src/functions/functions.ipsec

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2017  IPFire Network Development Team                         #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 IPSEC_CONNECTION_CONFIG_SETTINGS="\
  23         AUTH_MODE \
  24         DPD_ACTION \
  25         DPD_DELAY \
  26         DPD_TIMEOUT \
  27         INACTIVITY_TIMEOUT \
  28         LOCAL_ADDRESS \
  29         LOCAL_ID \
  30         LOCAL_PREFIX \
  31         MODE \
  32         PEER \
  33         PSK \
  34         REMOTE_ID \
  35         REMOTE_PREFIX \
  36         SECURITY_POLICY \
  37         ENABLED"
  38
  39 # Default values
  40 IPSEC_DEFAULT_AUTH_MODE="PSK"
  41 IPSEC_DEFAULT_DPD_ACTION="restart"
  42 IPSEC_DEFAULT_DPD_DELAY="30"
  43 IPSEC_DEFAULT_DPD_TIMEOUT="120"
  44 IPSEC_DEFAULT_ENABLED="true"
  45 IPSEC_DEFAULT_INACTIVITY_TIMEOUT="0"
  46 IPSEC_DEFAULT_MODE="tunnel"
  47 IPSEC_DEFAULT_SECURITY_POLICY="system"
  48 IPSEC_DEFAULT_START_ACTION="on-demand"
  49
  50 IPSEC_VALID_MODES="gre-transport tunnel vti"
  51 IPSEC_VALID_AUTH_MODES="PSK"
  52
  53 cli_ipsec() {
  54         local action=${1}
  55         shift 1
  56
  57         case "${action}" in
  58                 connection)
  59                         cli_ipsec_connection $@
  60                         ;;
  61                 *)
  62                         error "Unrecognized argument: ${action}"
  63                         exit ${EXIT_ERROR}
  64                         ;;
  65         esac
  66 }
  67
  68 cli_ipsec_connection() {
  69         if ipsec_connection_exists ${1}; then
  70                 local connection=${1}
  71                 local key=${2}
  72                 key=${key//-/_}
  73                 shift 2
  74
  75                 case "${key}" in
  76                         authentication|down|disable|dpd|enable|inactivity_timeout|local|mode|peer|remote|security_policy|start_action|up)
  77                                 ipsec_connection_${key} ${connection} $@
  78                                 ;;
  79                         show)
  80                                 cli_ipsec_connection_show "${connection}"
  81                                 exit $?
  82                                 ;;
  83                         *)
  84                                 error "Unrecognized argument: ${key}"
  85                                 exit ${EXIT_ERROR}
  86                                 ;;
  87                 esac
  88         else
  89                 local action=${1}
  90                 shift
  91
  92                 case "${action}" in
  93                         new)
  94                                 ipsec_connection_new $@
  95                                 ;;
  96                         destroy)
  97                                 ipsec_connection_destroy $@
  98                                 ;;
  99                         ""|*)
 100                                 if [ -n "${action}" ]; then
 101                                         error "Unrecognized argument: '${action}'"
 102                                 fi
 103                                 exit ${EXIT_ERROR}
 104                                 ;;
 105                 esac
 106         fi
 107 }
 108
 109 cli_ipsec_connection_show() {
 110         local connection="${1}"
 111
 112         # Read the config settings
 113         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 114         if ! ipsec_connection_read_config "${connection}"; then
 115                 error "Could not read the connection configuration"
 116                 return ${EXIT_ERROR}
 117         fi
 118
 119         cli_headline 0 "IPsec VPN Connection: ${connection}"
 120         cli_space
 121
 122         # Peer
 123         if isset PEER; then
 124                 cli_print_fmt1 1 "Peer" "${PEER}"
 125         fi
 126
 127         # Security Policy
 128         cli_print_fmt1 1 "Security Policy" "${SECURITY_POLICY-${IPSEC_DEFAULT_SECURITY_POLICY}}"
 129         cli_space
 130
 131         cli_headline 2 "Authentication"
 132         case "${AUTH_MODE^^}" in
 133                 PSK)
 134                         cli_print_fmt1 2 "Mode" "Pre-Shared-Key"
 135
 136                         if isset PSK; then
 137                                 cli_print_fmt1 2 "Pre-Shared-Key" "****"
 138                         else
 139                                 cli_print_fmt1 2 "Pre-Shared-Key" "- is not set -"
 140                         fi
 141                         ;;
 142                 X509)
 143                         : # TODO
 144                         ;;
 145         esac
 146         cli_space
 147
 148         local i
 149         for i in LOCAL REMOTE; do
 150                 case "${i}" in
 151                         LOCAL)
 152                                 cli_headline 2 "Local"
 153                                 ;;
 154                         REMOTE)
 155                                 cli_headline 2 "Remote"
 156                                 ;;
 157                 esac
 158
 159                 local id_var="${i}_ID"
 160                 if [ -n "${!id_var}" ]; then
 161                         cli_print_fmt1 2 "ID" "${!id_var}"
 162                 fi
 163
 164                 local prefix_var="${i}_PREFIX"
 165                 if isset ${prefix_var}; then
 166                         cli_headline 3 "Prefix(es)"
 167
 168                         local prefix
 169                         for prefix in ${!prefix_var}; do
 170                                 cli_print_fmt1 3 "${prefix}"
 171                         done
 172                 fi
 173
 174                 cli_space
 175         done
 176
 177         cli_headline 2 "Misc."
