src/functions/functions.ipsec

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2017  IPFire Network Development Team                         #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 IPSEC_CONNECTION_CONFIG_SETTINGS="\
  23         AUTH_MODE \
  24         DPD_ACTION \
  25         DPD_DELAY \
  26         DPD_TIMEOUT \
  27         INACTIVITY_TIMEOUT \
  28         LOCAL_ADDRESS \
  29         LOCAL_ID \
  30         LOCAL_PREFIX \
  31         MODE \
  32         PEER \
  33         PSK \
  34         REMOTE_ID \
  35         REMOTE_PREFIX \
  36         SECURITY_POLICY"
  37
  38 # Default values
  39 IPSEC_DEFAULT_AUTH_MODE="PSK"
  40 IPSEC_DEFAULT_DPD_ACTION="restart"
  41 IPSEC_DEFAULT_DPD_DELAY="30"
  42 IPSEC_DEFAULT_DPD_TIMEOUT="120"
  43 IPSEC_DEFAULT_INACTIVITY_TIMEOUT="0"
  44 IPSEC_DEFAULT_MODE="tunnel"
  45 IPSEC_DEFAULT_SECURITY_POLICY="system"
  46 IPSEC_DEFAULT_START_ACTION="on-demand"
  47
  48 IPSEC_VALID_MODES="gre-transport tunnel vti"
  49 IPSEC_VALID_AUTH_MODES="PSK"
  50
  51 cli_ipsec() {
  52         local action=${1}
  53         shift 1
  54
  55         case "${action}" in
  56                 connection)
  57                         cli_ipsec_connection $@
  58                         ;;
  59                 *)
  60                         error "Unrecognized argument: ${action}"
  61                         exit ${EXIT_ERROR}
  62                         ;;
  63         esac
  64 }
  65
  66 cli_ipsec_connection() {
  67         if ipsec_connection_exists ${1}; then
  68                 local connection=${1}
  69                 local key=${2}
  70                 key=${key//-/_}
  71                 shift 2
  72
  73                 case "${key}" in
  74                         authentication|down|dpd|inactivity_timeout|local|mode|peer|remote|security_policy|start_action|up)
  75                                 ipsec_connection_${key} ${connection} $@
  76                                 ;;
  77                         show)
  78                                 cli_ipsec_connection_show "${connection}"
  79                                 exit $?
  80                                 ;;
  81                         *)
  82                                 error "Unrecognized argument: ${key}"
  83                                 exit ${EXIT_ERROR}
  84                                 ;;
  85                 esac
  86         else
  87                 local action=${1}
  88                 shift
  89
  90                 case "${action}" in
  91                         new)
  92                                 ipsec_connection_new $@
  93                                 ;;
  94                         destroy)
  95                                 ipsec_connection_destroy $@
  96                                 ;;
  97                         ""|*)
  98                                 if [ -n "${action}" ]; then
  99                                         error "Unrecognized argument: '${action}'"
 100                                 fi
 101                                 exit ${EXIT_ERROR}
 102                                 ;;
 103                 esac
 104         fi
 105 }
 106
 107 cli_ipsec_connection_show() {
 108         local connection="${1}"
 109
 110         # Read the config settings
 111         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 112         if ! ipsec_connection_read_config "${connection}"; then
 113                 error "Could not read the connection configuration"
 114                 return ${EXIT_ERROR}
 115         fi
 116
 117         cli_headline 0 "IPsec VPN Connection: ${connection}"
 118         cli_space
 119
 120         # Peer
 121         if isset PEER; then
 122                 cli_print_fmt1 1 "Peer" "${PEER}"
 123         fi
 124
 125         # Security Policy
 126         cli_print_fmt1 1 "Security Policy" "${SECURITY_POLICY-${IPSEC_DEFAULT_SECURITY_POLICY}}"
 127         cli_space
 128
 129         cli_headline 2 "Authentication"
 130         case "${AUTH_MODE^^}" in
 131                 PSK)
 132                         cli_print_fmt1 2 "Mode" "Pre-Shared-Key"
 133
 134                         if isset PSK; then
 135                                 cli_print_fmt1 2 "Pre-Shared-Key" "****"
 136                         else
 137                                 cli_print_fmt1 2 "Pre-Shared-Key" "- is not set -"
 138                         fi
 139                         ;;
 140                 X509)
 141                         : # TODO
 142                         ;;
 143         esac
 144         cli_space
 145
 146         local i
 147         for i in LOCAL REMOTE; do
 148                 case "${i}" in
 149                         LOCAL)
 150                                 cli_headline 2 "Local"
 151                                 ;;
 152                         REMOTE)
 153                                 cli_headline 2 "Remote"
 154                                 ;;
 155                 esac
 156
 157                 local id_var="${i}_ID"
 158                 if [ -n "${!id_var}" ]; then
 159                         cli_print_fmt1 2 "ID" "${!id_var}"
 160                 fi
 161
 162                 local prefix_var="${i}_PREFIX"
 163                 if isset ${prefix_var}; then
 164                         cli_headline 3 "Prefix(es)"
 165
 166                         local prefix
 167                         for prefix in ${!prefix_var}; do
 168                                 cli_print_fmt1 3 "${prefix}"
 169                         done
 170                 fi
 171
 172                 cli_space
 173         done
 174
 175         cli_headline 2 "Misc."
