2 ###############################################################################
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2017 IPFire Network Development Team #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
20 ###############################################################################
22 IPSEC_CONNECTION_CONFIG_SETTINGS
="\
40 IPSEC_DEFAULT_AUTH_MODE
="PSK"
41 IPSEC_DEFAULT_DPD_ACTION
="restart"
42 IPSEC_DEFAULT_DPD_DELAY
="30"
43 IPSEC_DEFAULT_DPD_TIMEOUT
="120"
44 IPSEC_DEFAULT_ENABLED
="true"
45 IPSEC_DEFAULT_INACTIVITY_TIMEOUT
="0"
46 IPSEC_DEFAULT_MODE
="tunnel"
47 IPSEC_DEFAULT_SECURITY_POLICY
="system"
48 IPSEC_DEFAULT_START_ACTION
="on-demand"
50 IPSEC_VALID_MODES
="gre-transport tunnel vti"
51 IPSEC_VALID_AUTH_MODES
="PSK"
59 cli_ipsec_connection $@
62 error
"Unrecognized argument: ${action}"
68 cli_ipsec_connection
() {
69 if ipsec_connection_exists
${1}; then
76 authentication|down|disable|dpd|
enable|inactivity_timeout|
local|mode|peer|remote|security_policy|start_action|up
)
77 ipsec_connection_
${key} ${connection} $@
80 cli_ipsec_connection_show
"${connection}"
84 error
"Unrecognized argument: ${key}"
94 ipsec_connection_new $@
97 ipsec_connection_destroy $@
100 if [ -n "${action}" ]; then
101 error
"Unrecognized argument: '${action}'"
109 cli_ipsec_connection_show
() {
110 local connection
="${1}"
112 # Read the config settings
113 local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
114 if ! ipsec_connection_read_config
"${connection}"; then
115 error
"Could not read the connection configuration"
119 cli_headline
0 "IPsec VPN Connection: ${connection}"
124 cli_print_fmt1
1 "Peer" "${PEER}"
128 cli_print_fmt1
1 "Security Policy" "${SECURITY_POLICY-${IPSEC_DEFAULT_SECURITY_POLICY}}"
131 cli_headline
2 "Authentication"
132 case "${AUTH_MODE^^}" in
134 cli_print_fmt1
2 "Mode" "Pre-Shared-Key"
137 cli_print_fmt1
2 "Pre-Shared-Key" "****"
139 cli_print_fmt1
2 "Pre-Shared-Key" "- is not set -"
149 for i
in LOCAL REMOTE
; do
152 cli_headline
2 "Local"
155 cli_headline
2 "Remote"
159 local id_var
="${i}_ID"
160 if [ -n "${!id_var}" ]; then
161 cli_print_fmt1
2 "ID" "${!id_var}"
164 local prefix_var
="${i}_PREFIX"
165 if isset
${prefix_var}; then
166 cli_headline
3 "Prefix(es)"
169 for prefix
in ${!prefix_var}; do
170 cli_print_fmt1
3 "${prefix}"
177 cli_headline
2 "Misc."