 178
 179         case "${MODE}" in
 180                 gre-transport)
 181                         cli_print_fmt1 2 "Transport Mode" "GRE Transport"
 182                         ;;
 183                 tunnel)
 184                         cli_print_fmt1 2 "Transport Mode" "Tunnel"
 185                         ;;
 186                 vti)
 187                         cli_print_fmt1 2 "Transport Mode" "Virtual Tunnel Interface"
 188                         ;;
 189                 *)
 190                         cli_print_fmt1 2 "Transport Mode" "- Unknown -"
 191                         ;;
 192         esac
 193
 194         # Inactivity timeout
 195         if isset INACTIVITY_TIMEOUT && [ ${INACTIVITY_TIMEOUT} -gt 0 ]; then
 196                 cli_print_fmt1 2 "Inactivity Timeout" "$(format_time ${INACTIVITY_TIMEOUT})"
 197         fi
 198         cli_space
 199
 200         return ${EXIT_OK}
 201 }
 202
 203 ipsec_connection_disable() {
 204         local connection=${1}
 205
 206         if ! ipsec_connection_write_config_key "${connection}" "ENABLED" "false"; then
 207                 log ERROR "Could not write configuration settings"
 208                 return ${EXIT_ERROR}
 209         fi
 210
 211         ipsec_reload ${connection}
 212
 213         # Configure strongswan autostart
 214         ipsec_strongswan_autostart
 215 }
 216
 217 ipsec_connection_enable() {
 218         local connection=${1}
 219
 220         if ! ipsec_connection_write_config_key "${connection}" "ENABLED" "true"; then
 221                 log ERROR "Could not write configuration settings"
 222                 return ${EXIT_ERROR}
 223         fi
 224
 225         ipsec_reload "${connection}"
 226
 227         # Configure strongswan autostart
 228         ipsec_strongswan_autostart
 229 }
 230
 231 # This function writes all values to a via ${connection} specificated VPN IPsec configuration file
 232 ipsec_connection_write_config() {
 233         assert [ $# -ge 1 ]
 234
 235         local connection="${1}"
 236
 237         if ! ipsec_connection_exists "${connection}"; then
 238                 log ERROR "No such VPN IPsec connection: ${connection}"
 239                 return ${EXIT_ERROR}
 240         fi
 241
 242         local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
 243
 244         if ! settings_write "${path}" ${IPSEC_CONNECTION_CONFIG_SETTINGS}; then
 245                 log ERROR "Could not write configuration settings for VPN IPsec connection ${connection}"
 246                 return ${EXIT_ERROR}
 247         fi
 248
 249         ipsec_reload ${connection}
 250 }
 251
 252 # This funtion writes the value for one key to a via ${connection} specificated VPN IPsec connection configuration file
 253 ipsec_connection_write_config_key() {
 254         assert [ $# -ge 3 ]
 255
 256         local connection=${1}
 257         local key=${2}
 258         shift 2
 259
 260         local value="$@"
 261
 262         if ! ipsec_connection_exists "${connection}"; then
 263                 log ERROR "No such VPN ipsec connection: ${connection}"
 264                 return ${EXIT_ERROR}
 265         fi
 266
 267         log DEBUG "Set '${key}' to new value '${value}' in VPN ipsec connection '${connection}'"
 268
 269         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 270
 271         # Read the config settings
 272         if ! ipsec_connection_read_config "${connection}"; then
 273                 return ${EXIT_ERROR}
 274         fi
 275
 276         # Set the key to a new value
 277         assign "${key}" "${value}"
 278
 279         if ! ipsec_connection_write_config "${connection}"; then
 280                 return ${EXIT_ERROR}
 281         fi
 282
 283         return ${EXIT_TRUE}
 284 }
 285
 286 # Reads one or more keys out of a settings file or all if no key is provided.
 287 ipsec_connection_read_config() {
 288         assert [ $# -ge 1 ]
 289
 290         local connection="${1}"
 291         shift 1
 292
 293         if ! ipsec_connection_exists "${connection}"; then
 294                 log ERROR "No such VPN IPsec connection : ${connection}"
 295                 return ${EXIT_ERROR}
 296         fi
 297
 298
 299         local args
 300         if [ $# -eq 0 ] && [ -n "${IPSEC_CONNECTION_CONFIG_SETTINGS}" ]; then
 301                 list_append args ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 302         else
 303                 list_append args $@
 304         fi
 305
 306         local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
 307
 308         if ! settings_read "${path}" ${args}; then
 309                 log ERROR "Could not read settings for VPN IPsec connection ${connection}"
 310                 return ${EXIT_ERROR}
 311         fi
 312 }
 313
 314 # This function checks if a vpn ipsec connection exists
 315 # Returns True when yes and false when not
 316 ipsec_connection_exists() {
 317         assert [ $# -eq 1 ]
 318
 319         local connection=${1}
 320
 321         local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}"
 322
 323         [ -d "${path}" ] && return ${EXIT_TRUE} || return ${EXIT_FALSE}
 324 }
 325
 326 # Determines if strongswan should be automatically started
 327 # when the system boots up.
