2 ###############################################################################
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2017 IPFire Network Development Team #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
20 ###############################################################################
22 IPSEC_CONNECTION_CONFIG_SETTINGS
="\
40 IPSEC_POOL_CONFIG_SETTINGS
="\
45 IPSEC_DEFAULT_AUTH_MODE
="PSK"
46 IPSEC_DEFAULT_DPD_ACTION
="restart"
47 IPSEC_DEFAULT_DPD_DELAY
="30"
48 IPSEC_DEFAULT_DPD_TIMEOUT
="120"
49 IPSEC_DEFAULT_ENABLED
="true"
50 IPSEC_DEFAULT_INACTIVITY_TIMEOUT
="0"
51 IPSEC_DEFAULT_MODE
="tunnel"
52 IPSEC_DEFAULT_SECURITY_POLICY
="system"
53 IPSEC_DEFAULT_START_ACTION
="on-demand"
55 IPSEC_VALID_MODES
="gre-transport tunnel vti"
56 IPSEC_VALID_AUTH_MODES
="PSK"
64 cli_ipsec_connection $@
70 error
"Unrecognized argument: ${action}"
76 cli_ipsec_connection
() {
77 if ipsec_connection_exists
${1}; then
84 authentication|down|disable|dpd|
enable|inactivity_timeout|
local|mode|peer|remote|security_policy|start_action|up
)
85 ipsec_connection_
${key} ${connection} $@
88 cli_ipsec_connection_show
"${connection}"
92 error
"Unrecognized argument: ${key}"
102 ipsec_connection_new $@
105 cli_ipsec_connection_destroy $@
108 if [ -n "${action}" ]; then
109 error
"Unrecognized argument: '${action}'"
118 if ipsec_pool_exists
${1}; then
126 ipsec_pool_
${key} ${pool} $@
129 cli_ipsec_pool_show
"${pool}"
133 error
"Unrecognized argument: ${key}"
146 ipsec_pool_destroy $@
149 if [ -n "${action}" ]; then
150 error
"Unrecognized argument: '${action}'"
158 cli_ipsec_connection_destroy
() {
159 local connection
="${1}"
161 if ! ipsec_connection_destroy
"${connection}"; then
165 # Inform strongswan about the changes
166 ipsec_strongswan_load
168 # Configure strongswan autostart
169 ipsec_strongswan_autostart
172 cli_ipsec_connection_show
() {
173 local connection
="${1}"
175 # Read the config settings
176 local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
177 if ! ipsec_connection_read_config
"${connection}"; then
178 error
"Could not read the connection configuration"
182 cli_headline
0 "IPsec VPN Connection: ${connection}"
187 cli_print_fmt1
1 "Peer" "${PEER}"
191 cli_print_fmt1
1 "Security Policy" "${SECURITY_POLICY-${IPSEC_DEFAULT_SECURITY_POLICY}}"
194 cli_headline
2 "Authentication"
195 case "${AUTH_MODE^^}" in
197 cli_print_fmt1
2 "Mode" "Pre-Shared-Key"
200 cli_print_fmt1
2 "Pre-Shared-Key" "****"
202 cli_print_fmt1
2 "Pre-Shared-Key" "- is not set -"
212 for i
in LOCAL REMOTE
; do
215 cli_headline
2 "Local"
218 cli_headline
2 "Remote"
222 local id_var
="${i}_ID"
223 if [ -n "${!id_var}" ]; then
224 cli_print_fmt1
2 "ID" "${!id_var}"
227 local prefix_var
="${i}_PREFIX"
228 if isset
${prefix_var}; then
229 cli_headline
3 "Prefix(es)"
232 for prefix
in ${!prefix_var}; do
233 cli_print_fmt1
3 "${prefix}"
240 cli_headline
2 "Misc."
