]> git.ipfire.org Git - people/stevee/network.git/blob - src/functions/functions.ipsec
ipsec: add pool feature
[people/stevee/network.git] / src / functions / functions.ipsec
1 #!/bin/bash
2 ###############################################################################
3 # #
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2017 IPFire Network Development Team #
6 # #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
11 # #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
16 # #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
19 # #
20 ###############################################################################
21
22 IPSEC_CONNECTION_CONFIG_SETTINGS="\
23 AUTH_MODE \
24 DPD_ACTION \
25 DPD_DELAY \
26 DPD_TIMEOUT \
27 INACTIVITY_TIMEOUT \
28 LOCAL_ADDRESS \
29 LOCAL_ID \
30 LOCAL_PREFIX \
31 MODE \
32 PEER \
33 PSK \
34 REMOTE_ID \
35 REMOTE_PREFIX \
36 SECURITY_POLICY \
37 START_ACTION \
38 ENABLED"
39
40 IPSEC_POOL_CONFIG_SETTINGS="\
41 DNS_SERVERS \
42 NETWORKS"
43
44 # Default values
45 IPSEC_DEFAULT_AUTH_MODE="PSK"
46 IPSEC_DEFAULT_DPD_ACTION="restart"
47 IPSEC_DEFAULT_DPD_DELAY="30"
48 IPSEC_DEFAULT_DPD_TIMEOUT="120"
49 IPSEC_DEFAULT_ENABLED="true"
50 IPSEC_DEFAULT_INACTIVITY_TIMEOUT="0"
51 IPSEC_DEFAULT_MODE="tunnel"
52 IPSEC_DEFAULT_SECURITY_POLICY="system"
53 IPSEC_DEFAULT_START_ACTION="on-demand"
54
55 IPSEC_VALID_MODES="gre-transport tunnel vti"
56 IPSEC_VALID_AUTH_MODES="PSK"
57
58 cli_ipsec() {
59 local action=${1}
60 shift 1
61
62 case "${action}" in
63 connection)
64 cli_ipsec_connection $@
65 ;;
66 pool)
67 cli_ipsec_pool $@
68 ;;
69 *)
70 error "Unrecognized argument: ${action}"
71 exit ${EXIT_ERROR}
72 ;;
73 esac
74 }
75
76 cli_ipsec_connection() {
77 if ipsec_connection_exists ${1}; then
78 local connection=${1}
79 local key=${2}
80 key=${key//-/_}
81 shift 2
82
83 case "${key}" in
84 authentication|down|disable|dpd|enable|inactivity_timeout|local|mode|peer|remote|security_policy|start_action|up)
85 ipsec_connection_${key} ${connection} $@
86 ;;
87 show)
88 cli_ipsec_connection_show "${connection}"
89 exit $?
90 ;;
91 *)
92 error "Unrecognized argument: ${key}"
93 exit ${EXIT_ERROR}
94 ;;
95 esac
96 else
97 local action=${1}
98 shift
99
100 case "${action}" in
101 new)
102 ipsec_connection_new $@
103 ;;
104 destroy)
105 cli_ipsec_connection_destroy $@
106 ;;
107 ""|*)
108 if [ -n "${action}" ]; then
109 error "Unrecognized argument: '${action}'"
110 fi
111 exit ${EXIT_ERROR}
112 ;;
113 esac
114 fi
115 }
116
117 cli_ipsec_pool() {
118 if ipsec_pool_exists ${1}; then
119 local pool=${1}
120 local key=${2}
121 key=${key//-/_}
122 shift 2
123
124 case "${key}" in
125 dns_server|network)
126 ipsec_pool_${key} ${pool} $@
127 ;;
128 show)
129 cli_ipsec_pool_show "${pool}"
130 exit $?
131 ;;
132 *)
133 error "Unrecognized argument: ${key}"
134 exit ${EXIT_ERROR}
135 ;;
136 esac
137 else
138 local action=${1}
139 shift
140
141 case "${action}" in
142 new)
143 ipsec_pool_new $@
144 ;;
145 destroy)
146 ipsec_pool_destroy $@
147 ;;
148 ""|*)
149 if [ -n "${action}" ]; then
150 error "Unrecognized argument: '${action}'"
151 fi
152 exit ${EXIT_ERROR}
153 ;;
154 esac
155 fi
156 }
157
158 cli_ipsec_connection_destroy() {
159 local connection="${1}"
160
161 if ! ipsec_connection_destroy "${connection}"; then
162 return ${EXIT_ERROR}
163 fi
164
165 # Inform strongswan about the changes
166 ipsec_strongswan_load
167
168 # Configure strongswan autostart
169 ipsec_strongswan_autostart
170 }
171
172 cli_ipsec_connection_show() {
173 local connection="${1}"
174
175 # Read the config settings
176 local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
177 if ! ipsec_connection_read_config "${connection}"; then
178 error "Could not read the connection configuration"
179 return ${EXIT_ERROR}
180 fi
181
182 cli_headline 0 "IPsec VPN Connection: ${connection}"
183 cli_space
184
185 # Peer
186 if isset PEER; then
187 cli_print_fmt1 1 "Peer" "${PEER}"
188 fi
189
190 # Security Policy
191 cli_print_fmt1 1 "Security Policy" "${SECURITY_POLICY-${IPSEC_DEFAULT_SECURITY_POLICY}}"
192 cli_space
193
194 cli_headline 2 "Authentication"
195 case "${AUTH_MODE^^}" in
196 PSK)
197 cli_print_fmt1 2 "Mode" "Pre-Shared-Key"
198
199 if isset PSK; then
200 cli_print_fmt1 2 "Pre-Shared-Key" "****"
201 else
202 cli_print_fmt1 2 "Pre-Shared-Key" "- is not set -"
203 fi
204 ;;
205 X509)
206 : # TODO
207 ;;
208 esac
209 cli_space
210
211 local i
212 for i in LOCAL REMOTE; do
213 case "${i}" in
214 LOCAL)
215 cli_headline 2 "Local"
216 ;;
217 REMOTE)
218 cli_headline 2 "Remote"
219 ;;
220 esac
221
222 local id_var="${i}_ID"
223 if [ -n "${!id_var}" ]; then
224 cli_print_fmt1 2 "ID" "${!id_var}"
225 fi
226
227 local prefix_var="${i}_PREFIX"
228 if isset ${prefix_var}; then
229 cli_headline 3 "Prefix(es)"
230
231 local prefix
232 for prefix in ${!prefix_var}; do
233 cli_print_fmt1 3 "${prefix}"
234 done
235 fi
236
237 cli_space
238 done
239
240 cli_headline 2 "Misc."
