src/functions/functions.ipsec

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2017  IPFire Network Development Team                         #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 IPSEC_CONNECTION_CONFIG_SETTINGS="\
  23         AUTH_MODE \
  24         DPD_ACTION \
  25         DPD_DELAY \
  26         DPD_TIMEOUT \
  27         INACTIVITY_TIMEOUT \
  28         LOCAL_ADDRESS \
  29         LOCAL_ID \
  30         LOCAL_PREFIX \
  31         MODE \
  32         PEER \
  33         POOLS \
  34         PSK \
  35         REMOTE_ID \
  36         REMOTE_PREFIX \
  37         SECURITY_POLICY \
  38         START_ACTION \
  39         ENABLED"
  40
  41 IPSEC_POOL_CONFIG_SETTINGS="\
  42         DNS_SERVER \
  43         NETWORK \
  44         TYPE"
  45
  46 # Default values
  47 IPSEC_DEFAULT_AUTH_MODE="PSK"
  48 IPSEC_DEFAULT_DPD_ACTION="restart"
  49 IPSEC_DEFAULT_DPD_DELAY="30"
  50 IPSEC_DEFAULT_DPD_TIMEOUT="120"
  51 IPSEC_DEFAULT_ENABLED="true"
  52 IPSEC_DEFAULT_INACTIVITY_TIMEOUT="0"
  53 IPSEC_DEFAULT_MODE="tunnel"
  54 IPSEC_DEFAULT_SECURITY_POLICY="system"
  55 IPSEC_DEFAULT_START_ACTION="on-demand"
  56
  57 IPSEC_VALID_MODES="gre-transport tunnel vti"
  58 IPSEC_VALID_AUTH_MODES="PSK"
  59
  60 cli_ipsec() {
  61         local action=${1}
  62         shift 1
  63
  64         case "${action}" in
  65                 connection)
  66                         cli_ipsec_connection $@
  67                         ;;
  68                 pool)
  69                         cli_ipsec_pool $@
  70                         ;;
  71                 *)
  72                         error "Unrecognized argument: ${action}"
  73                         exit ${EXIT_ERROR}
  74                         ;;
  75         esac
  76 }
  77
  78 cli_ipsec_connection() {
  79         if ipsec_connection_exists ${1}; then
  80                 local connection=${1}
  81                 local key=${2}
  82                 key=${key//-/_}
  83                 shift 2
  84
  85                 case "${key}" in
  86                         authentication|down|disable|dpd|enable|inactivity_timeout|local|mode|peer|pool|remote|security_policy|start_action|up)
  87                                 ipsec_connection_${key} ${connection} $@
  88                                 ;;
  89                         show)
  90                                 cli_ipsec_connection_show "${connection}"
  91                                 exit $?
  92                                 ;;
  93                         *)
  94                                 error "Unrecognized argument: ${key}"
  95                                 exit ${EXIT_ERROR}
  96                                 ;;
  97                 esac
  98         else
  99                 local action=${1}
 100                 shift
 101
 102                 case "${action}" in
 103                         new)
 104                                 ipsec_connection_new $@
 105                                 ;;
 106                         destroy)
 107                                 cli_ipsec_connection_destroy $@
 108                                 ;;
 109                         ""|*)
 110                                 if [ -n "${action}" ]; then
 111                                         error "Unrecognized argument: '${action}'"
 112                                 fi
 113                                 exit ${EXIT_ERROR}
 114                                 ;;
 115                 esac
 116         fi
 117 }
 118
 119 cli_ipsec_pool() {
 120         if ipsec_pool_exists ${1}; then
 121                 local pool=${1}
 122                 local key=${2}
 123                 key=${key//-/_}
 124                 shift 2
 125
 126                 case "${key}" in
 127                         dns_server|network)
 128                                 ipsec_pool_${key} ${pool} $@
 129                                 ;;
 130                         show)
 131                                 cli_ipsec_pool_show "${pool}"
 132                                 exit $?
 133                                 ;;
 134                         *)
 135                                 error "Unrecognized argument: ${key}"
 136                                 exit ${EXIT_ERROR}
 137                                 ;;
 138                 esac
 139         else
 140                 local action=${1}
 141                 shift
 142
 143                 case "${action}" in
 144                         new)
 145                                 ipsec_pool_new $@
 146                                 ;;
 147                         destroy)
 148                                 ipsec_pool_destroy $@
 149                                 ;;
 150                         ""|*)
 151                                 if [ -n "${action}" ]; then
 152                                         error "Unrecognized argument: '${action}'"
 153                                 fi
 154                                 exit ${EXIT_ERROR}
 155                                 ;;
 156                 esac
 157         fi
 158 }
 159
 160 cli_ipsec_connection_destroy() {
 161         local connection="${1}"
 162
 163         if ! ipsec_connection_destroy "${connection}"; then
 164                 return ${EXIT_ERROR}
 165         fi
 166
 167         # Inform strongswan about the changes
 168         ipsec_strongswan_load
 169
 170         # Configure strongswan autostart
 171         ipsec_strongswan_autostart
 172 }
 173
 174 cli_ipsec_connection_show() {
 175         local connection="${1}"
 176
 177         # Read the config settings
 178         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 179         if ! ipsec_connection_read_config "${connection}"; then
 180                 error "Could not read the connection configuration"
 181                 return ${EXIT_ERROR}
 182         fi
 183
 184         cli_headline 0 "IPsec VPN Connection: ${connection}"
 185         cli_space
 186
 187         # Peer
 188         if isset PEER; then
 189                 cli_print_fmt1 1 "Peer" "${PEER}"
 190         fi
 191
 192         # Security Policy
 193         cli_print_fmt1 1 "Security Policy" "${SECURITY_POLICY-${IPSEC_DEFAULT_SECURITY_POLICY}}"
 194         cli_space
 195
 196         cli_headline 2 "Authentication"
 197         case "${AUTH_MODE^^}" in
 198                 PSK)
 199                         cli_print_fmt1 2 "Mode" "Pre-Shared-Key"
 200
 201                         if isset PSK; then
 202                                 cli_print_fmt1 2 "Pre-Shared-Key" "****"
 203                         else
 204                                 cli_print_fmt1 2 "Pre-Shared-Key" "- is not set -"
 205                         fi
 206                         ;;
 207                 X509)
 208                         : # TODO
 209                         ;;
 210         esac
 211         cli_space
 212
 213         local i
 214         for i in LOCAL REMOTE; do
 215                 case "${i}" in
 216                         LOCAL)
 217                                 cli_headline 2 "Local"
 218                                 ;;
 219                         REMOTE)
 220                                 cli_headline 2 "Remote"
 221                                 ;;
 222                 esac
 223
 224                 local id_var="${i}_ID"
 225                 if [ -n "${!id_var}" ]; then
 226                         cli_print_fmt1 2 "ID" "${!id_var}"
 227                 fi
 228
 229                 local prefix_var="${i}_PREFIX"
 230                 if isset ${prefix_var}; then
 231                         cli_headline 3 "Prefix(es)"
 232
 233                         local prefix
 234                         for prefix in ${!prefix_var}; do
 235                                 cli_print_fmt1 3 "${prefix}"
 236                         done
 237                 fi
 238
 239                 cli_space
 240         done
 241
 242         cli_headline 2 "Misc."
