2 ###############################################################################
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2017 IPFire Network Development Team #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
20 ###############################################################################
22 IPSEC_CONNECTION_CONFIG_SETTINGS
="\
43 IPSEC_DEFAULT_AUTH_MODE
="PSK"
44 IPSEC_DEFAULT_DPD_ACTION
="restart"
45 IPSEC_DEFAULT_DPD_DELAY
="30"
46 IPSEC_DEFAULT_DPD_TIMEOUT
="120"
47 IPSEC_DEFAULT_ENABLED
="true"
48 IPSEC_DEFAULT_INACTIVITY_TIMEOUT
="0"
49 IPSEC_DEFAULT_MODE
="tunnel"
50 IPSEC_DEFAULT_SECURITY_POLICY
="system"
51 IPSEC_DEFAULT_START_ACTION
="on-demand"
52 IPSEC_DEFAULT_TYPE
="net-to-net"
54 IPSEC_VALID_MODES
="gre-transport tunnel vti"
55 IPSEC_VALID_AUTH_MODES
="PSK"
63 cli_ipsec_connection
"$@"
69 error
"Unrecognized argument: ${action}"
75 cli_ipsec_connection
() {
76 if ipsec_connection_exists
${1}; then
83 authentication|down|disable|dpd|
enable|inactivity_timeout|
local|mode|peer|pool|remote|security_policy|start_action|up
)
84 ipsec_connection_
${key} ${connection} "$@"
87 cli_ipsec_connection_show
"${connection}"
91 error
"Unrecognized argument: ${key}"
101 ipsec_connection_new
"$@"
104 cli_ipsec_connection_destroy
"$@"
107 if [ -n "${action}" ]; then
108 error
"Unrecognized argument: '${action}'"
116 cli_ipsec_connection_destroy
() {
117 local connection
="${1}"
119 if ! ipsec_connection_destroy
"${connection}"; then
123 # Inform strongswan about the changes
124 ipsec_strongswan_load
126 # Configure strongswan autostart
127 ipsec_strongswan_autostart
130 cli_ipsec_connection_show
() {
131 local connection
="${1}"
133 # Read the config settings
134 local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
135 if ! ipsec_connection_read_config
"${connection}"; then
136 error
"Could not read the connection configuration"
140 cli_headline
0 "IPsec VPN Connection: ${connection}"
145 cli_print_fmt1
1 "Peer" "${PEER}"
149 cli_print_fmt1
1 "Security Policy" "${SECURITY_POLICY-${IPSEC_DEFAULT_SECURITY_POLICY}}"
152 cli_headline
2 "Authentication"
153 case "${AUTH_MODE^^}" in
155 cli_print_fmt1
2 "Mode" "Pre-Shared-Key"
158 cli_print_fmt1
2 "Pre-Shared-Key" "****"
160 cli_print_fmt1
2 "Pre-Shared-Key" "- is not set -"
170 for i
in LOCAL REMOTE
; do
173 cli_headline
2 "Local"
176 cli_headline
2 "Remote"
180 local id_var
="${i}_ID"
181 if [ -n "${!id_var}" ]; then
182 cli_print_fmt1
2 "ID" "${!id_var}"
185 local prefix_var
="${i}_PREFIX"
186 if isset
${prefix_var}; then
187 cli_headline
3 "Prefix(es)"
190 for prefix
in ${!prefix_var}; do
191 cli_print_fmt1
3 "${prefix}"
198 cli_headline
2 "Misc."