241
242 case "${MODE}" in
243 gre-transport)
244 cli_print_fmt1 2 "Transport Mode" "GRE Transport"
245 ;;
246 tunnel)
247 cli_print_fmt1 2 "Transport Mode" "Tunnel"
248 ;;
249 vti)
250 cli_print_fmt1 2 "Transport Mode" "Virtual Tunnel Interface"
251 ;;
252 *)
253 cli_print_fmt1 2 "Transport Mode" "- Unknown -"
254 ;;
255 esac
256
257 # Inactivity timeout
258 if isset INACTIVITY_TIMEOUT && [ ${INACTIVITY_TIMEOUT} -gt 0 ]; then
259 cli_print_fmt1 2 "Inactivity Timeout" "$(format_time ${INACTIVITY_TIMEOUT})"
260 fi
261 cli_space
262
263 return ${EXIT_OK}
264 }
265
266 ipsec_connection_disable() {
267 local connection=${1}
268
269 if ! ipsec_connection_write_config_key "${connection}" "ENABLED" "false"; then
270 log ERROR "Could not write configuration settings"
271 return ${EXIT_ERROR}
272 fi
273
274 # Configure strongswan autostart
275 ipsec_strongswan_autostart
276 }
277
278 ipsec_connection_enable() {
279 local connection=${1}
280
281 if ! ipsec_connection_write_config_key "${connection}" "ENABLED" "true"; then
282 log ERROR "Could not write configuration settings"
283 return ${EXIT_ERROR}
284 fi
285
286 # Configure strongswan autostart
287 ipsec_strongswan_autostart
288 }
289
290 # This function writes all values to a via ${connection} specificated VPN IPsec configuration file
291 ipsec_connection_write_config() {
292 assert [ $# -ge 1 ]
293
294 local connection="${1}"
295
296 if ! ipsec_connection_exists "${connection}"; then
297 log ERROR "No such VPN IPsec connection: ${connection}"
298 return ${EXIT_ERROR}
299 fi
300
301 local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
302
303 if ! settings_write "${path}" ${IPSEC_CONNECTION_CONFIG_SETTINGS}; then
304 log ERROR "Could not write configuration settings for VPN IPsec connection ${connection}"
305 return ${EXIT_ERROR}
306 fi
307
308 ipsec_reload ${connection}
309 }
310
311 # This funtion writes the value for one key to a via ${connection} specificated VPN IPsec connection configuration file
312 ipsec_connection_write_config_key() {
313 assert [ $# -ge 3 ]
314
315 local connection=${1}
316 local key=${2}
317 shift 2
318
319 local value="$@"
320
321 if ! ipsec_connection_exists "${connection}"; then
322 log ERROR "No such VPN ipsec connection: ${connection}"
323 return ${EXIT_ERROR}
324 fi
325
326 log DEBUG "Set '${key}' to new value '${value}' in VPN ipsec connection '${connection}'"
327
328 local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
329
330 # Read the config settings
331 if ! ipsec_connection_read_config "${connection}"; then
332 return ${EXIT_ERROR}
333 fi
334
335 # Set the key to a new value
336 assign "${key}" "${value}"
337
338 if ! ipsec_connection_write_config "${connection}"; then
339 return ${EXIT_ERROR}
340 fi
341
342 return ${EXIT_TRUE}
343 }
344
345 # Reads one or more keys out of a settings file or all if no key is provided.
346 ipsec_connection_read_config() {
347 assert [ $# -ge 1 ]
348
349 local connection="${1}"
350 shift 1
351
352 if ! ipsec_connection_exists "${connection}"; then
353 log ERROR "No such VPN IPsec connection : ${connection}"
354 return ${EXIT_ERROR}
355 fi
356
357
358 local args
359 if [ $# -eq 0 ] && [ -n "${IPSEC_CONNECTION_CONFIG_SETTINGS}" ]; then
360 list_append args ${IPSEC_CONNECTION_CONFIG_SETTINGS}
361 else
362 list_append args $@
363 fi
364
365 local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
366
367 if ! settings_read "${path}" ${args}; then
368 log ERROR "Could not read settings for VPN IPsec connection ${connection}"
369 return ${EXIT_ERROR}
370 fi
371 }
372
373 # This function checks if a vpn ipsec connection exists
374 # Returns True when yes and false when not
375 ipsec_connection_exists() {
376 assert [ $# -eq 1 ]
377
378 local connection=${1}
379
380 local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}"
381
382 [ -d "${path}" ] && return ${EXIT_TRUE} || return ${EXIT_FALSE}
383 }
384
385 # Determines if strongswan should be automatically started
386 # when the system boots up.
387 ipsec_strongswan_autostart() {
388 local autostart_needed="false"
389
390 local connection
391 for connection in $(ipsec_list_connections); do
392 local ENABLED
393
394 if ! ipsec_connection_read_config "${connection}" "ENABLED"; then
395 log WARNING "Could not read configuation"
396 continue
397 fi
398
399 if enabled ENABLED; then
400 autostart_needed="true"
401 break
402 fi
403 done
404
405 # Start strongswan when we need it and when it is not yet enabled
406 if ${autostart_needed}; then
407 if ! service_is_enabled "strongswan"; then
408 service_enable "strongswan"
409 fi
410
411 if ! service_is_active "strongswan"; then
412 service_start "strongswan"
413 fi
414
415 # Disable strongswan when we do not need it but it is enabled
416 elif ! ${autostart_needed}; then
417 if service_is_enabled "strongswan"; then
418 service_disable "strongswan"
419 fi
420
421 if service_is_active "strongswan"; then
422 service_stop "strongswan"
423 fi
424 fi
425 }
426
427 ipsec_strongswan_load() {
428 # Do nothing if strongswan is not running
429 if ! service_is_active "strongswan"; then
430 return ${EXIT_OK}
431 fi
432
433 if ! cmd swanctl --load-all; then
434 log ERROR "Could not reload strongswan config"
435 return ${EXIT_ERROR}
436 fi
437 }
438
439 # Reloads the connection after config changes
440 ipsec_reload() {
441 local connection=${1}
442
443 local ENABLED
444
