2 ###############################################################################
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2017 IPFire Network Development Team #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
20 ###############################################################################
22 IPSEC_CONNECTION_CONFIG_SETTINGS
="\
40 IPSEC_DEFAULT_AUTH_MODE
="PSK"
41 IPSEC_DEFAULT_DPD_ACTION
="restart"
42 IPSEC_DEFAULT_DPD_DELAY
="30"
43 IPSEC_DEFAULT_DPD_TIMEOUT
="120"
44 IPSEC_DEFAULT_ENABLED
="true"
45 IPSEC_DEFAULT_INACTIVITY_TIMEOUT
="0"
46 IPSEC_DEFAULT_MODE
="tunnel"
47 IPSEC_DEFAULT_SECURITY_POLICY
="system"
48 IPSEC_DEFAULT_START_ACTION
="on-demand"
50 IPSEC_VALID_MODES
="gre-transport tunnel vti"
51 IPSEC_VALID_AUTH_MODES
="PSK"
59 cli_ipsec_connection $@
62 error
"Unrecognized argument: ${action}"
68 cli_ipsec_connection
() {
69 if ipsec_connection_exists
${1}; then
76 authentication|down|disable|dpd|
enable|inactivity_timeout|
local|mode|peer|remote|security_policy|start_action|up
)
77 ipsec_connection_
${key} ${connection} $@
80 cli_ipsec_connection_show
"${connection}"
84 error
"Unrecognized argument: ${key}"
94 ipsec_connection_new $@
97 cli_ipsec_connection_destroy $@
100 if [ -n "${action}" ]; then
101 error
"Unrecognized argument: '${action}'"
109 cli_ipsec_connection_destroy
() {
110 local connection
="${1}"
112 if ! ipsec_connection_destroy
"${connection}"; then
116 # Inform strongswan about the changes
117 ipsec_strongswan_load
119 # Configure strongswan autostart
120 ipsec_strongswan_autostart
123 cli_ipsec_connection_show
() {
124 local connection
="${1}"
126 # Read the config settings
127 local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
128 if ! ipsec_connection_read_config
"${connection}"; then
129 error
"Could not read the connection configuration"
133 cli_headline
0 "IPsec VPN Connection: ${connection}"
138 cli_print_fmt1
1 "Peer" "${PEER}"
142 cli_print_fmt1
1 "Security Policy" "${SECURITY_POLICY-${IPSEC_DEFAULT_SECURITY_POLICY}}"
145 cli_headline
2 "Authentication"
146 case "${AUTH_MODE^^}" in
148 cli_print_fmt1
2 "Mode" "Pre-Shared-Key"
151 cli_print_fmt1
2 "Pre-Shared-Key" "****"
153 cli_print_fmt1
2 "Pre-Shared-Key" "- is not set -"
163 for i
in LOCAL REMOTE
; do
166 cli_headline
2 "Local"
169 cli_headline
2 "Remote"
173 local id_var
="${i}_ID"
174 if [ -n "${!id_var}" ]; then
175 cli_print_fmt1
2 "ID" "${!id_var}"
178 local prefix_var
="${i}_PREFIX"
179 if isset
${prefix_var}; then
180 cli_headline
3 "Prefix(es)"
183 for prefix
in ${!prefix_var}; do
184 cli_print_fmt1
3 "${prefix}"
191 cli_headline
2 "Misc."