244 cli_print_fmt1
2 "Transport Mode" "GRE Transport"
247 cli_print_fmt1
2 "Transport Mode" "Tunnel"
250 cli_print_fmt1
2 "Transport Mode" "Virtual Tunnel Interface"
253 cli_print_fmt1
2 "Transport Mode" "- Unknown -"
258 if isset INACTIVITY_TIMEOUT
&& [ ${INACTIVITY_TIMEOUT} -gt 0 ]; then
259 cli_print_fmt1
2 "Inactivity Timeout" "$(format_time ${INACTIVITY_TIMEOUT})"
266 ipsec_connection_disable
() {
267 local connection
=${1}
269 if ! ipsec_connection_write_config_key
"${connection}" "ENABLED" "false"; then
270 log ERROR
"Could not write configuration settings"
274 # Configure strongswan autostart
275 ipsec_strongswan_autostart
278 ipsec_connection_enable
() {
279 local connection
=${1}
281 if ! ipsec_connection_write_config_key
"${connection}" "ENABLED" "true"; then
282 log ERROR
"Could not write configuration settings"
286 # Configure strongswan autostart
287 ipsec_strongswan_autostart
290 # This function writes all values to a via ${connection} specificated VPN IPsec configuration file
291 ipsec_connection_write_config
() {
294 local connection
="${1}"
296 if ! ipsec_connection_exists
"${connection}"; then
297 log ERROR
"No such VPN IPsec connection: ${connection}"
301 local path
="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
303 if ! settings_write
"${path}" ${IPSEC_CONNECTION_CONFIG_SETTINGS}; then
304 log ERROR
"Could not write configuration settings for VPN IPsec connection ${connection}"
308 ipsec_reload
${connection}
311 # This funtion writes the value for one key to a via ${connection} specificated VPN IPsec connection configuration file
312 ipsec_connection_write_config_key
() {
315 local connection
=${1}
321 if ! ipsec_connection_exists
"${connection}"; then
322 log ERROR
"No such VPN ipsec connection: ${connection}"
326 log DEBUG
"Set '${key}' to new value '${value}' in VPN ipsec connection '${connection}'"
328 local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
330 # Read the config settings
331 if ! ipsec_connection_read_config
"${connection}"; then
335 # Set the key to a new value
336 assign
"${key}" "${value}"
338 if ! ipsec_connection_write_config
"${connection}"; then
345 # Reads one or more keys out of a settings file or all if no key is provided.
346 ipsec_connection_read_config
() {
349 local connection
="${1}"
352 if ! ipsec_connection_exists
"${connection}"; then
353 log ERROR
"No such VPN IPsec connection : ${connection}"
359 if [ $# -eq 0 ] && [ -n "${IPSEC_CONNECTION_CONFIG_SETTINGS}" ]; then
360 list_append args
${IPSEC_CONNECTION_CONFIG_SETTINGS}
365 local path
="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
367 if ! settings_read
"${path}" ${args}; then
368 log ERROR
"Could not read settings for VPN IPsec connection ${connection}"
373 # This function checks if a vpn ipsec connection exists
374 # Returns True when yes and false when not
375 ipsec_connection_exists
() {
378 local connection
=${1}
380 local path
="${NETWORK_IPSEC_CONNS_DIR}/${connection}"
382 [ -d "${path}" ] && return ${EXIT_TRUE} || return ${EXIT_FALSE}
385 # Determines if strongswan should be automatically started
386 # when the system boots up.
387 ipsec_strongswan_autostart() {
388 local autostart_needed="false
"
391 for connection in $(ipsec_list_connections); do
394 if ! ipsec_connection_read_config "${connection}" "ENABLED
"; then
395 log WARNING "Could not
read configuation
"
399 if enabled ENABLED; then
400 autostart_needed="true
"
405 # Start strongswan when we need it and when it is not yet enabled
406 if ${autostart_needed}; then
407 if ! service_is_enabled "strongswan
"; then
408 service_enable "strongswan
"
411 if ! service_is_active "strongswan
"; then
412 service_start "strongswan
"
415 # Disable strongswan when we do not need it but it is enabled
416 elif ! ${autostart_needed}; then
417 if service_is_enabled "strongswan
"; then
418 service_disable "strongswan
"
421 if service_is_active "strongswan
"; then
422 service_stop "strongswan
"
427 ipsec_strongswan_load() {
428 # Do nothing if strongswan is not running
429 if ! service_is_active "strongswan
"; then
433 if ! cmd swanctl --load-all; then
434 log ERROR "Could not reload strongswan config
"
439 # Reloads the connection after config changes
441 local connection=${1}
445 if ! ipsec_connection_read_config "${connection}" "ENABLED
"; then
446 log ERROR "Could not