202 cli_print_fmt1
2 "Transport Mode" "GRE Transport"
205 cli_print_fmt1
2 "Transport Mode" "Tunnel"
208 cli_print_fmt1
2 "Transport Mode" "Virtual Tunnel Interface"
211 cli_print_fmt1
2 "Transport Mode" "- Unknown -"
216 if isset INACTIVITY_TIMEOUT
&& [ ${INACTIVITY_TIMEOUT} -gt 0 ]; then
217 cli_print_fmt1
2 "Inactivity Timeout" "$(format_time ${INACTIVITY_TIMEOUT})"
224 ipsec_connection_disable
() {
225 local connection
=${1}
227 if ! ipsec_connection_write_config_key
"${connection}" "ENABLED" "false"; then
228 log ERROR
"Could not write configuration settings"
232 # Configure strongswan autostart
233 ipsec_strongswan_autostart
236 ipsec_connection_enable
() {
237 local connection
=${1}
239 if ! ipsec_connection_write_config_key
"${connection}" "ENABLED" "true"; then
240 log ERROR
"Could not write configuration settings"
244 # Configure strongswan autostart
245 ipsec_strongswan_autostart
248 # This function writes all values to a via ${connection} specificated VPN IPsec configuration file
249 ipsec_connection_write_config
() {
252 local connection
="${1}"
254 if ! ipsec_connection_exists
"${connection}"; then
255 log ERROR
"No such VPN IPsec connection: ${connection}"
259 local path
="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
261 if ! settings_write
"${path}" ${IPSEC_CONNECTION_CONFIG_SETTINGS}; then
262 log ERROR
"Could not write configuration settings for VPN IPsec connection ${connection}"
266 ipsec_reload
${connection}
269 # This funtion writes the value for one key to a via ${connection} specificated VPN IPsec connection configuration file
270 ipsec_connection_write_config_key
() {
273 local connection
=${1}
279 if ! ipsec_connection_exists
"${connection}"; then
280 log ERROR
"No such VPN ipsec connection: ${connection}"
284 log DEBUG
"Set '${key}' to new value '${value}' in VPN ipsec connection '${connection}'"
286 local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
288 # Read the config settings
289 if ! ipsec_connection_read_config
"${connection}"; then
293 # Set the key to a new value
294 assign
"${key}" "${value}"
296 if ! ipsec_connection_write_config
"${connection}"; then
303 # Reads one or more keys out of a settings file or all if no key is provided.
304 ipsec_connection_read_config
() {
307 local connection
="${1}"
310 if ! ipsec_connection_exists
"${connection}"; then
311 log ERROR
"No such VPN IPsec connection : ${connection}"
317 if [ $# -eq 0 ] && [ -n "${IPSEC_CONNECTION_CONFIG_SETTINGS}" ]; then
318 list_append args
${IPSEC_CONNECTION_CONFIG_SETTINGS}
320 list_append args
"$@"
323 local path
="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
325 if ! settings_read
"${path}" ${args}; then
326 log ERROR
"Could not read settings for VPN IPsec connection ${connection}"
331 # This function checks if a vpn ipsec connection exists
332 # Returns True when yes and false when not
333 ipsec_connection_exists
() {
336 local connection
=${1}
338 local path
="${NETWORK_IPSEC_CONNS_DIR}/${connection}"
340 [ -d "${path}" ] && return ${EXIT_TRUE} || return ${EXIT_FALSE}
343 # Determines if strongswan should be automatically started
344 # when the system boots up.