 176
 177         case "${MODE}" in
 178                 gre-transport)
 179                         cli_print_fmt1 2 "Transport Mode" "GRE Transport"
 180                         ;;
 181                 tunnel)
 182                         cli_print_fmt1 2 "Transport Mode" "Tunnel"
 183                         ;;
 184                 vti)
 185                         cli_print_fmt1 2 "Transport Mode" "Virtual Tunnel Interface"
 186                         ;;
 187                 *)
 188                         cli_print_fmt1 2 "Transport Mode" "- Unknown -"
 189                         ;;
 190         esac
 191
 192         # Inactivity timeout
 193         if isset INACTIVITY_TIMEOUT && [ ${INACTIVITY_TIMEOUT} -gt 0 ]; then
 194                 cli_print_fmt1 2 "Inactivity Timeout" "$(format_time ${INACTIVITY_TIMEOUT})"
 195         fi
 196         cli_space
 197
 198         return ${EXIT_OK}
 199 }
 200
 201 # This function writes all values to a via ${connection} specificated VPN IPsec configuration file
 202 ipsec_connection_write_config() {
 203         assert [ $# -ge 1 ]
 204
 205         local connection="${1}"
 206
 207         if ! ipsec_connection_exists "${connection}"; then
 208                 log ERROR "No such VPN IPsec connection: ${connection}"
 209                 return ${EXIT_ERROR}
 210         fi
 211
 212         local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
 213
 214         if ! settings_write "${path}" ${IPSEC_CONNECTION_CONFIG_SETTINGS}; then
 215                 log ERROR "Could not write configuration settings for VPN IPsec connection ${connection}"
 216                 return ${EXIT_ERROR}
 217         fi
 218
 219         ipsec_reload ${connection}
 220 }
 221
 222 # This funtion writes the value for one key to a via ${connection} specificated VPN IPsec connection configuration file
 223 ipsec_connection_write_config_key() {
 224         assert [ $# -ge 3 ]
 225
 226         local connection=${1}
 227         local key=${2}
 228         shift 2
 229
 230         local value="$@"
 231
 232         if ! ipsec_connection_exists "${connection}"; then
 233                 log ERROR "No such VPN ipsec connection: ${connection}"
 234                 return ${EXIT_ERROR}
 235         fi
 236
 237         log DEBUG "Set '${key}' to new value '${value}' in VPN ipsec connection '${connection}'"
 238
 239         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 240
 241         # Read the config settings
 242         if ! ipsec_connection_read_config "${connection}"; then
 243                 return ${EXIT_ERROR}
 244         fi
 245
 246         # Set the key to a new value
 247         assign "${key}" "${value}"
 248
 249         if ! ipsec_connection_write_config "${connection}"; then
 250                 return ${EXIT_ERROR}
 251         fi
 252
 253         return ${EXIT_TRUE}
 254 }
 255
 256 # Reads one or more keys out of a settings file or all if no key is provided.
 257 ipsec_connection_read_config() {
 258         assert [ $# -ge 1 ]
 259
 260         local connection="${1}"
 261         shift 1
 262
 263         if ! ipsec_connection_exists "${connection}"; then
 264                 log ERROR "No such VPN IPsec connection : ${connection}"
 265                 return ${EXIT_ERROR}
 266         fi
 267
 268
 269         local args
 270         if [ $# -eq 0 ] && [ -n "${IPSEC_CONNECTION_CONFIG_SETTINGS}" ]; then
 271                 list_append args ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 272         else
 273                 list_append args $@
 274         fi
 275
 276         local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
 277
 278         if ! settings_read "${path}" ${args}; then
 279                 log ERROR "Could not read settings for VPN IPsec connection ${connection}"
 280                 return ${EXIT_ERROR}
 281         fi
 282 }
 283
 284 # This function checks if a vpn ipsec connection exists
 285 # Returns True when yes and false when not
 286 ipsec_connection_exists() {
 287         assert [ $# -eq 1 ]
 288
 289         local connection=${1}
 290
 291         local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}"
 292
 293         [ -d "${path}" ] && return ${EXIT_TRUE} || return ${EXIT_FALSE}
 294 }
 295
 296 # Reloads the connection after config changes
 297 ipsec_reload() {
 298         local connection=${1}
 299
 300         if ! ipsec_connection_to_strongswan ${connection}; then
 301                 log ERROR "Could not generate strongswan config for ${connnection}"
 302                 return ${EXIT_ERROR}
 303         fi
 304
 305         if ! cmd swanctl --load-all; then
 306                 log ERROR "Could not reload strongswan config"
 307                 return ${EXIT_ERROR}
 308         fi
 309 }
 310
 311 # Handle the cli after authentification
 312 ipsec_connection_authentication() {
 313         if [ ! $# -gt 1 ]; then
 314                 log ERROR "Not enough arguments"
 315                 return ${EXIT_ERROR}
 316         fi
 317
 318         local connection=${1}
 319         local cmd=${2}
 320         shift 2
 321