195 cli_print_fmt1
2 "Transport Mode" "GRE Transport"
198 cli_print_fmt1
2 "Transport Mode" "Tunnel"
201 cli_print_fmt1
2 "Transport Mode" "Virtual Tunnel Interface"
204 cli_print_fmt1
2 "Transport Mode" "- Unknown -"
209 if isset INACTIVITY_TIMEOUT
&& [ ${INACTIVITY_TIMEOUT} -gt 0 ]; then
210 cli_print_fmt1
2 "Inactivity Timeout" "$(format_time ${INACTIVITY_TIMEOUT})"
217 ipsec_connection_disable
() {
218 local connection
=${1}
220 if ! ipsec_connection_write_config_key
"${connection}" "ENABLED" "false"; then
221 log ERROR
"Could not write configuration settings"
225 ipsec_reload
${connection}
227 # Configure strongswan autostart
228 ipsec_strongswan_autostart
231 ipsec_connection_enable
() {
232 local connection
=${1}
234 if ! ipsec_connection_write_config_key
"${connection}" "ENABLED" "true"; then
235 log ERROR
"Could not write configuration settings"
239 ipsec_reload
"${connection}"
241 # Configure strongswan autostart
242 ipsec_strongswan_autostart
245 # This function writes all values to a via ${connection} specificated VPN IPsec configuration file
246 ipsec_connection_write_config
() {
249 local connection
="${1}"
251 if ! ipsec_connection_exists
"${connection}"; then
252 log ERROR
"No such VPN IPsec connection: ${connection}"
256 local path
="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
258 if ! settings_write
"${path}" ${IPSEC_CONNECTION_CONFIG_SETTINGS}; then
259 log ERROR
"Could not write configuration settings for VPN IPsec connection ${connection}"
263 ipsec_reload
${connection}
266 # This funtion writes the value for one key to a via ${connection} specificated VPN IPsec connection configuration file
267 ipsec_connection_write_config_key
() {
270 local connection
=${1}
276 if ! ipsec_connection_exists
"${connection}"; then
277 log ERROR
"No such VPN ipsec connection: ${connection}"
281 log DEBUG
"Set '${key}' to new value '${value}' in VPN ipsec connection '${connection}'"
283 local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
285 # Read the config settings
286 if ! ipsec_connection_read_config
"${connection}"; then
290 # Set the key to a new value
291 assign
"${key}" "${value}"
293 if ! ipsec_connection_write_config
"${connection}"; then
300 # Reads one or more keys out of a settings file or all if no key is provided.
301 ipsec_connection_read_config
() {
304 local connection
="${1}"
307 if ! ipsec_connection_exists
"${connection}"; then
308 log ERROR
"No such VPN IPsec connection : ${connection}"
314 if [ $# -eq 0 ] && [ -n "${IPSEC_CONNECTION_CONFIG_SETTINGS}" ]; then
315 list_append args
${IPSEC_CONNECTION_CONFIG_SETTINGS}
320 local path
="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
322 if ! settings_read
"${path}" ${args}; then
323 log ERROR
"Could not read settings for VPN IPsec connection ${connection}"
328 # This function checks if a vpn ipsec connection exists
329 # Returns True when yes and false when not
330 ipsec_connection_exists
() {
333 local connection
=${1}
335 local path
="${NETWORK_IPSEC_CONNS_DIR}/${connection}"
337 [ -d "${path}" ] && return ${EXIT_TRUE} || return ${EXIT_FALSE}
340 # Determines if strongswan should be automatically started
341 # when the system boots up.
342 ipsec_strongswan_autostart() {
343 local autostart_needed="false
"
346 for connection in $(ipsec_list_connections); do
349 if ! ipsec_connection_read_config "${connection}" "ENABLED
"; then
350 log WARNING "Could not
read configuation
"
354 if enabled ENABLED; then
355 autostart_needed="true
"
360 # Start strongswan when we need it and when it is not yet enabled
361 if ${autostart_needed}; then
362 if ! service_is_enabled "strongswan
"; then
363 service_enable "strongswan
"
366 if ! service_is_active "strongswan
"; then
367 service_start "strongswan
"
370 # Disable strongswan when we do not need it but it is enabled
371 elif ! ${autostart_needed}; then
372 if service_is_enabled "strongswan
"; then
373 service_disable "strongswan
"
376 if service_is_active "strongswan
"; then
377 service_stop "strongswan
"