345 ipsec_strongswan_autostart() {
346 local autostart_needed="false
"
349 for connection in $(ipsec_list_connections); do
352 if ! ipsec_connection_read_config "${connection}" "ENABLED
"; then
353 log WARNING "Could not
read configuation
"
357 if enabled ENABLED; then
358 autostart_needed="true
"
363 # Start strongswan when we need it and when it is not yet enabled
364 if ${autostart_needed}; then
365 if ! service_is_enabled "strongswan
"; then
366 service_enable "strongswan
"
369 if ! service_is_active "strongswan
"; then
370 service_start "strongswan
"
373 # Disable strongswan when we do not need it but it is enabled
374 elif ! ${autostart_needed}; then
375 if service_is_enabled "strongswan
"; then
376 service_disable "strongswan
"
379 if service_is_active "strongswan
"; then
380 service_stop "strongswan
"
385 ipsec_strongswan_load() {
386 # Do nothing if strongswan is not running
387 if ! service_is_active "strongswan
"; then
391 if ! cmd swanctl --load-all; then
392 log ERROR "Could not reload strongswan config
"
397 # Reloads the connection after config changes
399 local connection=${1}
403 if ! ipsec_connection_read_config "${connection}" "ENABLED
"; then
404 log ERROR "Could not
read configuration
for IPsec connection
${connection}"
408 if enabled ENABLED; then
409 if ! ipsec_connection_to_strongswan ${connection}; then
410 log ERROR "Could not generate strongswan config
for ${connnection}"
414 log DEBUG "Deleting strongswan config
${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf
"
415 unlink "${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf
"
418 ipsec_strongswan_load
421 # Handle the cli after authentification
422 ipsec_connection_authentication() {
423 if [ ! $# -gt 1 ]; then
424 log ERROR "Not enough arguments
"
428 local connection=${1}
434 ipsec_connection_authentication_mode "${connection}" "$@
"
437 ipsec_connection_authentication_psk "${connection}" "$@
"
440 log ERROR "Unrecognized argument
: ${cmd}"
446 # Set the authentification mode
447 ipsec_connection_authentication_mode() {
448 if [ ! $# -eq 2 ]; then
449 log ERROR "Not enough arguments
"
452 local connection=${1}
455 if ! isoneof mode ${IPSEC_VALID_AUTH_MODES}; then
456 log ERROR "Auth mode
'${mode}' is invalid
"
460 if ! ipsec_connection_write_config_key "${connection}" "AUTH_MODE
" ${mode^^}; then
461 log ERROR "Could not
write configuration settings
"
467 ipsec_connection_authentication_psk() {
468 if [ ! $# -eq 2 ]; then
469 log ERROR "Not enough arguments
"
473 local connection=${1}
478 if [ ${length} -lt 4 ]; then
479 error "The PSK must be longer than four characters
"
483 if [ ${length} -gt 128 ]; then
484 error "The PSK cannot be longer than
128 characters
"
488 if ! ipsec_connection_write_config_key "${connection}" "PSK
" "${psk}"; then
489 log ERROR "Could not
write configuration settings
"
496 ipsec_connection_up() {
497 local connection="${1}"
499 if ! ipsec_connection_exists "${connection}"; then
500 error "No such VPN IPsec connection
: ${connection}"
504 cmd swanctl --initiate --child "${connection}"
507 ipsec_connection_down() {
508 local connection="${1}"
510 if ! ipsec_connection_exists "${connection}"; then
511 error "No such VPN IPsec connection
: ${connection}"
515 cmd swanctl --terminate --ike "${connection}"
518 # Handle the cli after authentification
519 ipsec_connection_dpd() {
520 if [ ! $# -gt 1 ]; then
521 log ERROR "Not enough arguments
"
525 local connection=${1}
531 ipsec_connection_dpd_action "${connection}" "$@
"
534 ipsec_connection_dpd_delay "${connection}" "$@
"
537 ipsec_connection_dpd_timeout "${connection}" "$@
"
540 log ERROR "Unrecognized argument
: ${cmd}"
546 # Set the default dpd action
547 ipsec_connection_dpd_action() {
548 if [ ! $# -eq 2 ]; then
549 log ERROR "Not enough arguments
"
552 local connection=${1}
555 if ! isoneof action "restart
" "clear"; then
556 log ERROR "dpd action
'${action}' is invalid
"
560 if ! ipsec_connection_write_config_key "${connection}" "DPD_ACTION
" ${action}; then
561 log ERROR "Could not
write configuration settings
"
567 ipsec_connection_dpd_delay() {
568 if [ ! $# -ge 2 ]; then
569 log ERROR "Not enough arguments
"
573 local connection=${1}
577 if ! isinteger value; then
578 value=$(parse_time "$@
")
579 if [ ! $? -eq 0 ]; then
580 log ERROR "Parsing the passed
time was not sucessful please check the passed values.
"
585 if [ ${value} -lt 0 ]; then
586 log ERROR "The passed
time value must be
in the
sum greater or equal zero seconds.