445 if ! ipsec_connection_read_config "${connection}" "ENABLED"; then
446 log ERROR "Could not read configuration for IPsec connection ${connection}"
447 return ${EXIT_ERROR}
448 fi
449
450 if enabled ENABLED; then
451 if ! ipsec_connection_to_strongswan ${connection}; then
452 log ERROR "Could not generate strongswan config for ${connnection}"
453 return ${EXIT_ERROR}
454 fi
455 else
456 log DEBUG "Deleting strongswan config ${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf"
457 unlink "${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf"
458 fi
459
460 ipsec_strongswan_load
461 }
462
463 # Handle the cli after authentification
464 ipsec_connection_authentication() {
465 if [ ! $# -gt 1 ]; then
466 log ERROR "Not enough arguments"
467 return ${EXIT_ERROR}
468 fi
469
470 local connection=${1}
471 local cmd=${2}
472 shift 2
473
474 case ${cmd} in
475 mode)
476 ipsec_connection_authentication_mode "${connection}" $@
477 ;;
478 pre-shared-key)
479 ipsec_connection_authentication_psk "${connection}" $@
480 ;;
481 *)
482 log ERROR "Unrecognized argument: ${cmd}"
483 return ${EXIT_ERROR}
484 ;;
485 esac
486 }
487
488 # Set the authentification mode
489 ipsec_connection_authentication_mode() {
490 if [ ! $# -eq 2 ]; then
491 log ERROR "Not enough arguments"
492 return ${EXIT_ERROR}
493 fi
494 local connection=${1}
495 local mode=${2}
496
497 if ! isoneof mode ${IPSEC_VALID_AUTH_MODES}; then
498 log ERROR "Auth mode '${mode}' is invalid"
499 return ${EXIT_ERROR}
500 fi
501
502 if ! ipsec_connection_write_config_key "${connection}" "AUTH_MODE" ${mode^^}; then
503 log ERROR "Could not write configuration settings"
504 return ${EXIT_ERROR}
505 fi
506 }
507
508 # Set the psk
509 ipsec_connection_authentication_psk() {
510 if [ ! $# -eq 2 ]; then
511 log ERROR "Not enough arguments"
512 return ${EXIT_ERROR}
513 fi
514
515 local connection=${1}
516 local psk=${2}
517
518 local length=${#psk}
519
520 if [ ${length} -lt 4 ]; then
521 error "The PSK must be longer than four characters"
522 return ${EXIT_ERROR}
523 fi
524
525 if [ ${length} -gt 128 ]; then
526 error "The PSK cannot be longer than 128 characters"
527 return ${EXIT_ERROR}
528 fi
529
530 if ! ipsec_connection_write_config_key "${connection}" "PSK" "${psk}"; then
531 log ERROR "Could not write configuration settings"
532 return ${EXIT_ERROR}
533 fi
534
535 return ${EXIT_OK}
536 }
537
538 ipsec_connection_up() {
539 local connection="${1}"
540
541 if ! ipsec_connection_exists "${connection}"; then
542 error "No such VPN IPsec connection: ${connection}"
543 return ${EXIT_ERROR}
544 fi
545
546 cmd swanctl --initiate --child "${connection}"
547 }
548
549 ipsec_connection_down() {
550 local connection="${1}"
551
552 if ! ipsec_connection_exists "${connection}"; then
553 error "No such VPN IPsec connection: ${connection}"
554 return ${EXIT_ERROR}
555 fi
556
557 cmd swanctl --terminate --ike "${connection}"
558 }
559
560 # Handle the cli after authentification
561 ipsec_connection_dpd() {
562 if [ ! $# -gt 1 ]; then
563 log ERROR "Not enough arguments"
564 return ${EXIT_ERROR}
565 fi
566
567 local connection=${1}
568 local cmd=${2}
569 shift 2
570
571 case ${cmd} in
572 action)
573 ipsec_connection_dpd_action "${connection}" $@
574 ;;
575 delay)
576 ipsec_connection_dpd_delay "${connection}" $@
577 ;;
578 timeout)
579 ipsec_connection_dpd_timeout "${connection}" $@
580 ;;
581 *)
582 log ERROR "Unrecognized argument: ${cmd}"
583 return ${EXIT_ERROR}
584 ;;
585 esac
586 }
587
588 # Set the default dpd action
589 ipsec_connection_dpd_action() {
590 if [ ! $# -eq 2 ]; then
591 log ERROR "Not enough arguments"
592 return ${EXIT_ERROR}
593 fi
594 local connection=${1}
595 local action=${2}
596
597 if ! isoneof action "restart" "clear"; then
598 log ERROR "dpd action '${action}' is invalid"
599 return ${EXIT_ERROR}
600 fi
601
602 if ! ipsec_connection_write_config_key "${connection}" "DPD_ACTION" ${action}; then
603 log ERROR "Could not write configuration settings"
604 return ${EXIT_ERROR}
605 fi
606 }
607
608 # Set the dpd delay
609 ipsec_connection_dpd_delay() {
610 if [ ! $# -ge 2 ]; then
611 log ERROR "Not enough arguments"
612 return ${EXIT_ERROR}
613 fi
614
615 local connection=${1}
616 shift 1
617 local value=$@
618
619 if ! isinteger value; then
620 value=$(parse_time $@)
621 if [ ! $? -eq 0 ]; then
622 log ERROR "Parsing the passed time was not sucessful please check the passed values."
623 return ${EXIT_ERROR}
624 fi
625 fi
626
627 if [ ${value} -lt 0 ]; then
628 log ERROR "The passed time value must be in the sum greater or equal zero seconds."
629 return ${EXIT_ERROR}
630 fi
631
632 if ! ipsec_connection_write_config_key "${connection}" "DPD_DELAY" ${value}; then
633 log ERROR "Could not write configuration settings"
634 return ${EXIT_ERROR}
635 fi
636
637 return ${EXIT_OK}
638 }
639
640 # Set the dpd timeout
641 ipsec_connection_dpd_timeout() {
642 if [ ! $# -ge 2 ]; then
643 log ERROR "Not enough arguments"
644 return ${EXIT_ERROR}
645 fi
646
647 local connection=${1}
648 shift 1
649 local value=$@
650
651 if ! isinteger value; then
652 value=$(parse_time $@)
653 if [ ! $? -eq 0 ]; then
654 log ERROR "Parsing the passed time was not sucessful please check the passed values."
655 return ${EXIT_ERROR}
656 fi
657 fi
658
659 if [ ${value} -le 0 ]; then
660 log ERROR "The passed time value must be in the sum greater or equal zero seconds."