382 ipsec_strongswan_load() {
383 # Do nothing if strongswan is not running
384 if ! service_is_active "strongswan
"; then
388 if ! cmd swanctl --load-all; then
389 log ERROR "Could not reload strongswan config
"
394 # Reloads the connection after config changes
396 local connection=${1}
400 if ! ipsec_connection_read_config "${connection}" "ENABLED
"; then
401 log ERROR "Could not
read configuration
for IPsec connection
${connection}"
405 if enabled ENABLED; then
406 if ! ipsec_connection_to_strongswan ${connection}; then
407 log ERROR "Could not generate strongswan config
for ${connnection}"
411 unlink "${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf
"
414 ipsec_strongswan_load
417 # Handle the cli after authentification
418 ipsec_connection_authentication() {
419 if [ ! $# -gt 1 ]; then
420 log ERROR "Not enough arguments
"
424 local connection=${1}
430 ipsec_connection_authentication_mode "${connection}" $@
433 ipsec_connection_authentication_psk "${connection}" $@
436 log ERROR "Unrecognized argument
: ${cmd}"
442 # Set the authentification mode
443 ipsec_connection_authentication_mode() {
444 if [ ! $# -eq 2 ]; then
445 log ERROR "Not enough arguments
"
448 local connection=${1}
451 if ! isoneof mode ${IPSEC_VALID_AUTH_MODES}; then
452 log ERROR "Auth mode
'${mode}' is invalid
"
456 if ! ipsec_connection_write_config_key "${connection}" "AUTH_MODE
" ${mode^^}; then
457 log ERROR "Could not
write configuration settings
"
463 ipsec_connection_authentication_psk() {
464 if [ ! $# -eq 2 ]; then
465 log ERROR "Not enough arguments
"
469 local connection=${1}
474 if [ ${length} -lt 4 ]; then
475 error "The PSK must be longer than four characters
"
479 if [ ${length} -gt 128 ]; then
480 error "The PSK cannot be longer than
128 characters
"
484 if ! ipsec_connection_write_config_key "${connection}" "PSK
" "${psk}"; then
485 log ERROR "Could not
write configuration settings
"
492 ipsec_connection_up() {
493 local connection="${1}"
495 if ! ipsec_connection_exists "${connection}"; then
496 error "No such VPN IPsec connection
: ${connection}"
500 cmd swanctl --initiate --child "${connection}"
503 ipsec_connection_down() {
504 local connection="${1}"
506 if ! ipsec_connection_exists "${connection}"; then
507 error "No such VPN IPsec connection
: ${connection}"
511 cmd swanctl --terminate --ike "${connection}"
514 # Handle the cli after authentification
515 ipsec_connection_dpd() {
516 if [ ! $# -gt 1 ]; then
517 log ERROR "Not enough arguments
"
521 local connection=${1}
527 ipsec_connection_dpd_action "${connection}" $@
530 ipsec_connection_dpd_delay "${connection}" $@
533 ipsec_connection_dpd_timeout "${connection}" $@
536 log ERROR "Unrecognized argument
: ${cmd}"
542 # Set the default dpd action
543 ipsec_connection_dpd_action() {
544 if [ ! $# -eq 2 ]; then
545 log ERROR "Not enough arguments
"
548 local connection=${1}
551 if ! isoneof action "restart
" "clear"; then
552 log ERROR "dpd action
'${action}' is invalid
"
556 if ! ipsec_connection_write_config_key "${connection}" "DPD_ACTION
" ${action}; then
557 log ERROR "Could not
write configuration settings
"
563 ipsec_connection_dpd_delay() {
564 if [ ! $# -ge 2 ]; then
565 log ERROR "Not enough arguments
"
569 local connection=${1}
573 if ! isinteger value; then
574 value=$(parse_time $@)
575 if [ ! $? -eq 0 ]; then
576 log ERROR "Parsing the passed
time was not sucessful please check the passed values.
"
581 if [ ${value} -lt 0 ]; then
582 log ERROR "The passed
time value must be
in the
sum greater or equal zero seconds.
"
586 if ! ipsec_connection_write_config_key "${connection}" "DPD_DELAY
" ${value}; then
587 log ERROR "Could not
write configuration settings
"
594 # Set the dpd timeout
595 ipsec_connection_dpd_timeout() {
596 if [ ! $# -ge 2 ]; then
597 log ERROR "Not enough arguments
"
601 local connection=${1}
605 if ! isinteger value; then
606 value=$(parse_time $@)
607 if [ ! $? -eq 0 ]; then
608 log ERROR "Parsing the passed
time was not sucessful please check the passed values.