"
590 if ! ipsec_connection_write_config_key "${connection}" "DPD_DELAY
" ${value}; then
591 log ERROR "Could not
write configuration settings
"
598 # Set the dpd timeout
599 ipsec_connection_dpd_timeout() {
600 if [ ! $# -ge 2 ]; then
601 log ERROR "Not enough arguments
"
605 local connection=${1}
609 if ! isinteger value; then
610 value=$(parse_time "$@
")
611 if [ ! $? -eq 0 ]; then
612 log ERROR "Parsing the passed
time was not sucessful please check the passed values.
"
617 if [ ${value} -le 0 ]; then
618 log ERROR "The passed
time value must be
in the
sum greater or equal zero seconds.
"
622 if ! ipsec_connection_write_config_key "${connection}" "DPD_TIMEOUT
" ${value}; then
623 log ERROR "Could not
write configuration settings
"
630 # Handle the cli after local
631 ipsec_connection_local() {
632 if [ ! $# -ge 2 ]; then
633 log ERROR "Not enough arguments
"
637 local connection=${1}
643 ipsec_connection_local_address "${connection}" "$@
"
646 ipsec_connection_id "${connection}" "LOCAL
" "$@
"
649 ipsec_connection_prefix "${connection}" "LOCAL
" "$@
"
652 log ERROR "Unrecognized argument
: ${cmd}"
660 # Set the connection mode
661 ipsec_connection_mode() {
662 if [ ! $# -eq 2 ]; then
663 log ERROR "Not enough arguments
"
666 local connection=${1}
669 if ! isoneof mode ${IPSEC_VALID_MODES}; then
670 log ERROR "Mode
'${mode}' is invalid
"
674 if ! ipsec_connection_write_config_key "${connection}" "MODE
" ${mode}; then
675 log ERROR "Could not
write configuration settings
"
682 # Set the local address
683 ipsec_connection_local_address() {
684 if [ ! $# -eq 2 ]; then
685 log ERROR "Not enough arguments
"
688 local connection=${1}
689 local local_address=${2}
691 if ! ipsec_connection_check_peer ${local_address}; then
692 log ERROR "Local address
'${local_address}' is invalid
"
696 if ! ipsec_connection_write_config_key "${connection}" "LOCAL_ADDRESS
" ${local_address}; then
697 log ERROR "Could not
write configuration settings
"
704 # Set the peer to connect to
705 ipsec_connection_peer() {
706 if [ ! $# -eq 2 ]; then
707 log ERROR "Not enough arguments
"
710 local connection=${1}
713 if ! ipsec_connection_check_peer ${peer}; then
714 log ERROR "Peer
'${peer}' is invalid
"
718 if ! ipsec_connection_write_config_key "${connection}" "PEER
" ${peer}; then
719 log ERROR "Could not
write configuration settings
"
726 #Set the local or remote id
727 ipsec_connection_id() {
728 if [ ! $# -eq 3 ]; then
729 log ERROR "Not enough arguments
"
732 local connection=${1}
736 if ! ipsec_connection_check_id ${id}; then
737 log ERROR "Id
'${id}' is invalid
"
741 if ! ipsec_connection_write_config_key "${connection}" "${type}_ID" ${id}; then
742 log ERROR
"Could not write configuration settings"
749 # Set the local or remote prefix
750 ipsec_connection_prefix
() {
751 if [ ! $# -ge 3 ]; then
752 log ERROR
"Not enough arguments"
755 local connection
=${1}
759 local _prefix
="${type}_PREFIX"
761 if ! ipsec_connection_read_config
"${connection}" "${_prefix}"; then
765 # Remove duplicated entries to proceed the list safely
766 assign
"${_prefix}" "$(list_unique ${!_prefix} )"
769 local prefixes_removed
772 while [ $# -gt 0 ]; do
777 list_append prefixes_added
"${arg:1}"
780 list_append prefixes_removed
"${arg:1}"
783 list_append prefixes_set
"${arg}"
786 error
"Invalid argument: ${arg}"
793 # Check if the user is trying a mixed operation
794 if ! list_is_empty prefixes_set
&& (! list_is_empty prefixes_added ||
! list_is_empty prefixes_removed
); then
795 error