661 return ${EXIT_ERROR}
662 fi
663
664 if ! ipsec_connection_write_config_key "${connection}" "DPD_TIMEOUT" ${value}; then
665 log ERROR "Could not write configuration settings"
666 return ${EXIT_ERROR}
667 fi
668
669 return ${EXIT_OK}
670 }
671
672 # Handle the cli after local
673 ipsec_connection_local() {
674 if [ ! $# -ge 2 ]; then
675 log ERROR "Not enough arguments"
676 return ${EXIT_ERROR}
677 fi
678
679 local connection=${1}
680 local cmd=${2}
681 shift 2
682
683 case ${cmd} in
684 address)
685 ipsec_connection_local_address "${connection}" $@
686 ;;
687 id)
688 ipsec_connection_id "${connection}" "LOCAL" $@
689 ;;
690 prefix)
691 ipsec_connection_prefix "${connection}" "LOCAL" $@
692 ;;
693 *)
694 log ERROR "Unrecognized argument: ${cmd}"
695 return ${EXIT_ERROR}
696 ;;
697 esac
698
699 return ${EXIT_OK}
700 }
701
702 # Set the connection mode
703 ipsec_connection_mode() {
704 if [ ! $# -eq 2 ]; then
705 log ERROR "Not enough arguments"
706 return ${EXIT_ERROR}
707 fi
708 local connection=${1}
709 local mode=${2}
710
711 if ! isoneof mode ${IPSEC_VALID_MODES}; then
712 log ERROR "Mode '${mode}' is invalid"
713 return ${EXIT_ERROR}
714 fi
715
716 if ! ipsec_connection_write_config_key "${connection}" "MODE" ${mode}; then
717 log ERROR "Could not write configuration settings"
718 return ${EXIT_ERROR}
719 fi
720
721 return ${EXIT_OK}
722 }
723
724 # Set the local address
725 ipsec_connection_local_address() {
726 if [ ! $# -eq 2 ]; then
727 log ERROR "Not enough arguments"
728 return ${EXIT_ERROR}
729 fi
730 local connection=${1}
731 local local_address=${2}
732
733 if ! ipsec_connection_check_peer ${local_address}; then
734 log ERROR "Local address '${local_address}' is invalid"
735 return ${EXIT_ERROR}
736 fi
737
738 if ! ipsec_connection_write_config_key "${connection}" "LOCAL_ADDRESS" ${local_address}; then
739 log ERROR "Could not write configuration settings"
740 return ${EXIT_ERROR}
741 fi
742
743 return ${EXIT_OK}
744 }
745
746 # Set the peer to connect to
747 ipsec_connection_peer() {
748 if [ ! $# -eq 2 ]; then
749 log ERROR "Not enough arguments"
750 return ${EXIT_ERROR}
751 fi
752 local connection=${1}
753 local peer=${2}
754
755 if ! ipsec_connection_check_peer ${peer}; then
756 log ERROR "Peer '${peer}' is invalid"
757 return ${EXIT_ERROR}
758 fi
759
760 if ! ipsec_connection_write_config_key "${connection}" "PEER" ${peer}; then
761 log ERROR "Could not write configuration settings"
762 return ${EXIT_ERROR}
763 fi
764
765 return ${EXIT_OK}
766 }
767
768 #Set the local or remote id
769 ipsec_connection_id() {
770 if [ ! $# -eq 3 ]; then
771 log ERROR "Not enough arguments"
772 return ${EXIT_ERROR}
773 fi
774 local connection=${1}
775 local type=${2}
776 local id=${3}
777
778 if ! ipsec_connection_check_id ${id}; then
779 log ERROR "Id '${id}' is invalid"
780 return ${EXIT_ERROR}
781 fi
782
783 if ! ipsec_connection_write_config_key "${connection}" "${type}_ID" ${id}; then
784 log ERROR "Could not write configuration settings"
785 return ${EXIT_ERROR}
786 fi
787
788 return ${EXIT_OK}
789 }
790
791 # Set the local or remote prefix
792 ipsec_connection_prefix() {
793 if [ ! $# -ge 3 ]; then
794 log ERROR "Not enough arguments"
795 return ${EXIT_ERROR}
796 fi
797 local connection=${1}
798 local type=${2}
799 shift 2
800
801 local _prefix="${type}_PREFIX"
802 local "${_prefix}"
803 if ! ipsec_connection_read_config "${connection}" "${_prefix}"; then
804 return ${EXIT_ERROR}
805 fi
806
807 # Remove duplicated entries to proceed the list safely
808 assign "${_prefix}" "$(list_unique ${!_prefix} )"
809
810 local prefixes_added
811 local prefixes_removed
812 local prefixes_set
813
814 while [ $# -gt 0 ]; do
815 local arg="${1}"
816
817 case "${arg}" in
818 +*)
819 list_append prefixes_added "${arg:1}"
820 ;;
821 -*)
822 list_append prefixes_removed "${arg:1}"
823 ;;
824 [A-Fa-f0-9]*)
825 list_append prefixes_set "${arg}"
826 ;;
827 *)
828 error "Invalid argument: ${arg}"
829 return ${EXIT_ERROR}
830 ;;
831 esac
832 shift
833 done
834
835 # Check if the user is trying a mixed operation
836 if ! list_is_empty prefixes_set && (! list_is_empty prefixes_added || ! list_is_empty prefixes_removed); then
837 error "You cannot reset the prefix list and add or remove prefixes at the same time"
838 return ${EXIT_ERROR}
839 fi
840
841 # Set new prefix list
842 if ! list_is_empty prefixes_set; then
843 # Check if all prefixes are valid
844 local prefix
845 for prefix in ${prefixes_set}; do
846 if ! ip_net_is_valid ${prefix}; then
847 error "Unsupported prefix: ${prefix}"
848 return ${EXIT_ERROR}
849 fi
850 done
851
852 assign "${_prefix}" "${prefixes_set}"
853
854 # Perform incremental updates
855 else
856 local prefix
857
858 # Perform all removals
859 for prefix in ${prefixes_removed}; do
860 if ! list_remove "${_prefix}" ${prefix}; then
861 warning "${prefix} was not on the list and could not be removed"
862 fi
863 done
864
865
866 for prefix in ${prefixes_added}; do
867 if ip_net_is_valid ${prefix}; then
868 if ! list_append_unique "${_prefix}" ${prefix}; then
869 warning "${prefix} is already on the prefix list"
870 fi
871 else
872 warning "${prefix} is not a valid IP network and could not be added"
873 fi
874 done
875 fi
876
877 # Check if the list contain at least one valid prefix
878 if list_is_empty ${_prefix}; then
879 error "Cannot save an empty prefix list"
880 return ${EXIT_ERROR}
881 fi
882
883 # Save everything
884 if ! ipsec_connection_write_config_key "${connection}" "${_prefix}" ${!_prefix}; then
885 log ERROR "Could not write configuration settings"
886 fi
887
888 return ${EXIT_OK}
889 }
890
891 # Handle the cli after remote
892 ipsec_connection_remote() {
893 if [ ! $# -ge 2 ]; then
894 log ERROR "Not enough arguments"
895 return ${EXIT_ERROR}
896 fi
897
898 local connection=${1}
899 local cmd=${2}
900 shift 2
901
902 case ${cmd} in
903 id)
904 ipsec_connection_id "${connection}" "REMOTE" $@
905 ;;
906
907 prefix)
908 ipsec_connection_prefix "${connection}" "REMOTE" $@
909 ;;
910 *)
911 log ERROR "Unrecognized argument: ${cmd}"
912 return ${EXIT_ERROR}
913 ;;
914 esac
915
916 return ${EXIT_OK}
917 }
918
919 # Set the inactivity timeout
920 ipsec_connection_inactivity_timeout() {
921 if [ ! $# -ge 2 ]; then
922 log ERROR "Not enough arguments"
923 return ${EXIT_ERROR}
924 fi
925
926 local connection=${1}
927 shift 1
928 local value=$@
929
930 if ! isinteger value; then
931 value=$(parse_time $@)
932 if [ ! $? -eq 0 ]; then
933 log ERROR "Parsing the passed time was not sucessful please check the passed values."