read configuration
for IPsec connection
${connection}"
450 if enabled ENABLED; then
451 if ! ipsec_connection_to_strongswan ${connection}; then
452 log ERROR "Could not generate strongswan config
for ${connnection}"
456 log DEBUG "Deleting strongswan config
${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf
"
457 unlink "${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf
"
460 ipsec_strongswan_load
463 # Handle the cli after authentification
464 ipsec_connection_authentication() {
465 if [ ! $# -gt 1 ]; then
466 log ERROR "Not enough arguments
"
470 local connection=${1}
476 ipsec_connection_authentication_mode "${connection}" $@
479 ipsec_connection_authentication_psk "${connection}" $@
482 log ERROR "Unrecognized argument
: ${cmd}"
488 # Set the authentification mode
489 ipsec_connection_authentication_mode() {
490 if [ ! $# -eq 2 ]; then
491 log ERROR "Not enough arguments
"
494 local connection=${1}
497 if ! isoneof mode ${IPSEC_VALID_AUTH_MODES}; then
498 log ERROR "Auth mode
'${mode}' is invalid
"
502 if ! ipsec_connection_write_config_key "${connection}" "AUTH_MODE
" ${mode^^}; then
503 log ERROR "Could not
write configuration settings
"
509 ipsec_connection_authentication_psk() {
510 if [ ! $# -eq 2 ]; then
511 log ERROR "Not enough arguments
"
515 local connection=${1}
520 if [ ${length} -lt 4 ]; then
521 error "The PSK must be longer than four characters
"
525 if [ ${length} -gt 128 ]; then
526 error "The PSK cannot be longer than
128 characters
"
530 if ! ipsec_connection_write_config_key "${connection}" "PSK
" "${psk}"; then
531 log ERROR "Could not
write configuration settings
"
538 ipsec_connection_up() {
539 local connection="${1}"
541 if ! ipsec_connection_exists "${connection}"; then
542 error "No such VPN IPsec connection
: ${connection}"
546 cmd swanctl --initiate --child "${connection}"
549 ipsec_connection_down() {
550 local connection="${1}"
552 if ! ipsec_connection_exists "${connection}"; then
553 error "No such VPN IPsec connection
: ${connection}"
557 cmd swanctl --terminate --ike "${connection}"
560 # Handle the cli after authentification
561 ipsec_connection_dpd() {
562 if [ ! $# -gt 1 ]; then
563 log ERROR "Not enough arguments
"
567 local connection=${1}
573 ipsec_connection_dpd_action "${connection}" $@
576 ipsec_connection_dpd_delay "${connection}" $@
579 ipsec_connection_dpd_timeout "${connection}" $@
582 log ERROR "Unrecognized argument
: ${cmd}"
588 # Set the default dpd action
589 ipsec_connection_dpd_action() {
590 if [ ! $# -eq 2 ]; then
591 log ERROR "Not enough arguments
"
594 local connection=${1}
597 if ! isoneof action "restart
" "clear"; then
598 log ERROR "dpd action
'${action}' is invalid
"
602 if ! ipsec_connection_write_config_key "${connection}" "DPD_ACTION
" ${action}; then
603 log ERROR "Could not
write configuration settings
"
609 ipsec_connection_dpd_delay() {
610 if [ ! $# -ge 2 ]; then
611 log ERROR "Not enough arguments
"
615 local connection=${1}
619 if ! isinteger value; then
620 value=$(parse_time $@)
621 if [ ! $? -eq 0 ]; then
622 log ERROR "Parsing the passed
time was not sucessful please check the passed values.
"
627 if [ ${value} -lt 0 ]; then
628 log ERROR "The passed
time value must be
in the
sum greater or equal zero seconds.
"
632 if ! ipsec_connection_write_config_key "${connection}" "DPD_DELAY
" ${value}; then
633 log ERROR "Could not
write configuration settings
"
640 # Set the dpd timeout
641 ipsec_connection_dpd_timeout() {
642 if [ ! $# -ge 2 ]; then
643 log ERROR "Not enough arguments
"
647 local connection=${1}
651 if ! isinteger value; then
652 value=$(parse_time $@)
653 if [ ! $? -eq 0 ]; then
654 log ERROR "Parsing the passed
time was not sucessful please check the passed values.
"
659 if [ ${value} -le 0 ]; then
660 log ERROR "The passed
time value must be
in the
sum greater or equal zero seconds.
"
664 if ! ipsec_connection_write_config_key "${connection}" "DPD_TIMEOUT
" ${value}; then
665 log ERROR "Could not
write configuration settings
"
672 # Handle the cli after local
673 ipsec_connection_local() {
674 if [ ! $# -ge 2 ]; then
675 log ERROR "Not enough arguments
"
679 local connection=${1}
685 ipsec_connection_local_address "${connection}" $@
688 ipsec_connection_id "${connection}" "LOCAL
" $@
691 ipsec_connection_prefix "${connection}" "LOCAL