 243
 244         case "${MODE}" in
 245                 gre-transport)
 246                         cli_print_fmt1 2 "Transport Mode" "GRE Transport"
 247                         ;;
 248                 tunnel)
 249                         cli_print_fmt1 2 "Transport Mode" "Tunnel"
 250                         ;;
 251                 vti)
 252                         cli_print_fmt1 2 "Transport Mode" "Virtual Tunnel Interface"
 253                         ;;
 254                 *)
 255                         cli_print_fmt1 2 "Transport Mode" "- Unknown -"
 256                         ;;
 257         esac
 258
 259         # Inactivity timeout
 260         if isset INACTIVITY_TIMEOUT && [ ${INACTIVITY_TIMEOUT} -gt 0 ]; then
 261                 cli_print_fmt1 2 "Inactivity Timeout" "$(format_time ${INACTIVITY_TIMEOUT})"
 262         fi
 263         cli_space
 264
 265         return ${EXIT_OK}
 266 }
 267
 268 ipsec_connection_disable() {
 269         local connection=${1}
 270
 271         if ! ipsec_connection_write_config_key "${connection}" "ENABLED" "false"; then
 272                 log ERROR "Could not write configuration settings"
 273                 return ${EXIT_ERROR}
 274         fi
 275
 276         # Configure strongswan autostart
 277         ipsec_strongswan_autostart
 278 }
 279
 280 ipsec_connection_enable() {
 281         local connection=${1}
 282
 283         if ! ipsec_connection_write_config_key "${connection}" "ENABLED" "true"; then
 284                 log ERROR "Could not write configuration settings"
 285                 return ${EXIT_ERROR}
 286         fi
 287
 288         # Configure strongswan autostart
 289         ipsec_strongswan_autostart
 290 }
 291
 292 # This function writes all values to a via ${connection} specificated VPN IPsec configuration file
 293 ipsec_connection_write_config() {
 294         assert [ $# -ge 1 ]
 295
 296         local connection="${1}"
 297
 298         if ! ipsec_connection_exists "${connection}"; then
 299                 log ERROR "No such VPN IPsec connection: ${connection}"
 300                 return ${EXIT_ERROR}
 301         fi
 302
 303         local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
 304
 305         if ! settings_write "${path}" ${IPSEC_CONNECTION_CONFIG_SETTINGS}; then
 306                 log ERROR "Could not write configuration settings for VPN IPsec connection ${connection}"
 307                 return ${EXIT_ERROR}
 308         fi
 309
 310         ipsec_reload ${connection}
 311 }
 312
 313 # This funtion writes the value for one key to a via ${connection} specificated VPN IPsec connection configuration file
 314 ipsec_connection_write_config_key() {
 315         assert [ $# -ge 3 ]
 316
 317         local connection=${1}
 318         local key=${2}
 319         shift 2
 320
 321         local value="$@"
 322
 323         if ! ipsec_connection_exists "${connection}"; then
 324                 log ERROR "No such VPN ipsec connection: ${connection}"
 325                 return ${EXIT_ERROR}
 326         fi
 327
 328         log DEBUG "Set '${key}' to new value '${value}' in VPN ipsec connection '${connection}'"
 329
 330         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 331
 332         # Read the config settings
 333         if ! ipsec_connection_read_config "${connection}"; then
 334                 return ${EXIT_ERROR}
 335         fi
 336
 337         # Set the key to a new value
 338         assign "${key}" "${value}"
 339
 340         if ! ipsec_connection_write_config "${connection}"; then
 341                 return ${EXIT_ERROR}
 342         fi
 343
 344         return ${EXIT_TRUE}
 345 }
 346
 347 # Reads one or more keys out of a settings file or all if no key is provided.
 348 ipsec_connection_read_config() {
 349         assert [ $# -ge 1 ]
 350
 351         local connection="${1}"
 352         shift 1
 353
 354         if ! ipsec_connection_exists "${connection}"; then
 355                 log ERROR "No such VPN IPsec connection : ${connection}"
 356                 return ${EXIT_ERROR}
 357         fi
 358
 359
 360         local args
 361         if [ $# -eq 0 ] && [ -n "${IPSEC_CONNECTION_CONFIG_SETTINGS}" ]; then
 362                 list_append args ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 363         else
 364                 list_append args $@
 365         fi
 366
 367         local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
 368
 369         if ! settings_read "${path}" ${args}; then
 370                 log ERROR "Could not read settings for VPN IPsec connection ${connection}"
 371                 return ${EXIT_ERROR}
 372         fi
 373 }
 374
 375 # This function checks if a vpn ipsec connection exists
 376 # Returns True when yes and false when not
 377 ipsec_connection_exists() {
 378         assert [ $# -eq 1 ]
 379
 380         local connection=${1}
 381
 382         local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}"
 383
 384         [ -d "${path}" ] && return ${EXIT_TRUE} || return ${EXIT_FALSE}
 385 }
 386
 387 # Determines if strongswan should be automatically started
 388 # when the system boots up.
 389 ipsec_strongswan_autostart() {
 390         local autostart_needed="false"
 391
 392         local connection
 393         for connection in $(ipsec_list_connections); do
 394                 local ENABLED
 395
 396                 if ! ipsec_connection_read_config "${connection}" "ENABLED"; then
 397                         log WARNING "Could not read configuation"
 398                         continue
 399                 fi
 400
 401                 if enabled ENABLED; then
 402                         autostart_needed="true"
 403                         break
 404                 fi
 405         done
 406
 407         # Start strongswan when we need it and when it is not yet enabled
 408         if ${autostart_needed}; then
 409                 if ! service_is_enabled "strongswan"; then
 410                         service_enable "strongswan"
 411                 fi
 412
 413                 if ! service_is_active "strongswan"; then
 414                         service_start "strongswan"
 415                 fi
 416
 417         # Disable strongswan when we do not need it but it is enabled
 418         elif ! ${autostart_needed}; then
 419                 if service_is_enabled "strongswan"; then
 420                         service_disable "strongswan"
 421                 fi
 422
 423                 if service_is_active "strongswan"; then
 424                         service_stop "strongswan"
 425                 fi
 426         fi
 427 }
 428
 429 ipsec_strongswan_load() {
 430         # Do nothing if strongswan is not running
 431         if ! service_is_active "strongswan"; then
 432                 return ${EXIT_OK}
 433         fi
 434
 435         if ! cmd swanctl --load-all; then
 436                 log ERROR "Could not reload strongswan config"
 437                 return ${EXIT_ERROR}
 438         fi
 439 }
 440
 441 # Reloads the connection after config changes
 442 ipsec_reload() {
 443         local connection=${1}
 444
 445         local ENABLED
 446
 447         if ! ipsec_connection_read_config "${connection}" "ENABLED"; then
 448                 log ERROR "Could not read configuration for IPsec connection ${connection}"
 449                 return ${EXIT_ERROR}
 450         fi