 322         case ${cmd} in
 323                 mode)
 324                         ipsec_connection_authentication_mode "${connection}" $@
 325                         ;;
 326                 pre-shared-key)
 327                         ipsec_connection_authentication_psk "${connection}" $@
 328                         ;;
 329                 *)
 330                         log ERROR "Unrecognized argument: ${cmd}"
 331                         return ${EXIT_ERROR}
 332                         ;;
 333         esac
 334 }
 335
 336 # Set the authentification mode
 337 ipsec_connection_authentication_mode() {
 338         if [ ! $# -eq 2 ]; then
 339                 log ERROR "Not enough arguments"
 340                 return ${EXIT_ERROR}
 341         fi
 342         local connection=${1}
 343         local mode=${2}
 344
 345         if ! isoneof mode ${IPSEC_VALID_AUTH_MODES}; then
 346                 log ERROR "Auth mode '${mode}' is invalid"
 347                 return ${EXIT_ERROR}
 348         fi
 349
 350         if ! ipsec_connection_write_config_key "${connection}" "AUTH_MODE" ${mode^^}; then
 351                 log ERROR "Could not write configuration settings"
 352                 return ${EXIT_ERROR}
 353         fi
 354 }
 355
 356 # Set the psk
 357 ipsec_connection_authentication_psk() {
 358         if [ ! $# -eq 2 ]; then
 359                 log ERROR "Not enough arguments"
 360                 return ${EXIT_ERROR}
 361         fi
 362
 363         local connection=${1}
 364         local psk=${2}
 365
 366         local length=${#psk}
 367
 368         if [ ${length} -lt 4 ]; then
 369                 error "The PSK must be longer than four characters"
 370                 return ${EXIT_ERROR}
 371         fi
 372
 373         if [ ${length} -gt 128 ]; then
 374                 error "The PSK cannot be longer than 128 characters"
 375                 return ${EXIT_ERROR}
 376         fi
 377
 378         if ! ipsec_connection_write_config_key "${connection}" "PSK" "${psk}"; then
 379                 log ERROR "Could not write configuration settings"
 380                 return ${EXIT_ERROR}
 381         fi
 382
 383         return ${EXIT_OK}
 384 }
 385
 386 ipsec_connection_up() {
 387         local connection="${1}"
 388
 389         if ! ipsec_connection_exists "${connection}"; then
 390                 error "No such VPN IPsec connection: ${connection}"
 391                 return ${EXIT_ERROR}
 392         fi
 393
 394         cmd swanctl --initiate --child "${connection}"
 395 }
 396
 397 ipsec_connection_down() {
 398         local connection="${1}"
 399
 400         if ! ipsec_connection_exists "${connection}"; then
 401                 error "No such VPN IPsec connection: ${connection}"
 402                 return ${EXIT_ERROR}
 403         fi
 404
 405         cmd swanctl --terminate --ike "${connection}"
 406 }
 407
 408 # Handle the cli after authentification
 409 ipsec_connection_dpd() {
 410         if [ ! $# -gt 1 ]; then
 411                 log ERROR "Not enough arguments"
 412                 return ${EXIT_ERROR}
 413         fi
 414
 415         local connection=${1}
 416         local cmd=${2}
 417         shift 2
 418
 419         case ${cmd} in
 420                 action)
 421                         ipsec_connection_dpd_action "${connection}" $@
 422                         ;;
 423                 delay)
 424                         ipsec_connection_dpd_delay "${connection}" $@
 425                         ;;
 426                 timeout)
 427                         ipsec_connection_dpd_timeout "${connection}" $@
 428                         ;;
 429                 *)
 430                         log ERROR "Unrecognized argument: ${cmd}"
 431                         return ${EXIT_ERROR}
 432                         ;;
 433         esac
 434 }
 435
 436 # Set the default dpd action
 437 ipsec_connection_dpd_action() {
 438         if [ ! $# -eq 2 ]; then
 439                 log ERROR "Not enough arguments"
 440                 return ${EXIT_ERROR}
 441         fi
 442         local connection=${1}
 443         local action=${2}
 444
 445         if ! isoneof action "restart" "clear"; then
 446                 log ERROR "dpd action '${action}' is invalid"
 447                 return ${EXIT_ERROR}
 448         fi
 449
 450         if ! ipsec_connection_write_config_key "${connection}" "DPD_ACTION" ${action}; then
 451                 log ERROR "Could not write configuration settings"
 452                 return ${EXIT_ERROR}
 453         fi
 454 }
 455
 456 # Set the dpd delay
 457 ipsec_connection_dpd_delay() {
 458         if [ ! $# -ge 2 ]; then
 459                 log ERROR "Not enough arguments"
 460                 return ${EXIT_ERROR}
 461         fi
 462
 463         local connection=${1}
 464         shift 1
 465         local value=$@
 466
 467         if ! isinteger value; then
 468                 value=$(parse_time $@)
 469                 if [ ! $? -eq 0 ]; then
 470                         log ERROR "Parsing the passed time was not sucessful please check the passed values."