181 cli_print_fmt1
2 "Transport Mode" "GRE Transport"
184 cli_print_fmt1
2 "Transport Mode" "Tunnel"
187 cli_print_fmt1
2 "Transport Mode" "Virtual Tunnel Interface"
190 cli_print_fmt1
2 "Transport Mode" "- Unknown -"
195 if isset INACTIVITY_TIMEOUT
&& [ ${INACTIVITY_TIMEOUT} -gt 0 ]; then
196 cli_print_fmt1
2 "Inactivity Timeout" "$(format_time ${INACTIVITY_TIMEOUT})"
203 ipsec_connection_disable
() {
204 local connection
=${1}
206 if ! ipsec_connection_write_config_key
"${connection}" "ENABLED" "false"; then
207 log ERROR
"Could not write configuration settings"
211 ipsec_reload
${connection}
213 # Configure strongswan autostart
214 ipsec_strongswan_autostart
217 ipsec_connection_enable
() {
218 local connection
=${1}
220 if ! ipsec_connection_write_config_key
"${connection}" "ENABLED" "true"; then
221 log ERROR
"Could not write configuration settings"
225 ipsec_reload
"${connection}"
227 # Configure strongswan autostart
228 ipsec_strongswan_autostart
231 # This function writes all values to a via ${connection} specificated VPN IPsec configuration file
232 ipsec_connection_write_config
() {
235 local connection
="${1}"
237 if ! ipsec_connection_exists
"${connection}"; then
238 log ERROR
"No such VPN IPsec connection: ${connection}"
242 local path
="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
244 if ! settings_write
"${path}" ${IPSEC_CONNECTION_CONFIG_SETTINGS}; then
245 log ERROR
"Could not write configuration settings for VPN IPsec connection ${connection}"
249 ipsec_reload
${connection}
252 # This funtion writes the value for one key to a via ${connection} specificated VPN IPsec connection configuration file
253 ipsec_connection_write_config_key
() {
256 local connection
=${1}
262 if ! ipsec_connection_exists
"${connection}"; then
263 log ERROR
"No such VPN ipsec connection: ${connection}"
267 log DEBUG
"Set '${key}' to new value '${value}' in VPN ipsec connection '${connection}'"
269 local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
271 # Read the config settings
272 if ! ipsec_connection_read_config
"${connection}"; then
276 # Set the key to a new value
277 assign
"${key}" "${value}"
279 if ! ipsec_connection_write_config
"${connection}"; then
286 # Reads one or more keys out of a settings file or all if no key is provided.
287 ipsec_connection_read_config
() {
290 local connection
="${1}"
293 if ! ipsec_connection_exists
"${connection}"; then
294 log ERROR
"No such VPN IPsec connection : ${connection}"
300 if [ $# -eq 0 ] && [ -n "${IPSEC_CONNECTION_CONFIG_SETTINGS}" ]; then
301 list_append args
${IPSEC_CONNECTION_CONFIG_SETTINGS}
306 local path
="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
308 if ! settings_read
"${path}" ${args}; then
309 log ERROR
"Could not read settings for VPN IPsec connection ${connection}"
314 # This function checks if a vpn ipsec connection exists
315 # Returns True when yes and false when not
316 ipsec_connection_exists
() {
319 local connection
=${1}
321 local path
="${NETWORK_IPSEC_CONNS_DIR}/${connection}"
323 [ -d "${path}" ] && return ${EXIT_TRUE} || return ${EXIT_FALSE}
326 # Determines if strongswan should be automatically started
327 # when the system boots up.
328 ipsec_strongswan_autostart() {
329 local autostart_needed="false
"
332 for connection in $(ipsec_list_connections); do
335 if ! ipsec_connection_read_config "${connection}" "ENABLED
"; then
336 log WARNING "Could not
read configuation
"
340 if enabled ENABLED; then
341 autostart_needed="true
"
346 # Start strongswan when we need it and when it is not yet enabled
347 if ${autostart_needed} && ! service_is_enabled "strongswan
"; then
348 service_enable "strongswan
"
350 # Disable strongswan when we do not need it but it is enabled
351 elif ! ${autostart_needed} && service_is_enabled "strongswan
"; then
352 service_disable "strongswan
"
356 ipsec_strongswan_load() {
