src/functions/functions.ipsec

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2017  IPFire Network Development Team                         #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 IPSEC_CONNECTION_CONFIG_SETTINGS="\
  23         AUTH_MODE \
  24         DPD_ACTION \
  25         DPD_DELAY \
  26         DPD_TIMEOUT \
  27         INACTIVITY_TIMEOUT \
  28         LOCAL_ADDRESS \
  29         LOCAL_ID \
  30         LOCAL_PREFIX \
  31         MODE \
  32         PEER \
  33         PSK \
  34         REMOTE_ID \
  35         REMOTE_PREFIX \
  36         SECURITY_POLICY \
  37         ENABLED"
  38
  39 # Default values
  40 IPSEC_DEFAULT_AUTH_MODE="PSK"
  41 IPSEC_DEFAULT_DPD_ACTION="restart"
  42 IPSEC_DEFAULT_DPD_DELAY="30"
  43 IPSEC_DEFAULT_DPD_TIMEOUT="120"
  44 IPSEC_DEFAULT_ENABLED="true"
  45 IPSEC_DEFAULT_INACTIVITY_TIMEOUT="0"
  46 IPSEC_DEFAULT_MODE="tunnel"
  47 IPSEC_DEFAULT_SECURITY_POLICY="system"
  48 IPSEC_DEFAULT_START_ACTION="on-demand"
  49
  50 IPSEC_VALID_MODES="gre-transport tunnel vti"
  51 IPSEC_VALID_AUTH_MODES="PSK"
  52
  53 cli_ipsec() {
  54         local action=${1}
  55         shift 1
  56
  57         case "${action}" in
  58                 connection)
  59                         cli_ipsec_connection $@
  60                         ;;
  61                 *)
  62                         error "Unrecognized argument: ${action}"
  63                         exit ${EXIT_ERROR}
  64                         ;;
  65         esac
  66 }
  67
  68 cli_ipsec_connection() {
  69         if ipsec_connection_exists ${1}; then
  70                 local connection=${1}
  71                 local key=${2}
  72                 key=${key//-/_}
  73                 shift 2
  74
  75                 case "${key}" in
  76                         authentication|down|disable|dpd|enable|inactivity_timeout|local|mode|peer|remote|security_policy|start_action|up)
  77                                 ipsec_connection_${key} ${connection} $@
  78                                 ;;
  79                         show)
  80                                 cli_ipsec_connection_show "${connection}"
  81                                 exit $?
  82                                 ;;
  83                         *)
  84                                 error "Unrecognized argument: ${key}"
  85                                 exit ${EXIT_ERROR}
  86                                 ;;
  87                 esac
  88         else
  89                 local action=${1}
  90                 shift
  91
  92                 case "${action}" in
  93                         new)
  94                                 ipsec_connection_new $@
  95                                 ;;
  96                         destroy)
  97                                 ipsec_connection_destroy $@
  98                                 ;;
  99                         ""|*)
 100                                 if [ -n "${action}" ]; then
 101                                         error "Unrecognized argument: '${action}'"
 102                                 fi
 103                                 exit ${EXIT_ERROR}
 104                                 ;;
 105                 esac
 106         fi
 107 }
 108
 109 cli_ipsec_connection_show() {
 110         local connection="${1}"
 111
 112         # Read the config settings
 113         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 114         if ! ipsec_connection_read_config "${connection}"; then
 115                 error "Could not read the connection configuration"
 116                 return ${EXIT_ERROR}
 117         fi
 118
 119         cli_headline 0 "IPsec VPN Connection: ${connection}"
 120         cli_space
 121
 122         # Peer
 123         if isset PEER; then
 124                 cli_print_fmt1 1 "Peer" "${PEER}"
 125         fi
 126
 127         # Security Policy
 128         cli_print_fmt1 1 "Security Policy" "${SECURITY_POLICY-${IPSEC_DEFAULT_SECURITY_POLICY}}"
 129         cli_space
 130
 131         cli_headline 2 "Authentication"
 132         case "${AUTH_MODE^^}" in
 133                 PSK)
 134                         cli_print_fmt1 2 "Mode" "Pre-Shared-Key"
 135
 136                         if isset PSK; then
 137                                 cli_print_fmt1 2 "Pre-Shared-Key" "****"
 138                         else
 139                                 cli_print_fmt1 2 "Pre-Shared-Key" "- is not set -"
 140                         fi
 141                         ;;
 142                 X509)
 143                         : # TODO
 144                         ;;
 145         esac
 146         cli_space
 147
 148         local i
 149         for i in LOCAL REMOTE; do
 150                 case "${i}" in
 151                         LOCAL)
 152                                 cli_headline 2 "Local"
 153                                 ;;
 154                         REMOTE)
 155                                 cli_headline 2 "Remote"
 156                                 ;;
 157                 esac
 158
 159                 local id_var="${i}_ID"
 160                 if [ -n "${!id_var}" ]; then
 161                         cli_print_fmt1 2 "ID" "${!id_var}"
 162                 fi
 163
 164                 local prefix_var="${i}_PREFIX"
 165                 if isset ${prefix_var}; then
 166                         cli_headline 3 "Prefix(es)"
 167
 168                         local prefix
 169                         for prefix in ${!prefix_var}; do
 170                                 cli_print_fmt1 3 "${prefix}"
 171                         done
 172                 fi
 173
 174                 cli_space
 175         done
 176
 177         cli_headline 2 "Misc."