 451
 452         if enabled ENABLED; then
 453                 if ! ipsec_connection_to_strongswan ${connection}; then
 454                         log ERROR "Could not generate strongswan config for ${connnection}"
 455                         return ${EXIT_ERROR}
 456                 fi
 457         else
 458                 log DEBUG "Deleting strongswan config ${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf"
 459                 unlink "${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf"
 460         fi
 461
 462         ipsec_strongswan_load
 463 }
 464
 465 # Handle the cli after authentification
 466 ipsec_connection_authentication() {
 467         if [ ! $# -gt 1 ]; then
 468                 log ERROR "Not enough arguments"
 469                 return ${EXIT_ERROR}
 470         fi
 471
 472         local connection=${1}
 473         local cmd=${2}
 474         shift 2
 475
 476         case ${cmd} in
 477                 mode)
 478                         ipsec_connection_authentication_mode "${connection}" $@
 479                         ;;
 480                 pre-shared-key)
 481                         ipsec_connection_authentication_psk "${connection}" $@
 482                         ;;
 483                 *)
 484                         log ERROR "Unrecognized argument: ${cmd}"
 485                         return ${EXIT_ERROR}
 486                         ;;
 487         esac
 488 }
 489
 490 # Set the authentification mode
 491 ipsec_connection_authentication_mode() {
 492         if [ ! $# -eq 2 ]; then
 493                 log ERROR "Not enough arguments"
 494                 return ${EXIT_ERROR}
 495         fi
 496         local connection=${1}
 497         local mode=${2}
 498
 499         if ! isoneof mode ${IPSEC_VALID_AUTH_MODES}; then
 500                 log ERROR "Auth mode '${mode}' is invalid"
 501                 return ${EXIT_ERROR}
 502         fi
 503
 504         if ! ipsec_connection_write_config_key "${connection}" "AUTH_MODE" ${mode^^}; then
 505                 log ERROR "Could not write configuration settings"
 506                 return ${EXIT_ERROR}
 507         fi
 508 }
 509
 510 # Set the psk
 511 ipsec_connection_authentication_psk() {
 512         if [ ! $# -eq 2 ]; then
 513                 log ERROR "Not enough arguments"
 514                 return ${EXIT_ERROR}
 515         fi
 516
 517         local connection=${1}
 518         local psk=${2}
 519
 520         local length=${#psk}
 521
 522         if [ ${length} -lt 4 ]; then
 523                 error "The PSK must be longer than four characters"
 524                 return ${EXIT_ERROR}
 525         fi
 526
 527         if [ ${length} -gt 128 ]; then
 528                 error "The PSK cannot be longer than 128 characters"
 529                 return ${EXIT_ERROR}
 530         fi
 531
 532         if ! ipsec_connection_write_config_key "${connection}" "PSK" "${psk}"; then
 533                 log ERROR "Could not write configuration settings"
 534                 return ${EXIT_ERROR}
 535         fi
 536
 537         return ${EXIT_OK}
 538 }
 539
 540 ipsec_connection_up() {
 541         local connection="${1}"
 542
 543         if ! ipsec_connection_exists "${connection}"; then
 544                 error "No such VPN IPsec connection: ${connection}"
 545                 return ${EXIT_ERROR}
 546         fi
 547
 548         cmd swanctl --initiate --child "${connection}"
 549 }
 550
 551 ipsec_connection_down() {
 552         local connection="${1}"
 553
 554         if ! ipsec_connection_exists "${connection}"; then
 555                 error "No such VPN IPsec connection: ${connection}"
 556                 return ${EXIT_ERROR}
 557         fi
 558
 559         cmd swanctl --terminate --ike "${connection}"
 560 }
 561
 562 # Handle the cli after authentification
 563 ipsec_connection_dpd() {
 564         if [ ! $# -gt 1 ]; then
 565                 log ERROR "Not enough arguments"
 566                 return ${EXIT_ERROR}
 567         fi
 568
 569         local connection=${1}
 570         local cmd=${2}
 571         shift 2
 572
 573         case ${cmd} in
 574                 action)
 575                         ipsec_connection_dpd_action "${connection}" $@
 576                         ;;
 577                 delay)
 578                         ipsec_connection_dpd_delay "${connection}" $@
 579                         ;;
 580                 timeout)
 581                         ipsec_connection_dpd_timeout "${connection}" $@
 582                         ;;
 583                 *)
 584                         log ERROR "Unrecognized argument: ${cmd}"
 585                         return ${EXIT_ERROR}
 586                         ;;
 587         esac
 588 }
 589
 590 # Set the default dpd action
 591 ipsec_connection_dpd_action() {
 592         if [ ! $# -eq 2 ]; then
 593                 log ERROR "Not enough arguments"
 594                 return ${EXIT_ERROR}
 595         fi
 596         local connection=${1}
 597         local action=${2}
 598
 599         if ! isoneof action "restart" "clear"; then
 600                 log ERROR "dpd action '${action}' is invalid"
 601                 return ${EXIT_ERROR}
 602         fi
 603
 604         if ! ipsec_connection_write_config_key "${connection}" "DPD_ACTION" ${action}; then
 605                 log ERROR "Could not write configuration settings"
 606                 return ${EXIT_ERROR}
 607         fi
 608 }
 609
 610 # Set the dpd delay
 611 ipsec_connection_dpd_delay() {
 612         if [ ! $# -ge 2 ]; then
 613                 log ERROR "Not enough arguments"
 614                 return ${EXIT_ERROR}
 615         fi
 616
 617         local connection=${1}
 618         shift 1
 619         local value=$@
 620
 621         if ! isinteger value; then
 622                 value=$(parse_time $@)
 623                 if [ ! $? -eq 0 ]; then
 624                         log ERROR "Parsing the passed time was not sucessful please check the passed values."
 625                         return ${EXIT_ERROR}
 626                 fi
 627         fi
 628
 629         if [ ${value} -lt 0 ]; then
 630                 log ERROR "The passed time value must be in the sum greater or equal zero seconds."
 631                 return ${EXIT_ERROR}
 632         fi
 633
 634         if ! ipsec_connection_write_config_key "${connection}" "DPD_DELAY" ${value}; then
 635                 log ERROR "Could not write configuration settings"
 636                 return ${EXIT_ERROR}
 637         fi
 638
 639         return ${EXIT_OK}
 640 }
 641
 642 # Set the dpd timeout
 643 ipsec_connection_dpd_timeout() {
 644         if [ ! $# -ge 2 ]; then
 645                 log ERROR "Not enough arguments"
 646                 return ${EXIT_ERROR}
 647         fi
 648
 649         local connection=${1}
 650         shift 1
 651         local value=$@
 652
 653         if ! isinteger value; then
 654                 value=$(parse_time $@)
 655                 if [ ! $? -eq 0 ]; then
 656                         log ERROR "Parsing the passed time was not sucessful please check the passed values."
 657                         return ${EXIT_ERROR}
 658                 fi
 659         fi
 660
 661         if [ ${value} -le 0 ]; then
 662                 log ERROR "The passed time value must be in the sum greater or equal zero seconds."