357 if ! cmd swanctl --load-all; then
358 log ERROR "Could not reload strongswan config
"
363 # Reloads the connection after config changes
365 local connection=${1}
369 if ! ipsec_connection_read_config "${connection}" "ENABLED
"; then
370 log ERROR "Could not
read configuration
for IPsec connection
${connection}"
374 if enabled ${ENABLED}; then
375 if ! ipsec_connection_to_strongswan ${connection}; then
376 log ERROR "Could not generate strongswan config
for ${connnection}"
380 unlink "${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf
"
383 ipsec_strongswan_load
386 # Handle the cli after authentification
387 ipsec_connection_authentication() {
388 if [ ! $# -gt 1 ]; then
389 log ERROR "Not enough arguments
"
393 local connection=${1}
399 ipsec_connection_authentication_mode "${connection}" $@
402 ipsec_connection_authentication_psk "${connection}" $@
405 log ERROR "Unrecognized argument
: ${cmd}"
411 # Set the authentification mode
412 ipsec_connection_authentication_mode() {
413 if [ ! $# -eq 2 ]; then
414 log ERROR "Not enough arguments
"
417 local connection=${1}
420 if ! isoneof mode ${IPSEC_VALID_AUTH_MODES}; then
421 log ERROR "Auth mode
'${mode}' is invalid
"
425 if ! ipsec_connection_write_config_key "${connection}" "AUTH_MODE
" ${mode^^}; then
426 log ERROR "Could not
write configuration settings
"
432 ipsec_connection_authentication_psk() {
433 if [ ! $# -eq 2 ]; then
434 log ERROR "Not enough arguments
"
438 local connection=${1}
443 if [ ${length} -lt 4 ]; then
444 error "The PSK must be longer than four characters
"
448 if [ ${length} -gt 128 ]; then
449 error "The PSK cannot be longer than
128 characters
"
453 if ! ipsec_connection_write_config_key "${connection}" "PSK
" "${psk}"; then
454 log ERROR "Could not
write configuration settings
"
461 ipsec_connection_up() {
462 local connection="${1}"
464 if ! ipsec_connection_exists "${connection}"; then
465 error "No such VPN IPsec connection
: ${connection}"
469 cmd swanctl --initiate --child "${connection}"
472 ipsec_connection_down() {
473 local connection="${1}"
475 if ! ipsec_connection_exists "${connection}"; then
476 error "No such VPN IPsec connection
: ${connection}"
480 cmd swanctl --terminate --ike "${connection}"
483 # Handle the cli after authentification
484 ipsec_connection_dpd() {
485 if [ ! $# -gt 1 ]; then
486 log ERROR "Not enough arguments
"
490 local connection=${1}
496 ipsec_connection_dpd_action "${connection}" $@
499 ipsec_connection_dpd_delay "${connection}" $@
502 ipsec_connection_dpd_timeout "${connection}" $@
505 log ERROR "Unrecognized argument
: ${cmd}"
511 # Set the default dpd action
512 ipsec_connection_dpd_action() {
513 if [ ! $# -eq 2 ]; then
514 log ERROR "Not enough arguments
"
517 local connection=${1}
520 if ! isoneof action "restart
" "clear"; then
521 log ERROR "dpd action
'${action}' is invalid
"
525 if ! ipsec_connection_write_config_key "${connection}" "DPD_ACTION
" ${action}; then
526 log ERROR "Could not
write configuration settings
"
532 ipsec_connection_dpd_delay() {
533 if [ ! $# -ge 2 ]; then
534 log ERROR "Not enough arguments
"
538 local connection=${1}
542 if ! isinteger value; then
543 value=$(parse_time $@)
544 if [ ! $? -eq 0 ]; then
545 log ERROR "Parsing the passed
time was not sucessful please check the passed values.
"
550 if [ ${value} -lt 0 ]; then
551 log ERROR "The passed
time value must be
in the
sum greater or equal zero seconds.
"
555 if ! ipsec_connection_write_config_key "${connection}" "DPD_DELAY
" ${value}; then
556 log ERROR "Could not
write configuration settings
"
563 # Set the dpd timeout
564 ipsec_connection_dpd_timeout() {
565 if [ ! $# -ge 2 ]; then
566 log ERROR "Not enough arguments
"
570 local connection=${1}
574 if ! isinteger value; then
575 value=$(parse_time $@)
576 if [ ! $? -eq 0 ]; then
577 log ERROR "Parsing the passed
time was not sucessful please check the passed values.