 178
 179         case "${MODE}" in
 180                 gre-transport)
 181                         cli_print_fmt1 2 "Transport Mode" "GRE Transport"
 182                         ;;
 183                 tunnel)
 184                         cli_print_fmt1 2 "Transport Mode" "Tunnel"
 185                         ;;
 186                 vti)
 187                         cli_print_fmt1 2 "Transport Mode" "Virtual Tunnel Interface"
 188                         ;;
 189                 *)
 190                         cli_print_fmt1 2 "Transport Mode" "- Unknown -"
 191                         ;;
 192         esac
 193
 194         # Inactivity timeout
 195         if isset INACTIVITY_TIMEOUT && [ ${INACTIVITY_TIMEOUT} -gt 0 ]; then
 196                 cli_print_fmt1 2 "Inactivity Timeout" "$(format_time ${INACTIVITY_TIMEOUT})"
 197         fi
 198         cli_space
 199
 200         return ${EXIT_OK}
 201 }
 202
 203 ipsec_connection_disable() {
 204         local connection=${1}
 205
 206         if ! ipsec_connection_write_config_key "${connection}" "ENABLED" "false"; then
 207                 log ERROR "Could not write configuration settings"
 208                 return ${EXIT_ERROR}
 209         fi
 210
 211         ipsec_reload ${connection}
 212
 213         # Configure strongswan autostart
 214         ipsec_strongswan_autostart
 215 }
 216
 217 ipsec_connection_enable() {
 218         local connection=${1}
 219
 220         if ! ipsec_connection_write_config_key "${connection}" "ENABLED" "true"; then
 221                 log ERROR "Could not write configuration settings"
 222                 return ${EXIT_ERROR}
 223         fi
 224
 225         ipsec_reload "${connection}"
 226
 227         # Configure strongswan autostart
 228         ipsec_strongswan_autostart
 229 }
 230
 231 # This function writes all values to a via ${connection} specificated VPN IPsec configuration file
 232 ipsec_connection_write_config() {
 233         assert [ $# -ge 1 ]
 234
 235         local connection="${1}"
 236
 237         if ! ipsec_connection_exists "${connection}"; then
 238                 log ERROR "No such VPN IPsec connection: ${connection}"
 239                 return ${EXIT_ERROR}
 240         fi
 241
 242         local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
 243
 244         if ! settings_write "${path}" ${IPSEC_CONNECTION_CONFIG_SETTINGS}; then
 245                 log ERROR "Could not write configuration settings for VPN IPsec connection ${connection}"
 246                 return ${EXIT_ERROR}
 247         fi
 248
 249         ipsec_reload ${connection}
 250 }
 251
 252 # This funtion writes the value for one key to a via ${connection} specificated VPN IPsec connection configuration file
 253 ipsec_connection_write_config_key() {
 254         assert [ $# -ge 3 ]
 255
 256         local connection=${1}
 257         local key=${2}
 258         shift 2
 259
 260         local value="$@"
 261
 262         if ! ipsec_connection_exists "${connection}"; then
 263                 log ERROR "No such VPN ipsec connection: ${connection}"
 264                 return ${EXIT_ERROR}
 265         fi
 266
 267         log DEBUG "Set '${key}' to new value '${value}' in VPN ipsec connection '${connection}'"
 268
 269         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 270
 271         # Read the config settings
 272         if ! ipsec_connection_read_config "${connection}"; then
 273                 return ${EXIT_ERROR}
 274         fi
 275
 276         # Set the key to a new value
 277         assign "${key}" "${value}"
 278
 279         if ! ipsec_connection_write_config "${connection}"; then
 280                 return ${EXIT_ERROR}
 281         fi
 282
 283         return ${EXIT_TRUE}
 284 }
 285
 286 # Reads one or more keys out of a settings file or all if no key is provided.
 287 ipsec_connection_read_config() {
 288         assert [ $# -ge 1 ]
 289
 290         local connection="${1}"
 291         shift 1
 292
 293         if ! ipsec_connection_exists "${connection}"; then
 294                 log ERROR "No such VPN IPsec connection : ${connection}"
 295                 return ${EXIT_ERROR}
 296         fi
 297
 298
 299         local args
 300         if [ $# -eq 0 ] && [ -n "${IPSEC_CONNECTION_CONFIG_SETTINGS}" ]; then
 301                 list_append args ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 302         else
 303                 list_append args $@
 304         fi
 305
 306         local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
 307
 308         if ! settings_read "${path}" ${args}; then
 309                 log ERROR "Could not read settings for VPN IPsec connection ${connection}"
 310                 return ${EXIT_ERROR}
 311         fi
 312 }
 313
 314 # This function checks if a vpn ipsec connection exists
 315 # Returns True when yes and false when not
 316 ipsec_connection_exists() {
 317         assert [ $# -eq 1 ]
 318
 319         local connection=${1}
 320
 321         local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}"
 322
 323         [ -d "${path}" ] && return ${EXIT_TRUE} || return ${EXIT_FALSE}
 324 }
 325
 326 # Determines if strongswan should be automatically started
 327 # when the system boots up.