" $@
694 log ERROR "Unrecognized argument
: ${cmd}"
702 # Set the connection mode
703 ipsec_connection_mode() {
704 if [ ! $# -eq 2 ]; then
705 log ERROR "Not enough arguments
"
708 local connection=${1}
711 if ! isoneof mode ${IPSEC_VALID_MODES}; then
712 log ERROR "Mode
'${mode}' is invalid
"
716 if ! ipsec_connection_write_config_key "${connection}" "MODE
" ${mode}; then
717 log ERROR "Could not
write configuration settings
"
724 # Set the local address
725 ipsec_connection_local_address() {
726 if [ ! $# -eq 2 ]; then
727 log ERROR "Not enough arguments
"
730 local connection=${1}
731 local local_address=${2}
733 if ! ipsec_connection_check_peer ${local_address}; then
734 log ERROR "Local address
'${local_address}' is invalid
"
738 if ! ipsec_connection_write_config_key "${connection}" "LOCAL_ADDRESS
" ${local_address}; then
739 log ERROR "Could not
write configuration settings
"
746 # Set the peer to connect to
747 ipsec_connection_peer() {
748 if [ ! $# -eq 2 ]; then
749 log ERROR "Not enough arguments
"
752 local connection=${1}
755 if ! ipsec_connection_check_peer ${peer}; then
756 log ERROR "Peer
'${peer}' is invalid
"
760 if ! ipsec_connection_write_config_key "${connection}" "PEER
" ${peer}; then
761 log ERROR "Could not
write configuration settings
"
768 #Set the local or remote id
769 ipsec_connection_id() {
770 if [ ! $# -eq 3 ]; then
771 log ERROR "Not enough arguments
"
774 local connection=${1}
778 if ! ipsec_connection_check_id ${id}; then
779 log ERROR "Id
'${id}' is invalid
"
783 if ! ipsec_connection_write_config_key "${connection}" "${type}_ID" ${id}; then
784 log ERROR
"Could not write configuration settings"
791 # Set the local or remote prefix
792 ipsec_connection_prefix
() {
793 if [ ! $# -ge 3 ]; then
794 log ERROR
"Not enough arguments"
797 local connection
=${1}
801 local _prefix
="${type}_PREFIX"
803 if ! ipsec_connection_read_config
"${connection}" "${_prefix}"; then
807 # Remove duplicated entries to proceed the list safely
808 assign
"${_prefix}" "$(list_unique ${!_prefix} )"
811 local prefixes_removed
814 while [ $# -gt 0 ]; do
819 list_append prefixes_added
"${arg:1}"
822 list_append prefixes_removed
"${arg:1}"
825 list_append prefixes_set
"${arg}"
828 error
"Invalid argument: ${arg}"
835 # Check if the user is trying a mixed operation
836 if ! list_is_empty prefixes_set
&& (! list_is_empty prefixes_added ||
! list_is_empty prefixes_removed
); then
837 error
"You cannot reset the prefix list and add or remove prefixes at the same time"
841 # Set new prefix list
842 if ! list_is_empty prefixes_set
; then
843 # Check if all prefixes are valid
845 for prefix
in ${prefixes_set}; do
846 if ! ip_net_is_valid
${prefix}; then
847 error
"Unsupported prefix: ${prefix}"
852 assign
"${_prefix}" "${prefixes_set}"
854 # Perform incremental updates
858 # Perform all removals
859 for prefix
in ${prefixes_removed}; do
860 if ! list_remove
"${_prefix}" ${prefix}; then
861 warning
"${prefix} was not on the list and could not be removed"
866 for prefix
in ${prefixes_added}; do
867 if ip_net_is_valid
${prefix}; then
868 if ! list_append_unique
"${_prefix}" ${prefix}; then
869 warning
"${prefix} is already on the prefix list"
872 warning
"${prefix} is not a valid IP network and could not be added"
877 # Check if the list contain at least one valid prefix
878 if list_is_empty
${_prefix}; then
879 error
"Cannot save an empty prefix list"
884 if ! ipsec_connection_write_config_key
"${connection}" "${_prefix}" ${!_prefix}; then
885 log ERROR "Could not
write configuration settings
"
891 # Handle the cli after remote
892 ipsec_connection_remote() {
893 if [ ! $# -ge 2 ]; then
894 log ERROR "Not enough arguments
"
898 local connection=${1}
904 ipsec_connection_id "${connection}" "REMOTE
" $@
908 ipsec_connection_prefix "${connection}" "REMOTE
" $@
911 log ERROR "Unrecognized argument
: ${cmd}"
919 # Set the inactivity timeout
920 ipsec_connection_inactivity_timeout() {
921 if [ ! $# -ge 2 ]; then
922 log ERROR "Not enough arguments
"
926 local connection=${1}
930 if ! isinteger value; then
931 value=$(parse_time $@)
932 if [ ! $? -eq 0 ]; then
933 log ERROR "Parsing the passed
time was not sucessful please check the passed values.
"
938 if [ ${value} -le 0 ]; then
939 log ERROR "The passed
time value must be
in the
sum greater zero seconds.