 663                 return ${EXIT_ERROR}
 664         fi
 665
 666         if ! ipsec_connection_write_config_key "${connection}" "DPD_TIMEOUT" ${value}; then
 667                 log ERROR "Could not write configuration settings"
 668                 return ${EXIT_ERROR}
 669         fi
 670
 671         return ${EXIT_OK}
 672 }
 673
 674 # Handle the cli after local
 675 ipsec_connection_local() {
 676         if [ ! $# -ge 2 ]; then
 677                 log ERROR "Not enough arguments"
 678                 return ${EXIT_ERROR}
 679         fi
 680
 681         local connection=${1}
 682         local cmd=${2}
 683         shift 2
 684
 685         case ${cmd} in
 686                 address)
 687                         ipsec_connection_local_address "${connection}" $@
 688                         ;;
 689                 id)
 690                         ipsec_connection_id "${connection}" "LOCAL" $@
 691                         ;;
 692                 prefix)
 693                         ipsec_connection_prefix "${connection}" "LOCAL" $@
 694                         ;;
 695                 *)
 696                         log ERROR "Unrecognized argument: ${cmd}"
 697                         return ${EXIT_ERROR}
 698                         ;;
 699         esac
 700
 701         return ${EXIT_OK}
 702 }
 703
 704 # Set the connection mode
 705 ipsec_connection_mode() {
 706         if [ ! $# -eq 2 ]; then
 707                 log ERROR "Not enough arguments"
 708                 return ${EXIT_ERROR}
 709         fi
 710         local connection=${1}
 711         local mode=${2}
 712
 713         if ! isoneof mode ${IPSEC_VALID_MODES}; then
 714                 log ERROR "Mode '${mode}' is invalid"
 715                 return ${EXIT_ERROR}
 716         fi
 717
 718         if ! ipsec_connection_write_config_key "${connection}" "MODE" ${mode}; then
 719                 log ERROR "Could not write configuration settings"
 720                 return ${EXIT_ERROR}
 721         fi
 722
 723         return ${EXIT_OK}
 724 }
 725
 726 # Set the local address
 727 ipsec_connection_local_address() {
 728         if [ ! $# -eq 2 ]; then
 729                 log ERROR "Not enough arguments"
 730                 return ${EXIT_ERROR}
 731         fi
 732         local connection=${1}
 733         local local_address=${2}
 734
 735         if ! ipsec_connection_check_peer ${local_address}; then
 736                 log ERROR "Local address '${local_address}' is invalid"
 737                 return ${EXIT_ERROR}
 738         fi
 739
 740         if ! ipsec_connection_write_config_key "${connection}" "LOCAL_ADDRESS" ${local_address}; then
 741                 log ERROR "Could not write configuration settings"
 742                 return ${EXIT_ERROR}
 743         fi
 744
 745         return ${EXIT_OK}
 746 }
 747
 748 # Set the peer to connect to
 749 ipsec_connection_peer() {
 750         if [ ! $# -eq 2 ]; then
 751                 log ERROR "Not enough arguments"
 752                 return ${EXIT_ERROR}
 753         fi
 754         local connection=${1}
 755         local peer=${2}
 756
 757         if ! ipsec_connection_check_peer ${peer}; then
 758                 log ERROR "Peer '${peer}' is invalid"
 759                 return ${EXIT_ERROR}
 760         fi
 761
 762         if ! ipsec_connection_write_config_key "${connection}" "PEER" ${peer}; then
 763                 log ERROR "Could not write configuration settings"
 764                 return ${EXIT_ERROR}
 765         fi
 766
 767         return ${EXIT_OK}
 768 }
 769
 770 #Set the local or remote id
 771 ipsec_connection_id() {
 772         if [ ! $# -eq 3 ]; then
 773                 log ERROR "Not enough arguments"
 774                 return ${EXIT_ERROR}
 775         fi
 776         local connection=${1}
 777         local type=${2}
 778         local id=${3}
 779
 780         if ! ipsec_connection_check_id ${id}; then
 781                 log ERROR "Id '${id}' is invalid"
 782                 return ${EXIT_ERROR}
 783         fi
 784
 785         if ! ipsec_connection_write_config_key "${connection}" "${type}_ID" ${id}; then
 786                 log ERROR "Could not write configuration settings"
 787                 return ${EXIT_ERROR}
 788         fi
 789
 790         return ${EXIT_OK}
 791 }
 792
 793 # Set the local or remote prefix
 794 ipsec_connection_prefix() {
 795         if [ ! $# -ge 3 ]; then
 796                 log ERROR "Not enough arguments"
 797                 return ${EXIT_ERROR}
 798         fi
 799         local connection=${1}
 800         local type=${2}
 801         shift 2
 802
 803         local _prefix="${type}_PREFIX"
 804         local "${_prefix}"
 805         if ! ipsec_connection_read_config "${connection}" "${_prefix}"; then
 806                 return ${EXIT_ERROR}
 807         fi
 808
 809         # Remove duplicated entries to proceed the list safely
 810         assign "${_prefix}" "$(list_unique ${!_prefix} )"
 811
 812         local prefixes_added
 813         local prefixes_removed
 814         local prefixes_set
 815
 816         while [ $# -gt 0 ]; do
 817                 local arg="${1}"
 818
 819                 case "${arg}" in
 820                         +*)
 821                                 list_append prefixes_added "${arg:1}"
 822                                 ;;
 823                         -*)
 824                                 list_append prefixes_removed "${arg:1}"
 825                                 ;;
 826                         [A-Fa-f0-9]*)
 827                                 list_append prefixes_set "${arg}"
 828                                 ;;
 829                         *)
 830                                 error "Invalid argument: ${arg}"
 831                                 return ${EXIT_ERROR}
 832                                 ;;
 833                 esac
 834                 shift
 835         done
 836
 837         # Check if the user is trying a mixed operation
 838         if ! list_is_empty prefixes_set && (! list_is_empty prefixes_added || ! list_is_empty prefixes_removed); then
 839                 error "You cannot reset the prefix list and add or remove prefixes at the same time"
 840                 return ${EXIT_ERROR}
 841         fi
 842
 843         # Set new prefix list
 844         if ! list_is_empty prefixes_set; then
 845                 # Check if all prefixes are valid
 846                 local prefix
 847                 for prefix in ${prefixes_set}; do
 848                         if ! ip_net_is_valid ${prefix}; then
 849                                 error "Unsupported prefix: ${prefix}"
 850                                 return ${EXIT_ERROR}
 851                         fi
 852                 done
 853
 854                 assign "${_prefix}" "${prefixes_set}"
 855
 856         # Perform incremental updates
 857         else
 858                 local prefix
 859
 860                 # Perform all removals
 861                 for prefix in ${prefixes_removed}; do
 862                         if ! list_remove "${_prefix}" ${prefix}; then
 863                                 warning "${prefix} was not on the list and could not be removed"
 864                         fi
 865                 done
 866
 867
 868                 for prefix in ${prefixes_added}; do
 869                         if ip_net_is_valid ${prefix}; then
 870                                 if ! list_append_unique "${_prefix}" ${prefix}; then
 871                                         warning "${prefix} is already on the prefix list"
 872                                 fi
 873                         else
 874                                 warning "${prefix} is not a valid IP network and could not be added"
 875                         fi
 876                 done
 877         fi
 878
 879         # Check if the list contain at least one valid prefix
 880         if list_is_empty ${_prefix}; then
 881                 error "Cannot save an empty prefix list"
 882                 return ${EXIT_ERROR}
 883         fi
 884
 885         # Save everything
 886         if ! ipsec_connection_write_config_key "${connection}" "${_prefix}" ${!_prefix}; then
 887                 log ERROR "Could not write configuration settings"
 888         fi
 889
 890         return ${EXIT_OK}
 891 }
 892
 893 # Set the pools to use
 894 ipsec_connection_pool() {
 895         if [ ! $# -ge 2 ]; then
 896                 log ERROR "Not enough arguments"
 897                 return ${EXIT_ERROR}
 898         fi
 899         local connection=${1}
 900         shift
 901
 902         local POOLS
 903         if ! ipsec_connection_read_config "${connection}" "POOLS"; then
 904                 return ${EXIT_ERROR}
 905         fi
 906
 907         # Remove duplicated entries to proceed the list safely
 908         assign "POOLS" "$(list_unique ${POOLS})"
 909
 910         local pools_added
 911         local pools_removed
 912         local pools_set
 913
 914         while [ $# -gt 0 ]; do
 915                 local arg="${1}"
 916
 917                 case "${arg}" in
 918                         +*)
 919                                 list_append pools_added "${arg:1}"
 920                                 ;;
 921                         -*)
 922                                 list_append pools_removed "${arg:1}"
 923                                 ;;
 924                         [A-Za-z0-9]*)
 925                                 list_append pools_set "${arg}"
 926                                 ;;