 328 ipsec_strongswan_autostart() {
 329         local autostart_needed="false"
 330
 331         local connection
 332         for connection in $(ipsec_list_connections); do
 333                 local ENABLED
 334
 335                 if ! ipsec_connection_read_config "${connection}" "ENABLED"; then
 336                         log WARNING "Could not read configuation"
 337                         continue
 338                 fi
 339
 340                 if enabled ENABLED; then
 341                         autostart_needed="true"
 342                         break
 343                 fi
 344         done
 345
 346         # Start strongswan when we need it and when it is not yet enabled
 347         if ${autostart_needed} && ! service_is_enabled "strongswan"; then
 348                 service_enable "strongswan"
 349
 350         # Disable strongswan when we do not need it but it is enabled
 351         elif ! ${autostart_needed} && service_is_enabled "strongswan"; then
 352                 service_disable "strongswan"
 353         fi
 354 }
 355
 356 ipsec_strongswan_load() {
 357         if ! cmd swanctl --load-all; then
 358                 log ERROR "Could not reload strongswan config"
 359                 return ${EXIT_ERROR}
 360         fi
 361 }
 362
 363 # Reloads the connection after config changes
 364 ipsec_reload() {
 365         local connection=${1}
 366
 367         local ENABLED
 368
 369         if ! ipsec_connection_read_config "${connection}" "ENABLED"; then
 370                 log ERROR "Could not read configuration for IPsec connection ${connection}"
 371                 return ${EXIT_ERROR}
 372         fi
 373
 374         if enabled ENABLED; then
 375                 if ! ipsec_connection_to_strongswan ${connection}; then
 376                         log ERROR "Could not generate strongswan config for ${connnection}"
 377                         return ${EXIT_ERROR}
 378                 fi
 379         else
 380                 unlink "${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf"
 381         fi
 382
 383         ipsec_strongswan_load
 384 }
 385
 386 # Handle the cli after authentification
 387 ipsec_connection_authentication() {
 388         if [ ! $# -gt 1 ]; then
 389                 log ERROR "Not enough arguments"
 390                 return ${EXIT_ERROR}
 391         fi
 392
 393         local connection=${1}
 394         local cmd=${2}
 395         shift 2
 396
 397         case ${cmd} in
 398                 mode)
 399                         ipsec_connection_authentication_mode "${connection}" $@
 400                         ;;
 401                 pre-shared-key)
 402                         ipsec_connection_authentication_psk "${connection}" $@
 403                         ;;
 404                 *)
 405                         log ERROR "Unrecognized argument: ${cmd}"
 406                         return ${EXIT_ERROR}
 407                         ;;
 408         esac
 409 }
 410
 411 # Set the authentification mode
 412 ipsec_connection_authentication_mode() {
 413         if [ ! $# -eq 2 ]; then
 414                 log ERROR "Not enough arguments"
 415                 return ${EXIT_ERROR}
 416         fi
 417         local connection=${1}
 418         local mode=${2}
 419
 420         if ! isoneof mode ${IPSEC_VALID_AUTH_MODES}; then
 421                 log ERROR "Auth mode '${mode}' is invalid"
 422                 return ${EXIT_ERROR}
 423         fi
 424
 425         if ! ipsec_connection_write_config_key "${connection}" "AUTH_MODE" ${mode^^}; then
 426                 log ERROR "Could not write configuration settings"
 427                 return ${EXIT_ERROR}
 428         fi
 429 }
 430
 431 # Set the psk
 432 ipsec_connection_authentication_psk() {
 433         if [ ! $# -eq 2 ]; then
 434                 log ERROR "Not enough arguments"
 435                 return ${EXIT_ERROR}
 436         fi
 437
 438         local connection=${1}
 439         local psk=${2}
 440
 441         local length=${#psk}
 442
 443         if [ ${length} -lt 4 ]; then
 444                 error "The PSK must be longer than four characters"
 445                 return ${EXIT_ERROR}
 446         fi
 447
 448         if [ ${length} -gt 128 ]; then
 449                 error "The PSK cannot be longer than 128 characters"
 450                 return ${EXIT_ERROR}
 451         fi
 452
 453         if ! ipsec_connection_write_config_key "${connection}" "PSK" "${psk}"; then
 454                 log ERROR "Could not write configuration settings"
 455                 return ${EXIT_ERROR}
 456         fi
 457
 458         return ${EXIT_OK}
 459 }
 460
 461 ipsec_connection_up() {
 462         local connection="${1}"
 463
 464         if ! ipsec_connection_exists "${connection}"; then
 465                 error "No such VPN IPsec connection: ${connection}"
 466                 return ${EXIT_ERROR}
 467         fi
 468
 469         cmd swanctl --initiate --child "${connection}"
 470 }
 471
 472 ipsec_connection_down() {
 473         local connection="${1}"
 474
 475         if ! ipsec_connection_exists "${connection}"; then
 476                 error "No such VPN IPsec connection: ${connection}"
 477                 return ${EXIT_ERROR}
 478         fi
 479
 480         cmd swanctl --terminate --ike "${connection}"
 481 }
 482
 483 # Handle the cli after authentification
 484 ipsec_connection_dpd() {
 485         if [ ! $# -gt 1 ]; then
 486                 log ERROR "Not enough arguments"
 487                 return ${EXIT_ERROR}
 488         fi
 489
 490         local connection=${1}
 491         local cmd=${2}
 492         shift 2
 493
 494         case ${cmd} in
 495                 action)
 496                         ipsec_connection_dpd_action "${connection}" $@
 497                         ;;
 498                 delay)
 499                         ipsec_connection_dpd_delay "${connection}" $@
 500                         ;;
 501                 timeout)
 502                         ipsec_connection_dpd_timeout "${connection}" $@
 503                         ;;
 504                 *)
 505                         log ERROR "Unrecognized argument: ${cmd}"
 506                         return ${EXIT_ERROR}
 507                         ;;
 508         esac
 509 }
 510
 511 # Set the default dpd action
 512 ipsec_connection_dpd_action() {
 513         if [ ! $# -eq 2 ]; then
 514                 log ERROR "Not enough arguments"
 515                 return ${EXIT_ERROR}
 516         fi
 517         local connection=${1}
 518         local action=${2}
 519
 520         if ! isoneof action "restart" "clear"; then
 521                 log ERROR "dpd action '${action}' is invalid"
 522                 return ${EXIT_ERROR}
 523         fi
 524
 525         if ! ipsec_connection_write_config_key "${connection}" "DPD_ACTION" ${action}; then
 526                 log ERROR "Could not write configuration settings"
 527                 return ${EXIT_ERROR}
 528         fi
 529 }
 530
 531 # Set the dpd delay
 532 ipsec_connection_dpd_delay() {
 533         if [ ! $# -ge 2 ]; then
 534                 log ERROR "Not enough arguments"
 535                 return ${EXIT_ERROR}
 536         fi
 537
 538         local connection=${1}
 539         shift 1
 540         local value=$@
 541
 542         if ! isinteger value; then
 543                 value=$(parse_time $@)
 544                 if [ ! $? -eq 0 ]; then
 545                         log ERROR "Parsing the passed time was not sucessful please check the passed values."