 328 ipsec_strongswan_autostart() {
 329         local autostart_needed="false"
 330
 331         local connection
 332         for connection in $(ipsec_list_connections); do
 333                 local ENABLED
 334
 335                 if ! ipsec_connection_read_config "${connection}" "ENABLED"; then
 336                         log WARNING "Could not read configuation"
 337                         continue
 338                 fi
 339
 340                 if enabled ENABLED; then
 341                         autostart_needed="true"
 342                         break
 343                 fi
 344         done
 345
 346         # Start strongswan when we need it and when it is not yet enabled
 347         if ${autostart_needed}; then
 348                 if ! service_is_enabled "strongswan"; then
 349                         service_enable "strongswan"
 350                 fi
 351
 352                 if ! service_is_active "strongswan"; then
 353                         service_start "strongswan"
 354                 fi
 355
 356         # Disable strongswan when we do not need it but it is enabled
 357         elif ! ${autostart_needed}; then
 358                 if service_is_enabled "strongswan"; then
 359                         service_disable "strongswan"
 360                 fi
 361
 362                 if service_is_active "strongswan"; then
 363                         service_stop "strongswan"
 364                 fi
 365         fi
 366 }
 367
 368 ipsec_strongswan_load() {
 369         if ! cmd swanctl --load-all; then
 370                 log ERROR "Could not reload strongswan config"
 371                 return ${EXIT_ERROR}
 372         fi
 373 }
 374
 375 # Reloads the connection after config changes
 376 ipsec_reload() {
 377         local connection=${1}
 378
 379         local ENABLED
 380
 381         if ! ipsec_connection_read_config "${connection}" "ENABLED"; then
 382                 log ERROR "Could not read configuration for IPsec connection ${connection}"
 383                 return ${EXIT_ERROR}
 384         fi
 385
 386         if enabled ENABLED; then
 387                 if ! ipsec_connection_to_strongswan ${connection}; then
 388                         log ERROR "Could not generate strongswan config for ${connnection}"
 389                         return ${EXIT_ERROR}
 390                 fi
 391         else
 392                 unlink "${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf"
 393         fi
 394
 395         ipsec_strongswan_load
 396 }
 397
 398 # Handle the cli after authentification
 399 ipsec_connection_authentication() {
 400         if [ ! $# -gt 1 ]; then
 401                 log ERROR "Not enough arguments"
 402                 return ${EXIT_ERROR}
 403         fi
 404
 405         local connection=${1}
 406         local cmd=${2}
 407         shift 2
 408
 409         case ${cmd} in
 410                 mode)
 411                         ipsec_connection_authentication_mode "${connection}" $@
 412                         ;;
 413                 pre-shared-key)
 414                         ipsec_connection_authentication_psk "${connection}" $@
 415                         ;;
 416                 *)
 417                         log ERROR "Unrecognized argument: ${cmd}"
 418                         return ${EXIT_ERROR}
 419                         ;;
 420         esac
 421 }
 422
 423 # Set the authentification mode
 424 ipsec_connection_authentication_mode() {
 425         if [ ! $# -eq 2 ]; then
 426                 log ERROR "Not enough arguments"
 427                 return ${EXIT_ERROR}
 428         fi
 429         local connection=${1}
 430         local mode=${2}
 431
 432         if ! isoneof mode ${IPSEC_VALID_AUTH_MODES}; then
 433                 log ERROR "Auth mode '${mode}' is invalid"
 434                 return ${EXIT_ERROR}
 435         fi
 436
 437         if ! ipsec_connection_write_config_key "${connection}" "AUTH_MODE" ${mode^^}; then
 438                 log ERROR "Could not write configuration settings"
 439                 return ${EXIT_ERROR}
 440         fi
 441 }
 442
 443 # Set the psk
 444 ipsec_connection_authentication_psk() {
 445         if [ ! $# -eq 2 ]; then
 446                 log ERROR "Not enough arguments"
 447                 return ${EXIT_ERROR}
 448         fi
 449
 450         local connection=${1}
 451         local psk=${2}
 452
 453         local length=${#psk}
 454
 455         if [ ${length} -lt 4 ]; then
 456                 error "The PSK must be longer than four characters"
 457                 return ${EXIT_ERROR}
 458         fi
 459
 460         if [ ${length} -gt 128 ]; then
 461                 error "The PSK cannot be longer than 128 characters"
 462                 return ${EXIT_ERROR}
 463         fi
 464
 465         if ! ipsec_connection_write_config_key "${connection}" "PSK" "${psk}"; then
 466                 log ERROR "Could not write configuration settings"
 467                 return ${EXIT_ERROR}
 468         fi
 469
 470         return ${EXIT_OK}
 471 }
 472
 473 ipsec_connection_up() {
 474         local connection="${1}"
 475
 476         if ! ipsec_connection_exists "${connection}"; then
 477                 error "No such VPN IPsec connection: ${connection}"
 478                 return ${EXIT_ERROR}
 479         fi
 480
 481         cmd swanctl --initiate --child "${connection}"
 482 }
 483
 484 ipsec_connection_down() {
 485         local connection="${1}"
 486
 487         if ! ipsec_connection_exists "${connection}"; then
 488                 error "No such VPN IPsec connection: ${connection}"
 489                 return ${EXIT_ERROR}
 490         fi
 491
 492         cmd swanctl --terminate --ike "${connection}"
 493 }
 494
 495 # Handle the cli after authentification
 496 ipsec_connection_dpd() {
 497         if [ ! $# -gt 1 ]; then
 498                 log ERROR "Not enough arguments"
 499                 return ${EXIT_ERROR}
 500         fi
 501
 502         local connection=${1}
 503         local cmd=${2}
 504         shift 2
 505
 506         case ${cmd} in
 507                 action)
 508                         ipsec_connection_dpd_action "${connection}" $@
 509                         ;;
 510                 delay)
 511                         ipsec_connection_dpd_delay "${connection}" $@
 512                         ;;