 927                         *)
 928                                 error "Invalid argument: ${arg}"
 929                                 return ${EXIT_ERROR}
 930                                 ;;
 931                 esac
 932                 shift
 933         done
 934
 935         # Check if the user is trying a mixed operation
 936         if ! list_is_empty pools_set && (! list_is_empty pools_added || ! list_is_empty pools_removed); then
 937                 error "You cannot reset the pools list and add or remove pools at the same time"
 938                 return ${EXIT_ERROR}
 939         fi
 940
 941         # Set new pools list
 942         if ! list_is_empty pools_set; then
 943                 # Check if all pools are valid
 944                 local pool
 945                 for pool in ${pools_set}; do
 946                         if ! ipsec_pool_exists ${pool} || ! ipsec_pool_check_config ${pool}; then
 947                                 error "Pool ${pool} is not valid"
 948                                 return ${EXIT_ERROR}
 949                         fi
 950                 done
 951
 952                 assign "POOLS" "${pools_set}"
 953
 954         # Perform incremental updates
 955         else
 956                 local pool
 957
 958                 # Perform all removals
 959                 for pool in ${pools_removed}; do
 960                         if ! list_remove "POOLS" ${pool}; then
 961                                 warning "${pool} was not on the list and could not be removed"
 962                         fi
 963                 done
 964
 965
 966                 for pool in ${pools_added}; do
 967                         if ! ipsec_pool_exists ${pool} && ! ipsec_pool_check_config ${pool}; then
 968                                 if ! list_append_unique "POOLS" ${pool}; then
 969                                         warning "${pool} is already on the prefix list"
 970                                 fi
 971                         else
 972                                 warning "${pool} is not a valid pool"
 973                         fi
 974                 done
 975         fi
 976
 977         # Check if the list contain at least one valid pool
 978         if list_is_empty POOLS; then
 979                 error "Cannot save an empty pool list"
 980                 return ${EXIT_ERROR}
 981         fi
 982
 983         # Save everything
 984         if ! ipsec_connection_write_config_key "${connection}" "POOLS" ${POOLS}; then
 985                 log ERROR "Could not write configuration settings"
 986         fi
 987
 988         return ${EXIT_OK}
 989 }
 990
 991 # Handle the cli after remote
 992 ipsec_connection_remote() {
 993         if [ ! $# -ge 2 ]; then
 994                 log ERROR "Not enough arguments"
 995                 return ${EXIT_ERROR}
 996         fi
 997
 998         local connection=${1}
 999         local cmd=${2}
1000         shift 2
1001
1002         case ${cmd} in
1003                 id)
1004                         ipsec_connection_id "${connection}" "REMOTE" $@
1005                         ;;
1006
1007                 prefix)
1008                         ipsec_connection_prefix "${connection}" "REMOTE" $@
1009                         ;;
1010                 *)
1011                         log ERROR "Unrecognized argument: ${cmd}"
1012                         return ${EXIT_ERROR}
1013                         ;;
1014         esac
1015
1016         return ${EXIT_OK}
1017 }
1018
1019 # Set the inactivity timeout
1020 ipsec_connection_inactivity_timeout() {
1021         if [ ! $# -ge 2 ]; then
1022                 log ERROR "Not enough arguments"
1023                 return ${EXIT_ERROR}
1024         fi
1025
1026         local connection=${1}
1027         shift 1
1028         local value=$@
1029
1030         if ! isinteger value; then
1031                 value=$(parse_time $@)
1032                 if [ ! $? -eq 0 ]; then
1033                         log ERROR "Parsing the passed time was not sucessful please check the passed values."
1034                         return ${EXIT_ERROR}
1035                 fi
1036         fi
1037
1038         if [ ${value} -le 0 ]; then
1039                 log ERROR "The passed time value must be in the sum greater zero seconds."
1040                 return ${EXIT_ERROR}
1041         fi
1042
1043         if ! ipsec_connection_write_config_key "${connection}" "INACTIVITY_TIMEOUT" ${value}; then
1044                 log ERROR "Could not write configuration settings"
1045                 return ${EXIT_ERROR}
1046         fi
1047
1048         return ${EXIT_OK}
1049 }
1050
1051 # Set the default start action
1052 ipsec_connection_start_action() {
1053         if [ ! $# -eq 2 ]; then
1054                 log ERROR "Not enough arguments"
1055                 return ${EXIT_ERROR}
1056         fi
1057         local connection=${1}
1058         local action=${2}
1059
1060         if ! isoneof action "on-demand" "always-on"; then
1061                 log ERROR "Start action '${action}' is invalid"
1062                 return ${EXIT_ERROR}
1063         fi
1064
1065         if ! ipsec_connection_write_config_key "${connection}" "START_ACTION" ${action}; then
1066                 log ERROR "Could not write configuration settings"
1067                 return ${EXIT_ERROR}
1068         fi
1069 }
1070
1071 # Set the security policy to use
1072 ipsec_connection_security_policy() {
1073         if [ ! $# -eq 2 ]; then
1074                 log ERROR "Not enough arguments"
1075                 return ${EXIT_ERROR}
1076         fi
1077         local connection=${1}
1078         local security_policy=${2}
1079
1080         if ! vpn_security_policy_exists ${security_policy}; then
1081                 log ERROR "No such vpn security policy '${security_policy}'"
1082                 return ${EXIT_ERROR}
1083         fi
1084
1085         if ! ipsec_connection_write_config_key "${connection}" "SECURITY_POLICY" ${security_policy}; then
1086                 log ERROR "Could not write configuration settings"
1087                 return ${EXIT_ERROR}
1088         fi
1089 }
1090
1091 # Check if a id is valid
1092 ipsec_connection_check_id() {
1093         assert [ $# -eq 1 ]
1094         local id=${1}
1095
1096         if [[ ${id} =~ ^@[[:alnum:]]+$ ]] || ip_is_valid ${id}; then
1097                 return ${EXIT_TRUE}
1098         else
1099                 return ${EXIT_FALSE}
1100         fi
1101 }
1102
1103 # Checks if a peer is valid
1104 ipsec_connection_check_peer() {
1105         assert [ $# -eq 1 ]
1106         local peer=${1}
1107
1108         # TODO Accept also FQDNs
1109         if ip_is_valid ${peer}; then
1110                 return ${EXIT_TRUE}
1111         else
1112                 return ${EXIT_FALSE}
1113         fi
1114 }
1115
1116 # This function checks if a VPN IPsec connection name is valid
1117 # Allowed are only A-Za-z0-9
1118 ipsec_connection_check_name() {
1119         assert [ $# -eq 1 ]
1120
1121         local connection=${1}
1122
1123         [[ "${connection}" =~ [^[:alnum:]$] ]]
1124 }
1125
1126 # Function that creates one VPN IPsec connection
1127 ipsec_connection_new() {
1128         if [ $# -gt 1 ]; then
1129                 error "Too many arguments"
1130                 return ${EXIT_ERROR}
1131         fi
1132
1133         local connection="${1}"
1134         if ! isset connection; then
1135                 error "Please provide a connection name"
1136                 return ${EXIT_ERROR}
1137         fi
1138
1139         # Check for duplicates
1140         if ipsec_connection_exists "${connection}"; then
1141                 error "The VPN IPsec connection ${connection} already exists"
1142                 return ${EXIT_ERROR}
1143         fi
1144
1145         # Check if the name of the connection is valid
1146         if  ipsec_connection_check_name "${connection}"; then
1147                 error "'${connection}' contains illegal characters"
1148                 return ${EXIT_ERROR}
1149         fi
1150
1151         log DEBUG "Creating VPN IPsec connection ${connection}"
1152
1153         if ! mkdir -p "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
1154                 log ERROR "Could not create config directory for ${connection}"
1155                 return ${EXIT_ERROR}
1156         fi
1157
1158         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
1159
1160         AUTH_MODE=${IPSEC_DEFAULT_AUTH_MODE}
1161         DPD_ACTION=${IPSEC_DEFAULT_DPD_ACTION}
1162         DPD_DELAY=${IPSEC_DEFAULT_DPD_DELAY}
1163         DPD_TIMEOUT=${IPSEC_DEFAULT_DPD_TIMEOUT}
1164         ENABLED=${IPSEC_DEFAULT_ENABLED}
1165         MODE=${IPSEC_DEFAULT_MODE}
1166         START_ACTION=${IPSEC_DEFAULT_START_ACTION}
1167
1168         INACTIVITY_TIMEOUT=${IPSEC_DEFAULT_INACTIVITY_TIMEOUT}
1169         SECURITY_POLICY=${IPSEC_DEFAULT_SECURITY_POLICY}
1170
1171         if ! ipsec_connection_write_config "${connection}"; then
1172                 log ERROR "Could not write new config file"
1173                 return ${EXIT_ERROR}
1174         fi
1175
1176         # Configure strongswan autostart
1177         ipsec_strongswan_autostart
1178 }
1179
1180 # Function that deletes based on the passed parameters one ore more vpn security policies
1181 ipsec_connection_destroy() {
1182         local connection
1183         for connection in $@; do
1184                 if ! ipsec_connection_exists "${connection}"; then
1185                         log ERROR "The VPN IPsec connection ${connection} does not exist."