"You cannot reset the prefix list and add or remove prefixes at the same time"
799 # Set new prefix list
800 if ! list_is_empty prefixes_set
; then
801 # Check if all prefixes are valid
803 for prefix
in ${prefixes_set}; do
804 if ! ip_net_is_valid
${prefix}; then
805 error
"Unsupported prefix: ${prefix}"
810 assign
"${_prefix}" "${prefixes_set}"
812 # Perform incremental updates
816 # Perform all removals
817 for prefix
in ${prefixes_removed}; do
818 if ! list_remove
"${_prefix}" ${prefix}; then
819 warning
"${prefix} was not on the list and could not be removed"
824 for prefix
in ${prefixes_added}; do
825 if ip_net_is_valid
${prefix}; then
826 if ! list_append_unique
"${_prefix}" ${prefix}; then
827 warning
"${prefix} is already on the prefix list"
830 warning
"${prefix} is not a valid IP network and could not be added"
835 # Check if the list contain at least one valid prefix
836 if list_is_empty
${_prefix}; then
837 error
"Cannot save an empty prefix list"
842 if ! ipsec_connection_write_config_key
"${connection}" "${_prefix}" ${!_prefix}; then
843 log ERROR "Could not
write configuration settings
"
849 # Set the pools to use
850 ipsec_connection_pool() {
851 if [ ! $# -ge 2 ]; then
852 log ERROR "Not enough arguments
"
855 local connection=${1}
859 if ! ipsec_connection_read_config "${connection}" "POOLS
"; then
863 # Remove duplicated entries to proceed the list safely
864 assign "POOLS
" "$
(list_unique
${POOLS})"
870 while [ $# -gt 0 ]; do
875 list_append pools_added "${arg:1}"
878 list_append pools_removed "${arg:1}"
881 list_append pools_set "${arg}"
884 error "Invalid argument
: ${arg}"
891 # Check if the user is trying a mixed operation
892 if ! list_is_empty pools_set && (! list_is_empty pools_added || ! list_is_empty pools_removed); then
893 error "You cannot
reset the pools list and add or remove pools
at the same
time"
898 if ! list_is_empty pools_set; then
899 # Check if all pools are valid
901 for pool in ${pools_set}; do
902 if ! ipsec_pool_exists ${pool} || ! ipsec_pool_check_config ${pool}; then
903 error "Pool
${pool} is not valid
"
908 assign "POOLS
" "${pools_set}"
910 # Perform incremental updates
914 # Perform all removals
915 for pool in ${pools_removed}; do
916 if ! list_remove "POOLS
" ${pool}; then
917 warning "${pool} was not on the list and could not be removed
"
922 for pool in ${pools_added}; do
923 if ipsec_pool_exists ${pool} && ipsec_pool_check_config ${pool}; then
924 if ! list_append_unique "POOLS
" ${pool}; then
925 warning "${pool} is already on the prefix list
"
928 warning "${pool} is not a valid pool
"
933 # Check if the list contain at least one valid pool
934 if list_is_empty POOLS; then
935 error "Cannot save an empty pool list
"
940 if ! ipsec_connection_write_config_key "${connection}" "POOLS
" ${POOLS}; then
941 log ERROR "Could not
write configuration settings
"
947 # Handle the cli after remote
948 ipsec_connection_remote() {
949 if [ ! $# -ge 2 ]; then
950 log ERROR "Not enough arguments
"
954 local connection=${1}
960 ipsec_connection_id "${connection}" "REMOTE
" "$@
"
964 ipsec_connection_prefix "${connection}" "REMOTE
" "$@
"
967 log ERROR "Unrecognized argument
: ${cmd}"
975 # Set the inactivity timeout
976 ipsec_connection_inactivity_timeout() {
977 if [ ! $# -ge 2 ]; then
978 log ERROR "Not enough arguments
"
982 local connection=${1}
986 if ! isinteger value; then
987 value=$(parse_time "$@
")
988 if [ ! $? -eq 0 ]; then
989 log ERROR "Parsing the passed
time was not sucessful please check the passed values.