"
582 if [ ${value} -le 0 ]; then
583 log ERROR "The passed
time value must be
in the
sum greater or equal zero seconds.
"
587 if ! ipsec_connection_write_config_key "${connection}" "DPD_TIMEOUT
" ${value}; then
588 log ERROR "Could not
write configuration settings
"
595 # Handle the cli after local
596 ipsec_connection_local() {
597 if [ ! $# -ge 2 ]; then
598 log ERROR "Not enough arguments
"
602 local connection=${1}
608 ipsec_connection_local_address "${connection}" $@
611 ipsec_connection_id "${connection}" "LOCAL
" $@
614 ipsec_connection_prefix "${connection}" "LOCAL
" $@
617 log ERROR "Unrecognized argument
: ${cmd}"
625 # Set the connection mode
626 ipsec_connection_mode() {
627 if [ ! $# -eq 2 ]; then
628 log ERROR "Not enough arguments
"
631 local connection=${1}
634 if ! isoneof mode ${IPSEC_VALID_MODES}; then
635 log ERROR "Mode
'${mode}' is invalid
"
639 if ! ipsec_connection_write_config_key "${connection}" "MODE
" ${mode}; then
640 log ERROR "Could not
write configuration settings
"
647 # Set the local address
648 ipsec_connection_local_address() {
649 if [ ! $# -eq 2 ]; then
650 log ERROR "Not enough arguments
"
653 local connection=${1}
654 local local_address=${2}
656 if ! ipsec_connection_check_peer ${local_address}; then
657 log ERROR "Local address
'${local_address}' is invalid
"
661 if ! ipsec_connection_write_config_key "${connection}" "LOCAL_ADDRESS
" ${local_address}; then
662 log ERROR "Could not
write configuration settings
"
669 # Set the peer to connect to
670 ipsec_connection_peer() {
671 if [ ! $# -eq 2 ]; then
672 log ERROR "Not enough arguments
"
675 local connection=${1}
678 if ! ipsec_connection_check_peer ${peer}; then
679 log ERROR "Peer
'${peer}' is invalid
"
683 if ! ipsec_connection_write_config_key "${connection}" "PEER
" ${peer}; then
684 log ERROR "Could not
write configuration settings
"
691 #Set the local or remote id
692 ipsec_connection_id() {
693 if [ ! $# -eq 3 ]; then
694 log ERROR "Not enough arguments
"
697 local connection=${1}
701 if ! ipsec_connection_check_id ${id}; then
702 log ERROR "Id
'${id}' is invalid
"
706 if ! ipsec_connection_write_config_key "${connection}" "${type}_ID" ${id}; then
707 log ERROR
"Could not write configuration settings"
714 # Set the local or remote prefix
715 ipsec_connection_prefix
() {
716 if [ ! $# -ge 3 ]; then
717 log ERROR
"Not enough arguments"
720 local connection
=${1}
724 local _prefix
="${type}_PREFIX"
726 if ! ipsec_connection_read_config
"${connection}" "${_prefix}"; then
730 # Remove duplicated entries to proceed the list safely
731 assign
"${_prefix}" "$(list_unique ${!_prefix} )"
734 local prefixes_removed
737 while [ $# -gt 0 ]; do
742 list_append prefixes_added
"${arg:1}"
745 list_append prefixes_removed
"${arg:1}"
748 list_append prefixes_set
"${arg}"
751 error
"Invalid argument: ${arg}"
758 # Check if the user is trying a mixed operation
759 if ! list_is_empty prefixes_set
&& (! list_is_empty prefixes_added ||
! list_is_empty prefixes_removed
); then
760 error
"You cannot reset the prefix list and add or remove prefixes at the same time"
764 # Set new prefix list
765 if ! list_is_empty prefixes_set
; then
766 # Check if all prefixes are valid
768 for prefix
in ${prefixes_set}; do