 546                         return ${EXIT_ERROR}
 547                 fi
 548         fi
 549
 550         if [ ${value} -lt 0 ]; then
 551                 log ERROR "The passed time value must be in the sum greater or equal zero seconds."
 552                 return ${EXIT_ERROR}
 553         fi
 554
 555         if ! ipsec_connection_write_config_key "${connection}" "DPD_DELAY" ${value}; then
 556                 log ERROR "Could not write configuration settings"
 557                 return ${EXIT_ERROR}
 558         fi
 559
 560         return ${EXIT_OK}
 561 }
 562
 563 # Set the dpd timeout
 564 ipsec_connection_dpd_timeout() {
 565         if [ ! $# -ge 2 ]; then
 566                 log ERROR "Not enough arguments"
 567                 return ${EXIT_ERROR}
 568         fi
 569
 570         local connection=${1}
 571         shift 1
 572         local value=$@
 573
 574         if ! isinteger value; then
 575                 value=$(parse_time $@)
 576                 if [ ! $? -eq 0 ]; then
 577                         log ERROR "Parsing the passed time was not sucessful please check the passed values."
 578                         return ${EXIT_ERROR}
 579                 fi
 580         fi
 581
 582         if [ ${value} -le 0 ]; then
 583                 log ERROR "The passed time value must be in the sum greater or equal zero seconds."
 584                 return ${EXIT_ERROR}
 585         fi
 586
 587         if ! ipsec_connection_write_config_key "${connection}" "DPD_TIMEOUT" ${value}; then
 588                 log ERROR "Could not write configuration settings"
 589                 return ${EXIT_ERROR}
 590         fi
 591
 592         return ${EXIT_OK}
 593 }
 594
 595 # Handle the cli after local
 596 ipsec_connection_local() {
 597         if [ ! $# -ge 2 ]; then
 598                 log ERROR "Not enough arguments"
 599                 return ${EXIT_ERROR}
 600         fi
 601
 602         local connection=${1}
 603         local cmd=${2}
 604         shift 2
 605
 606         case ${cmd} in
 607                 address)
 608                         ipsec_connection_local_address "${connection}" $@
 609                         ;;
 610                 id)
 611                         ipsec_connection_id "${connection}" "LOCAL" $@
 612                         ;;
 613                 prefix)
 614                         ipsec_connection_prefix "${connection}" "LOCAL" $@
 615                         ;;
 616                 *)
 617                         log ERROR "Unrecognized argument: ${cmd}"
 618                         return ${EXIT_ERROR}
 619                         ;;
 620         esac
 621
 622         return ${EXIT_OK}
 623 }
 624
 625 # Set the connection mode
 626 ipsec_connection_mode() {
 627         if [ ! $# -eq 2 ]; then
 628                 log ERROR "Not enough arguments"
 629                 return ${EXIT_ERROR}
 630         fi
 631         local connection=${1}
 632         local mode=${2}
 633
 634         if ! isoneof mode ${IPSEC_VALID_MODES}; then
 635                 log ERROR "Mode '${mode}' is invalid"
 636                 return ${EXIT_ERROR}
 637         fi
 638
 639         if ! ipsec_connection_write_config_key "${connection}" "MODE" ${mode}; then
 640                 log ERROR "Could not write configuration settings"
 641                 return ${EXIT_ERROR}
 642         fi
 643
 644         return ${EXIT_OK}
 645 }
 646
 647 # Set the local address
 648 ipsec_connection_local_address() {
 649         if [ ! $# -eq 2 ]; then
 650                 log ERROR "Not enough arguments"
 651                 return ${EXIT_ERROR}
 652         fi
 653         local connection=${1}
 654         local local_address=${2}
 655
 656         if ! ipsec_connection_check_peer ${local_address}; then
 657                 log ERROR "Local address '${local_address}' is invalid"
 658                 return ${EXIT_ERROR}
 659         fi
 660
 661         if ! ipsec_connection_write_config_key "${connection}" "LOCAL_ADDRESS" ${local_address}; then
 662                 log ERROR "Could not write configuration settings"
 663                 return ${EXIT_ERROR}
 664         fi
 665
 666         return ${EXIT_OK}
 667 }
 668
 669 # Set the peer to connect to
 670 ipsec_connection_peer() {
 671         if [ ! $# -eq 2 ]; then
 672                 log ERROR "Not enough arguments"
 673                 return ${EXIT_ERROR}
 674         fi
 675         local connection=${1}
 676         local peer=${2}
 677
 678         if ! ipsec_connection_check_peer ${peer}; then
 679                 log ERROR "Peer '${peer}' is invalid"
 680                 return ${EXIT_ERROR}
 681         fi
 682
 683         if ! ipsec_connection_write_config_key "${connection}" "PEER" ${peer}; then
 684                 log ERROR "Could not write configuration settings"
 685                 return ${EXIT_ERROR}
 686         fi
 687
 688         return ${EXIT_OK}
 689 }
 690
 691 #Set the local or remote id
 692 ipsec_connection_id() {
 693         if [ ! $# -eq 3 ]; then
 694                 log ERROR "Not enough arguments"
 695                 return ${EXIT_ERROR}
 696         fi
 697         local connection=${1}
 698         local type=${2}
 699         local id=${3}
 700
 701         if ! ipsec_connection_check_id ${id}; then
 702                 log ERROR "Id '${id}' is invalid"
 703                 return ${EXIT_ERROR}
 704         fi
 705
 706         if ! ipsec_connection_write_config_key "${connection}" "${type}_ID" ${id}; then
 707                 log ERROR "Could not write configuration settings"
