network fix parameter passing when using ""

[people/stevee/network.git] / src / functions / functions.ipsec

diff --git a/src/functions/functions.ipsec b/src/functions/functions.ipsec
index 18478af669071ba6e2c9be20d463bc51c675ffb6..038ed879c345913f11aba3cfaf529696a44f51ec 100644 (file)
--- a/src/functions/functions.ipsec
+++ b/src/functions/functions.ipsec
@@ -36,6 +36,7 @@ IPSEC_CONNECTION_CONFIG_SETTINGS="\
        REMOTE_PREFIX \
        SECURITY_POLICY \
        START_ACTION \
+       TYPE \
        ENABLED"
 
 IPSEC_POOL_CONFIG_SETTINGS="\
@@ -53,6 +54,7 @@ IPSEC_DEFAULT_INACTIVITY_TIMEOUT="0"
 IPSEC_DEFAULT_MODE="tunnel"
 IPSEC_DEFAULT_SECURITY_POLICY="system"
 IPSEC_DEFAULT_START_ACTION="on-demand"
+IPSEC_DEFAULT_TYPE="net-to-net"
 
 IPSEC_VALID_MODES="gre-transport tunnel vti"
 IPSEC_VALID_AUTH_MODES="PSK"
@@ -63,10 +65,10 @@ cli_ipsec() {
 
        case "${action}" in
                connection)
-                       cli_ipsec_connection $@
+                       cli_ipsec_connection "$@"
                        ;;
                pool)
-                       cli_ipsec_pool $@
+                       cli_ipsec_pool "$@"
                        ;;
                *)
                        error "Unrecognized argument: ${action}"
@@ -84,7 +86,7 @@ cli_ipsec_connection() {
 
                case "${key}" in
                        authentication|down|disable|dpd|enable|inactivity_timeout|local|mode|peer|pool|remote|security_policy|start_action|up)
-                               ipsec_connection_${key} ${connection} $@
+                               ipsec_connection_${key} ${connection} "$@"
                                ;;
                        show)
                                cli_ipsec_connection_show "${connection}"
@@ -101,10 +103,10 @@ cli_ipsec_connection() {
 
                case "${action}" in
                        new)
-                               ipsec_connection_new $@
+                               ipsec_connection_new "$@"
                                ;;
                        destroy)
-                               cli_ipsec_connection_destroy $@
+                               cli_ipsec_connection_destroy "$@"
                                ;;
                        ""|*)
                                if [ -n "${action}" ]; then
@@ -125,7 +127,7 @@ cli_ipsec_pool() {
 
                case "${key}" in
                        dns_server|network)
-                               ipsec_pool_${key} ${pool} $@
+                               ipsec_pool_${key} ${pool} "$@"
                                ;;
                        show)
                                cli_ipsec_pool_show "${pool}"
@@ -142,10 +144,10 @@ cli_ipsec_pool() {
 
                case "${action}" in
                        new)
-                               ipsec_pool_new $@
+                               ipsec_pool_new "$@"
                                ;;
                        destroy)
-                               ipsec_pool_destroy $@
+                               ipsec_pool_destroy "$@"
                                ;;
                        ""|*)
                                if [ -n "${action}" ]; then
@@ -361,7 +363,7 @@ ipsec_connection_read_config() {
        if [ $# -eq 0 ] && [ -n "${IPSEC_CONNECTION_CONFIG_SETTINGS}" ]; then
                list_append args ${IPSEC_CONNECTION_CONFIG_SETTINGS}
        else
-               list_append args $@
+               list_append args "$@"
        fi
 
        local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
@@ -475,10 +477,10 @@ ipsec_connection_authentication() {
 
        case ${cmd} in
                mode)
-                       ipsec_connection_authentication_mode "${connection}" $@
+                       ipsec_connection_authentication_mode "${connection}" "$@"
                        ;;
                pre-shared-key)
-                       ipsec_connection_authentication_psk "${connection}" $@
+                       ipsec_connection_authentication_psk "${connection}" "$@"
                        ;;
                *)
                        log ERROR "Unrecognized argument: ${cmd}"
@@ -572,13 +574,13 @@ ipsec_connection_dpd() {
 
        case ${cmd} in
                action)
-                       ipsec_connection_dpd_action "${connection}" $@
+                       ipsec_connection_dpd_action "${connection}" "$@"
                        ;;
                delay)
-                       ipsec_connection_dpd_delay "${connection}" $@
+                       ipsec_connection_dpd_delay "${connection}" "$@"
                        ;;
                timeout)
-                       ipsec_connection_dpd_timeout "${connection}" $@
+                       ipsec_connection_dpd_timeout "${connection}" "$@"
                        ;;
                *)
                        log ERROR "Unrecognized argument: ${cmd}"
@@ -619,7 +621,7 @@ ipsec_connection_dpd_delay() {
        local value=$@
 