934 return ${EXIT_ERROR}
935 fi
936 fi
937
938 if [ ${value} -le 0 ]; then
939 log ERROR "The passed time value must be in the sum greater zero seconds."
940 return ${EXIT_ERROR}
941 fi
942
943 if ! ipsec_connection_write_config_key "${connection}" "INACTIVITY_TIMEOUT" ${value}; then
944 log ERROR "Could not write configuration settings"
945 return ${EXIT_ERROR}
946 fi
947
948 return ${EXIT_OK}
949 }
950
951 # Set the default start action
952 ipsec_connection_start_action() {
953 if [ ! $# -eq 2 ]; then
954 log ERROR "Not enough arguments"
955 return ${EXIT_ERROR}
956 fi
957 local connection=${1}
958 local action=${2}
959
960 if ! isoneof action "on-demand" "always-on"; then
961 log ERROR "Start action '${action}' is invalid"
962 return ${EXIT_ERROR}
963 fi
964
965 if ! ipsec_connection_write_config_key "${connection}" "START_ACTION" ${action}; then
966 log ERROR "Could not write configuration settings"
967 return ${EXIT_ERROR}
968 fi
969 }
970
971 # Set the security policy to use
972 ipsec_connection_security_policy() {
973 if [ ! $# -eq 2 ]; then
974 log ERROR "Not enough arguments"
975 return ${EXIT_ERROR}
976 fi
977 local connection=${1}
978 local security_policy=${2}
979
980 if ! vpn_security_policy_exists ${security_policy}; then
981 log ERROR "No such vpn security policy '${security_policy}'"
982 return ${EXIT_ERROR}
983 fi
984
985 if ! ipsec_connection_write_config_key "${connection}" "SECURITY_POLICY" ${security_policy}; then
986 log ERROR "Could not write configuration settings"
987 return ${EXIT_ERROR}
988 fi
989 }
990
991 # Check if a id is valid
992 ipsec_connection_check_id() {
993 assert [ $# -eq 1 ]
994 local id=${1}
995
996 if [[ ${id} =~ ^@[[:alnum:]]+$ ]] || ip_is_valid ${id}; then
997 return ${EXIT_TRUE}
998 else
999 return ${EXIT_FALSE}
1000 fi
1001 }
1002
1003 # Checks if a peer is valid
1004 ipsec_connection_check_peer() {
1005 assert [ $# -eq 1 ]
1006 local peer=${1}
1007
1008 # TODO Accept also FQDNs
1009 if ip_is_valid ${peer}; then
1010 return ${EXIT_TRUE}
1011 else
1012 return ${EXIT_FALSE}
1013 fi
1014 }
1015
1016 # This function checks if a VPN IPsec connection name is valid
1017 # Allowed are only A-Za-z0-9
1018 ipsec_connection_check_name() {
1019 assert [ $# -eq 1 ]
1020
1021 local connection=${1}
1022
1023 [[ "${connection}" =~ [^[:alnum:]$] ]]
1024 }
1025
1026 # Function that creates one VPN IPsec connection
1027 ipsec_connection_new() {
1028 if [ $# -gt 1 ]; then
1029 error "Too many arguments"
1030 return ${EXIT_ERROR}
1031 fi
1032
1033 local connection="${1}"
1034 if ! isset connection; then
1035 error "Please provide a connection name"
1036 return ${EXIT_ERROR}
1037 fi
1038
1039 # Check for duplicates
1040 if ipsec_connection_exists "${connection}"; then
1041 error "The VPN IPsec connection ${connection} already exists"
1042 return ${EXIT_ERROR}
1043 fi
1044
1045 # Check if the name of the connection is valid
1046 if ipsec_connection_check_name "${connection}"; then
1047 error "'${connection}' contains illegal characters"
1048 return ${EXIT_ERROR}
1049 fi
1050
1051 log DEBUG "Creating VPN IPsec connection ${connection}"
1052
1053 if ! mkdir -p "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
1054 log ERROR "Could not create config directory for ${connection}"
1055 return ${EXIT_ERROR}
1056 fi
1057
1058 local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
1059
1060 AUTH_MODE=${IPSEC_DEFAULT_AUTH_MODE}
1061 DPD_ACTION=${IPSEC_DEFAULT_DPD_ACTION}
1062 DPD_DELAY=${IPSEC_DEFAULT_DPD_DELAY}
1063 DPD_TIMEOUT=${IPSEC_DEFAULT_DPD_TIMEOUT}
1064 ENABLED=${IPSEC_DEFAULT_ENABLED}
1065 MODE=${IPSEC_DEFAULT_MODE}
1066 START_ACTION=${IPSEC_DEFAULT_START_ACTION}
1067
1068 INACTIVITY_TIMEOUT=${IPSEC_DEFAULT_INACTIVITY_TIMEOUT}
1069 SECURITY_POLICY=${IPSEC_DEFAULT_SECURITY_POLICY}
1070
1071 if ! ipsec_connection_write_config "${connection}"; then
1072 log ERROR "Could not write new config file"
1073 return ${EXIT_ERROR}
1074 fi
1075
1076 # Configure strongswan autostart
1077 ipsec_strongswan_autostart
1078 }
1079
1080 # Function that deletes based on the passed parameters one ore more vpn security policies
1081 ipsec_connection_destroy() {
1082 local connection
1083 for connection in $@; do
1084 if ! ipsec_connection_exists "${connection}"; then
1085 log ERROR "The VPN IPsec connection ${connection} does not exist."
1086 continue
1087 fi
1088
1089 log DEBUG "Deleting VPN IPsec connection ${connection}"
1090
1091 # Delete strongswan configuration file
1092 file_delete "${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf"
1093
1094 if ! rm -rf "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
1095 log ERROR "Deleting the VPN IPsec connection ${connection} was not sucessful"
1096 return ${EXIT_ERROR}
1097 fi
1098
1099 done
1100 }
1101
1102 # List all ipsec connections
1103 ipsec_list_connections() {
1104 local connection
1105 for connection in ${NETWORK_IPSEC_CONNS_DIR}/*; do
1106 [ -d ${connection} ] || continue
1107 basename ${connection}
1108 done
1109 }
1110
1111 ipsec_connection_to_strongswan() {
1112 local connection="${1}"
1113
1114 # Read the config settings
1115 local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
1116 if ! ipsec_connection_read_config "${connection}"; then
1117 error "Could not read the connection ${connection}"
1118 return ${EXIT_ERROR}
1119 fi
1120
1121 local path="${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf"
1122
1123 (
1124 # Write the connection section
1125 _ipsec_connection_to_strongswan_connection "${connection}"
1126
1127 # Write the secrets section
1128 _ipsec_connection_to_strongswan_secrets "${connection}"
1129
1130 ) > ${path}
1131 }
1132
1133 _ipsec_connection_to_strongswan_connection() {
1134 local connection="${1}"
1135
1136 # Read the security policy
1137 local ${VPN_SECURITY_POLICIES_CONFIG_SETTINGS}
1138 if ! vpn_security_policies_read_config "${SECURITY_POLICY}"; then
1139 return ${EXIT_ERROR}
1140 fi
1141
1142 # Is DPD enabled?