1186                         continue
1187                 fi
1188
1189                 log DEBUG "Deleting VPN IPsec connection ${connection}"
1190
1191                 # Delete strongswan configuration file
1192                 file_delete "${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf"
1193
1194                 if ! rm -rf "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
1195                         log ERROR "Deleting the VPN IPsec connection ${connection} was not sucessful"
1196                         return ${EXIT_ERROR}
1197                 fi
1198
1199         done
1200 }
1201
1202 # List all ipsec connections
1203 ipsec_list_connections() {
1204         local connection
1205         for connection in ${NETWORK_IPSEC_CONNS_DIR}/*; do
1206                 [ -d ${connection} ] || continue
1207                 basename ${connection}
1208         done
1209 }
1210
1211 ipsec_connection_to_strongswan() {
1212         local connection="${1}"
1213         log DEBUG "Generating IPsec configuration for ${connection}"
1214
1215         # Read the config settings
1216         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
1217         if ! ipsec_connection_read_config "${connection}"; then
1218                 error "Could not read the connection ${connection}"
1219                 return ${EXIT_ERROR}
1220         fi
1221
1222         local path="${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf"
1223
1224         (
1225                 # Write the connection section
1226                 _ipsec_connection_to_strongswan_connection "${connection}"
1227
1228                 # Write the secrets section
1229                 _ipsec_connection_to_strongswan_secrets "${connection}"
1230
1231         ) > ${path}
1232 }
1233
1234 _ipsec_connection_to_strongswan_connection() {
1235         local connection="${1}"
1236
1237         # Read the security policy
1238         local ${VPN_SECURITY_POLICIES_CONFIG_SETTINGS}
1239         if ! vpn_security_policies_read_config "${SECURITY_POLICY}"; then
1240                 return ${EXIT_ERROR}
1241         fi
1242
1243         # Is DPD enabled?
1244         local dpd="false"
1245         if isset DPD_DELAY && isinteger DPD_DELAY && [ ${DPD_DELAY} -gt 0 ]; then
1246                 dpd="true"
1247         fi
1248
1249         # Write configuration header
1250         config_header "strongSwan configuration for ${connection}"
1251
1252         print_indent 0 "connections {"
1253         print_indent 1 "${connection} {"
1254
1255         # IKE Version
1256         print_indent 2 "# IKE Version"
1257         case "${KEY_EXCHANGE^^}" in
1258                 IKEV1)
1259                         print_indent 2 "version = 1"
1260                         ;;
1261
1262                 # Fall back to IKEv2 for any random values
1263                 IKEV2|*)
1264                         print_indent 2 "version = 2"
1265                         ;;
1266         esac
1267         print # empty line
1268
1269         # Always only keep one connection open at a time
1270         print_indent 2 "# Unique IDs"
1271         print_indent 2 "unique = replace"
1272         print
1273
1274         # Local Address
1275         print_indent 2 "# Local Address"
1276         if isset LOCAL_ADDRESS; then
1277                 print_indent 2 "local_addrs = ${LOCAL_ADDRESS}"
1278         else
1279                 print_indent 2 "local_addrs = %any"
1280         fi
1281         print
1282
1283         # Remote Address
1284         print_indent 2 "# Remote Address"
1285         if isset PEER; then
1286                 print_indent 2 "remote_addrs = ${PEER}"
1287         else
1288                 print_indent 2 "remote_addrs = %any"
1289         fi
1290         print
1291
1292         # IKE Proposals
1293         print_indent 2 "# IKE Proposals"
1294         print_indent 2 "proposals = $(vpn_security_policies_make_ike_proposal ${SECURITY_POLICY})"
1295         print
1296
1297         # DPD Settings
1298         if enabled dpd; then
1299                 print_indent 2 "# Dead Peer Detection"
1300                 print_indent 2 "dpd_delay = ${DPD_DELAY}"
1301
1302                 if isset DPD_TIMEOUT; then
1303                         print_indent 2 "dpd_timeout = ${DPD_TIMEOUT}"
1304                 fi
1305
1306                 print
1307         fi
1308
1309         # Fragmentation
1310         print_indent 2 "# Fragmentation"
1311         print_indent 2 "fragmentation = yes"
1312         print
1313
1314         # Pools
1315         if isset POOLS; then
1316                 print_indent 2 "# Pools"
1317                 print_indent 2 "pools = $(list_join POOLS ", ")"
1318                 print
1319         fi
1320
1321         # Local
1322         print_indent 2 "local {"
1323
1324         # Local ID
1325         if isset LOCAL_ID; then
1326                 print_indent 3 "id = ${LOCAL_ID}"
1327         fi
1328
1329         # Authentication
1330         case "${AUTH_MODE}" in
1331                 PSK)
1332                         print_indent 3 "auth = psk"
1333                         ;;
1334         esac
1335
1336         print_indent 2 "}"
1337         print
1338
1339         # Remote
1340         print_indent 2 "remote {"
1341
1342         # Remote ID
1343         if isset REMOTE_ID; then
1344                 print_indent 3 "id = ${REMOTE_ID}"
1345         fi
1346
1347         # Authentication
1348         case "${AUTH_MODE}" in
1349                 PSK)
1350                         print_indent 3 "auth = psk"
1351                         ;;
1352         esac
1353
1354         print_indent 2 "}"
1355         print
1356
1357         # Children
1358
1359         print_indent 2 "children {"
1360         print_indent 3 "${connection} {"
1361
1362         print_indent 4 "# ESP Proposals"
1363         print_indent 4 "esp_proposals = $(vpn_security_policies_make_esp_proposal ${SECURITY_POLICY})"
1364         print
1365
1366         # Traffic Selectors
1367
1368         case "${MODE}" in
1369                 gre-*)
1370                         print_indent 4 "local_ts = dynamic[gre]"
1371                         print_indent 4 "remote_ts = dynamic[gre]"
1372                         ;;
1373                 *)
1374                         # Local Prefixes
1375                         if isset LOCAL_PREFIX; then
1376                                 print_indent 4 "local_ts = $(list_join LOCAL_PREFIX ,)"
1377                         else
1378                                 print_indent 4 "local_ts = dynamic"
1379                         fi
1380
1381                         # Remote Prefixes
1382                         if isset REMOTE_PREFIX; then
1383                                 print_indent 4 "remote_ts = $(list_join REMOTE_PREFIX ,)"
1384                         else
1385                                 print_indent 4 "remote_ts = dynamic"
1386                         fi
1387                         ;;
1388         esac
1389         print
1390
1391         # Netfilter Marks
1392         case "${MODE}" in
1393                 vti)
1394                         print_indent 4 "# Netfilter Marks"
1395                         print_indent 4 "mark_in = %unique"
1396                         print_indent 4 "mark_out = %unique"
1397                         print
1398                         ;;
1399         esac
1400
1401         # Dead Peer Detection
1402         if enabled dpd; then
1403                 print_indent 4 "# Dead Peer Detection"
1404                 print_indent 4 "dpd_action = ${DPD_ACTION}"
1405                 print
1406         fi
1407
1408         # Rekeying
1409         if isset LIFETIME; then
1410                 print_indent 4 "# Rekey Time"
1411                 print_indent 4 "rekey_time = ${LIFETIME}"
1412                 print
1413         fi
1414
1415         # Updown Script
1416         print_indent 4 "updown = ${NETWORK_HELPERS_DIR}/ipsec-updown"
1417         print