"
943 if ! ipsec_connection_write_config_key "${connection}" "INACTIVITY_TIMEOUT
" ${value}; then
944 log ERROR "Could not
write configuration settings
"
951 # Set the default start action
952 ipsec_connection_start_action() {
953 if [ ! $# -eq 2 ]; then
954 log ERROR "Not enough arguments
"
957 local connection=${1}
960 if ! isoneof action "on-demand
" "always-on
"; then
961 log ERROR "Start action
'${action}' is invalid
"
965 if ! ipsec_connection_write_config_key "${connection}" "START_ACTION
" ${action}; then
966 log ERROR "Could not
write configuration settings
"
971 # Set the security policy to use
972 ipsec_connection_security_policy() {
973 if [ ! $# -eq 2 ]; then
974 log ERROR "Not enough arguments
"
977 local connection=${1}
978 local security_policy=${2}
980 if ! vpn_security_policy_exists ${security_policy}; then
981 log ERROR "No such vpn security policy
'${security_policy}'"
985 if ! ipsec_connection_write_config_key "${connection}" "SECURITY_POLICY
" ${security_policy}; then
986 log ERROR "Could not
write configuration settings
"
991 # Check if a id is valid
992 ipsec_connection_check_id() {
996 if [[ ${id} =~ ^@[[:alnum:]]+$ ]] || ip_is_valid ${id}; then
1003 # Checks if a peer is valid
1004 ipsec_connection_check_peer() {
1008 # TODO Accept also FQDNs
1009 if ip_is_valid ${peer}; then
1012 return ${EXIT_FALSE}
1016 # This function checks if a VPN IPsec connection name is valid
1017 # Allowed are only A-Za-z0-9
1018 ipsec_connection_check_name() {
1021 local connection=${1}
1023 [[ "${connection}" =~ [^[:alnum:]$] ]]
1026 # Function that creates one VPN IPsec connection
1027 ipsec_connection_new() {
1028 if [ $# -gt 1 ]; then
1029 error "Too many arguments
"
1030 return ${EXIT_ERROR}
1033 local connection="${1}"
1034 if ! isset connection; then
1035 error "Please provide a connection name
"
1036 return ${EXIT_ERROR}
1039 # Check for duplicates
1040 if ipsec_connection_exists "${connection}"; then
1041 error "The VPN IPsec connection
${connection} already exists
"
1042 return ${EXIT_ERROR}
1045 # Check if the name of the connection is valid
1046 if ipsec_connection_check_name "${connection}"; then
1047 error "'${connection}' contains illegal characters
"
1048 return ${EXIT_ERROR}
1051 log DEBUG "Creating VPN IPsec connection
${connection}"
1053 if ! mkdir -p "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
1054 log ERROR "Could not create config directory
for ${connection}"
1055 return ${EXIT_ERROR}
1058 local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
1060 AUTH_MODE=${IPSEC_DEFAULT_AUTH_MODE}
1061 DPD_ACTION=${IPSEC_DEFAULT_DPD_ACTION}
1062 DPD_DELAY=${IPSEC_DEFAULT_DPD_DELAY}
1063 DPD_TIMEOUT=${IPSEC_DEFAULT_DPD_TIMEOUT}
1064 ENABLED=${IPSEC_DEFAULT_ENABLED}
1065 MODE=${IPSEC_DEFAULT_MODE}
1066 START_ACTION=${IPSEC_DEFAULT_START_ACTION}
1068 INACTIVITY_TIMEOUT=${IPSEC_DEFAULT_INACTIVITY_TIMEOUT}
1069 SECURITY_POLICY=${IPSEC_DEFAULT_SECURITY_POLICY}
1071 if ! ipsec_connection_write_config "${connection}"; then
1072 log ERROR "Could not
write new config
file"
1073 return ${EXIT_ERROR}
1076 # Configure strongswan autostart
1077 ipsec_strongswan_autostart
1080 # Function that deletes based on the passed parameters one ore more vpn security policies
1081 ipsec_connection_destroy() {
1083 for connection in $@; do
1084 if ! ipsec_connection_exists "${connection}"; then
1085 log ERROR "The VPN IPsec connection
${connection} does not exist.
"
1089 log DEBUG "Deleting VPN IPsec connection
${connection}"
1091 # Delete strongswan configuration file
1092 file_delete "${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf
"
1094 if ! rm -rf "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
1095 log ERROR "Deleting the VPN IPsec connection
${connection} was not sucessful
"
1096 return ${EXIT_ERROR}
1102 # List all ipsec connections
1103 ipsec_list_connections() {
1105 for connection in ${NETWORK_IPSEC_CONNS_DIR}/*; do