 708                 return ${EXIT_ERROR}
 709         fi
 710
 711         return ${EXIT_OK}
 712 }
 713
 714 # Set the local or remote prefix
 715 ipsec_connection_prefix() {
 716         if [ ! $# -ge 3 ]; then
 717                 log ERROR "Not enough arguments"
 718                 return ${EXIT_ERROR}
 719         fi
 720         local connection=${1}
 721         local type=${2}
 722         shift 2
 723
 724         local _prefix="${type}_PREFIX"
 725         local "${_prefix}"
 726         if ! ipsec_connection_read_config "${connection}" "${_prefix}"; then
 727                 return ${EXIT_ERROR}
 728         fi
 729
 730         # Remove duplicated entries to proceed the list safely
 731         assign "${_prefix}" "$(list_unique ${!_prefix} )"
 732
 733         local prefixes_added
 734         local prefixes_removed
 735         local prefixes_set
 736
 737         while [ $# -gt 0 ]; do
 738                 local arg="${1}"
 739
 740                 case "${arg}" in
 741                         +*)
 742                                 list_append prefixes_added "${arg:1}"
 743                                 ;;
 744                         -*)
 745                                 list_append prefixes_removed "${arg:1}"
 746                                 ;;
 747                         [A-Fa-f0-9]*)
 748                                 list_append prefixes_set "${arg}"
 749                                 ;;
 750                         *)
 751                                 error "Invalid argument: ${arg}"
 752                                 return ${EXIT_ERROR}
 753                                 ;;
 754                 esac
 755                 shift
 756         done
 757
 758         # Check if the user is trying a mixed operation
 759         if ! list_is_empty prefixes_set && (! list_is_empty prefixes_added || ! list_is_empty prefixes_removed); then
 760                 error "You cannot reset the prefix list and add or remove prefixes at the same time"
 761                 return ${EXIT_ERROR}
 762         fi
 763
 764         # Set new prefix list
 765         if ! list_is_empty prefixes_set; then
 766                 # Check if all prefixes are valid
 767                 local prefix
 768                 for prefix in ${prefixes_set}; do
 769                         if ! ip_net_is_valid ${prefix}; then
 770                                 error "Unsupported prefix: ${prefix}"
 771                                 return ${EXIT_ERROR}
 772                         fi
 773                 done
 774
 775                 assign "${_prefix}" "${prefixes_set}"
 776
 777         # Perform incremental updates
 778         else
 779                 local prefix
 780
 781                 # Perform all removals
 782                 for prefix in ${prefixes_removed}; do
 783                         if ! list_remove "${_prefix}" ${prefix}; then
 784                                 warning "${prefix} was not on the list and could not be removed"
 785                         fi
 786                 done
 787
 788
 789                 for prefix in ${prefixes_added}; do
 790                         if ip_net_is_valid ${prefix}; then
 791                                 if ! list_append_unique "${_prefix}" ${prefix}; then
 792                                         warning "${prefix} is already on the prefix list"
 793                                 fi
 794                         else
 795                                 warning "${prefix} is not a valid IP network and could not be added"
 796                         fi
 797                 done
 798         fi
 799
 800         # Check if the list contain at least one valid prefix
 801         if list_is_empty ${_prefix}; then
 802                 error "Cannot save an empty prefix list"
 803                 return ${EXIT_ERROR}
 804         fi
 805
 806         # Save everything
 807         if ! ipsec_connection_write_config_key "${connection}" "${_prefix}" ${!_prefix}; then
 808                 log ERROR "Could not write configuration settings"
 809         fi
 810
 811         return ${EXIT_OK}
 812 }
 813
 814 # Handle the cli after remote
 815 ipsec_connection_remote() {
 816         if [ ! $# -ge 2 ]; then
 817                 log ERROR "Not enough arguments"
 818                 return ${EXIT_ERROR}
 819         fi
 820
 821         local connection=${1}
 822         local cmd=${2}
 823         shift 2
 824
 825         case ${cmd} in
 826                 id)
 827                         ipsec_connection_id "${connection}" "REMOTE" $@
 828                         ;;
 829
 830                 prefix)
 831                         ipsec_connection_prefix "${connection}" "REMOTE" $@
 832                         ;;
 833                 *)
 834                         log ERROR "Unrecognized argument: ${cmd}"
 835                         return ${EXIT_ERROR}
 836                         ;;
 837         esac
 838
 839         return ${EXIT_OK}
 840 }
 841
 842 # Set the inactivity timeout
 843 ipsec_connection_inactivity_timeout() {
 844         if [ ! $# -ge 2 ]; then
 845                 log ERROR "Not enough arguments"
 846                 return ${EXIT_ERROR}
 847         fi
 848
 849         local connection=${1}
 850         shift 1
 851         local value=$@
 852
 853         if ! isinteger value; then
 854                 value=$(parse_time $@)
 855                 if [ ! $? -eq 0 ]; then
 856                         log ERROR "Parsing the passed time was not sucessful please check the passed values."