1143 local dpd="false"
1144 if isset DPD_DELAY && isinteger DPD_DELAY && [ ${DPD_DELAY} -gt 0 ]; then
1145 dpd="true"
1146 fi
1147
1148 # Write configuration header
1149 config_header "strongSwan configuration for ${connection}"
1150
1151 print_indent 0 "connections {"
1152 print_indent 1 "${connection} {"
1153
1154 # IKE Version
1155 print_indent 2 "# IKE Version"
1156 case "${KEY_EXCHANGE^^}" in
1157 IKEV1)
1158 print_indent 2 "version = 1"
1159 ;;
1160
1161 # Fall back to IKEv2 for any random values
1162 IKEV2|*)
1163 print_indent 2 "version = 2"
1164 ;;
1165 esac
1166 print # empty line
1167
1168 # Always only keep one connection open at a time
1169 print_indent 2 "# Unique IDs"
1170 print_indent 2 "unique = replace"
1171 print
1172
1173 # Local Address
1174 print_indent 2 "# Local Address"
1175 if isset LOCAL_ADDRESS; then
1176 print_indent 2 "local_addrs = ${LOCAL_ADDRESS}"
1177 else
1178 print_indent 2 "local_addrs = %any"
1179 fi
1180 print
1181
1182 # Remote Address
1183 print_indent 2 "# Remote Address"
1184 if isset PEER; then
1185 print_indent 2 "remote_addrs = ${PEER}"
1186 else
1187 print_indent 2 "remote_addrs = %any"
1188 fi
1189 print
1190
1191 # IKE Proposals
1192 print_indent 2 "# IKE Proposals"
1193 print_indent 2 "proposals = $(vpn_security_policies_make_ike_proposal ${SECURITY_POLICY})"
1194 print
1195
1196 # DPD Settings
1197 if enabled dpd; then
1198 print_indent 2 "# Dead Peer Detection"
1199 print_indent 2 "dpd_delay = ${DPD_DELAY}"
1200
1201 if isset DPD_TIMEOUT; then
1202 print_indent 2 "dpd_timeout = ${DPD_TIMEOUT}"
1203 fi
1204
1205 print
1206 fi
1207
1208 # Fragmentation
1209 print_indent 2 "# Fragmentation"
1210 print_indent 2 "fragmentation = yes"
1211 print
1212
1213 # Local
1214 print_indent 2 "local {"
1215
1216 # Local ID
1217 if isset LOCAL_ID; then
1218 print_indent 3 "id = ${LOCAL_ID}"
1219 fi
1220
1221 # Authentication
1222 case "${AUTH_MODE}" in
1223 PSK)
1224 print_indent 3 "auth = psk"
1225 ;;
1226 esac
1227
1228 print_indent 2 "}"
1229 print
1230
1231 # Remote
1232 print_indent 2 "remote {"
1233
1234 # Remote ID
1235 if isset REMOTE_ID; then
1236 print_indent 3 "id = ${REMOTE_ID}"
1237 fi
1238
1239 # Authentication
1240 case "${AUTH_MODE}" in
1241 PSK)
1242 print_indent 3 "auth = psk"
1243 ;;
1244 esac
1245
1246 print_indent 2 "}"
1247 print
1248
1249 # Children
1250
1251 print_indent 2 "children {"
1252 print_indent 3 "${connection} {"
1253
1254 print_indent 4 "# ESP Proposals"
1255 print_indent 4 "esp_proposals = $(vpn_security_policies_make_esp_proposal ${SECURITY_POLICY})"
1256 print
1257
1258 # Traffic Selectors
1259
1260 case "${MODE}" in
1261 gre-*)
1262 print_indent 4 "local_ts = dynamic[gre]"
1263 print_indent 4 "remote_ts = dynamic[gre]"
1264 ;;
1265 *)
1266 # Local Prefixes
1267 if isset LOCAL_PREFIX; then
1268 print_indent 4 "local_ts = $(list_join LOCAL_PREFIX ,)"
1269 else
1270 print_indent 4 "local_ts = dynamic"
1271 fi
1272
1273 # Remote Prefixes
1274 if isset REMOTE_PREFIX; then
1275 print_indent 4 "remote_ts = $(list_join REMOTE_PREFIX ,)"
1276 else
1277 print_indent 4 "remote_ts = dynamic"
1278 fi
1279 ;;
1280 esac
1281 print
1282
1283 # Netfilter Marks
1284 case "${MODE}" in
1285 vti)
1286 print_indent 4 "# Netfilter Marks"
1287 print_indent 4 "mark_in = %unique"
1288 print_indent 4 "mark_out = %unique"
1289 print
1290 ;;
1291 esac
1292
1293 # Dead Peer Detection
1294 if enabled dpd; then
1295 print_indent 4 "# Dead Peer Detection"
1296 print_indent 4 "dpd_action = ${DPD_ACTION}"
1297 print
1298 fi
1299
1300 # Rekeying
1301 if isset LIFETIME; then
1302 print_indent 4 "# Rekey Time"
1303 print_indent 4 "rekey_time = ${LIFETIME}"
1304 print
1305 fi
1306
1307 # Updown Script
1308 print_indent 4 "updown = ${NETWORK_HELPERS_DIR}/ipsec-updown"
1309 print
1310
1311 # Mode
1312 print_indent 4 "# Mode"
1313 case "${MODE}" in
1314 gre-transport)
1315 print_indent 4 "mode = transport"
1316 ;;
1317 tunnel|vti|*)
1318 print_indent 4 "mode = tunnel"
1319 ;;
1320 esac
1321 print
1322
1323 # Compression
1324 print_indent 4 "# Compression"
1325 if enabled COMPRESSION; then
1326 print_indent 4 "ipcomp = yes"
1327 else
1328 print_indent 4 "ipcomp = no"
1329 fi
1330 print
1331
1332 # Inactivity Timeout
1333 if isset INACTIVITY_TIMEOUT; then
1334 print_indent 4 "# Inactivity Timeout"
1335 print_indent 4 "inactivity = ${INACTIVITY_TIMEOUT}"
1336 print
1337 fi
1338
1339 # Start Action
1340 print_indent 4 "# Start Action"
1341 case "${START_ACTION}" in
1342 on-demand)
1343 print_indent 4 "start_action = trap"
1344 print_indent 4 "close_action = trap"
1345 ;;
1346 wait)
1347 print_indent 4 "start_action = none"
1348 print_indent 4 "close_action = none"
1349 ;;
1350 always-on|*)
1351 print_indent 4 "start_action = start"