1106 [ -d ${connection} ] || continue
1107 basename ${connection}
1111 ipsec_connection_to_strongswan() {
1112 local connection="${1}"
1114 # Read the config settings
1115 local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
1116 if ! ipsec_connection_read_config "${connection}"; then
1117 error "Could not
read the connection
${connection}"
1118 return ${EXIT_ERROR}
1121 local path="${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf
"
1124 # Write the connection section
1125 _ipsec_connection_to_strongswan_connection "${connection}"
1127 # Write the secrets section
1128 _ipsec_connection_to_strongswan_secrets "${connection}"
1133 _ipsec_connection_to_strongswan_connection() {
1134 local connection="${1}"
1136 # Read the security policy
1137 local ${VPN_SECURITY_POLICIES_CONFIG_SETTINGS}
1138 if ! vpn_security_policies_read_config "${SECURITY_POLICY}"; then
1139 return ${EXIT_ERROR}
1144 if isset DPD_DELAY && isinteger DPD_DELAY && [ ${DPD_DELAY} -gt 0 ]; then
1148 # Write configuration header
1149 config_header "strongSwan configuration
for ${connection}"
1151 print_indent 0 "connections
{"
1152 print_indent 1 "${connection} {"
1155 print_indent 2 "# IKE Version"
1156 case "${KEY_EXCHANGE^^}" in
1158 print_indent
2 "version = 1"
1161 # Fall back to IKEv2 for any random values
1163 print_indent
2 "version = 2"
1168 # Always only keep one connection open at a time
1169 print_indent
2 "# Unique IDs"
1170 print_indent
2 "unique = replace"
1174 print_indent
2 "# Local Address"
1175 if isset LOCAL_ADDRESS
; then
1176 print_indent
2 "local_addrs = ${LOCAL_ADDRESS}"
1178 print_indent
2 "local_addrs = %any"
1183 print_indent
2 "# Remote Address"
1185 print_indent
2 "remote_addrs = ${PEER}"
1187 print_indent
2 "remote_addrs = %any"
1192 print_indent
2 "# IKE Proposals"
1193 print_indent
2 "proposals = $(vpn_security_policies_make_ike_proposal ${SECURITY_POLICY})"
1197 if enabled dpd
; then
1198 print_indent
2 "# Dead Peer Detection"
1199 print_indent
2 "dpd_delay = ${DPD_DELAY}"
1201 if isset DPD_TIMEOUT
; then
1202 print_indent
2 "dpd_timeout = ${DPD_TIMEOUT}"
1209 print_indent
2 "# Fragmentation"
1210 print_indent
2 "fragmentation = yes"
1214 print_indent
2 "local {"
1217 if isset LOCAL_ID
; then
1218 print_indent
3 "id = ${LOCAL_ID}"
1222 case "${AUTH_MODE}" in
1224 print_indent
3 "auth = psk"
1232 print_indent
2 "remote {"
1235 if isset REMOTE_ID
; then
1236 print_indent
3 "id = ${REMOTE_ID}"
1240 case "${AUTH_MODE}" in
1242 print_indent
3 "auth = psk"
1251 print_indent
2 "children {"
1252 print_indent
3 "${connection} {"
1254 print_indent
4 "# ESP Proposals"
1255 print_indent
4 "esp_proposals = $(vpn_security_policies_make_esp_proposal ${SECURITY_POLICY})"
1262 print_indent
4 "local_ts = dynamic[gre]"
1263 print_indent
4 "remote_ts = dynamic[gre]"
1267 if isset LOCAL_PREFIX
; then
1268 print_indent
4 "local_ts = $(list_join LOCAL_PREFIX ,)"
1270 print_indent
4 "local_ts = dynamic"
1274 if isset REMOTE_PREFIX
; then
1275 print_indent
4 "remote_ts = $(list_join REMOTE_PREFIX ,)"
1277 print_indent
4 "remote_ts = dynamic"
1286 print_indent
4 "# Netfilter Marks"
1287 print_indent
4 "mark_in = %unique"
1288 print_indent
4 "mark_out = %unique"
1293 # Dead Peer Detection
1294 if enabled dpd
; then
1295 print_indent
4 "# Dead Peer Detection"
1296 print_indent
4 "dpd_action = ${DPD_ACTION}"
1301 if isset LIFETIME
; then
1302 print_indent
4 "# Rekey Time"
1303 print_indent
4 "rekey_time = ${LIFETIME}"
1308 print_indent
4 "updown = ${NETWORK_HELPERS_DIR}/ipsec-updown"
1312 print_indent
4 "# Mode"
1315 print_indent
4 "mode = transport"
1318 print_indent
4 "mode = tunnel"
1324 print_indent
4 "# Compression"
1325 if enabled COMPRESSION
; then
1326 print_indent
4 "ipcomp = yes"
1328 print_indent
4 "ipcomp = no"
1332 # Inactivity Timeout
1333 if isset INACTIVITY_TIMEOUT
; then
1334 print_indent
4 "# Inactivity Timeout"
1335 print_indent
4 "inactivity = ${INACTIVITY_TIMEOUT}"
1340 print_indent