"
613 if [ ${value} -le 0 ]; then
614 log ERROR "The passed
time value must be
in the
sum greater or equal zero seconds.
"
618 if ! ipsec_connection_write_config_key "${connection}" "DPD_TIMEOUT
" ${value}; then
619 log ERROR "Could not
write configuration settings
"
626 # Handle the cli after local
627 ipsec_connection_local() {
628 if [ ! $# -ge 2 ]; then
629 log ERROR "Not enough arguments
"
633 local connection=${1}
639 ipsec_connection_local_address "${connection}" $@
642 ipsec_connection_id "${connection}" "LOCAL
" $@
645 ipsec_connection_prefix "${connection}" "LOCAL
" $@
648 log ERROR "Unrecognized argument
: ${cmd}"
656 # Set the connection mode
657 ipsec_connection_mode() {
658 if [ ! $# -eq 2 ]; then
659 log ERROR "Not enough arguments
"
662 local connection=${1}
665 if ! isoneof mode ${IPSEC_VALID_MODES}; then
666 log ERROR "Mode
'${mode}' is invalid
"
670 if ! ipsec_connection_write_config_key "${connection}" "MODE
" ${mode}; then
671 log ERROR "Could not
write configuration settings
"
678 # Set the local address
679 ipsec_connection_local_address() {
680 if [ ! $# -eq 2 ]; then
681 log ERROR "Not enough arguments
"
684 local connection=${1}
685 local local_address=${2}
687 if ! ipsec_connection_check_peer ${local_address}; then
688 log ERROR "Local address
'${local_address}' is invalid
"
692 if ! ipsec_connection_write_config_key "${connection}" "LOCAL_ADDRESS
" ${local_address}; then
693 log ERROR "Could not
write configuration settings
"
700 # Set the peer to connect to
701 ipsec_connection_peer() {
702 if [ ! $# -eq 2 ]; then
703 log ERROR "Not enough arguments
"
706 local connection=${1}
709 if ! ipsec_connection_check_peer ${peer}; then
710 log ERROR "Peer
'${peer}' is invalid
"
714 if ! ipsec_connection_write_config_key "${connection}" "PEER
" ${peer}; then
715 log ERROR "Could not
write configuration settings
"
722 #Set the local or remote id
723 ipsec_connection_id() {
724 if [ ! $# -eq 3 ]; then
725 log ERROR "Not enough arguments
"
728 local connection=${1}
732 if ! ipsec_connection_check_id ${id}; then
733 log ERROR "Id
'${id}' is invalid
"
737 if ! ipsec_connection_write_config_key "${connection}" "${type}_ID" ${id}; then
738 log ERROR
"Could not write configuration settings"
745 # Set the local or remote prefix
746 ipsec_connection_prefix
() {
747 if [ ! $# -ge 3 ]; then
748 log ERROR
"Not enough arguments"
751 local connection
=${1}
755 local _prefix
="${type}_PREFIX"
757 if ! ipsec_connection_read_config
"${connection}" "${_prefix}"; then
761 # Remove duplicated entries to proceed the list safely
762 assign
"${_prefix}" "$(list_unique ${!_prefix} )"
765 local prefixes_removed
768 while [ $# -gt 0 ]; do
773 list_append prefixes_added
"${arg:1}"
776 list_append prefixes_removed
"${arg:1}"
779 list_append prefixes_set
"${arg}"
782 error
"Invalid argument: ${arg}"
789 # Check if the user is trying a mixed operation
790 if ! list_is_empty prefixes_set
&& (! list_is_empty prefixes_added ||
! list_is_empty prefixes_removed
); then
791 error
"You cannot reset the prefix list and add or remove prefixes at the same time"
795 # Set new prefix list
796 if ! list_is_empty prefixes_set
; then
797 # Check if all prefixes are valid
799 for prefix
in ${prefixes_set}; do
800 if ! ip_net_is_valid
${prefix}; then
801 error
"Unsupported prefix: ${prefix}"