1352 print_indent 4 "close_action = start"
1353 ;;
1354 esac
1355 print
1356
1357 print_indent 3 "}"
1358 print_indent 2 "}"
1359 print
1360
1361 print_indent 1 "}"
1362 print_indent 0 "}"
1363 print
1364 }
1365
1366 _ipsec_connection_to_strongswan_secrets() {
1367 local connection="${1}"
1368
1369 print_indent 0 "secrets {"
1370
1371 case "${AUTH_MODE}" in
1372 PSK)
1373 print_indent 1 "ike {"
1374
1375 # Secret
1376 print_indent 2 "secret = ${PSK}"
1377
1378 # ID
1379 if isset REMOTE_ID; then
1380 print_indent 2 "id = ${REMOTE_ID}"
1381 fi
1382
1383 print_indent 1 "}"
1384 ;;
1385 esac
1386
1387 print_indent 0 "}"
1388 }
1389
1390 # This function writes all values to a via ${pool} specificated VPN IPsec pool configuration file
1391 ipsec_pool_write_config() {
1392 assert [ $# -ge 1 ]
1393
1394 local pool="${1}"
1395
1396 if ! ipsec_pool_exists "${pool}"; then
1397 log ERROR "No such VPN IPsec pool: ${pool}"
1398 return ${EXIT_ERROR}
1399 fi
1400
1401 local path="${NETWORK_IPSEC_POOLS_DIR}/${pool}/settings"
1402
1403 if ! settings_write "${path}" ${IPSEC_POOL_CONFIG_SETTINGS}; then
1404 log ERROR "Could not write configuration settings for VPN IPsec pool ${pool}"
1405 return ${EXIT_ERROR}
1406 fi
1407 }
1408
1409 # This funtion writes the value for one key to a via ${connection} specificated
1410 # VPN IPsec pool configuration file
1411 ipsec_pool_write_config_key() {
1412 assert [ $# -ge 3 ]
1413
1414 local pool=${1}
1415 local key=${2}
1416 shift 2
1417
1418 local value="$@"
1419
1420 if ! ipsec_pool_exists "${pool}"; then
1421 log ERROR "No such VPN IPsec pool: ${pool}"
1422 return ${EXIT_ERROR}
1423 fi
1424
1425 log DEBUG "Set '${key}' to new value '${value}' in VPN IPsec pool '${pool}'"
1426
1427 local ${IPSEC_POOL_CONFIG_SETTINGS}
1428
1429 # Read the config settings
1430 if ! ipsec_pool_read_config "${pool}"; then
1431 return ${EXIT_ERROR}
1432 fi
1433
1434 # Set the key to a new value
1435 assign "${key}" "${value}"
1436
1437 if ! ipsec_pool_write_config "${pool}"; then
1438 return ${EXIT_ERROR}
1439 fi
1440
1441 return ${EXIT_TRUE}
1442 }
1443
1444 # Reads one or more keys out of a settings file or all if no key is provided.
1445 ipsec_pool_read_config() {
1446 assert [ $# -ge 1 ]
1447
1448 local pool="${1}"
1449 shift 1
1450
1451 if ! ipsec_pool_exists "${pool}"; then
1452 log ERROR "No such VPN IPsec pool : ${pool}"
1453 return ${EXIT_ERROR}
1454 fi
1455
1456 local args
1457 if [ $# -eq 0 ] && [ -n "${IPSEC_POOL_CONFIG_SETTINGS}" ]; then
1458 list_append args ${IPSEC_POOL_CONFIG_SETTINGS}
1459 else
1460 list_append args $@
1461 fi
1462
1463 local path="${NETWORK_IPSEC_POOLS_DIR}/${pool}/settings"
1464
1465 if ! settings_read "${path}" ${args}; then
1466 log ERROR "Could not read settings for VPN IPsec pool ${pool}"
1467 return ${EXIT_ERROR}
1468 fi
1469 }
1470
1471 # This function checks if a vpn IPsec pool exists
1472 # Returns True when yes and false when not
1473 ipsec_pool_exists() {
1474 assert [ $# -eq 1 ]
1475
1476 local pool=${1}
1477
1478 local path="${NETWORK_IPSEC_POOLS_DIR}/${pool}"
1479
1480 [ -d "${path}" ] && return ${EXIT_TRUE} || return ${EXIT_FALSE}
1481 }
1482
1483 # This function checks if a VPN IPsec pool name is valid
1484 # Allowed are only A-Za-z0-9
1485 ipsec_pool_check_name() {
1486 assert [ $# -eq 1 ]
1487
1488 local pool=${1}
1489
1490 # These are special words in strongswan
1491 if isoneof pool dhcp radius; then
1492 return ${EXIT_ERROR}
1493 fi
1494
1495 [[ "${pool}" =~ [^[:alnum:]$] ]]
1496 }
1497
1498 ipsec_pool_new() {
1499 if [ $# -gt 1 ]; then
1500 error "Too many arguments"
1501 return ${EXIT_ERROR}
1502 fi
1503
1504 local pool="${1}"
1505 if ! isset pool; then
1506 error "Please provide a pool name"
1507 return ${EXIT_ERROR}
1508 fi
1509
1510 # Check for duplicates
1511 if ipsec_pool_exists "${pool}"; then
1512 error "The VPN IPsec pool ${pool} already exists"
1513 return ${EXIT_ERROR}
1514 fi
1515
1516 # Check if the name of the connection is valid
1517 if ipsec_pool_check_name "${pool}"; then
1518 error "'${pool}' contains illegal characters"
1519 return ${EXIT_ERROR}
1520 fi
1521
1522 log DEBUG "Creating VPN IPsec pool ${pool}"
1523
1524 if ! mkdir -p "${NETWORK_IPSEC_POOLS_DIR}/${pool}"; then
1525 log ERROR "Could not create config directory for ${pool}"
1526 return ${EXIT_ERROR}
1527 fi
1528
1529 local ${IPSEC_POOL_CONFIG_SETTINGS}
1530
1531 if ! ipsec_pool_write_config "${pool}"; then
1532 log ERROR "Could not write new config file"
1533 return ${EXIT_ERROR}
1534 fi
1535 }
1536
1537 # Function that deletes based on the passed parameters
1538 # one ore more vpn ipsec pools
1539 ipsec_pool_destroy() {
1540 local pool
1541 for pool in $@; do
1542 if ! ipsec_pool_exists "${pool}"; then
1543 log ERROR "The VPN IPsec pool ${pool} does not exist."