 471                         return ${EXIT_ERROR}
 472                 fi
 473         fi
 474
 475         if [ ${value} -lt 0 ]; then
 476                 log ERROR "The passed time value must be in the sum greater or equal zero seconds."
 477                 return ${EXIT_ERROR}
 478         fi
 479
 480         if ! ipsec_connection_write_config_key "${connection}" "DPD_DELAY" ${value}; then
 481                 log ERROR "Could not write configuration settings"
 482                 return ${EXIT_ERROR}
 483         fi
 484
 485         return ${EXIT_OK}
 486 }
 487
 488 # Set the dpd timeout
 489 ipsec_connection_dpd_timeout() {
 490         if [ ! $# -ge 2 ]; then
 491                 log ERROR "Not enough arguments"
 492                 return ${EXIT_ERROR}
 493         fi
 494
 495         local connection=${1}
 496         shift 1
 497         local value=$@
 498
 499         if ! isinteger value; then
 500                 value=$(parse_time $@)
 501                 if [ ! $? -eq 0 ]; then
 502                         log ERROR "Parsing the passed time was not sucessful please check the passed values."
 503                         return ${EXIT_ERROR}
 504                 fi
 505         fi
 506
 507         if [ ${value} -le 0 ]; then
 508                 log ERROR "The passed time value must be in the sum greater or equal zero seconds."
 509                 return ${EXIT_ERROR}
 510         fi
 511
 512         if ! ipsec_connection_write_config_key "${connection}" "DPD_TIMEOUT" ${value}; then
 513                 log ERROR "Could not write configuration settings"
 514                 return ${EXIT_ERROR}
 515         fi
 516
 517         return ${EXIT_OK}
 518 }
 519
 520 # Handle the cli after local
 521 ipsec_connection_local() {
 522         if [ ! $# -ge 2 ]; then
 523                 log ERROR "Not enough arguments"
 524                 return ${EXIT_ERROR}
 525         fi
 526
 527         local connection=${1}
 528         local cmd=${2}
 529         shift 2
 530
 531         case ${cmd} in
 532                 address)
 533                         ipsec_connection_local_address "${connection}" $@
 534                         ;;
 535                 id)
 536                         ipsec_connection_id "${connection}" "LOCAL" $@
 537                         ;;
 538                 prefix)
 539                         ipsec_connection_prefix "${connection}" "LOCAL" $@
 540                         ;;
 541                 *)
 542                         log ERROR "Unrecognized argument: ${cmd}"
 543                         return ${EXIT_ERROR}
 544                         ;;
 545         esac
 546
 547         return ${EXIT_OK}
 548 }
 549
 550 # Set the connection mode
 551 ipsec_connection_mode() {
 552         if [ ! $# -eq 2 ]; then
 553                 log ERROR "Not enough arguments"
 554                 return ${EXIT_ERROR}
 555         fi
 556         local connection=${1}
 557         local mode=${2}
 558
 559         if ! isoneof mode ${IPSEC_VALID_MODES}; then
 560                 log ERROR "Mode '${mode}' is invalid"
 561                 return ${EXIT_ERROR}
 562         fi
 563
 564         if ! ipsec_connection_write_config_key "${connection}" "MODE" ${mode}; then
 565                 log ERROR "Could not write configuration settings"
 566                 return ${EXIT_ERROR}
 567         fi
 568
 569         return ${EXIT_OK}
 570 }
 571
 572 # Set the local address
 573 ipsec_connection_local_address() {
 574         if [ ! $# -eq 2 ]; then
 575                 log ERROR "Not enough arguments"
 576                 return ${EXIT_ERROR}
 577         fi
 578         local connection=${1}
 579         local local_address=${2}
 580
 581         if ! ipsec_connection_check_peer ${local_address}; then
 582                 log ERROR "Local address '${local_address}' is invalid"
 583                 return ${EXIT_ERROR}
 584         fi
 585
 586         if ! ipsec_connection_write_config_key "${connection}" "LOCAL_ADDRESS" ${local_address}; then
 587                 log ERROR "Could not write configuration settings"
 588                 return ${EXIT_ERROR}
 589         fi
 590
 591         return ${EXIT_OK}
 592 }
 593
 594 # Set the peer to connect to
 595 ipsec_connection_peer() {
 596         if [ ! $# -eq 2 ]; then
 597                 log ERROR "Not enough arguments"
 598                 return ${EXIT_ERROR}
 599         fi
 600         local connection=${1}
 601         local peer=${2}
 602
 603         if ! ipsec_connection_check_peer ${peer}; then
 604                 log ERROR "Peer '${peer}' is invalid"
 605                 return ${EXIT_ERROR}
 606         fi
 607
 608         if ! ipsec_connection_write_config_key "${connection}" "PEER" ${peer}; then
 609                 log ERROR "Could not write configuration settings"
 610                 return ${EXIT_ERROR}
 611         fi
 612
 613         return ${EXIT_OK}
 614 }
 615
 616 #Set the local or remote id
 617 ipsec_connection_id() {
 618         if [ ! $# -eq 3 ]; then
 619                 log ERROR "Not enough arguments"
 620                 return ${EXIT_ERROR}
 621         fi
 622         local connection=${1}
 623         local type=${2}
 624         local id=${3}
 625
 626         if ! ipsec_connection_check_id ${id}; then
 627                 log ERROR "Id '${id}' is invalid"
 628                 return ${EXIT_ERROR}
 629         fi
 630
 631         if ! ipsec_connection_write_config_key "${connection}" "${type}_ID" ${id}; then
 632                 log ERROR "Could not write configuration settings"