4 "# Start Action"
1341 case "${START_ACTION}" in
1343 print_indent
4 "start_action = trap"
1344 print_indent
4 "close_action = trap"
1347 print_indent
4 "start_action = none"
1348 print_indent
4 "close_action = none"
1351 print_indent
4 "start_action = start"
1352 print_indent
4 "close_action = start"
1366 _ipsec_connection_to_strongswan_secrets
() {
1367 local connection
="${1}"
1369 print_indent
0 "secrets {"
1371 case "${AUTH_MODE}" in
1373 print_indent
1 "ike {"
1376 print_indent
2 "secret = ${PSK}"
1379 if isset REMOTE_ID
; then
1380 print_indent
2 "id = ${REMOTE_ID}"
1390 # This function writes all values to a via ${pool} specificated VPN IPsec pool configuration file
1391 ipsec_pool_write_config
() {
1396 if ! ipsec_pool_exists
"${pool}"; then
1397 log ERROR
"No such VPN IPsec pool: ${pool}"
1398 return ${EXIT_ERROR}
1401 local path
="${NETWORK_IPSEC_POOLS_DIR}/${pool}/settings"
1403 if ! settings_write
"${path}" ${IPSEC_POOL_CONFIG_SETTINGS}; then
1404 log ERROR
"Could not write configuration settings for VPN IPsec pool ${pool}"
1405 return ${EXIT_ERROR}
1409 # This funtion writes the value for one key to a via ${connection} specificated
1410 # VPN IPsec pool configuration file
1411 ipsec_pool_write_config_key
() {
1420 if ! ipsec_pool_exists
"${pool}"; then
1421 log ERROR
"No such VPN IPsec pool: ${pool}"
1422 return ${EXIT_ERROR}
1425 log DEBUG
"Set '${key}' to new value '${value}' in VPN IPsec pool '${pool}'"
1427 local ${IPSEC_POOL_CONFIG_SETTINGS}
1429 # Read the config settings
1430 if ! ipsec_pool_read_config
"${pool}"; then
1431 return ${EXIT_ERROR}
1434 # Set the key to a new value
1435 assign
"${key}" "${value}"
1437 if ! ipsec_pool_write_config
"${pool}"; then
1438 return ${EXIT_ERROR}
1444 # Reads one or more keys out of a settings file or all if no key is provided.
1445 ipsec_pool_read_config
() {
1451 if ! ipsec_pool_exists
"${pool}"; then
1452 log ERROR
"No such VPN IPsec pool : ${pool}"
1453 return ${EXIT_ERROR}
1457 if [ $# -eq 0 ] && [ -n "${IPSEC_POOL_CONFIG_SETTINGS}" ]; then
1458 list_append args
${IPSEC_POOL_CONFIG_SETTINGS}
1463 local path
="${NETWORK_IPSEC_POOLS_DIR}/${pool}/settings"
1465 if ! settings_read
"${path}" ${args}; then
1466 log ERROR
"Could not read settings for VPN IPsec pool ${pool}"
1467 return ${EXIT_ERROR}
1471 # This function checks if a vpn IPsec pool exists
1472 # Returns True when yes and false when not
1473 ipsec_pool_exists
() {
1478 local path
="${NETWORK_IPSEC_POOLS_DIR}/${pool}"
1480 [ -d "${path}" ] && return ${EXIT_TRUE} || return ${EXIT_FALSE}
1483 # This function checks if a VPN IPsec pool name is valid
1484 # Allowed are only A-Za-z0-9
1485 ipsec_pool_check_name() {
1490 # These are special words in strongswan
1491 if isoneof pool dhcp radius; then
1492 return ${EXIT_ERROR}
1495 [[ "${pool}" =~ [^[:alnum:]$] ]]
1499 if [ $# -gt 1 ]; then
1500 error "Too many arguments
"
1501 return ${EXIT_ERROR}
1505 if ! isset pool; then
1506 error "Please provide a pool name
"
1507 return ${EXIT_ERROR}
1510 # Check for duplicates
1511 if ipsec_pool_exists "${pool}"; then
1512 error "The VPN IPsec pool
${pool} already exists
"
1513 return ${EXIT_ERROR}
1516 # Check if the name of the connection is valid
1517 if ipsec_pool_check_name "${pool}"; then
1518 error "'${pool}' contains illegal characters
"
1519 return ${EXIT_ERROR}
1522 log DEBUG "Creating VPN IPsec pool
${pool}"
1524 if ! mkdir -p "${NETWORK_IPSEC_POOLS_DIR}/${pool}"; then
1525 log ERROR "Could not create config directory
for ${pool}"
1526 return ${EXIT_ERROR}
1529 local ${IPSEC_POOL_CONFIG_SETTINGS}
1531 if ! ipsec_pool_write_config "${pool}"; then
1532 log ERROR "Could not
write new config
file"
1533 return ${EXIT_ERROR}
1537 # Function that deletes based on the passed parameters
1538 # one ore more vpn ipsec pools
1539 ipsec_pool_destroy() {
1542 if ! ipsec_pool_exists "${pool}"; then
1543 log ERROR "The VPN IPsec pool
${pool} does not exist.