769 if ! ip_net_is_valid
${prefix}; then
770 error
"Unsupported prefix: ${prefix}"
775 assign
"${_prefix}" "${prefixes_set}"
777 # Perform incremental updates
781 # Perform all removals
782 for prefix
in ${prefixes_removed}; do
783 if ! list_remove
"${_prefix}" ${prefix}; then
784 warning
"${prefix} was not on the list and could not be removed"
789 for prefix
in ${prefixes_added}; do
790 if ip_net_is_valid
${prefix}; then
791 if ! list_append_unique
"${_prefix}" ${prefix}; then
792 warning
"${prefix} is already on the prefix list"
795 warning
"${prefix} is not a valid IP network and could not be added"
800 # Check if the list contain at least one valid prefix
801 if list_is_empty
${_prefix}; then
802 error
"Cannot save an empty prefix list"
807 if ! ipsec_connection_write_config_key
"${connection}" "${_prefix}" ${!_prefix}; then
808 log ERROR "Could not
write configuration settings
"
814 # Handle the cli after remote
815 ipsec_connection_remote() {
816 if [ ! $# -ge 2 ]; then
817 log ERROR "Not enough arguments
"
821 local connection=${1}
827 ipsec_connection_id "${connection}" "REMOTE
" $@
831 ipsec_connection_prefix "${connection}" "REMOTE
" $@
834 log ERROR "Unrecognized argument
: ${cmd}"
842 # Set the inactivity timeout
843 ipsec_connection_inactivity_timeout() {
844 if [ ! $# -ge 2 ]; then
845 log ERROR "Not enough arguments
"
849 local connection=${1}
853 if ! isinteger value; then
854 value=$(parse_time $@)
855 if [ ! $? -eq 0 ]; then
856 log ERROR "Parsing the passed
time was not sucessful please check the passed values.
"
861 if [ ${value} -le 0 ]; then
862 log ERROR "The passed
time value must be
in the
sum greater zero seconds.
"
866 if ! ipsec_connection_write_config_key "${connection}" "INACTIVITY_TIMEOUT
" ${value}; then
867 log ERROR "Could not
write configuration settings
"
874 # Set the default start action
875 ipsec_connection_start_action() {
876 if [ ! $# -eq 2 ]; then
877 log ERROR "Not enough arguments
"
880 local connection=${1}
883 if ! isoneof action "on-demand
" "always-on
"; then
884 log ERROR "Start action
'${action}' is invalid
"
888 if ! ipsec_connection_write_config_key "${connection}" "START_ACTION
" ${action}; then
889 log ERROR "Could not
write configuration settings
"
894 # Set the security policy to use
895 ipsec_connection_security_policy() {
896 if [ ! $# -eq 2 ]; then
897 log ERROR "Not enough arguments
"
900 local connection=${1}
901 local security_policy=${2}
903 if ! vpn_security_policy_exists ${security_policy}; then
904 log ERROR "No such vpn security policy
'${security_policy}'"
908 if ! ipsec_connection_write_config_key "${connection}" "SECURITY_POLICY
" ${security_policy}; then
909 log ERROR "Could not
write configuration settings
"
914 # Check if a id is valid
915 ipsec_connection_check_id() {
919 if [[ ${id} =~ ^@[[:alnum:]]+$ ]] || ip_is_valid ${id}; then
926 # Checks if a peer is valid
927 ipsec_connection_check_peer() {
931 # TODO Accept also FQDNs
932 if ip_is_valid ${peer}; then
939 # This function checks if a VPN IPsec connection name is valid
940 # Allowed are only A-Za-z0-9
941 ipsec_connection_check_name() {
944 local connection=${1}
946 [[ "${connection}" =~ [^[:alnum:]$] ]]
949 # Function that creates one VPN IPsec connection