        if ! isinteger value; then
-               value=$(parse_time $@)
+               value=$(parse_time "$@")
                if [ ! $? -eq 0 ]; then
                        log ERROR "Parsing the passed time was not sucessful please check the passed values."
                        return ${EXIT_ERROR}
@@ -651,7 +653,7 @@ ipsec_connection_dpd_timeout() {
        local value=$@
 
        if ! isinteger value; then
-               value=$(parse_time $@)
+               value=$(parse_time "$@")
                if [ ! $? -eq 0 ]; then
                        log ERROR "Parsing the passed time was not sucessful please check the passed values."
                        return ${EXIT_ERROR}
@@ -684,13 +686,13 @@ ipsec_connection_local() {
 
        case ${cmd} in
                address)
-                       ipsec_connection_local_address "${connection}" $@
+                       ipsec_connection_local_address "${connection}" "$@"
                        ;;
                id)
-                       ipsec_connection_id "${connection}" "LOCAL" $@
+                       ipsec_connection_id "${connection}" "LOCAL" "$@"
                        ;;
                prefix)
-                       ipsec_connection_prefix "${connection}" "LOCAL" $@
+                       ipsec_connection_prefix "${connection}" "LOCAL" "$@"
                        ;;
                *)
                        log ERROR "Unrecognized argument: ${cmd}"
@@ -781,16 +783,16 @@ ipsec_connection_id() {
                log ERROR "Id '${id}' is invalid"
                return ${EXIT_ERROR}
        fi
-       
+
        if ! ipsec_connection_write_config_key "${connection}" "${type}_ID" ${id}; then
                log ERROR "Could not write configuration settings"
                return ${EXIT_ERROR}
        fi
-       
+
        return ${EXIT_OK}
 }
 
-# Set the local or remote prefix 
+# Set the local or remote prefix
 ipsec_connection_prefix() {
        if [ ! $# -ge 3 ]; then
                log ERROR "Not enough arguments"
@@ -799,7 +801,7 @@ ipsec_connection_prefix() {
        local connection=${1}
        local type=${2}
        shift 2
-       
+
        local _prefix="${type}_PREFIX"
        local "${_prefix}"
        if ! ipsec_connection_read_config "${connection}" "${_prefix}"; then
@@ -964,7 +966,7 @@ ipsec_connection_pool() {
 
 
                for pool in ${pools_added}; do
-                       if ! ipsec_pool_exists ${pool} && ! ipsec_pool_check_config ${pool}; then
+                       if ipsec_pool_exists ${pool} && ipsec_pool_check_config ${pool}; then
                                if ! list_append_unique "POOLS" ${pool}; then
                                        warning "${pool} is already on the prefix list"
                                fi
@@ -1001,11 +1003,11 @@ ipsec_connection_remote() {
 
        case ${cmd} in
                id)
-                       ipsec_connection_id "${connection}" "REMOTE" $@
+                       ipsec_connection_id "${connection}" "REMOTE" "$@"
                        ;;
 
                prefix)
-                       ipsec_connection_prefix "${connection}" "REMOTE" $@
+                       ipsec_connection_prefix "${connection}" "REMOTE" "$@"
                        ;;
                *)
                        log ERROR "Unrecognized argument: ${cmd}"
@@ -1028,7 +1030,7 @@ ipsec_connection_inactivity_timeout() {
        local value=$@
 
        if ! isinteger value; then
-               value=$(parse_time $@)
+               value=$(parse_time "$@")
                if [ ! $? -eq 0 ]; then
                        log ERROR "Parsing the passed time was not sucessful please check the passed values."
                        return ${EXIT_ERROR}
@@ -1125,12 +1127,14 @@ ipsec_connection_check_name() {
 
 # Function that creates one VPN IPsec connection
 ipsec_connection_new() {
-       if [ $# -gt 1 ]; then
+       if [ $# -gt 2 ]; then
                error "Too many arguments"
                return ${EXIT_ERROR}
        fi
 
        local connection="${1}"
+       local type="${2}"
+
        if ! isset connection; then
                error "Please provide a connection name"
                return ${EXIT_ERROR}
@@ -1148,6 +1152,16 @@ ipsec_connection_new() {
                return ${EXIT_ERROR}
        fi
 