 633                 return ${EXIT_ERROR}
 634         fi
 635
 636         return ${EXIT_OK}
 637 }
 638
 639 # Set the local or remote prefix
 640 ipsec_connection_prefix() {
 641         if [ ! $# -ge 3 ]; then
 642                 log ERROR "Not enough arguments"
 643                 return ${EXIT_ERROR}
 644         fi
 645         local connection=${1}
 646         local type=${2}
 647         shift 2
 648
 649         local _prefix="${type}_PREFIX"
 650         local "${_prefix}"
 651         if ! ipsec_connection_read_config "${connection}" "${_prefix}"; then
 652                 return ${EXIT_ERROR}
 653         fi
 654
 655         # Remove duplicated entries to proceed the list safely
 656         assign "${_prefix}" "$(list_unique ${!_prefix} )"
 657
 658         local prefixes_added
 659         local prefixes_removed
 660         local prefixes_set
 661
 662         while [ $# -gt 0 ]; do
 663                 local arg="${1}"
 664
 665                 case "${arg}" in
 666                         +*)
 667                                 list_append prefixes_added "${arg:1}"
 668                                 ;;
 669                         -*)
 670                                 list_append prefixes_removed "${arg:1}"
 671                                 ;;
 672                         [A-Fa-f0-9]*)
 673                                 list_append prefixes_set "${arg}"
 674                                 ;;
 675                         *)
 676                                 error "Invalid argument: ${arg}"
 677                                 return ${EXIT_ERROR}
 678                                 ;;
 679                 esac
 680                 shift
 681         done
 682
 683         # Check if the user is trying a mixed operation
 684         if ! list_is_empty prefixes_set && (! list_is_empty prefixes_added || ! list_is_empty prefixes_removed); then
 685                 error "You cannot reset the prefix list and add or remove prefixes at the same time"
 686                 return ${EXIT_ERROR}
 687         fi
 688
 689         # Set new prefix list
 690         if ! list_is_empty prefixes_set; then
 691                 # Check if all prefixes are valid
 692                 local prefix
 693                 for prefix in ${prefixes_set}; do
 694                         if ! ip_net_is_valid ${prefix}; then
 695                                 error "Unsupported prefix: ${prefix}"
 696                                 return ${EXIT_ERROR}
 697                         fi
 698                 done
 699
 700                 assign "${_prefix}" "${prefixes_set}"
 701
 702         # Perform incremental updates
 703         else
 704                 local prefix
 705
 706                 # Perform all removals
 707                 for prefix in ${prefixes_removed}; do
 708                         if ! list_remove "${_prefix}" ${prefix}; then
 709                                 warning "${prefix} was not on the list and could not be removed"
 710                         fi
 711                 done
 712
 713
 714                 for prefix in ${prefixes_added}; do
 715                         if ip_net_is_valid ${prefix}; then
 716                                 if ! list_append_unique "${_prefix}" ${prefix}; then
 717                                         warning "${prefix} is already on the prefix list"
 718                                 fi
 719                         else
 720                                 warning "${prefix} is not a valid IP network and could not be added"
 721                         fi
 722                 done
 723         fi
 724
 725         # Check if the list contain at least one valid prefix
 726         if list_is_empty ${_prefix}; then
 727                 error "Cannot save an empty prefix list"
 728                 return ${EXIT_ERROR}
 729         fi
 730
 731         # Save everything
 732         if ! ipsec_connection_write_config_key "${connection}" "${_prefix}" ${!_prefix}; then
 733                 log ERROR "Could not write configuration settings"
 734         fi
 735
 736         return ${EXIT_OK}
 737 }
 738
 739 # Handle the cli after remote
 740 ipsec_connection_remote() {
 741         if [ ! $# -ge 2 ]; then
 742                 log ERROR "Not enough arguments"
 743                 return ${EXIT_ERROR}
 744         fi
 745
 746         local connection=${1}
 747         local cmd=${2}
 748         shift 2
 749
 750         case ${cmd} in
 751                 id)
 752                         ipsec_connection_id "${connection}" "REMOTE" $@
 753                         ;;
 754
 755                 prefix)
 756                         ipsec_connection_prefix "${connection}" "REMOTE" $@
 757                         ;;
 758                 *)
 759                         log ERROR "Unrecognized argument: ${cmd}"
 760                         return ${EXIT_ERROR}
 761                         ;;
 762         esac
 763
 764         return ${EXIT_OK}
 765 }
 766
 767 # Set the inactivity timeout
 768 ipsec_connection_inactivity_timeout() {
 769         if [ ! $# -ge 2 ]; then
 770                 log ERROR "Not enough arguments"
 771                 return ${EXIT_ERROR}
 772         fi
 773
 774         local connection=${1}
 775         shift 1
 776         local value=$@
 777
 778         if ! isinteger value; then
 779                 value=$(parse_time $@)
 780                 if [ ! $? -eq 0 ]; then
 781                         log ERROR "Parsing the passed time was not sucessful please check the passed values."