1418
1419         # Mode
1420         print_indent 4 "# Mode"
1421         case "${MODE}" in
1422                 gre-transport)
1423                         print_indent 4 "mode = transport"
1424                         ;;
1425                 tunnel|vti|*)
1426                         print_indent 4 "mode = tunnel"
1427                         ;;
1428         esac
1429         print
1430
1431         # Compression
1432         print_indent 4 "# Compression"
1433         if enabled COMPRESSION; then
1434                 print_indent 4 "ipcomp = yes"
1435         else
1436                 print_indent 4 "ipcomp = no"
1437         fi
1438         print
1439
1440         # Inactivity Timeout
1441         if isset INACTIVITY_TIMEOUT; then
1442                 print_indent 4 "# Inactivity Timeout"
1443                 print_indent 4 "inactivity = ${INACTIVITY_TIMEOUT}"
1444                 print
1445         fi
1446
1447         # Start Action
1448         print_indent 4 "# Start Action"
1449         case "${START_ACTION}" in
1450                 on-demand)
1451                         print_indent 4 "start_action = trap"
1452                         print_indent 4 "close_action = trap"
1453                         ;;
1454                 wait)
1455                         print_indent 4 "start_action = none"
1456                         print_indent 4 "close_action = none"
1457                         ;;
1458                 always-on|*)
1459                         print_indent 4 "start_action = start"
1460                         print_indent 4 "close_action = start"
1461                         ;;
1462         esac
1463         print
1464
1465         print_indent 3 "}"
1466         print_indent 2 "}"
1467         print
1468
1469         print_indent 1 "}"
1470         print_indent 0 "}"
1471         print
1472 }
1473
1474 _ipsec_connection_to_strongswan_secrets() {
1475         local connection="${1}"
1476
1477         print_indent 0 "secrets {"
1478
1479         case "${AUTH_MODE}" in
1480                 PSK)
1481                         print_indent 1 "ike {"
1482
1483                         # Secret
1484                         print_indent 2 "secret = ${PSK}"
1485
1486                         # ID
1487                         if isset REMOTE_ID; then
1488                                 print_indent 2 "id = ${REMOTE_ID}"
1489                         fi
1490
1491                         print_indent 1 "}"
1492                         ;;
1493         esac
1494
1495         print_indent 0 "}"
1496 }
1497
1498 # This function writes all values to a via ${pool} specificated VPN IPsec pool configuration file
1499 ipsec_pool_write_config() {
1500         assert [ $# -ge 1 ]
1501
1502         local pool="${1}"
1503
1504         if ! ipsec_pool_exists "${pool}"; then
1505                 log ERROR "No such VPN IPsec pool: ${pool}"
1506                 return ${EXIT_ERROR}
1507         fi
1508
1509         local path="${NETWORK_IPSEC_POOLS_DIR}/${pool}/settings"
1510
1511         if ! settings_write "${path}" ${IPSEC_POOL_CONFIG_SETTINGS}; then
1512                 log ERROR "Could not write configuration settings for VPN IPsec pool ${pool}"
1513                 return ${EXIT_ERROR}
1514         fi
1515
1516         if ! ipsec_pool_reload ${pool}; then
1517                 log WARNING "Could not reload IPsec pool ${pool}"
1518         fi
1519
1520         # When we get here the writing of the config file was successful
1521         return ${EXIT_OK}
1522 }
1523
1524 # This funtion writes the value for one key to a via ${connection} specificated
1525 # VPN IPsec pool configuration file
1526 ipsec_pool_write_config_key() {
1527         assert [ $# -ge 3 ]
1528
1529         local pool=${1}
1530         local key=${2}
1531         shift 2
1532
1533         local value="$@"
1534
1535         if ! ipsec_pool_exists "${pool}"; then
1536                 log ERROR "No such VPN IPsec pool: ${pool}"
1537                 return ${EXIT_ERROR}
1538         fi
1539
1540         log DEBUG "Set '${key}' to new value '${value}' in VPN IPsec pool '${pool}'"
1541
1542         local ${IPSEC_POOL_CONFIG_SETTINGS}
1543
1544         # Read the config settings
1545         if ! ipsec_pool_read_config "${pool}"; then
1546                 return ${EXIT_ERROR}
1547         fi
1548
1549         # Set the key to a new value
1550         assign "${key}" "${value}"
1551
1552         if ! ipsec_pool_write_config "${pool}"; then
1553                 return ${EXIT_ERROR}
1554         fi
1555
1556         return ${EXIT_TRUE}
1557 }
1558
1559 # Reads one or more keys out of a settings file or all if no key is provided.
1560 ipsec_pool_read_config() {
1561         assert [ $# -ge 1 ]
1562
1563         local pool="${1}"
1564         shift 1
1565
1566         if ! ipsec_pool_exists "${pool}"; then
1567                 log ERROR "No such VPN IPsec pool : ${pool}"
1568                 return ${EXIT_ERROR}
1569         fi
1570
1571         local args
1572         if [ $# -eq 0 ] && [ -n "${IPSEC_POOL_CONFIG_SETTINGS}" ]; then
1573                 list_append args ${IPSEC_POOL_CONFIG_SETTINGS}
1574         else
1575                 list_append args $@
1576         fi
1577
1578         local path="${NETWORK_IPSEC_POOLS_DIR}/${pool}/settings"
1579
1580         if ! settings_read "${path}" ${args}; then
1581                 log ERROR "Could not read settings for VPN IPsec pool ${pool}"
1582                 return ${EXIT_ERROR}
1583         fi
1584 }
1585
1586 # This function checks if a vpn IPsec pool exists
1587 # Returns True when yes and false when not
1588 ipsec_pool_exists() {
1589         assert [ $# -eq 1 ]
1590
1591         local pool=${1}
1592
1593         local path="${NETWORK_IPSEC_POOLS_DIR}/${pool}"
1594
1595         [ -d "${path}" ] && return ${EXIT_TRUE} || return ${EXIT_FALSE}
1596 }
1597
1598 # This function checks if a VPN IPsec pool name is valid
1599 # Allowed are only A-Za-z0-9
1600 ipsec_pool_check_name() {
1601         assert [ $# -eq 1 ]
1602
1603         local pool=${1}
1604
1605         # These are special words in strongswan
1606         if isoneof pool dhcp radius; then
1607                 return ${EXIT_ERROR}
1608         fi
1609
1610         [[ "${pool}" =~ [^[:alnum:]$] ]]
1611 }
1612
1613 ipsec_pool_new() {
1614         if [ $# -gt 1 ]; then
1615                 error "Too many arguments"
1616                 return ${EXIT_ERROR}
1617         fi
1618
1619         local pool="${1}"
1620         if ! isset pool; then
1621                 error "Please provide a pool name"
1622                 return ${EXIT_ERROR}
1623         fi
1624
1625         # Check for duplicates
1626         if ipsec_pool_exists "${pool}"; then
1627                 error "The VPN IPsec pool ${pool} already exists"
1628                 return ${EXIT_ERROR}
1629         fi
1630
1631         # Check if the name of the connection is valid
1632         if  ipsec_pool_check_name "${pool}"; then
1633                 error "'${pool}' contains illegal characters"
1634                 return ${EXIT_ERROR}
1635         fi
1636
1637         log DEBUG "Creating VPN IPsec pool ${pool}"
1638
1639         if ! mkdir -p "${NETWORK_IPSEC_POOLS_DIR}/${pool}"; then
1640                 log ERROR "Could not create config directory for ${pool}"
1641                 return ${EXIT_ERROR}
1642         fi
1643
1644         local ${IPSEC_POOL_CONFIG_SETTINGS}
1645
1646         if ! ipsec_pool_write_config "${pool}"; then
1647                 log ERROR "Could not write new config file"
1648                 return ${EXIT_ERROR}
1649         fi
1650 }
1651
1652 # Function that deletes based on the passed parameters
1653 # one ore more vpn ipsec pools
1654 ipsec_pool_destroy() {
1655         local pool
1656         for pool in $@; do
1657                 if ! ipsec_pool_exists "${pool}"; then
1658                         log ERROR "The VPN IPsec pool ${pool} does not exist."