1544 continue
1545 fi
1546
1547 log DEBUG "Deleting VPN IPsec pool ${pool}"
1548
1549 if ! rm -rf "${NETWORK_IPSEC_POOLS_DIR}/${pool}"; then
1550 log ERROR "Deleting the VPN IPsec pool ${pool} was not sucessful"
1551 return ${EXIT_ERROR}
1552 fi
1553 done
1554 }
1555
1556 ipsec_pool_network() {
1557 if [ ! $# -ge 2 ]; then
1558 log ERROR "Not enough arguments"
1559 return ${EXIT_ERROR}
1560 fi
1561 local pool=${1}
1562 shift 1
1563
1564 local NETWORKS
1565 if ! ipsec_pool_read_config "${pool}" "NETWORKS"; then
1566 return ${EXIT_ERROR}
1567 fi
1568
1569 # Remove duplicated entries to proceed the list safely
1570 assign "NETWORKS" "$(list_unique ${NETWORKS})"
1571
1572 local networks_added
1573 local networks_removed
1574 local networks_set
1575
1576 while [ $# -gt 0 ]; do
1577 local arg="${1}"
1578
1579 case "${arg}" in
1580 +*)
1581 list_append networks_added "${arg:1}"
1582 ;;
1583 -*)
1584 list_append networks_removed "${arg:1}"
1585 ;;
1586 [A-Fa-f0-9]*)
1587 list_append networks_set "${arg}"
1588 ;;
1589 *)
1590 error "Invalid argument: ${arg}"
1591 return ${EXIT_ERROR}
1592 ;;
1593 esac
1594 shift
1595 done
1596
1597 # Check if the user is trying a mixed operation
1598 if ! list_is_empty networks_set && (! list_is_empty networks_added || ! list_is_empty networks_removed); then
1599 error "You cannot reset the networks list and add or remove networks at the same time"
1600 return ${EXIT_ERROR}
1601 fi
1602
1603 # Set new prefix list
1604 if ! list_is_empty networks_set; then
1605 # Check if all networks are valid
1606 local network
1607 for network in ${networks_set}; do
1608 if ! ip_net_is_valid ${network}; then
1609 error "Unsupported prefix: ${network}"
1610 return ${EXIT_ERROR}
1611 fi
1612 done
1613
1614 assign "NETWORKS" "${networks_set}"
1615
1616 # Perform incremental updates
1617 else
1618 # Perform all removals
1619 local network
1620 for network in ${networks_removed}; do
1621 if ! list_remove "NETWORKS" ${network}; then
1622 warning "${network} was not on the list and could not be removed"
1623 fi
1624 done
1625
1626 for network in ${networks_added}; do
1627 if ip_net_is_valid ${network}; then
1628 if ! list_append_unique "NETWORKS" ${network}; then
1629 warning "${network} is already on the network list"
1630 fi
1631 else
1632 warning "${network} is not a valid IP network and could not be added"
1633 fi
1634 done
1635 fi
1636
1637 # Check if the list contain at least one valid network
1638 if list_is_empty "NETWORKS"; then
1639 error "Cannot save an empty network list"
1640 return ${EXIT_ERROR}
1641 fi
1642
1643 # Save everything
1644 if ! ipsec_pool_write_config_key "${pool}" "NETWORKS" "${NETWORKS}"; then
1645 log ERROR "Could not write configuration settings"
1646 fi
1647
1648 return ${EXIT_OK}
1649 }
1650
1651 ipsec_pool_dns_server() {
1652 if [ ! $# -ge 2 ]; then
1653 log ERROR "Not enough arguments"
1654 return ${EXIT_ERROR}
1655 fi
1656 local pool=${1}
1657 shift 1
1658
1659 local NETWORK
1660 if ! ipsec_pool_read_config "${pool}" "DNS_SERVERS"; then
1661 return ${EXIT_ERROR}
1662 fi
1663
1664 # Remove duplicated entries to proceed the list safely
1665 assign "DNS_SERVERS" "$(list_unique ${DNS_SERVERS})"
1666
1667 local dns_servers_added
1668 local dns_servers_removed
1669 local dns_servers_set
1670
1671 while [ $# -gt 0 ]; do
1672 local arg="${1}"
1673
1674 case "${arg}" in
1675 +*)
1676 list_append dns_servers_added "${arg:1}"
1677 ;;
1678 -*)
1679 list_append dns_servers_removed "${arg:1}"
1680 ;;
1681 [A-Fa-f0-9]*)
1682 list_append dns_servers_set "${arg}"
1683 ;;
1684 *)
1685 error "Invalid argument: ${arg}"
1686 return ${EXIT_ERROR}
1687 ;;
1688 esac
1689 shift
1690 done
1691
1692 # Check if the user is trying a mixed operation
1693 if ! list_is_empty dns_servers_set && (! list_is_empty dns_servers_added || ! list_is_empty dns_servers_removed); then
1694 error "You cannot reset the DNS servers list and add or remove DNS servers at the same time"
1695 return ${EXIT_ERROR}
1696 fi
1697
1698 # Set new dns server list
1699 if ! list_is_empty dns_servers_set; then
1700 # Check if all dns servers are valid
1701 local dns_server
1702 for dns_server in ${dns_servers_set}; do
1703 if ! ip_is_valid ${dns_server}; then
1704 error "Invalid DNS server: ${dns_server}"
1705 return ${EXIT_ERROR}
1706 fi
1707 done
1708
1709 assign "DNS_SERVERS" "${dns_servers_set}"
1710
1711 # Perform incremental updates
1712 else
1713 # Perform all removals
1714 local dns_server
1715 for dns_server in ${dns_servers_removed}; do
1716 if ! list_remove "DNS_SERVERS" ${dns_server}; then
1717 warning "${dns_server} was not on the list and could not be removed"
1718 fi
1719 done
1720
1721 for dns_server in ${dns_servers_added}; do
1722 if ip_is_valid ${dns_server}; then
1723 if ! list_append_unique "DNS_SERVERS" ${dns_server}; then
1724 warning "${dns_server} is already on the DNS server list"
1725 fi
1726 else
1727 warning "${dns_server} is not a valid DNS server and could not be added"
1728 fi
1729 done
1730 fi
1731
1732 # Check if the list contain at least one valid prefix
1733 if list_is_empty "DNS_SERVERS"; then
1734 error "Cannot save an empty DNS server list"
1735 return ${EXIT_ERROR}
1736 fi
1737
1738 # Save everything
1739 if ! ipsec_pool_write_config_key "${pool}" "DNS_SERVERS" "${DNS_SERVER}"; then
1740 log ERROR "Could not write configuration settings"
1741 fi
1742
1743 return ${EXIT_OK}
1744 }