 782                         return ${EXIT_ERROR}
 783                 fi
 784         fi
 785
 786         if [ ${value} -le 0 ]; then
 787                 log ERROR "The passed time value must be in the sum greater zero seconds."
 788                 return ${EXIT_ERROR}
 789         fi
 790
 791         if ! ipsec_connection_write_config_key "${connection}" "INACTIVITY_TIMEOUT" ${value}; then
 792                 log ERROR "Could not write configuration settings"
 793                 return ${EXIT_ERROR}
 794         fi
 795
 796         return ${EXIT_OK}
 797 }
 798
 799 # Set the default start action
 800 ipsec_connection_start_action() {
 801         if [ ! $# -eq 2 ]; then
 802                 log ERROR "Not enough arguments"
 803                 return ${EXIT_ERROR}
 804         fi
 805         local connection=${1}
 806         local action=${2}
 807
 808         if ! isoneof action "on-demand" "always-on"; then
 809                 log ERROR "Start action '${action}' is invalid"
 810                 return ${EXIT_ERROR}
 811         fi
 812
 813         if ! ipsec_connection_write_config_key "${connection}" "START_ACTION" ${action}; then
 814                 log ERROR "Could not write configuration settings"
 815                 return ${EXIT_ERROR}
 816         fi
 817 }
 818
 819 # Set the security policy to use
 820 ipsec_connection_security_policy() {
 821         if [ ! $# -eq 2 ]; then
 822                 log ERROR "Not enough arguments"
 823                 return ${EXIT_ERROR}
 824         fi
 825         local connection=${1}
 826         local security_policy=${2}
 827
 828         if ! vpn_security_policy_exists ${security_policy}; then
 829                 log ERROR "No such vpn security policy '${security_policy}'"
 830                 return ${EXIT_ERROR}
 831         fi
 832
 833         if ! ipsec_connection_write_config_key "${connection}" "SECURITY_POLICY" ${security_policy}; then
 834                 log ERROR "Could not write configuration settings"
 835                 return ${EXIT_ERROR}
 836         fi
 837 }
 838
 839 # Check if a id is valid
 840 ipsec_connection_check_id() {
 841         assert [ $# -eq 1 ]
 842         local id=${1}
 843
 844         if [[ ${id} =~ ^@[[:alnum:]]+$ ]] || ip_is_valid ${id}; then
 845                 return ${EXIT_TRUE}
 846         else
 847                 return ${EXIT_FALSE}
 848         fi
 849 }
 850
 851 # Checks if a peer is valid
 852 ipsec_connection_check_peer() {
 853         assert [ $# -eq 1 ]
 854         local peer=${1}
 855
 856         # TODO Accept also FQDNs
 857         if ip_is_valid ${peer}; then
 858                 return ${EXIT_TRUE}
 859         else
 860                 return ${EXIT_FALSE}
 861         fi
 862 }
 863
 864 # This function checks if a VPN IPsec connection name is valid
 865 # Allowed are only A-Za-z0-9
 866 ipsec_connection_check_name() {
 867         assert [ $# -eq 1 ]
 868
 869         local connection=${1}
 870
 871         [[ "${connection}" =~ [^[:alnum:]$] ]]
 872 }
 873
 874 # Function that creates one VPN IPsec connection
 875 ipsec_connection_new() {
 876         if [ $# -gt 1 ]; then
 877                 error "Too many arguments"
 878                 return ${EXIT_ERROR}
 879         fi
 880
 881         local connection="${1}"
 882         if ! isset connection; then
 883                 error "Please provide a connection name"
 884                 return ${EXIT_ERROR}
 885         fi
 886
 887         # Check for duplicates
 888         if ipsec_connection_exists "${connection}"; then
 889                 error "The VPN IPsec connection ${connection} already exists"
 890                 return ${EXIT_ERROR}
 891         fi
 892
 893         # Check if the name of the connection is valid
 894         if  ipsec_connection_check_name "${connection}"; then
 895                 error "'${connection}' contains illegal characters"
 896                 return ${EXIT_ERROR}
 897         fi
 898
 899         log DEBUG "Creating VPN IPsec connection ${connection}"
 900
 901         if ! mkdir -p "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
 902                 log ERROR "Could not create config directory for ${connection}"
 903                 return ${EXIT_ERROR}
 904         fi
 905
 906         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 907
 908         AUTH_MODE=${IPSEC_DEFAULT_AUTH_MODE}
 909         DPD_ACTION=${IPSEC_DEFAULT_DPD_ACTION}
 910         DPD_DELAY=${IPSEC_DEFAULT_DPD_DELAY}
 911         DPD_TIMEOUT=${IPSEC_DEFAULT_DPD_TIMEOUT}
 912         MODE=${IPSEC_DEFAULT_MODE}
 913         START_ACTION=${IPSEC_DEFAULT_START_ACTION}
 914
 915         INACTIVITY_TIMEOUT=${IPSEC_DEFAULT_INACTIVITY_TIMEOUT}
 916         SECURITY_POLICY=${IPSEC_DEFAULT_SECURITY_POLICY}
 917
 918         if ! ipsec_connection_write_config "${connection}"; then
 919                 log ERROR "Could not write new config file"
 920                 return ${EXIT_ERROR}
 921         fi
 922 }
 923
 924 # Function that deletes based on the passed parameters one ore more vpn security policies
 925 ipsec_connection_destroy() {
 926         local connection
 927         for connection in $@; do
 928                 if ! ipsec_connection_exists "${connection}"; then
 929                         log ERROR "The VPN IPsec connection ${connection} does not exist."
