunnel Interface config support (IPv6) in /etc/config/network.
|
||||
endef |
||||
|
||||
define Build/Compile |
||||
endef |
||||
|
||||
define Build/Configure |
||||
endef |
||||
|
||||
define Package/vti/install |
||||
$(INSTALL_DIR) $(1)/lib/netifd/proto
|
||||
$(INSTALL_BIN) ./files/vti.sh $(1)/lib/netifd/proto/vti.sh
|
||||
endef |
||||
|
||||
$(eval $(call BuildPackage,vti)) |
||||
$(eval $(call BuildPackage,vtiv4)) |
||||
$(eval $(call BuildPackage,vtiv6)) |
@ -0,0 +1,151 @@ |
||||
#!/bin/sh |
||||
|
||||
[ -n "$INCLUDE_ONLY" ] || { |
||||
. /lib/functions.sh |
||||
. /lib/functions/network.sh |
||||
. ../netifd-proto.sh |
||||
init_proto "$@" |
||||
} |
||||
|
||||
vti_generic_setup() { |
||||
local cfg="$1" |
||||
local mode="$2" |
||||
local local="$3" |
||||
local remote="$4" |
||||
local link="$5" |
||||
local mtu zone ikey |
||||
json_get_vars mtu zone ikey okey |
||||
|
||||
[ -z "$zone" ] && zone="wan" |
||||
|
||||
proto_init_update "$link" 1 |
||||
|
||||
proto_add_tunnel |
||||
json_add_string mode "$mode" |
||||
json_add_int mtu "${mtu:-1280}" |
||||
json_add_string local "$local" |
||||
json_add_string remote "$remote" |
||||
[ -n "$tunlink" ] && json_add_string link "$tunlink" |
||||
json_add_string info "${ikey:-0},${okey:-0}" |
||||
proto_close_tunnel |
||||
|
||||
proto_add_data |
||||
[ -n "$zone" ] && json_add_string zone "$zone" |
||||
proto_close_data |
||||
|
||||
proto_send_update "$cfg" |
||||
} |
||||
|
||||
vti_setup() { |
||||
local cfg="$1" |
||||
local mode="$2" |
||||
|
||||
local ipaddr peeraddr |
||||
json_get_vars df ipaddr peeraddr tunlink |
||||
|
||||
[ -z "$peeraddr" ] && { |
||||
proto_notify_error "$cfg" "MISSING_ADDRESS" |
||||
proto_block_restart "$cfg" |
||||
exit |
||||
} |
||||
|
||||
( proto_add_host_dependency "$cfg" "$peeraddr" "$tunlink" ) |
||||
|
||||
[ -z "$ipaddr" ] && { |
||||
local wanif="$tunlink" |
||||
if [ -z $wanif ] && ! network_find_wan wanif; then |
||||
proto_notify_error "$cfg" "NO_WAN_LINK" |
||||
exit |
||||
fi |
||||
|
||||
if ! network_get_ipaddr ipaddr "$wanif"; then |
||||
proto_notify_error "$cfg" "NO_WAN_LINK" |
||||
exit |
||||
fi |
||||
} |
||||
|
||||
vti_generic_setup $cfg $mode $ipaddr $peeraddr "vti-$cfg" |
||||
} |
||||
|
||||
proto_vti_setup() { |
||||
local cfg="$1" |
||||
|
||||
vti_setup $cfg "vtiip" |
||||
} |
||||
|
||||
vti6_setup() { |
||||
local cfg="$1" |
||||
local mode="$2" |
||||
|
||||
local ip6addr peer6addr weakif |
||||
json_get_vars ip6addr peer6addr tunlink weakif |
||||
|
||||
[ -z "$peer6addr" ] && { |
||||
proto_notify_error "$cfg" "MISSING_ADDRESS" |
||||
proto_block_restart "$cfg" |
||||
exit |
||||
} |
||||
|
||||
( proto_add_host_dependency "$cfg" "$peer6addr" "$tunlink" ) |
||||
|
||||
[ -z "$ip6addr" ] && { |
||||
local wanif="$tunlink" |
||||
if [ -z $wanif ] && ! network_find_wan6 wanif; then |
||||
proto_notify_error "$cfg" "NO_WAN_LINK" |
||||
exit |
||||
fi |
||||
|
||||
if ! network_get_ipaddr6 ip6addr "$wanif"; then |
||||
[ -z "$weakif" ] && weakif="lan" |
||||
if ! network_get_ipaddr6 ip6addr "$weakif"; then |
||||
proto_notify_error "$cfg" "NO_WAN_LINK" |
||||
exit |
||||
fi |
||||
fi |
||||
} |
||||
|
||||
vti_generic_setup $cfg $mode $ip6addr $peer6addr "vti6-$cfg" |
||||
} |
||||
|
||||
proto_vti6_setup() { |
||||
local cfg="$1" |
||||
|
||||
vti6_setup $cfg "vtiip6" |
||||
} |
||||
|
||||
proto_vti_teardown() { |
||||
local cfg="$1" |
||||
} |
||||
|
||||
proto_vti6_teardown() { |
||||
local cfg="$1" |
||||
} |
||||
|
||||
vti_generic_init_config() { |
||||
no_device=1 |
||||
available=1 |
||||
|
||||
proto_config_add_int "mtu" |
||||
proto_config_add_string "tunlink" |
||||
proto_config_add_string "zone" |
||||
proto_config_add_int "ikey" |
||||
proto_config_add_int "okey" |
||||
} |
||||
|
||||
proto_vti_init_config() { |
||||
vti_generic_init_config |
||||
proto_config_add_string "ipaddr" |
||||
proto_config_add_string "peeraddr" |
||||
} |
||||
|
||||
proto_vti6_init_config() { |
||||
vti_generic_init_config |
||||
proto_config_add_string "ip6addr" |
||||
proto_config_add_string "peer6addr" |
||||
proto_config_add_string "weakif" |
||||
} |
||||
|
||||
[ -n "$INCLUDE_ONLY" ] || { |
||||
[ -f /lib/modules/$(uname -r)/ip_vti.ko ] && add_protocol vti |
||||
[ -f /lib/modules/$(uname -r)/ip6_vti.ko ] && add_protocol vti6 |
||||
} |
Loading…
Reference in new issue