1659                         continue
1660                 fi
1661
1662                 log DEBUG "Deleting VPN IPsec pool ${pool}"
1663
1664                 if ! rm -rf "${NETWORK_IPSEC_POOLS_DIR}/${pool}"; then
1665                         log ERROR "Deleting the VPN IPsec pool ${pool} was not sucessful"
1666                         return ${EXIT_ERROR}
1667                 fi
1668         done
1669 }
1670
1671 ipsec_pool_set_type() {
1672         local pool=${1}
1673         local ip=${2}
1674         assert isset pool
1675         assert isset ip
1676
1677         local type=$(ip_detect_protocol ${ip})
1678
1679         if ! isset type; then
1680                 error "Cannot detect IP protocol of ${ip}"
1681                 return ${EXIT_ERROR}
1682         else
1683                 log DEBUG "IP protocol of ${ip} is ${type}"
1684                 if ! ipsec_pool_write_config_key "${pool}" "TYPE" ${type}; then
1685                         log ERROR "Could not write configuration settings"
1686                         return ${EXIT_ERROR}
1687                 fi
1688         fi
1689 }
1690
1691 ipsec_pool_network() {
1692         if [ ! $# -eq 2 ]; then
1693                 log ERROR "Not enough arguments"
1694                 return ${EXIT_ERROR}
1695         fi
1696         local pool=${1}
1697         local network=${2}
1698
1699         local TYPE
1700         if ! ipsec_pool_read_config ${pool} "TYPE"; then
1701                 error "Failed to read configuration settings for pool '${pool}'"
1702                 return ${EXIT_ERROR}
1703         fi
1704
1705         if ! isset TYPE; then
1706                 if ! ip_net_is_valid ${network}; then
1707                         log ERROR "Network '${network}' is invalid"
1708                         return ${EXIT_ERROR}
1709                 fi
1710
1711                 if ! ipsec_pool_set_type ${pool} ${network}; then
1712                         log ERROR "Could not set type for IPsec pool ${pool}"
1713                         return ${EXIT_ERROR}
1714                 fi
1715         else
1716                 if ! ${TYPE}_net_is_valid ${network}; then
1717                         log ERROR "Network '${network}' is invalid"
1718                         return ${EXIT_ERROR}
1719                 fi
1720         fi
1721
1722         if ! ipsec_pool_write_config_key "${pool}" "NETWORK" ${network}; then
1723                 log ERROR "Could not write configuration settings"
1724                 return ${EXIT_ERROR}
1725         fi
1726 }
1727
1728 ipsec_pool_dns_server() {
1729         if [ ! $# -eq 2 ]; then
1730                 log ERROR "Not enough arguments"
1731                 return ${EXIT_ERROR}
1732         fi
1733         local pool=${1}
1734         local dns_server=${2}
1735
1736         local TYPE
1737         if ! ipsec_pool_read_config ${pool} "TYPE"; then
1738                 error "Failed to read configuration settings for pool '${pool}'"
1739                 return ${EXIT_ERROR}
1740         fi
1741
1742         if ! isset TYPE; then
1743                 if ! ip_is_valid ${dns_server}; then
1744                         log ERROR "DNS server '${dns_server}' is invalid"
1745                         return ${EXIT_ERROR}
1746                 fi
1747
1748                 if ! ipsec_pool_set_type ${pool} ${dns_server}; then
1749                         log ERROR "Could not set type for IPsec pool ${pool}"
1750                         return ${EXIT_ERROR}
1751                 fi
1752         else
1753                 if ! ${TYPE}_is_valid ${dns_server}; then
1754                         log ERROR "DNS server '${dns_server}' is invalid"
1755                         return ${EXIT_ERROR}
1756                 fi
1757         fi
1758
1759         if ! ipsec_pool_write_config_key "${pool}" "DNS_SERVER" ${dns_server}; then
1760                 log ERROR "Could not write configuration settings"
1761                 return ${EXIT_ERROR}
1762         fi
1763 }
1764
1765 ipsec_pool_check_config() {
1766         local pool=${1}
1767         assert isset pool
1768
1769         local ${IPSEC_POOL_CONFIG_SETTINGS}
1770         if ! ipsec_pool_read_config "${pool}"; then
1771                 log ERROR "Could not read configuration settings"
1772                 return ${EXIT_ERROR}
1773         fi
1774
1775         if ! isset NETWORK; then
1776                 log ERROR "Network for IPSec pool ${pool} is not set"
1777                 return ${EXIT_ERROR}
1778         fi
1779
1780         if ! isset TYPE; then
1781                 TYPE=$(ip_detect_protocol ${NETWORK})
1782                 log DEBUG "IP protocol of ${NETWORK} is ${TYPE}"
1783                 if ! isset TYPE; then
1784                         error "Cannot detect IP protocol of ${NETWORK}"
1785                         return ${EXIT_ERROR}
1786                 else
1787                         if ! ipsec_pool_write_config_key "${pool}" "TYPE" ${TYPE}; then
1788                                 log ERROR "Could not write configuration settings"
1789                                 return ${EXIT_ERROR}
1790                         fi
1791                 fi
1792         else
1793                 if ! ${TYPE}_net_is_valid ${NETWORK}; then
1794                         log ERROR "NETWORK '${NETWORK}' is invalid"
1795                         return ${EXIT_ERROR}
1796                 fi
1797
1798                 if isset DNS_SERVER && ! ${TYPE}_is_valid ${DNS_SERVER}; then
1799                         log ERROR "DNS server '${DNS_SERVER}' is invalid"
1800                         return ${EXIT_ERROR}
1801                 fi
1802         fi
1803
1804         return ${EXIT_OK}
1805 }
1806
1807 ipsec_pool_reload() {
1808         local pool=${1}
1809
1810         if ! ipsec_pool_to_strongswan ${pool}; then
1811                 log ERROR "Could not generate strongswan config for ${pool}"
1812                 return ${EXIT_ERROR}
1813         fi
1814
1815         ipsec_strongswan_load
1816 }
1817
1818 ipsec_pool_to_strongswan() {
1819         local pool=${1}
1820
1821         log DEBUG "Generating IPsec pool config for ${pool}"
1822
1823         local ${IPSEC_POOL_CONFIG_SETTINGS}
1824         if ! ipsec_pool_read_config "${pool}"; then
1825                 return ${EXIT_ERROR}
1826         fi
1827
1828         if isset NETWORK && ! ipsec_pool_check_config "${pool}"; then
1829                 log ERROR "Configuration of ${pool} seems to be invalid"
1830                 return ${EXIT_ERROR}
1831         fi
1832
1833         local path="${NETWORK_IPSEC_SWANCTL_POOLS_DIR}/${pool}.conf"
1834
1835         (
1836                 config_header "strongSwan pool configuration"
1837
1838                 if isset NETWORK; then
1839                         print_indent 0 "pools {"
1840
1841                         print_indent 1 "${pool} {"
1842                         print_indent 2 "addrs = ${NETWORK}"
1843
1844                         if isset DNS_SERVER; then
1845                                 print_indent 2 "dns = ${DNS_SERVER}"
1846                         fi
1847
1848                         print_indent 1 "}"
1849                         print_indent 0 "}"
1850                 fi
1851         ) > ${path}
1852 }