"
994 if [ ${value} -le 0 ]; then
995 log ERROR "The passed
time value must be
in the
sum greater zero seconds.
"
999 if ! ipsec_connection_write_config_key "${connection}" "INACTIVITY_TIMEOUT
" ${value}; then
1000 log ERROR "Could not
write configuration settings
"
1001 return ${EXIT_ERROR}
1007 # Set the default start action
1008 ipsec_connection_start_action() {
1009 if [ ! $# -eq 2 ]; then
1010 log ERROR "Not enough arguments
"
1011 return ${EXIT_ERROR}
1013 local connection=${1}
1016 if ! isoneof action "on-demand
" "always-on
"; then
1017 log ERROR "Start action
'${action}' is invalid
"
1018 return ${EXIT_ERROR}
1021 if ! ipsec_connection_write_config_key "${connection}" "START_ACTION
" ${action}; then
1022 log ERROR "Could not
write configuration settings
"
1023 return ${EXIT_ERROR}
1027 # Set the security policy to use
1028 ipsec_connection_security_policy() {
1029 if [ ! $# -eq 2 ]; then
1030 log ERROR "Not enough arguments
"
1031 return ${EXIT_ERROR}
1033 local connection=${1}
1034 local security_policy=${2}
1036 if ! vpn_security_policy_exists ${security_policy}; then
1037 log ERROR "No such vpn security policy
'${security_policy}'"
1038 return ${EXIT_ERROR}
1041 if ! ipsec_connection_write_config_key "${connection}" "SECURITY_POLICY
" ${security_policy}; then
1042 log ERROR "Could not
write configuration settings
"
1043 return ${EXIT_ERROR}
1047 # Check if a id is valid
1048 ipsec_connection_check_id() {
1052 if [[ ${id} =~ ^@[[:alnum:]]+$ ]] || ip_is_valid ${id}; then
1055 return ${EXIT_FALSE}
1059 # Checks if a peer is valid
1060 ipsec_connection_check_peer() {
1064 # TODO Accept also FQDNs
1065 if ip_is_valid ${peer}; then
1068 return ${EXIT_FALSE}
1072 # This function checks if a VPN IPsec connection name is valid
1073 # Allowed are only A-Za-z0-9
1074 ipsec_connection_check_name() {
1077 local connection=${1}
1079 [[ "${connection}" =~ [^[:alnum:]$] ]]
1082 # Function that creates one VPN IPsec connection
1083 ipsec_connection_new() {
1084 if [ $# -gt 2 ]; then
1085 error "Too many arguments
"
1086 return ${EXIT_ERROR}
1089 local connection="${1}"
1092 if ! isset connection; then
1093 error "Please provide a connection name
"
1094 return ${EXIT_ERROR}
1097 # Check for duplicates
1098 if ipsec_connection_exists "${connection}"; then
1099 error "The VPN IPsec connection
${connection} already exists
"
1100 return ${EXIT_ERROR}
1103 # Check if the name of the connection is valid
1104 if ipsec_connection_check_name "${connection}"; then
1105 error "'${connection}' contains illegal characters
"
1106 return ${EXIT_ERROR}
1109 # Set TYPE to default if not set by the user
1110 if ! isset type; then
1111 type="${IPSEC_DEFAULT_TYPE}"
1114 if ! isoneof "type" "net-to-net
" "host-to-net
"; then
1115 error "Type is invalid
"
1116 return ${EXIT_ERROR}
1119 log DEBUG "Creating VPN IPsec connection
${connection}"
1121 if ! mkdir -p "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
1122 log ERROR "Could not create config directory
for ${connection}"
1123 return ${EXIT_ERROR}
1126 local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