 857                         return ${EXIT_ERROR}
 858                 fi
 859         fi
 860
 861         if [ ${value} -le 0 ]; then
 862                 log ERROR "The passed time value must be in the sum greater zero seconds."
 863                 return ${EXIT_ERROR}
 864         fi
 865
 866         if ! ipsec_connection_write_config_key "${connection}" "INACTIVITY_TIMEOUT" ${value}; then
 867                 log ERROR "Could not write configuration settings"
 868                 return ${EXIT_ERROR}
 869         fi
 870
 871         return ${EXIT_OK}
 872 }
 873
 874 # Set the default start action
 875 ipsec_connection_start_action() {
 876         if [ ! $# -eq 2 ]; then
 877                 log ERROR "Not enough arguments"
 878                 return ${EXIT_ERROR}
 879         fi
 880         local connection=${1}
 881         local action=${2}
 882
 883         if ! isoneof action "on-demand" "always-on"; then
 884                 log ERROR "Start action '${action}' is invalid"
 885                 return ${EXIT_ERROR}
 886         fi
 887
 888         if ! ipsec_connection_write_config_key "${connection}" "START_ACTION" ${action}; then
 889                 log ERROR "Could not write configuration settings"
 890                 return ${EXIT_ERROR}
 891         fi
 892 }
 893
 894 # Set the security policy to use
 895 ipsec_connection_security_policy() {
 896         if [ ! $# -eq 2 ]; then
 897                 log ERROR "Not enough arguments"
 898                 return ${EXIT_ERROR}
 899         fi
 900         local connection=${1}
 901         local security_policy=${2}
 902
 903         if ! vpn_security_policy_exists ${security_policy}; then
 904                 log ERROR "No such vpn security policy '${security_policy}'"
 905                 return ${EXIT_ERROR}
 906         fi
 907
 908         if ! ipsec_connection_write_config_key "${connection}" "SECURITY_POLICY" ${security_policy}; then
 909                 log ERROR "Could not write configuration settings"
 910                 return ${EXIT_ERROR}
 911         fi
 912 }
 913
 914 # Check if a id is valid
 915 ipsec_connection_check_id() {
 916         assert [ $# -eq 1 ]
 917         local id=${1}
 918
 919         if [[ ${id} =~ ^@[[:alnum:]]+$ ]] || ip_is_valid ${id}; then
 920                 return ${EXIT_TRUE}
 921         else
 922                 return ${EXIT_FALSE}
 923         fi
 924 }
 925
 926 # Checks if a peer is valid
 927 ipsec_connection_check_peer() {
 928         assert [ $# -eq 1 ]
 929         local peer=${1}
 930
 931         # TODO Accept also FQDNs
 932         if ip_is_valid ${peer}; then
 933                 return ${EXIT_TRUE}
 934         else
 935                 return ${EXIT_FALSE}
 936         fi
 937 }
 938
 939 # This function checks if a VPN IPsec connection name is valid
 940 # Allowed are only A-Za-z0-9
 941 ipsec_connection_check_name() {
 942         assert [ $# -eq 1 ]
 943
 944         local connection=${1}
 945
 946         [[ "${connection}" =~ [^[:alnum:]$] ]]
 947 }
 948
 949 # Function that creates one VPN IPsec connection
 950 ipsec_connection_new() {
 951         if [ $# -gt 1 ]; then
 952                 error "Too many arguments"
 953                 return ${EXIT_ERROR}
 954         fi
 955
 956         local connection="${1}"
 957         if ! isset connection; then
 958                 error "Please provide a connection name"
 959                 return ${EXIT_ERROR}
 960         fi
 961
 962         # Check for duplicates
 963         if ipsec_connection_exists "${connection}"; then
 964                 error "The VPN IPsec connection ${connection} already exists"
 965                 return ${EXIT_ERROR}
 966         fi
 967
 968         # Check if the name of the connection is valid
 969         if  ipsec_connection_check_name "${connection}"; then
 970                 error "'${connection}' contains illegal characters"
 971                 return ${EXIT_ERROR}
 972         fi
 973
 974         log DEBUG "Creating VPN IPsec connection ${connection}"
 975
 976         if ! mkdir -p "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
 977                 log ERROR "Could not create config directory for ${connection}"
 978                 return ${EXIT_ERROR}
 979         fi
 980
 981         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 982
 983         AUTH_MODE=${IPSEC_DEFAULT_AUTH_MODE}
 984         DPD_ACTION=${IPSEC_DEFAULT_DPD_ACTION}
 985         DPD_DELAY=${IPSEC_DEFAULT_DPD_DELAY}
 986         DPD_TIMEOUT=${IPSEC_DEFAULT_DPD_TIMEOUT}
 987         ENABLED=${IPSEC_DEFAULT_ENABLED}
 988         MODE=${IPSEC_DEFAULT_MODE}
 989         START_ACTION=${IPSEC_DEFAULT_START_ACTION}
 990
 991         INACTIVITY_TIMEOUT=${IPSEC_DEFAULT_INACTIVITY_TIMEOUT}
 992         SECURITY_POLICY=${IPSEC_DEFAULT_SECURITY_POLICY}
 993
 994         if ! ipsec_connection_write_config "${connection}"; then
 995                 log ERROR "Could not write new config file"
 996                 return ${EXIT_ERROR}
 997         fi
 998
 999         # Configure strongswan autostart
1000         ipsec_strongswan_autostart
1001 }
1002
1003 # Function that deletes based on the passed parameters one ore more vpn security policies
1004 ipsec_connection_destroy() {
1005         local connection
1006         for connection in $@; do
1007                 if ! ipsec_connection_exists "${connection}"; then
1008                         log ERROR "The VPN IPsec connection ${connection} does not exist."