 513                 timeout)
 514                         ipsec_connection_dpd_timeout "${connection}" $@
 515                         ;;
 516                 *)
 517                         log ERROR "Unrecognized argument: ${cmd}"
 518                         return ${EXIT_ERROR}
 519                         ;;
 520         esac
 521 }
 522
 523 # Set the default dpd action
 524 ipsec_connection_dpd_action() {
 525         if [ ! $# -eq 2 ]; then
 526                 log ERROR "Not enough arguments"
 527                 return ${EXIT_ERROR}
 528         fi
 529         local connection=${1}
 530         local action=${2}
 531
 532         if ! isoneof action "restart" "clear"; then
 533                 log ERROR "dpd action '${action}' is invalid"
 534                 return ${EXIT_ERROR}
 535         fi
 536
 537         if ! ipsec_connection_write_config_key "${connection}" "DPD_ACTION" ${action}; then
 538                 log ERROR "Could not write configuration settings"
 539                 return ${EXIT_ERROR}
 540         fi
 541 }
 542
 543 # Set the dpd delay
 544 ipsec_connection_dpd_delay() {
 545         if [ ! $# -ge 2 ]; then
 546                 log ERROR "Not enough arguments"
 547                 return ${EXIT_ERROR}
 548         fi
 549
 550         local connection=${1}
 551         shift 1
 552         local value=$@
 553
 554         if ! isinteger value; then
 555                 value=$(parse_time $@)
 556                 if [ ! $? -eq 0 ]; then
 557                         log ERROR "Parsing the passed time was not sucessful please check the passed values."
 558                         return ${EXIT_ERROR}
 559                 fi
 560         fi
 561
 562         if [ ${value} -lt 0 ]; then
 563                 log ERROR "The passed time value must be in the sum greater or equal zero seconds."
 564                 return ${EXIT_ERROR}
 565         fi
 566
 567         if ! ipsec_connection_write_config_key "${connection}" "DPD_DELAY" ${value}; then
 568                 log ERROR "Could not write configuration settings"
 569                 return ${EXIT_ERROR}
 570         fi
 571
 572         return ${EXIT_OK}
 573 }
 574
 575 # Set the dpd timeout
 576 ipsec_connection_dpd_timeout() {
 577         if [ ! $# -ge 2 ]; then
 578                 log ERROR "Not enough arguments"
 579                 return ${EXIT_ERROR}
 580         fi
 581
 582         local connection=${1}
 583         shift 1
 584         local value=$@
 585
 586         if ! isinteger value; then
 587                 value=$(parse_time $@)
 588                 if [ ! $? -eq 0 ]; then
 589                         log ERROR "Parsing the passed time was not sucessful please check the passed values."
 590                         return ${EXIT_ERROR}
 591                 fi
 592         fi
 593
 594         if [ ${value} -le 0 ]; then
 595                 log ERROR "The passed time value must be in the sum greater or equal zero seconds."
 596                 return ${EXIT_ERROR}
 597         fi
 598
 599         if ! ipsec_connection_write_config_key "${connection}" "DPD_TIMEOUT" ${value}; then
 600                 log ERROR "Could not write configuration settings"
 601                 return ${EXIT_ERROR}
 602         fi
 603
 604         return ${EXIT_OK}
 605 }
 606
 607 # Handle the cli after local
 608 ipsec_connection_local() {
 609         if [ ! $# -ge 2 ]; then
 610                 log ERROR "Not enough arguments"
 611                 return ${EXIT_ERROR}
 612         fi
 613
 614         local connection=${1}
 615         local cmd=${2}
 616         shift 2
 617
 618         case ${cmd} in
 619                 address)
 620                         ipsec_connection_local_address "${connection}" $@
 621                         ;;
 622                 id)
 623                         ipsec_connection_id "${connection}" "LOCAL" $@
 624                         ;;
 625                 prefix)
 626                         ipsec_connection_prefix "${connection}" "LOCAL" $@
 627                         ;;
 628                 *)
 629                         log ERROR "Unrecognized argument: ${cmd}"
 630                         return ${EXIT_ERROR}
 631                         ;;
 632         esac
 633
 634         return ${EXIT_OK}
 635 }
 636
 637 # Set the connection mode
 638 ipsec_connection_mode() {
 639         if [ ! $# -eq 2 ]; then
 640                 log ERROR "Not enough arguments"
 641                 return ${EXIT_ERROR}
 642         fi
 643         local connection=${1}
 644         local mode=${2}
 645
 646         if ! isoneof mode ${IPSEC_VALID_MODES}; then
 647                 log ERROR "Mode '${mode}' is invalid"
 648                 return ${EXIT_ERROR}
 649         fi
 650
 651         if ! ipsec_connection_write_config_key "${connection}" "MODE" ${mode}; then
 652                 log ERROR "Could not write configuration settings"
 653                 return ${EXIT_ERROR}
 654         fi
 655
 656         return ${EXIT_OK}
 657 }
 658
 659 # Set the local address
 660 ipsec_connection_local_address() {
 661         if [ ! $# -eq 2 ]; then
 662                 log ERROR "Not enough arguments"
 663                 return ${EXIT_ERROR}
 664         fi
 665         local connection=${1}
 666         local local_address=${2}
 667
 668         if ! ipsec_connection_check_peer ${local_address}; then
 669                 log ERROR "Local address '${local_address}' is invalid"
 670                 return ${EXIT_ERROR}
 671         fi
 672
 673         if ! ipsec_connection_write_config_key "${connection}" "LOCAL_ADDRESS" ${local_address}; then
 674                 log ERROR "Could not write configuration settings"
 675                 return ${EXIT_ERROR}
 676         fi
 677
 678         return ${EXIT_OK}
 679 }
 680
 681 # Set the peer to connect to
 682 ipsec_connection_peer() {
 683         if [ ! $# -eq 2 ]; then
 684                 log ERROR "Not enough arguments"
 685                 return ${EXIT_ERROR}
 686         fi
 687         local connection=${1}
 688         local peer=${2}
 689
 690         if ! ipsec_connection_check_peer ${peer}; then
 691                 log ERROR "Peer '${peer}' is invalid"
 692                 return ${EXIT_ERROR}
 693         fi
 694
 695         if ! ipsec_connection_write_config_key "${connection}" "PEER" ${peer}; then