1128 AUTH_MODE=${IPSEC_DEFAULT_AUTH_MODE}
1129 DPD_ACTION=${IPSEC_DEFAULT_DPD_ACTION}
1130 DPD_DELAY=${IPSEC_DEFAULT_DPD_DELAY}
1131 DPD_TIMEOUT=${IPSEC_DEFAULT_DPD_TIMEOUT}
1132 ENABLED=${IPSEC_DEFAULT_ENABLED}
1133 MODE=${IPSEC_DEFAULT_MODE}
1134 START_ACTION=${IPSEC_DEFAULT_START_ACTION}
1137 INACTIVITY_TIMEOUT=${IPSEC_DEFAULT_INACTIVITY_TIMEOUT}
1138 SECURITY_POLICY=${IPSEC_DEFAULT_SECURITY_POLICY}
1140 if ! ipsec_connection_write_config "${connection}"; then
1141 log ERROR "Could not
write new config
file"
1142 return ${EXIT_ERROR}
1145 # Configure strongswan autostart
1146 ipsec_strongswan_autostart
1149 # Function that deletes based on the passed parameters one ore more vpn security policies
1150 ipsec_connection_destroy() {
1152 for connection in "$@
"; do
1153 if ! ipsec_connection_exists "${connection}"; then
1154 log ERROR "The VPN IPsec connection
${connection} does not exist.
"
1158 log DEBUG "Deleting VPN IPsec connection
${connection}"
1160 # Delete strongswan configuration file
1161 file_delete "${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf
"
1163 if ! rm -rf "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
1164 log ERROR "Deleting the VPN IPsec connection
${connection} was not sucessful
"
1165 return ${EXIT_ERROR}
1171 # List all ipsec connections
1172 ipsec_list_connections() {
1174 for connection in ${NETWORK_IPSEC_CONNS_DIR}/*; do
1175 [ -d ${connection} ] || continue
1176 basename ${connection}
1180 ipsec_connection_to_strongswan() {
1181 local connection="${1}"
1182 log DEBUG "Generating IPsec configuration
for ${connection}"
1184 # Read the config settings
1185 local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
1186 if ! ipsec_connection_read_config "${connection}"; then
1187 error "Could not
read the connection
${connection}"
1188 return ${EXIT_ERROR}
1191 local path="${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf
"
1194 # Write the connection section
1195 _ipsec_connection_to_strongswan_connection "${connection}"
1197 # Write the secrets section
1198 _ipsec_connection_to_strongswan_secrets "${connection}"
1203 _ipsec_connection_to_strongswan_connection() {
1204 local connection="${1}"
1206 # Read the security policy
1207 local ${VPN_SECURITY_POLICIES_CONFIG_SETTINGS}
1208 if ! vpn_security_policies_read_config "${SECURITY_POLICY}"; then
1209 return ${EXIT_ERROR}
1214 if isset DPD_DELAY && isinteger DPD_DELAY && [ ${DPD_DELAY} -gt 0 ]; then
1218 # Write configuration header
1219 config_header "strongSwan configuration
for ${connection}"
1221 print_indent 0 "connections
{"
1222 print_indent 1 "${connection} {"
1225 print_indent 2 "# IKE Version"
1226 case "${KEY_EXCHANGE^^}" in
1228 print_indent
2 "version = 1"
1231 # Fall back to IKEv2 for any random values
1233 print_indent
2 "version = 2"
1238 # Always only keep one connection open at a time
1239 print_indent
2 "# Unique IDs"
1240 print_indent
2 "unique = replace"
1244 print_indent
2 "# Local Address"
1245 if isset LOCAL_ADDRESS
; then
1246 print_indent
2 "local_addrs = ${LOCAL_ADDRESS}"
1248 print_indent
2 "local_addrs = %any"
