90 lines
2.0 KiB
Bash
90 lines
2.0 KiB
Bash
|
#!/bin/bash
|
||
|
|
|
||
|
|
set -o errexit
|
||
|
|
|
||
|
|
# This script enables IP forwarding only for the time of ocserv running
|
||
|
|
#
|
||
|
|
# The script should be run as a pre and post script via the systemd service
|
||
|
|
# unit.
|
||
|
|
#
|
||
|
|
# It only touches a sysctl if it doesn't have the required value and is able
|
||
|
|
# to restore it back to the original value by keeping track of changed
|
||
|
|
# settings in a state file.
|
||
|
|
|
||
|
|
STATEDIR="/run/ocserv"
|
||
|
|
STATEFILE="$STATEDIR/changed_sysctls"
|
||
|
|
# the sysctls that need to be at '1' for ocserv to work properly
|
||
|
|
CONTROLS=("net.ipv4.ip_forward" "net.ipv6.conf.default.forwarding" "net.ipv6.conf.all.forwarding")
|
||
|
|
|
||
|
|
errecho() {
|
||
|
|
echo $* 1>&2
|
||
|
|
}
|
||
|
|
|
||
|
|
usage() {
|
||
|
|
errecho "Usage: $0 [--enable|--disable]"
|
||
|
|
errecho
|
||
|
|
errecho "--enable: enable IP forwarding kernel settings, if necessary"
|
||
|
|
errecho "--disable: restore IP forwarding kernel settings that have previously been changed via --enable"
|
||
|
|
errecho
|
||
|
|
errecho "This script temporarily enables IP forwarding while ocserv is running"
|
||
|
|
exit 1
|
||
|
|
}
|
||
|
|
|
||
|
|
# make sure we don't create anything world readable for other users
|
||
|
|
umask 077
|
||
|
|
|
||
|
|
if [ $# -ne 1 ]; then
|
||
|
|
usage
|
||
|
|
fi
|
||
|
|
|
||
|
|
SYSCTL=`which sysctl`
|
||
|
|
if [ -z "$SYSCTL" ]; then
|
||
|
|
errecho "Couldn't find 'sysctl'. You need to be root to run this script."
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
operation="$1"
|
||
|
|
|
||
|
|
if [ "$operation" = "-h" -o "$operation" = "--help" ]; then
|
||
|
|
usage
|
||
|
|
elif [ "$operation" = "--enable" ]; then
|
||
|
|
changed=()
|
||
|
|
for control in ${CONTROLS[@]}; do
|
||
|
|
val=$($SYSCTL -n "$control")
|
||
|
|
if [ $? -ne 0 ]; then
|
||
|
|
errecho "failed to run sysctl"
|
||
|
|
exit 2
|
||
|
|
fi
|
||
|
|
|
||
|
|
if [ "$val" -eq 0 ]; then
|
||
|
|
echo -n "enabling $control: "
|
||
|
|
$SYSCTL "${control}=1"
|
||
|
|
if [ $? -eq 0 ]; then
|
||
|
|
changed+=("$control")
|
||
|
|
fi
|
||
|
|
fi
|
||
|
|
done
|
||
|
|
|
||
|
|
if (( ${#changed[@]} )); then
|
||
|
|
mkdir -p "$STATEDIR"
|
||
|
|
for changed in ${changed[@]}; do
|
||
|
|
echo "$changed" >>"$STATEFILE"
|
||
|
|
done
|
||
|
|
fi
|
||
|
|
elif [ "$operation" = "--disable" ]; then
|
||
|
|
if [ ! -f "$STATEFILE" ]; then
|
||
|
|
# nothing to restore
|
||
|
|
exit 0
|
||
|
|
fi
|
||
|
|
|
||
|
|
for control in `cat $STATEFILE`; do
|
||
|
|
echo -n "restoring $control: "
|
||
|
|
$SYSCTL "${control}=0" || continue
|
||
|
|
done
|
||
|
|
|
||
|
|
rm -f "$STATEFILE"
|
||
|
|
else
|
||
|
|
errecho "invalid argument: $operation"
|
||
|
|
usage
|
||
|
|
fi
|