1009                         continue
1010                 fi
1011
1012                 log DEBUG "Deleting VPN IPsec connection ${connection}"
1013                 if ! rm -rf "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
1014                         log ERROR "Deleting the VPN IPsec connection ${connection} was not sucessful"
1015                         return ${EXIT_ERROR}
1016                 fi
1017         done
1018
1019         # Configure strongswan autostart
1020         ipsec_strongswan_autostart
1021 }
1022
1023 # List all ipsec connections
1024 ipsec_list_connections() {
1025         local connection
1026         for connection in ${NETWORK_IPSEC_CONNS_DIR}/*; do
1027                 [ -d ${connection} ] || continue
1028                 basename ${connection}
1029         done
1030 }
1031
1032 ipsec_connection_to_strongswan() {
1033         local connection="${1}"
1034
1035         # Read the config settings
1036         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
1037         if ! ipsec_connection_read_config "${connection}"; then
1038                 error "Could not read the connection ${connection}"
1039                 return ${EXIT_ERROR}
1040         fi
1041
1042         local path="${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf"
1043
1044         (
1045                 # Write the connection section
1046                 _ipsec_connection_to_strongswan_connection "${connection}"
1047
1048                 # Write the secrets section
1049                 _ipsec_connection_to_strongswan_secrets "${connection}"
1050
1051         ) > ${path}
1052 }
1053
1054 _ipsec_connection_to_strongswan_connection() {
1055         local connection="${1}"
1056
1057         # Read the security policy
1058         local ${VPN_SECURITY_POLICIES_CONFIG_SETTINGS}
1059         if ! vpn_security_policies_read_config "${SECURITY_POLICY}"; then
1060                 return ${EXIT_ERROR}
1061         fi
1062
1063         # Is DPD enabled?
1064         local dpd="false"
1065         if isset DPD_DELAY && isinteger DPD_DELAY && [ ${DPD_DELAY} -gt 0 ]; then
1066                 dpd="true"
1067         fi
1068
1069         print_indent 0 "connections {"
1070         print_indent 1 "${connection} {"
1071
1072         # IKE Version
1073         print_indent 2 "# IKE Version"
1074         case "${KEY_EXCHANGE^^}" in
1075                 IKEV1)
1076                         print_indent 2 "version = 1"
1077                         ;;
1078
1079                 # Fall back to IKEv2 for any random values
1080                 IKEV2|*)
1081                         print_indent 2 "version = 2"
1082                         ;;
1083         esac
1084         print # empty line
1085
1086         # Always only keep one connection open at a time
1087         print_indent 2 "# Unique IDs"
1088         print_indent 2 "unique = replace"
1089         print
1090
1091         # Local Address
1092         print_indent 2 "# Local Address"
1093         if isset LOCAL_ADDRESS; then
1094                 print_indent 2 "local_addrs = ${LOCAL_ADDRESS}"
1095         else
1096                 print_indent 2 "local_addrs = %any"
1097         fi
1098         print
1099
1100         # Remote Address
1101         print_indent 2 "# Remote Address"
1102         if isset PEER; then
1103                 print_indent 2 "remote_addrs = ${PEER}"
1104         else
1105                 print_indent 2 "remote_addrs = %any"
1106         fi
1107         print
1108
1109         # IKE Proposals
1110         print_indent 2 "# IKE Proposals"
1111         print_indent 2 "proposals = $(vpn_security_policies_make_ike_proposal ${SECURITY_POLICY})"
1112         print
1113
1114         # DPD Settings
1115         if enabled dpd; then
1116                 print_indent 2 "# Dead Peer Detection"
1117                 print_indent 2 "dpd_delay = ${DPD_DELAY}"
1118
1119                 if isset DPD_TIMEOUT; then
1120                         print_indent 2 "dpd_timeout = ${DPD_TIMEOUT}"
1121                 fi
1122
1123                 print
1124         fi
1125
1126         # Fragmentation
1127         print_indent 2 "# Fragmentation"
1128         print_indent 2 "fragmentation = yes"
1129         print
1130
1131         # Local
1132         print_indent 2 "local {"
1133
1134         # Local ID
1135         if isset LOCAL_ID; then
1136                 print_indent 3 "id = ${LOCAL_ID}"
1137         fi
1138
1139         # Authentication
1140         case "${AUTH_MODE}" in
1141                 PSK)
1142                         print_indent 3 "auth = psk"
1143                         ;;
1144         esac
1145
1146         print_indent 2 "}"
1147         print
1148
1149         # Remote
1150         print_indent 2 "remote {"
1151
1152         # Remote ID
1153         if isset REMOTE_ID; then
1154                 print_indent 3 "id = ${REMOTE_ID}"
1155         fi
1156
1157         # Authentication