 930                         continue
 931                 fi
 932
 933                 log DEBUG "Deleting VPN IPsec connection ${connection}"
 934                 if ! rm -rf "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
 935                         log ERROR "Deleting the VPN IPsec connection ${connection} was not sucessful"
 936                         return ${EXIT_ERROR}
 937                 fi
 938         done
 939 }
 940
 941 # List all ipsec connections
 942 ipsec_list_connections() {
 943         local connection
 944         for connection in ${NETWORK_IPSEC_CONNS_DIR}/*; do
 945                 [ -d ${connection} ] || continue
 946                 basename ${connection}
 947         done
 948 }
 949
 950 ipsec_connection_to_strongswan() {
 951         local connection="${1}"
 952
 953         # Read the config settings
 954         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 955         if ! ipsec_connection_read_config "${connection}"; then
 956                 error "Could not read the connection ${connection}"
 957                 return ${EXIT_ERROR}
 958         fi
 959
 960         local path="${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf"
 961
 962         (
 963                 # Write the connection section
 964                 _ipsec_connection_to_strongswan_connection "${connection}"
 965
 966                 # Write the secrets section
 967                 _ipsec_connection_to_strongswan_secrets "${connection}"
 968
 969         ) > ${path}
 970 }
 971
 972 _ipsec_connection_to_strongswan_connection() {
 973         local connection="${1}"
 974
 975         # Read the security policy
 976         local ${VPN_SECURITY_POLICIES_CONFIG_SETTINGS}
 977         if ! vpn_security_policies_read_config "${SECURITY_POLICY}"; then
 978                 return ${EXIT_ERROR}
 979         fi
 980
 981         # Is DPD enabled?
 982         local dpd="false"
 983         if isset DPD_DELAY && isinteger DPD_DELAY && [ ${DPD_DELAY} -gt 0 ]; then
 984                 dpd="true"
 985         fi
 986
 987         print_indent 0 "connections {"
 988         print_indent 1 "${connection} {"
 989
 990         # IKE Version
 991         print_indent 2 "# IKE Version"
 992         case "${KEY_EXCHANGE^^}" in
 993                 IKEV1)
 994                         print_indent 2 "version = 1"
 995                         ;;
 996
 997                 # Fall back to IKEv2 for any random values
 998                 IKEV2|*)
 999                         print_indent 2 "version = 2"
1000                         ;;
1001         esac
1002         print # empty line
1003
1004         # Local Address
1005         print_indent 2 "# Local Address"
1006         if isset LOCAL_ADDRESS; then
1007                 print_indent 2 "local_addrs = ${LOCAL_ADDRESS}"
1008         else
1009                 print_indent 2 "local_addrs = %any"
1010         fi
1011         print
1012
1013         # Remote Address
1014         print_indent 2 "# Remote Address"
1015         if isset PEER; then
1016                 print_indent 2 "remote_addrs = ${PEER}"
1017         else
1018                 print_indent 2 "remote_addrs = %any"
1019         fi
1020         print
1021
1022         # IKE Proposals
1023         print_indent 2 "# IKE Proposals"
1024         print_indent 2 "proposals = $(vpn_security_policies_make_ike_proposal ${SECURITY_POLICY})"
1025         print
1026
1027         # DPD Settings
1028         if enabled dpd; then
1029                 print_indent 2 "# Dead Peer Detection"
1030                 print_indent 2 "dpd_delay = ${DPD_DELAY}"
1031
1032                 if isset DPD_TIMEOUT; then
1033                         print_indent 2 "dpd_timeout = ${DPD_TIMEOUT}"
1034                 fi
1035
1036                 print
1037         fi
1038
1039         # Fragmentation
1040         print_indent 2 "# Fragmentation"
1041         print_indent 2 "fragmentation = yes"
1042         print
1043
1044         # Local
1045         print_indent 2 "local {"
1046
1047         # Local ID
1048         if isset LOCAL_ID; then
1049                 print_indent 3 "id = ${LOCAL_ID}"
1050         fi
1051
1052         # Authentication
1053         case "${AUTH_MODE}" in
1054                 PSK)
1055                         print_indent 3 "auth = psk"
1056                         ;;
1057         esac
1058
1059         print_indent 2 "}"
1060         print
1061
1062         # Remote
1063         print_indent 2 "remote {"
1064
1065         # Remote ID
1066         if isset REMOTE_ID; then
1067                 print_indent 3 "id = ${REMOTE_ID}"
1068         fi
1069
1070         # Authentication
1071         case "${AUTH_MODE}" in
1072                 PSK)
1073                         print_indent 3 "auth = psk"