806 assign
"${_prefix}" "${prefixes_set}"
808 # Perform incremental updates
812 # Perform all removals
813 for prefix
in ${prefixes_removed}; do
814 if ! list_remove
"${_prefix}" ${prefix}; then
815 warning
"${prefix} was not on the list and could not be removed"
820 for prefix
in ${prefixes_added}; do
821 if ip_net_is_valid
${prefix}; then
822 if ! list_append_unique
"${_prefix}" ${prefix}; then
823 warning
"${prefix} is already on the prefix list"
826 warning
"${prefix} is not a valid IP network and could not be added"
831 # Check if the list contain at least one valid prefix
832 if list_is_empty
${_prefix}; then
833 error
"Cannot save an empty prefix list"
838 if ! ipsec_connection_write_config_key
"${connection}" "${_prefix}" ${!_prefix}; then
839 log ERROR "Could not
write configuration settings
"
845 # Handle the cli after remote
846 ipsec_connection_remote() {
847 if [ ! $# -ge 2 ]; then
848 log ERROR "Not enough arguments
"
852 local connection=${1}
858 ipsec_connection_id "${connection}" "REMOTE
" $@
862 ipsec_connection_prefix "${connection}" "REMOTE
" $@
865 log ERROR "Unrecognized argument
: ${cmd}"
873 # Set the inactivity timeout
874 ipsec_connection_inactivity_timeout() {
875 if [ ! $# -ge 2 ]; then
876 log ERROR "Not enough arguments
"
880 local connection=${1}
884 if ! isinteger value; then
885 value=$(parse_time $@)
886 if [ ! $? -eq 0 ]; then
887 log ERROR "Parsing the passed
time was not sucessful please check the passed values.
"
892 if [ ${value} -le 0 ]; then
893 log ERROR "The passed
time value must be
in the
sum greater zero seconds.
"
897 if ! ipsec_connection_write_config_key "${connection}" "INACTIVITY_TIMEOUT
" ${value}; then
898 log ERROR "Could not
write configuration settings
"
905 # Set the default start action
906 ipsec_connection_start_action() {
907 if [ ! $# -eq 2 ]; then
908 log ERROR "Not enough arguments
"
911 local connection=${1}
914 if ! isoneof action "on-demand
" "always-on
"; then
915 log ERROR "Start action
'${action}' is invalid
"
919 if ! ipsec_connection_write_config_key "${connection}" "START_ACTION
" ${action}; then
920 log ERROR "Could not
write configuration settings
"
925 # Set the security policy to use
926 ipsec_connection_security_policy() {
927 if [ ! $# -eq 2 ]; then
928 log ERROR "Not enough arguments
"
931 local connection=${1}
932 local security_policy=${2}
934 if ! vpn_security_policy_exists ${security_policy}; then
935 log ERROR "No such vpn security policy
'${security_policy}'"
939 if ! ipsec_connection_write_config_key "${connection}" "SECURITY_POLICY
" ${security_policy}; then
940 log ERROR "Could not
write configuration settings
"
945 # Check if a id is valid
946 ipsec_connection_check_id() {
950 if [[ ${id} =~ ^@[[:alnum:]]+$ ]] || ip_is_valid ${id}; then
957 # Checks if a peer is valid
958 ipsec_connection_check_peer() {
962 # TODO Accept also FQDNs
963 if ip_is_valid ${peer}; then
970 # This function checks if a VPN IPsec connection name is valid
971 # Allowed are only A-Za-z0-9
972 ipsec_connection_check_name() {
975 local connection=${1}
977 [[ "${connection}" =~ [^[:alnum:]$] ]]
980 # Function that creates one VPN IPsec connection
981 ipsec_connection_new() {
982 if [ $# -gt 1 ]; then
983 error "Too many arguments
"
987 local connection="${1}"
988 if ! isset connection; then