"
1547 log DEBUG "Deleting VPN IPsec pool
${pool}"
1549 if ! rm -rf "${NETWORK_IPSEC_POOLS_DIR}/${pool}"; then
1550 log ERROR "Deleting the VPN IPsec pool
${pool} was not sucessful
"
1551 return ${EXIT_ERROR}
1556 ipsec_pool_network() {
1557 if [ ! $# -ge 2 ]; then
1558 log ERROR "Not enough arguments
"
1559 return ${EXIT_ERROR}
1565 if ! ipsec_pool_read_config "${pool}" "NETWORKS
"; then
1566 return ${EXIT_ERROR}
1569 # Remove duplicated entries to proceed the list safely
1570 assign "NETWORKS
" "$
(list_unique
${NETWORKS})"
1572 local networks_added
1573 local networks_removed
1576 while [ $# -gt 0 ]; do
1581 list_append networks_added "${arg:1}"
1584 list_append networks_removed "${arg:1}"
1587 list_append networks_set "${arg}"
1590 error "Invalid argument
: ${arg}"
1591 return ${EXIT_ERROR}
1597 # Check if the user is trying a mixed operation
1598 if ! list_is_empty networks_set && (! list_is_empty networks_added || ! list_is_empty networks_removed); then
1599 error "You cannot
reset the networks list and add or remove networks
at the same
time"
1600 return ${EXIT_ERROR}
1603 # Set new prefix list
1604 if ! list_is_empty networks_set; then
1605 # Check if all networks are valid
1607 for network in ${networks_set}; do
1608 if ! ip_net_is_valid ${network}; then
1609 error "Unsupported prefix
: ${network}"
1610 return ${EXIT_ERROR}
1614 assign "NETWORKS
" "${networks_set}"
1616 # Perform incremental updates
1618 # Perform all removals
1620 for network in ${networks_removed}; do
1621 if ! list_remove "NETWORKS
" ${network}; then
1622 warning "${network} was not on the list and could not be removed
"
1626 for network in ${networks_added}; do
1627 if ip_net_is_valid ${network}; then
1628 if ! list_append_unique "NETWORKS
" ${network}; then
1629 warning "${network} is already on the network list
"
1632 warning "${network} is not a valid IP network and could not be added
"
1637 # Check if the list contain at least one valid network
1638 if list_is_empty "NETWORKS
"; then
1639 error "Cannot save an empty network list
"
1640 return ${EXIT_ERROR}
1644 if ! ipsec_pool_write_config_key "${pool}" "NETWORKS
" "${NETWORKS}"; then
1645 log ERROR "Could not
write configuration settings
"
1651 ipsec_pool_dns_server() {
1652 if [ ! $# -ge 2 ]; then
1653 log ERROR "Not enough arguments
"
1654 return ${EXIT_ERROR}
1660 if ! ipsec_pool_read_config "${pool}" "DNS_SERVERS
"; then
1661 return ${EXIT_ERROR}
1664 # Remove duplicated entries to proceed the list safely
1665 assign "DNS_SERVERS
" "$
(list_unique
${DNS_SERVERS})"
1667 local dns_servers_added
1668 local dns_servers_removed
1669 local dns_servers_set
1671 while [ $# -gt 0 ]; do
1676 list_append dns_servers_added "${arg:1}"
1679 list_append dns_servers_removed "${arg:1}"
1682 list_append dns_servers_set "${arg}"
1685 error "Invalid argument
: ${arg}"
1686 return ${EXIT_ERROR}
1692 # Check if the user is trying a mixed operation
1693 if ! list_is_empty dns_servers_set && (! list_is_empty dns_servers_added || ! list_is_empty dns_servers_removed); then
1694 error "You cannot
reset the DNS servers list and add or remove DNS servers
at the same
time"
1695 return ${EXIT_ERROR}
1698 # Set new dns server list
1699 if ! list_is_empty dns_servers_set; then
1700 # Check if all dns servers are valid
1702 for dns_server in ${dns_servers_set}; do
1703 if ! ip_is_valid ${dns_server}; then
1704 error "Invalid DNS server
: ${dns_server}"
1705 return ${EXIT_ERROR}
1709 assign "DNS_SERVERS
" "${dns_servers_set}"
1711 # Perform incremental updates
1713 # Perform all removals
1715 for dns_server in ${dns_servers_removed}; do
1716 if ! list_remove "DNS_SERVERS
" ${dns_server}; then
1717 warning "${dns_server} was not on the list and could not be removed
"
1721 for dns_server in ${dns_servers_added}; do
1722 if ip_is_valid ${dns_server}; then
1723 if ! list_append_unique "DNS_SERVERS
" ${dns_server}; then
1724 warning "${dns_server} is already on the DNS server list
"
1727 warning "${dns_server} is not a valid DNS server and could not be added
"
1732 # Check if the list contain at least one valid prefix
1733 if list_is_empty "DNS_SERVERS
"; then
1734 error "Cannot save an empty DNS server list
"
1735 return ${EXIT_ERROR}
1739 if ! ipsec_pool_write_config_key "${pool}" "DNS_SERVERS
" "${DNS_SERVER}"; then
1740 log ERROR "Could not
write configuration settings
"