950 ipsec_connection_new() {
951 if [ $# -gt 1 ]; then
952 error "Too many arguments
"
956 local connection="${1}"
957 if ! isset connection; then
958 error "Please provide a connection name
"
962 # Check for duplicates
963 if ipsec_connection_exists "${connection}"; then
964 error "The VPN IPsec connection
${connection} already exists
"
968 # Check if the name of the connection is valid
969 if ipsec_connection_check_name "${connection}"; then
970 error "'${connection}' contains illegal characters
"
974 log DEBUG "Creating VPN IPsec connection
${connection}"
976 if ! mkdir -p "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
977 log ERROR "Could not create config directory
for ${connection}"
981 local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
983 AUTH_MODE=${IPSEC_DEFAULT_AUTH_MODE}
984 DPD_ACTION=${IPSEC_DEFAULT_DPD_ACTION}
985 DPD_DELAY=${IPSEC_DEFAULT_DPD_DELAY}
986 DPD_TIMEOUT=${IPSEC_DEFAULT_DPD_TIMEOUT}
987 ENABLED=${IPSEC_DEFAULT_ENABLED}
988 MODE=${IPSEC_DEFAULT_MODE}
989 START_ACTION=${IPSEC_DEFAULT_START_ACTION}
991 INACTIVITY_TIMEOUT=${IPSEC_DEFAULT_INACTIVITY_TIMEOUT}
992 SECURITY_POLICY=${IPSEC_DEFAULT_SECURITY_POLICY}
994 if ! ipsec_connection_write_config "${connection}"; then
995 log ERROR "Could not
write new config
file"
999 # Configure strongswan autostart
1000 ipsec_strongswan_autostart
1003 # Function that deletes based on the passed parameters one ore more vpn security policies
1004 ipsec_connection_destroy() {
1006 for connection in $@; do
1007 if ! ipsec_connection_exists "${connection}"; then
1008 log ERROR "The VPN IPsec connection
${connection} does not exist.
"
1012 log DEBUG "Deleting VPN IPsec connection
${connection}"
1013 if ! rm -rf "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
1014 log ERROR "Deleting the VPN IPsec connection
${connection} was not sucessful
"
1015 return ${EXIT_ERROR}
1019 # Configure strongswan autostart
1020 ipsec_strongswan_autostart
1023 # List all ipsec connections
1024 ipsec_list_connections() {
1026 for connection in ${NETWORK_IPSEC_CONNS_DIR}/*; do
1027 [ -d ${connection} ] || continue
1028 basename ${connection}
1032 ipsec_connection_to_strongswan() {
1033 local connection="${1}"
1035 # Read the config settings
1036 local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
1037 if ! ipsec_connection_read_config "${connection}"; then
1038 error "Could not
read the connection
${connection}"
1039 return ${EXIT_ERROR}
1042 local path="${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf
"
1045 # Write the connection section
1046 _ipsec_connection_to_strongswan_connection "${connection}"
1048 # Write the secrets section
1049 _ipsec_connection_to_strongswan_secrets "${connection}"
1054 _ipsec_connection_to_strongswan_connection() {
1055 local connection="${1}"
1057 # Read the security policy
1058 local ${VPN_SECURITY_POLICIES_CONFIG_SETTINGS}
1059 if ! vpn_security_policies_read_config "${SECURITY_POLICY}"; then
1060 return ${EXIT_ERROR}
1065 if isset DPD_DELAY && isinteger DPD_DELAY && [ ${DPD_DELAY} -gt 0 ]; then
1069 print_indent 0 "connections
{"
1070 print_indent 1 "${connection} {"
1073 print_indent 2 "# IKE Version"
1074 case "${KEY_EXCHANGE^^}" in
1076 print_indent
2 "version = 1"
1079 # Fall back to IKEv2 for any random values