1158         case "${AUTH_MODE}" in
1159                 PSK)
1160                         print_indent 3 "auth = psk"
1161                         ;;
1162         esac
1163
1164         print_indent 2 "}"
1165         print
1166
1167         # Children
1168
1169         print_indent 2 "children {"
1170         print_indent 3 "${connection} {"
1171
1172         print_indent 4 "# ESP Proposals"
1173         print_indent 4 "esp_proposals = $(vpn_security_policies_make_esp_proposal ${SECURITY_POLICY})"
1174         print
1175
1176         # Traffic Selectors
1177
1178         case "${MODE}" in
1179                 gre-*)
1180                         print_indent 4 "local_ts = dynamic[gre]"
1181                         print_indent 4 "remote_ts = dynamic[gre]"
1182                         ;;
1183                 *)
1184                         # Local Prefixes
1185                         if isset LOCAL_PREFIX; then
1186                                 print_indent 4 "local_ts = $(list_join LOCAL_PREFIX ,)"
1187                         else
1188                                 print_indent 4 "local_ts = dynamic"
1189                         fi
1190
1191                         # Remote Prefixes
1192                         if isset REMOTE_PREFIX; then
1193                                 print_indent 4 "remote_ts = $(list_join REMOTE_PREFIX ,)"
1194                         else
1195                                 print_indent 4 "remote_ts = dynamic"
1196                         fi
1197                         ;;
1198         esac
1199         print
1200
1201         # Netfilter Marks
1202         print_indent 4 "# Netfilter Marks"
1203         print_indent 4 "mark_in = %unique"
1204         print_indent 4 "mark_out = %unique"
1205         print
1206
1207         # Dead Peer Detection
1208         if enabled dpd; then
1209                 print_indent 4 "# Dead Peer Detection"
1210                 print_indent 4 "dpd_action = ${DPD_ACTION}"
1211                 print
1212         fi
1213
1214         # Rekeying
1215         if isset LIFETIME; then
1216                 print_indent 4 "# Rekey Time"
1217                 print_indent 4 "rekey_time = ${LIFETIME}"
1218                 print
1219         fi
1220
1221         # Updown Script
1222         print_indent 4 "updown = ${NETWORK_HELPERS_DIR}/ipsec-updown"
1223         print
1224
1225         # Mode
1226         print_indent 4 "# Mode"
1227         case "${MODE}" in
1228                 gre-transport)
1229                         print_indent 4 "mode = transport"
1230                         ;;
1231                 tunnel|vti|*)
1232                         print_indent 4 "mode = tunnel"
1233                         ;;
1234         esac
1235         print
1236
1237         # Compression
1238         print_indent 4 "# Compression"
1239         if enabled COMPRESSION; then
1240                 print_indent 4 "ipcomp = yes"
1241         else
1242                 print_indent 4 "ipcomp = no"
1243         fi
1244         print
1245
1246         # Inactivity Timeout
1247         if isset INACTIVITY_TIMEOUT; then
1248                 print_indent 4 "# Inactivity Timeout"
1249                 print_indent 4 "inactivity = ${INACTIVITY_TIMEOUT}"
1250                 print
1251         fi
1252
1253         # Start Action
1254         print_indent 4 "# Start Action"
1255         case "${START_ACTION}" in
1256                 on-demand)
1257                         print_indent 4 "start_action = trap"
1258                         print_indent 4 "close_action = trap"
1259                         ;;
1260                 wait)
1261                         print_indent 4 "start_action = none"
1262                         print_indent 4 "close_action = none"
1263                         ;;
1264                 always-on|*)
1265                         print_indent 4 "start_action = start"
1266                         print_indent 4 "close_action = start"
1267                         ;;
1268         esac
1269         print
1270
1271         print_indent 3 "}"
1272         print_indent 2 "}"
1273         print
1274
1275         print_indent 1 "}"
1276         print_indent 0 "}"
1277         print
1278 }
1279
1280 _ipsec_connection_to_strongswan_secrets() {
1281         local connection="${1}"
1282
1283         print_indent 0 "secrets {"
1284
1285         case "${AUTH_MODE}" in
1286                 PSK)
1287                         print_indent 1 "ike {"
1288
1289                         # Secret
1290                         print_indent 2 "secret = ${PSK}"
1291
1292                         # ID
1293                         if isset REMOTE_ID; then
1294                                 print_indent 2 "id = ${REMOTE_ID}"
1295                         fi
1296
1297                         print_indent 1 "}"
1298                         ;;
1299         esac
1300
1301         print_indent 0 "}"
1302 }