 696                 log ERROR "Could not write configuration settings"
 697                 return ${EXIT_ERROR}
 698         fi
 699
 700         return ${EXIT_OK}
 701 }
 702
 703 #Set the local or remote id
 704 ipsec_connection_id() {
 705         if [ ! $# -eq 3 ]; then
 706                 log ERROR "Not enough arguments"
 707                 return ${EXIT_ERROR}
 708         fi
 709         local connection=${1}
 710         local type=${2}
 711         local id=${3}
 712
 713         if ! ipsec_connection_check_id ${id}; then
 714                 log ERROR "Id '${id}' is invalid"
 715                 return ${EXIT_ERROR}
 716         fi
 717
 718         if ! ipsec_connection_write_config_key "${connection}" "${type}_ID" ${id}; then
 719                 log ERROR "Could not write configuration settings"
 720                 return ${EXIT_ERROR}
 721         fi
 722
 723         return ${EXIT_OK}
 724 }
 725
 726 # Set the local or remote prefix
 727 ipsec_connection_prefix() {
 728         if [ ! $# -ge 3 ]; then
 729                 log ERROR "Not enough arguments"
 730                 return ${EXIT_ERROR}
 731         fi
 732         local connection=${1}
 733         local type=${2}
 734         shift 2
 735
 736         local _prefix="${type}_PREFIX"
 737         local "${_prefix}"
 738         if ! ipsec_connection_read_config "${connection}" "${_prefix}"; then
 739                 return ${EXIT_ERROR}
 740         fi
 741
 742         # Remove duplicated entries to proceed the list safely
 743         assign "${_prefix}" "$(list_unique ${!_prefix} )"
 744
 745         local prefixes_added
 746         local prefixes_removed
 747         local prefixes_set
 748
 749         while [ $# -gt 0 ]; do
 750                 local arg="${1}"
 751
 752                 case "${arg}" in
 753                         +*)
 754                                 list_append prefixes_added "${arg:1}"
 755                                 ;;
 756                         -*)
 757                                 list_append prefixes_removed "${arg:1}"
 758                                 ;;
 759                         [A-Fa-f0-9]*)
 760                                 list_append prefixes_set "${arg}"
 761                                 ;;
 762                         *)
 763                                 error "Invalid argument: ${arg}"
 764                                 return ${EXIT_ERROR}
 765                                 ;;
 766                 esac
 767                 shift
 768         done
 769
 770         # Check if the user is trying a mixed operation
 771         if ! list_is_empty prefixes_set && (! list_is_empty prefixes_added || ! list_is_empty prefixes_removed); then
 772                 error "You cannot reset the prefix list and add or remove prefixes at the same time"
 773                 return ${EXIT_ERROR}
 774         fi
 775
 776         # Set new prefix list
 777         if ! list_is_empty prefixes_set; then
 778                 # Check if all prefixes are valid
 779                 local prefix
 780                 for prefix in ${prefixes_set}; do
 781                         if ! ip_net_is_valid ${prefix}; then
 782                                 error "Unsupported prefix: ${prefix}"
 783                                 return ${EXIT_ERROR}
 784                         fi
 785                 done
 786
 787                 assign "${_prefix}" "${prefixes_set}"
 788
 789         # Perform incremental updates
 790         else
 791                 local prefix
 792
 793                 # Perform all removals
 794                 for prefix in ${prefixes_removed}; do
 795                         if ! list_remove "${_prefix}" ${prefix}; then
 796                                 warning "${prefix} was not on the list and could not be removed"
 797                         fi
 798                 done
 799
 800
 801                 for prefix in ${prefixes_added}; do
 802                         if ip_net_is_valid ${prefix}; then
 803                                 if ! list_append_unique "${_prefix}" ${prefix}; then
 804                                         warning "${prefix} is already on the prefix list"
 805                                 fi
 806                         else
 807                                 warning "${prefix} is not a valid IP network and could not be added"
 808                         fi
 809                 done
 810         fi
 811
 812         # Check if the list contain at least one valid prefix
 813         if list_is_empty ${_prefix}; then
 814                 error "Cannot save an empty prefix list"
 815                 return ${EXIT_ERROR}
 816         fi
 817
 818         # Save everything
 819         if ! ipsec_connection_write_config_key "${connection}" "${_prefix}" ${!_prefix}; then
 820                 log ERROR "Could not write configuration settings"
 821         fi
 822
 823         return ${EXIT_OK}
 824 }
 825
 826 # Handle the cli after remote
 827 ipsec_connection_remote() {
 828         if [ ! $# -ge 2 ]; then
 829                 log ERROR "Not enough arguments"
 830                 return ${EXIT_ERROR}
 831         fi
 832
 833         local connection=${1}
 834         local cmd=${2}
 835         shift 2
 836
 837         case ${cmd} in
 838                 id)
 839                         ipsec_connection_id "${connection}" "REMOTE" $@
 840                         ;;
 841
 842                 prefix)
 843                         ipsec_connection_prefix "${connection}" "REMOTE" $@
 844                         ;;
 845                 *)
 846                         log ERROR "Unrecognized argument: ${cmd}"
 847                         return ${EXIT_ERROR}
 848                         ;;
 849         esac
 850
 851         return ${EXIT_OK}
 852 }
 853
 854 # Set the inactivity timeout
 855 ipsec_connection_inactivity_timeout() {
 856         if [ ! $# -ge 2 ]; then
 857                 log ERROR "Not enough arguments"
 858                 return ${EXIT_ERROR}
 859         fi
 860
 861         local connection=${1}
 862         shift 1
 863         local value=$@
 864
 865         if ! isinteger value; then
 866                 value=$(parse_time $@)
 867                 if [ ! $? -eq 0 ]; then
 868                         log ERROR "Parsing the passed time was not sucessful please check the passed values."