1081 print_indent
2 "version = 2"
1086 # Always only keep one connection open at a time
1087 print_indent
2 "# Unique IDs"
1088 print_indent
2 "unique = replace"
1092 print_indent
2 "# Local Address"
1093 if isset LOCAL_ADDRESS
; then
1094 print_indent
2 "local_addrs = ${LOCAL_ADDRESS}"
1096 print_indent
2 "local_addrs = %any"
1101 print_indent
2 "# Remote Address"
1103 print_indent
2 "remote_addrs = ${PEER}"
1105 print_indent
2 "remote_addrs = %any"
1110 print_indent
2 "# IKE Proposals"
1111 print_indent
2 "proposals = $(vpn_security_policies_make_ike_proposal ${SECURITY_POLICY})"
1115 if enabled dpd
; then
1116 print_indent
2 "# Dead Peer Detection"
1117 print_indent
2 "dpd_delay = ${DPD_DELAY}"
1119 if isset DPD_TIMEOUT
; then
1120 print_indent
2 "dpd_timeout = ${DPD_TIMEOUT}"
1127 print_indent
2 "# Fragmentation"
1128 print_indent
2 "fragmentation = yes"
1132 print_indent
2 "local {"
1135 if isset LOCAL_ID
; then
1136 print_indent
3 "id = ${LOCAL_ID}"
1140 case "${AUTH_MODE}" in
1142 print_indent
3 "auth = psk"
1150 print_indent
2 "remote {"
1153 if isset REMOTE_ID
; then
1154 print_indent
3 "id = ${REMOTE_ID}"
1158 case "${AUTH_MODE}" in
1160 print_indent
3 "auth = psk"
1169 print_indent
2 "children {"
1170 print_indent
3 "${connection} {"
1172 print_indent
4 "# ESP Proposals"
1173 print_indent
4 "esp_proposals = $(vpn_security_policies_make_esp_proposal ${SECURITY_POLICY})"
1180 print_indent
4 "local_ts = dynamic[gre]"
1181 print_indent
4 "remote_ts = dynamic[gre]"
1185 if isset LOCAL_PREFIX
; then
1186 print_indent
4 "local_ts = $(list_join LOCAL_PREFIX ,)"
1188 print_indent
4 "local_ts = dynamic"
1192 if isset REMOTE_PREFIX
; then
1193 print_indent
4 "remote_ts = $(list_join REMOTE_PREFIX ,)"
1195 print_indent
4 "remote_ts = dynamic"
1202 print_indent
4 "# Netfilter Marks"
1203 print_indent
4 "mark_in = %unique"
1204 print_indent
4 "mark_out = %unique"
1207 # Dead Peer Detection
1208 if enabled dpd
; then
1209 print_indent
4 "# Dead Peer Detection"
1210 print_indent
4 "dpd_action = ${DPD_ACTION}"
1215 if isset LIFETIME
; then
1216 print_indent
4 "# Rekey Time"
1217 print_indent
4 "rekey_time = ${LIFETIME}"
1222 print_indent
4 "updown = ${NETWORK_HELPERS_DIR}/ipsec-updown"
1226 print_indent
4 "# Mode"
1229 print_indent
4 "mode = transport"
1232 print_indent
4 "mode = tunnel"
1238 print_indent
4 "# Compression"
1239 if enabled COMPRESSION
; then
1240 print_indent
4 "ipcomp = yes"
1242 print_indent
4 "ipcomp = no"
1246 # Inactivity Timeout
1247 if isset INACTIVITY_TIMEOUT
; then
1248 print_indent
4 "# Inactivity Timeout"
1249 print_indent
4 "inactivity = ${INACTIVITY_TIMEOUT}"
1254 print_indent
4 "# Start Action"
1255 case "${START_ACTION}" in
1257 print_indent
4 "start_action = trap"
1258 print_indent
4 "close_action = trap"
1261 print_indent
4 "start_action = none"
1262 print_indent
4 "close_action = none"
1265 print_indent
4 "start_action = start"
1266 print_indent
4 "close_action = start"
1280 _ipsec_connection_to_strongswan_secrets
() {
1281 local connection
="${1}"
1283 print_indent
0 "secrets {"
1285 case "${AUTH_MODE}" in
1287 print_indent
1 "ike {"
1290 print_indent
2 "secret = ${PSK}"
1293 if isset REMOTE_ID
; then
1294 print_indent
2 "id = ${REMOTE_ID}"