989 error "Please provide a connection name
"
993 # Check for duplicates
994 if ipsec_connection_exists "${connection}"; then
995 error "The VPN IPsec connection
${connection} already exists
"
999 # Check if the name of the connection is valid
1000 if ipsec_connection_check_name "${connection}"; then
1001 error "'${connection}' contains illegal characters
"
1002 return ${EXIT_ERROR}
1005 log DEBUG "Creating VPN IPsec connection
${connection}"
1007 if ! mkdir -p "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
1008 log ERROR "Could not create config directory
for ${connection}"
1009 return ${EXIT_ERROR}
1012 local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
1014 AUTH_MODE=${IPSEC_DEFAULT_AUTH_MODE}
1015 DPD_ACTION=${IPSEC_DEFAULT_DPD_ACTION}
1016 DPD_DELAY=${IPSEC_DEFAULT_DPD_DELAY}
1017 DPD_TIMEOUT=${IPSEC_DEFAULT_DPD_TIMEOUT}
1018 ENABLED=${IPSEC_DEFAULT_ENABLED}
1019 MODE=${IPSEC_DEFAULT_MODE}
1020 START_ACTION=${IPSEC_DEFAULT_START_ACTION}
1022 INACTIVITY_TIMEOUT=${IPSEC_DEFAULT_INACTIVITY_TIMEOUT}
1023 SECURITY_POLICY=${IPSEC_DEFAULT_SECURITY_POLICY}
1025 if ! ipsec_connection_write_config "${connection}"; then
1026 log ERROR "Could not
write new config
file"
1027 return ${EXIT_ERROR}
1030 # Configure strongswan autostart
1031 ipsec_strongswan_autostart
1034 # Function that deletes based on the passed parameters one ore more vpn security policies
1035 ipsec_connection_destroy() {
1037 for connection in $@; do
1038 if ! ipsec_connection_exists "${connection}"; then
1039 log ERROR "The VPN IPsec connection
${connection} does not exist.
"
1043 log DEBUG "Deleting VPN IPsec connection
${connection}"
1045 # Delete strongswan configuration file
1046 file_delete "${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf
"
1048 if ! rm -rf "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
1049 log ERROR "Deleting the VPN IPsec connection
${connection} was not sucessful
"
1050 return ${EXIT_ERROR}
1056 # List all ipsec connections
1057 ipsec_list_connections() {
1059 for connection in ${NETWORK_IPSEC_CONNS_DIR}/*; do
1060 [ -d ${connection} ] || continue
1061 basename ${connection}
1065 ipsec_connection_to_strongswan() {
1066 local connection="${1}"
1068 # Read the config settings
1069 local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
1070 if ! ipsec_connection_read_config "${connection}"; then
1071 error "Could not
read the connection
${connection}"
1072 return ${EXIT_ERROR}
1075 local path="${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf
"
1078 # Write the connection section
1079 _ipsec_connection_to_strongswan_connection "${connection}"
1081 # Write the secrets section
1082 _ipsec_connection_to_strongswan_secrets "${connection}"
1087 _ipsec_connection_to_strongswan_connection() {
1088 local connection="${1}"
1090 # Read the security policy
1091 local ${VPN_SECURITY_POLICIES_CONFIG_SETTINGS}
1092 if ! vpn_security_policies_read_config "${SECURITY_POLICY}"; then
1093 return ${EXIT_ERROR}
1098 if isset DPD_DELAY && isinteger DPD_DELAY && [ ${DPD_DELAY} -gt 0 ]; then
1102 # Write configuration header
1103 config_header "strongSwan configuration
for ${connection}"
1105 print_indent 0 "connections
{"
1106 print_indent 1 "${connection} {"
1109 print_indent 2 "# IKE Version"
1110 case "${KEY_EXCHANGE^^}" in