 869                         return ${EXIT_ERROR}
 870                 fi
 871         fi
 872
 873         if [ ${value} -le 0 ]; then
 874                 log ERROR "The passed time value must be in the sum greater zero seconds."
 875                 return ${EXIT_ERROR}
 876         fi
 877
 878         if ! ipsec_connection_write_config_key "${connection}" "INACTIVITY_TIMEOUT" ${value}; then
 879                 log ERROR "Could not write configuration settings"
 880                 return ${EXIT_ERROR}
 881         fi
 882
 883         return ${EXIT_OK}
 884 }
 885
 886 # Set the default start action
 887 ipsec_connection_start_action() {
 888         if [ ! $# -eq 2 ]; then
 889                 log ERROR "Not enough arguments"
 890                 return ${EXIT_ERROR}
 891         fi
 892         local connection=${1}
 893         local action=${2}
 894
 895         if ! isoneof action "on-demand" "always-on"; then
 896                 log ERROR "Start action '${action}' is invalid"
 897                 return ${EXIT_ERROR}
 898         fi
 899
 900         if ! ipsec_connection_write_config_key "${connection}" "START_ACTION" ${action}; then
 901                 log ERROR "Could not write configuration settings"
 902                 return ${EXIT_ERROR}
 903         fi
 904 }
 905
 906 # Set the security policy to use
 907 ipsec_connection_security_policy() {
 908         if [ ! $# -eq 2 ]; then
 909                 log ERROR "Not enough arguments"
 910                 return ${EXIT_ERROR}
 911         fi
 912         local connection=${1}
 913         local security_policy=${2}
 914
 915         if ! vpn_security_policy_exists ${security_policy}; then
 916                 log ERROR "No such vpn security policy '${security_policy}'"
 917                 return ${EXIT_ERROR}
 918         fi
 919
 920         if ! ipsec_connection_write_config_key "${connection}" "SECURITY_POLICY" ${security_policy}; then
 921                 log ERROR "Could not write configuration settings"
 922                 return ${EXIT_ERROR}
 923         fi
 924 }
 925
 926 # Check if a id is valid
 927 ipsec_connection_check_id() {
 928         assert [ $# -eq 1 ]
 929         local id=${1}
 930
 931         if [[ ${id} =~ ^@[[:alnum:]]+$ ]] || ip_is_valid ${id}; then
 932                 return ${EXIT_TRUE}
 933         else
 934                 return ${EXIT_FALSE}
 935         fi
 936 }
 937
 938 # Checks if a peer is valid
 939 ipsec_connection_check_peer() {
 940         assert [ $# -eq 1 ]
 941         local peer=${1}
 942
 943         # TODO Accept also FQDNs
 944         if ip_is_valid ${peer}; then
 945                 return ${EXIT_TRUE}
 946         else
 947                 return ${EXIT_FALSE}
 948         fi
 949 }
 950
 951 # This function checks if a VPN IPsec connection name is valid
 952 # Allowed are only A-Za-z0-9
 953 ipsec_connection_check_name() {
 954         assert [ $# -eq 1 ]
 955
 956         local connection=${1}
 957
 958         [[ "${connection}" =~ [^[:alnum:]$] ]]
 959 }
 960
 961 # Function that creates one VPN IPsec connection
 962 ipsec_connection_new() {
 963         if [ $# -gt 1 ]; then
 964                 error "Too many arguments"
 965                 return ${EXIT_ERROR}
 966         fi
 967
 968         local connection="${1}"
 969         if ! isset connection; then
 970                 error "Please provide a connection name"
 971                 return ${EXIT_ERROR}
 972         fi
 973
 974         # Check for duplicates
 975         if ipsec_connection_exists "${connection}"; then
 976                 error "The VPN IPsec connection ${connection} already exists"
 977                 return ${EXIT_ERROR}
 978         fi
 979
 980         # Check if the name of the connection is valid
 981         if  ipsec_connection_check_name "${connection}"; then
 982                 error "'${connection}' contains illegal characters"
 983                 return ${EXIT_ERROR}
 984         fi
 985
 986         log DEBUG "Creating VPN IPsec connection ${connection}"
 987
 988         if ! mkdir -p "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
 989                 log ERROR "Could not create config directory for ${connection}"
 990                 return ${EXIT_ERROR}
 991         fi
 992
 993         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 994
 995         AUTH_MODE=${IPSEC_DEFAULT_AUTH_MODE}
 996         DPD_ACTION=${IPSEC_DEFAULT_DPD_ACTION}
 997         DPD_DELAY=${IPSEC_DEFAULT_DPD_DELAY}
 998         DPD_TIMEOUT=${IPSEC_DEFAULT_DPD_TIMEOUT}
 999         ENABLED=${IPSEC_DEFAULT_ENABLED}
1000         MODE=${IPSEC_DEFAULT_MODE}
1001         START_ACTION=${IPSEC_DEFAULT_START_ACTION}
1002
1003         INACTIVITY_TIMEOUT=${IPSEC_DEFAULT_INACTIVITY_TIMEOUT}
1004         SECURITY_POLICY=${IPSEC_DEFAULT_SECURITY_POLICY}
1005
1006         if ! ipsec_connection_write_config "${connection}"; then
1007                 log ERROR "Could not write new config file"
1008                 return ${EXIT_ERROR}
1009         fi
1010
1011         # Configure strongswan autostart
1012         ipsec_strongswan_autostart
1013 }
1014
1015 # Function that deletes based on the passed parameters one ore more vpn security policies
1016 ipsec_connection_destroy() {
1017         local connection
1018         for connection in $@; do
1019                 if ! ipsec_connection_exists "${connection}"; then
1020                         log ERROR "The VPN IPsec connection ${connection} does not exist."