+       # Set TYPE to default if not set by the user
+       if ! isset type; then
+               type="${IPSEC_DEFAULT_TYPE}"
+       fi
+
+       if ! isoneof "type" "net-to-net" "host-to-net"; then
+               error "Type is invalid"
+               return ${EXIT_ERROR}
+       fi
+
        log DEBUG "Creating VPN IPsec connection ${connection}"
 
        if ! mkdir -p "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
@@ -1164,6 +1178,7 @@ ipsec_connection_new() {
        ENABLED=${IPSEC_DEFAULT_ENABLED}
        MODE=${IPSEC_DEFAULT_MODE}
        START_ACTION=${IPSEC_DEFAULT_START_ACTION}
+       TYPE="${type}"
 
        INACTIVITY_TIMEOUT=${IPSEC_DEFAULT_INACTIVITY_TIMEOUT}
        SECURITY_POLICY=${IPSEC_DEFAULT_SECURITY_POLICY}
@@ -1180,7 +1195,7 @@ ipsec_connection_new() {
 # Function that deletes based on the passed parameters one ore more vpn security policies
 ipsec_connection_destroy() {
        local connection
-       for connection in $@; do
+       for connection in "$@"; do
                if ! ipsec_connection_exists "${connection}"; then
                        log ERROR "The VPN IPsec connection ${connection} does not exist."
                        continue
@@ -1210,7 +1225,7 @@ ipsec_list_connections() {
 
 ipsec_connection_to_strongswan() {
        local connection="${1}"
-       log DEBUG "Generating IPsec configuration for ${connection}"    
+       log DEBUG "Generating IPsec configuration for ${connection}"
 
        # Read the config settings
        local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
@@ -1311,12 +1326,18 @@ _ipsec_connection_to_strongswan_connection() {
        print_indent 2 "fragmentation = yes"
        print
 
-       # Pools
-       if isset POOLS; then
-               print_indent 2 "# Pools"
-               print_indent 2 "pools = $(list_join POOLS ", ")"
-               print
-       fi
+
+       # Host-to-Net specific settings
+       case "${TYPE}" in
+               host-to-net)
+                       # Pools
+                       if isset POOLS; then
+                               print_indent 2 "# Pools"
+                               print_indent 2 "pools = $(list_join POOLS ", ")"
+                               print
+                       fi
+                       ;;
+       esac
 
        # Local
        print_indent 2 "local {"
@@ -1444,23 +1465,28 @@ _ipsec_connection_to_strongswan_connection() {
                print
        fi
 
-       # Start Action
-       print_indent 4 "# Start Action"
-       case "${START_ACTION}" in
-               on-demand)
-                       print_indent 4 "start_action = trap"
-                       print_indent 4 "close_action = trap"
-                       ;;
-               wait)
-                       print_indent 4 "start_action = none"
-                       print_indent 4 "close_action = none"
-                       ;;
-               always-on|*)
-                       print_indent 4 "start_action = start"
-                       print_indent 4 "close_action = start"
+       # Net-to-Net specific settings
+       case "${TYPE}" in
+               net-to-net)
+                       # Start Action
+                       print_indent 4 "# Start Action"
+                       case "${START_ACTION}" in
+                               on-demand)
+                                       print_indent 4 "start_action = trap"
+                                       print_indent 4 "close_action = trap"
+                                       ;;
+                               wait)
+                                       print_indent 4 "start_action = none"
+                                       print_indent 4 "close_action = none"
+                                       ;;
+                               always-on|*)
+                                       print_indent 4 "start_action = start"
+                                       print_indent 4 "close_action = start"
+                                       ;;
+                       esac
+                       print
                        ;;
        esac
-       print
 
        print_indent 3 "}"
        print_indent 2 "}"
@@ -1572,7 +1598,7 @@ ipsec_pool_read_config() {
        if [ $# -eq 0 ] && [ -n "${IPSEC_POOL_CONFIG_SETTINGS}" ]; then
                list_append args ${IPSEC_POOL_CONFIG_SETTINGS}
        else
-               list_append args $@
+               list_append args "$@"
        fi
 
        local path="${NETWORK_IPSEC_POOLS_DIR}/${pool}/settings"
@@ -1653,7 +1679,7 @@ ipsec_pool_new() {
 # one ore more vpn ipsec pools
 ipsec_pool_destroy() {
        local pool
-       for pool in $@; do
+       for pool in "$@"; do
                if ! ipsec_pool_exists "${pool}"; then
                        log ERROR "The VPN IPsec pool ${pool} does not exist."
                        continue