1112 print_indent
2 "version = 1"
1115 # Fall back to IKEv2 for any random values
1117 print_indent
2 "version = 2"
1122 # Always only keep one connection open at a time
1123 print_indent
2 "# Unique IDs"
1124 print_indent
2 "unique = replace"
1128 print_indent
2 "# Local Address"
1129 if isset LOCAL_ADDRESS
; then
1130 print_indent
2 "local_addrs = ${LOCAL_ADDRESS}"
1132 print_indent
2 "local_addrs = %any"
1137 print_indent
2 "# Remote Address"
1139 print_indent
2 "remote_addrs = ${PEER}"
1141 print_indent
2 "remote_addrs = %any"
1146 print_indent
2 "# IKE Proposals"
1147 print_indent
2 "proposals = $(vpn_security_policies_make_ike_proposal ${SECURITY_POLICY})"
1151 if enabled dpd
; then
1152 print_indent
2 "# Dead Peer Detection"
1153 print_indent
2 "dpd_delay = ${DPD_DELAY}"
1155 if isset DPD_TIMEOUT
; then
1156 print_indent
2 "dpd_timeout = ${DPD_TIMEOUT}"
1163 print_indent
2 "# Fragmentation"
1164 print_indent
2 "fragmentation = yes"
1168 print_indent
2 "local {"
1171 if isset LOCAL_ID
; then
1172 print_indent
3 "id = ${LOCAL_ID}"
1176 case "${AUTH_MODE}" in
1178 print_indent
3 "auth = psk"
1186 print_indent
2 "remote {"
1189 if isset REMOTE_ID
; then
1190 print_indent
3 "id = ${REMOTE_ID}"
1194 case "${AUTH_MODE}" in
1196 print_indent
3 "auth = psk"
1205 print_indent
2 "children {"
1206 print_indent
3 "${connection} {"
1208 print_indent
4 "# ESP Proposals"
1209 print_indent
4 "esp_proposals = $(vpn_security_policies_make_esp_proposal ${SECURITY_POLICY})"
1216 print_indent
4 "local_ts = dynamic[gre]"
1217 print_indent
4 "remote_ts = dynamic[gre]"
1221 if isset LOCAL_PREFIX
; then
1222 print_indent
4 "local_ts = $(list_join LOCAL_PREFIX ,)"
1224 print_indent
4 "local_ts = dynamic"
1228 if isset REMOTE_PREFIX
; then
1229 print_indent
4 "remote_ts = $(list_join REMOTE_PREFIX ,)"
1231 print_indent
4 "remote_ts = dynamic"
1238 print_indent
4 "# Netfilter Marks"
1239 print_indent
4 "mark_in = %unique"
1240 print_indent
4 "mark_out = %unique"
1243 # Dead Peer Detection
1244 if enabled dpd
; then
1245 print_indent
4 "# Dead Peer Detection"
1246 print_indent
4 "dpd_action = ${DPD_ACTION}"
1251 if isset LIFETIME
; then
1252 print_indent
4 "# Rekey Time"
1253 print_indent
4 "rekey_time = ${LIFETIME}"
1258 print_indent
4 "updown = ${NETWORK_HELPERS_DIR}/ipsec-updown"
1262 print_indent
4 "# Mode"
1265 print_indent
4 "mode = transport"
1268 print_indent
4 "mode = tunnel"
1274 print_indent
4 "# Compression"
1275 if enabled COMPRESSION
; then
1276 print_indent
4 "ipcomp = yes"
1278 print_indent
4 "ipcomp = no"
1282 # Inactivity Timeout
1283 if isset INACTIVITY_TIMEOUT
; then
1284 print_indent
4 "# Inactivity Timeout"
1285 print_indent
4 "inactivity = ${INACTIVITY_TIMEOUT}"
1290 print_indent
4 "# Start Action"
1291 case "${START_ACTION}" in
1293 print_indent
4 "start_action = trap"
1294 print_indent
4 "close_action = trap"
1297 print_indent
4 "start_action = none"
1298 print_indent
4 "close_action = none"
1301 print_indent
4 "start_action = start"
1302 print_indent
4 "close_action = start"
1316 _ipsec_connection_to_strongswan_secrets
() {
1317 local connection
="${1}"
1319 print_indent
0 "secrets {"
1321 case "${AUTH_MODE}" in
1323 print_indent
1 "ike {"
1326 print_indent
2 "secret = ${PSK}"
1329 if isset REMOTE_ID
; then
1330 print_indent
2 "id = ${REMOTE_ID}"