1253 print_indent
2 "# Remote Address"
1255 print_indent
2 "remote_addrs = ${PEER}"
1257 print_indent
2 "remote_addrs = %any"
1262 print_indent
2 "# IKE Proposals"
1263 print_indent
2 "proposals = $(vpn_security_policies_make_ike_proposal ${SECURITY_POLICY})"
1267 if enabled dpd
; then
1268 print_indent
2 "# Dead Peer Detection"
1269 print_indent
2 "dpd_delay = ${DPD_DELAY}"
1271 if isset DPD_TIMEOUT
; then
1272 print_indent
2 "dpd_timeout = ${DPD_TIMEOUT}"
1279 print_indent
2 "# Fragmentation"
1280 print_indent
2 "fragmentation = yes"
1284 # Host-to-Net specific settings
1288 if isset POOLS
; then
1289 print_indent
2 "# Pools"
1290 print_indent
2 "pools = $(list_join POOLS ", ")"
1297 print_indent
2 "local {"
1300 if isset LOCAL_ID
; then
1301 print_indent
3 "id = ${LOCAL_ID}"
1305 case "${AUTH_MODE}" in
1307 print_indent
3 "auth = psk"
1315 print_indent
2 "remote {"
1318 if isset REMOTE_ID
; then
1319 print_indent
3 "id = ${REMOTE_ID}"
1323 case "${AUTH_MODE}" in
1325 print_indent
3 "auth = psk"
1334 print_indent
2 "children {"
1335 print_indent
3 "${connection} {"
1337 print_indent
4 "# ESP Proposals"
1338 print_indent
4 "esp_proposals = $(vpn_security_policies_make_esp_proposal ${SECURITY_POLICY})"
1345 print_indent
4 "local_ts = dynamic[gre]"
1346 print_indent
4 "remote_ts = dynamic[gre]"
1350 if isset LOCAL_PREFIX
; then
1351 print_indent
4 "local_ts = $(list_join LOCAL_PREFIX ,)"
1353 print_indent
4 "local_ts = dynamic"
1357 if isset REMOTE_PREFIX
; then
1358 print_indent
4 "remote_ts = $(list_join REMOTE_PREFIX ,)"
1360 print_indent
4 "remote_ts = dynamic"
1369 print_indent
4 "# Netfilter Marks"
1370 print_indent
4 "mark_in = %unique"
1371 print_indent
4 "mark_out = %unique"
1376 # Dead Peer Detection
1377 if enabled dpd
; then
1378 print_indent
4 "# Dead Peer Detection"
1379 print_indent
4 "dpd_action = ${DPD_ACTION}"
1384 if isset LIFETIME
; then
1385 print_indent
4 "# Rekey Time"
1386 print_indent
4 "rekey_time = ${LIFETIME}"
1391 print_indent
4 "updown = ${NETWORK_HELPERS_DIR}/ipsec-updown"
1395 print_indent
4 "# Mode"
1398 print_indent
4 "mode = transport"
1401 print_indent
4 "mode = tunnel"
1407 print_indent
4 "# Compression"
1408 if enabled COMPRESSION
; then
1409 print_indent
4 "ipcomp = yes"
1411 print_indent
4 "ipcomp = no"
1415 # Inactivity Timeout
1416 if isset INACTIVITY_TIMEOUT
; then
1417 print_indent
4 "# Inactivity Timeout"
1418 print_indent
4 "inactivity = ${INACTIVITY_TIMEOUT}"
1422 # Net-to-Net specific settings
1426 print_indent
4 "# Start Action"
1427 case "${START_ACTION}" in
1429 print_indent
4 "start_action = trap"
1430 print_indent
4 "close_action = trap"
1433 print_indent
4 "start_action = none"
1434 print_indent
4 "close_action = none"
1437 print_indent
4 "start_action = start"
1438 print_indent
4 "close_action = start"
1454 _ipsec_connection_to_strongswan_secrets
() {
1455 local connection
="${1}"
1457 print_indent
0 "secrets {"
1459 case "${AUTH_MODE}" in
1461 print_indent
1 "ike {"
1464 print_indent
2 "secret = ${PSK}"
1467 if isset REMOTE_ID
; then
1468 print_indent
2 "id = ${REMOTE_ID}"