1021                         continue
1022                 fi
1023
1024                 log DEBUG "Deleting VPN IPsec connection ${connection}"
1025                 if ! rm -rf "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
1026                         log ERROR "Deleting the VPN IPsec connection ${connection} was not sucessful"
1027                         return ${EXIT_ERROR}
1028                 fi
1029         done
1030
1031         # Configure strongswan autostart
1032         ipsec_strongswan_autostart
1033 }
1034
1035 # List all ipsec connections
1036 ipsec_list_connections() {
1037         local connection
1038         for connection in ${NETWORK_IPSEC_CONNS_DIR}/*; do
1039                 [ -d ${connection} ] || continue
1040                 basename ${connection}
1041         done
1042 }
1043
1044 ipsec_connection_to_strongswan() {
1045         local connection="${1}"
1046
1047         # Read the config settings
1048         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
1049         if ! ipsec_connection_read_config "${connection}"; then
1050                 error "Could not read the connection ${connection}"
1051                 return ${EXIT_ERROR}
1052         fi
1053
1054         local path="${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf"
1055
1056         (
1057                 # Write the connection section
1058                 _ipsec_connection_to_strongswan_connection "${connection}"
1059
1060                 # Write the secrets section
1061                 _ipsec_connection_to_strongswan_secrets "${connection}"
1062
1063         ) > ${path}
1064 }
1065
1066 _ipsec_connection_to_strongswan_connection() {
1067         local connection="${1}"
1068
1069         # Read the security policy
1070         local ${VPN_SECURITY_POLICIES_CONFIG_SETTINGS}
1071         if ! vpn_security_policies_read_config "${SECURITY_POLICY}"; then
1072                 return ${EXIT_ERROR}
1073         fi
1074
1075         # Is DPD enabled?
1076         local dpd="false"
1077         if isset DPD_DELAY && isinteger DPD_DELAY && [ ${DPD_DELAY} -gt 0 ]; then
1078                 dpd="true"
1079         fi
1080
1081         # Write configuration header
1082         config_header "strongSwan configuration for ${connection}"
1083
1084         print_indent 0 "connections {"
1085         print_indent 1 "${connection} {"
1086
1087         # IKE Version
1088         print_indent 2 "# IKE Version"
1089         case "${KEY_EXCHANGE^^}" in
1090                 IKEV1)
1091                         print_indent 2 "version = 1"
1092                         ;;
1093
1094                 # Fall back to IKEv2 for any random values
1095                 IKEV2|*)
1096                         print_indent 2 "version = 2"
1097                         ;;
1098         esac
1099         print # empty line
1100
1101         # Always only keep one connection open at a time
1102         print_indent 2 "# Unique IDs"
1103         print_indent 2 "unique = replace"
1104         print
1105
1106         # Local Address
1107         print_indent 2 "# Local Address"
1108         if isset LOCAL_ADDRESS; then
1109                 print_indent 2 "local_addrs = ${LOCAL_ADDRESS}"
1110         else
1111                 print_indent 2 "local_addrs = %any"
1112         fi
1113         print
1114
1115         # Remote Address
1116         print_indent 2 "# Remote Address"
1117         if isset PEER; then
1118                 print_indent 2 "remote_addrs = ${PEER}"
1119         else
1120                 print_indent 2 "remote_addrs = %any"
1121         fi
1122         print
1123
1124         # IKE Proposals
1125         print_indent 2 "# IKE Proposals"
1126         print_indent 2 "proposals = $(vpn_security_policies_make_ike_proposal ${SECURITY_POLICY})"
1127         print
1128
1129         # DPD Settings
1130         if enabled dpd; then
1131                 print_indent 2 "# Dead Peer Detection"
1132                 print_indent 2 "dpd_delay = ${DPD_DELAY}"
1133
1134                 if isset DPD_TIMEOUT; then
1135                         print_indent 2 "dpd_timeout = ${DPD_TIMEOUT}"
1136                 fi
1137
1138                 print
1139         fi
1140
1141         # Fragmentation
1142         print_indent 2 "# Fragmentation"
1143         print_indent 2 "fragmentation = yes"
1144         print
1145
1146         # Local
1147         print_indent 2 "local {"
1148
1149         # Local ID
1150         if isset LOCAL_ID; then
1151                 print_indent 3 "id = ${LOCAL_ID}"
1152         fi
1153
1154         # Authentication
1155         case "${AUTH_MODE}" in
1156                 PSK)
1157                         print_indent 3 "auth = psk"
1158                         ;;
1159         esac
1160
1161         print_indent 2 "}"
1162         print
1163
1164         # Remote
1165         print_indent 2 "remote {"
1166
1167         # Remote ID
1168         if isset REMOTE_ID; then
1169                 print_indent 3 "id = ${REMOTE_ID}"