1074                         ;;
1075         esac
1076
1077         print_indent 2 "}"
1078         print
1079
1080         # Children
1081
1082         print_indent 2 "children {"
1083         print_indent 3 "${connection} {"
1084
1085         print_indent 4 "# ESP Proposals"
1086         print_indent 4 "esp_proposals = $(vpn_security_policies_make_esp_proposal ${SECURITY_POLICY})"
1087         print
1088
1089         # Traffic Selectors
1090
1091         case "${MODE}" in
1092                 gre-*)
1093                         print_indent 4 "local_ts = dynamic[gre]"
1094                         print_indent 4 "remote_ts = dynamic[gre]"
1095                         ;;
1096                 *)
1097                         # Local Prefixes
1098                         if isset LOCAL_PREFIX; then
1099                                 print_indent 4 "local_ts = $(list_join LOCAL_PREFIX ,)"
1100                         else
1101                                 print_indent 4 "local_ts = dynamic"
1102                         fi
1103
1104                         # Remote Prefixes
1105                         if isset REMOTE_PREFIX; then
1106                                 print_indent 4 "remote_ts = $(list_join REMOTE_PREFIX ,)"
1107                         else
1108                                 print_indent 4 "remote_ts = dynamic"
1109                         fi
1110                         ;;
1111         esac
1112         print
1113
1114         # Netfilter Marks
1115         print_indent 4 "# Netfilter Marks"
1116         print_indent 4 "mark_in = %unique"
1117         print_indent 4 "mark_out = %unique"
1118         print
1119
1120         # Dead Peer Detection
1121         if enabled dpd; then
1122                 print_indent 4 "# Dead Peer Detection"
1123                 print_indent 4 "dpd_action = ${DPD_ACTION}"
1124                 print
1125         fi
1126
1127         # Rekeying
1128         if isset LIFETIME; then
1129                 print_indent 4 "# Rekey Time"
1130                 print_indent 4 "rekey_time = ${LIFETIME}"
1131                 print
1132         fi
1133
1134         # Updown Script
1135         print_indent 4 "updown = ${NETWORK_HELPERS_DIR}/ipsec-updown"
1136         print
1137
1138         # Mode
1139         print_indent 4 "# Mode"
1140         case "${MODE}" in
1141                 gre-transport)
1142                         print_indent 4 "mode = transport"
1143                         ;;
1144                 tunnel|vti|*)
1145                         print_indent 4 "mode = tunnel"
1146                         ;;
1147         esac
1148         print
1149
1150         # Compression
1151         print_indent 4 "# Compression"
1152         if enabled COMPRESSION; then
1153                 print_indent 4 "ipcomp = yes"
1154         else
1155                 print_indent 4 "ipcomp = no"
1156         fi
1157         print
1158
1159         # Inactivity Timeout
1160         if isset INACTIVITY_TIMEOUT; then
1161                 print_indent 4 "# Inactivity Timeout"
1162                 print_indent 4 "inactivity = ${INACTIVITY_TIMEOUT}"
1163                 print
1164         fi
1165
1166         # Start Action
1167         print_indent 4 "# Start Action"
1168         case "${START_ACTION}" in
1169                 on-demand)
1170                         print_indent 4 "start_action = trap"
1171                         print_indent 4 "close_action = trap"
1172                         ;;
1173                 wait)
1174                         print_indent 4 "start_action = none"
1175                         print_indent 4 "close_action = none"
1176                         ;;
1177                 always-on|*)
1178                         print_indent 4 "start_action = start"
1179                         print_indent 4 "close_action = start"
1180                         ;;
1181         esac
1182         print
1183
1184         print_indent 3 "}"
1185         print_indent 2 "}"
1186         print
1187
1188         print_indent 1 "}"
1189         print_indent 0 "}"
1190         print
1191 }
1192
1193 _ipsec_connection_to_strongswan_secrets() {
1194         local connection="${1}"
1195
1196         print_indent 0 "secrets {"
1197
1198         case "${AUTH_MODE}" in
1199                 PSK)
1200                         print_indent 1 "ike {"
1201
1202                         # Secret
1203                         print_indent 2 "secret = ${PSK}"
1204
1205                         # ID
1206                         if isset REMOTE_ID; then
1207                                 print_indent 2 "id = ${REMOTE_ID}"
1208                         fi
1209
1210                         print_indent 1 "}"
1211                         ;;
1212         esac
1213
1214         print_indent 0 "}"
1215 }