1170         fi
1171
1172         # Authentication
1173         case "${AUTH_MODE}" in
1174                 PSK)
1175                         print_indent 3 "auth = psk"
1176                         ;;
1177         esac
1178
1179         print_indent 2 "}"
1180         print
1181
1182         # Children
1183
1184         print_indent 2 "children {"
1185         print_indent 3 "${connection} {"
1186
1187         print_indent 4 "# ESP Proposals"
1188         print_indent 4 "esp_proposals = $(vpn_security_policies_make_esp_proposal ${SECURITY_POLICY})"
1189         print
1190
1191         # Traffic Selectors
1192
1193         case "${MODE}" in
1194                 gre-*)
1195                         print_indent 4 "local_ts = dynamic[gre]"
1196                         print_indent 4 "remote_ts = dynamic[gre]"
1197                         ;;
1198                 *)
1199                         # Local Prefixes
1200                         if isset LOCAL_PREFIX; then
1201                                 print_indent 4 "local_ts = $(list_join LOCAL_PREFIX ,)"
1202                         else
1203                                 print_indent 4 "local_ts = dynamic"
1204                         fi
1205
1206                         # Remote Prefixes
1207                         if isset REMOTE_PREFIX; then
1208                                 print_indent 4 "remote_ts = $(list_join REMOTE_PREFIX ,)"
1209                         else
1210                                 print_indent 4 "remote_ts = dynamic"
1211                         fi
1212                         ;;
1213         esac
1214         print
1215
1216         # Netfilter Marks
1217         print_indent 4 "# Netfilter Marks"
1218         print_indent 4 "mark_in = %unique"
1219         print_indent 4 "mark_out = %unique"
1220         print
1221
1222         # Dead Peer Detection
1223         if enabled dpd; then
1224                 print_indent 4 "# Dead Peer Detection"
1225                 print_indent 4 "dpd_action = ${DPD_ACTION}"
1226                 print
1227         fi
1228
1229         # Rekeying
1230         if isset LIFETIME; then
1231                 print_indent 4 "# Rekey Time"
1232                 print_indent 4 "rekey_time = ${LIFETIME}"
1233                 print
1234         fi
1235
1236         # Updown Script
1237         print_indent 4 "updown = ${NETWORK_HELPERS_DIR}/ipsec-updown"
1238         print
1239
1240         # Mode
1241         print_indent 4 "# Mode"
1242         case "${MODE}" in
1243                 gre-transport)
1244                         print_indent 4 "mode = transport"
1245                         ;;
1246                 tunnel|vti|*)
1247                         print_indent 4 "mode = tunnel"
1248                         ;;
1249         esac
1250         print
1251
1252         # Compression
1253         print_indent 4 "# Compression"
1254         if enabled COMPRESSION; then
1255                 print_indent 4 "ipcomp = yes"
1256         else
1257                 print_indent 4 "ipcomp = no"
1258         fi
1259         print
1260
1261         # Inactivity Timeout
1262         if isset INACTIVITY_TIMEOUT; then
1263                 print_indent 4 "# Inactivity Timeout"
1264                 print_indent 4 "inactivity = ${INACTIVITY_TIMEOUT}"
1265                 print
1266         fi
1267
1268         # Start Action
1269         print_indent 4 "# Start Action"
1270         case "${START_ACTION}" in
1271                 on-demand)
1272                         print_indent 4 "start_action = trap"
1273                         print_indent 4 "close_action = trap"
1274                         ;;
1275                 wait)
1276                         print_indent 4 "start_action = none"
1277                         print_indent 4 "close_action = none"
1278                         ;;
1279                 always-on|*)
1280                         print_indent 4 "start_action = start"
1281                         print_indent 4 "close_action = start"
1282                         ;;
1283         esac
1284         print
1285
1286         print_indent 3 "}"
1287         print_indent 2 "}"
1288         print
1289
1290         print_indent 1 "}"
1291         print_indent 0 "}"
1292         print
1293 }
1294
1295 _ipsec_connection_to_strongswan_secrets() {
1296         local connection="${1}"
1297
1298         print_indent 0 "secrets {"
1299
1300         case "${AUTH_MODE}" in
1301                 PSK)
1302                         print_indent 1 "ike {"
1303
1304                         # Secret
1305                         print_indent 2 "secret = ${PSK}"
1306
1307                         # ID
1308                         if isset REMOTE_ID; then
1309                                 print_indent 2 "id = ${REMOTE_ID}"
1310                         fi
1311
1312                         print_indent 1 "}"
1313                         ;;
1314         esac
1315
1316         print_indent 0 "}"
1317 }