src/functions/functions.ipsec

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2017  IPFire Network Development Team                         #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 IPSEC_CONNECTION_CONFIG_SETTINGS="\
  23         AUTH_MODE \
  24         DPD_ACTION \
  25         DPD_DELAY \
  26         DPD_TIMEOUT \
  27         INACTIVITY_TIMEOUT \
  28         LOCAL_ADDRESS \
  29         LOCAL_ID \
  30         LOCAL_PREFIX \
  31         MODE \
  32         PEER \
  33         POOLS \
  34         PSK \
  35         REMOTE_ID \
  36         REMOTE_PREFIX \
  37         SECURITY_POLICY \
  38         START_ACTION \
  39         ENABLED"
  40
  41 IPSEC_POOL_CONFIG_SETTINGS="\
  42         DNS_SERVER \
  43         NETWORK \
  44         TYPE"
  45
  46 # Default values
  47 IPSEC_DEFAULT_AUTH_MODE="PSK"
  48 IPSEC_DEFAULT_DPD_ACTION="restart"
  49 IPSEC_DEFAULT_DPD_DELAY="30"
  50 IPSEC_DEFAULT_DPD_TIMEOUT="120"
  51 IPSEC_DEFAULT_ENABLED="true"
  52 IPSEC_DEFAULT_INACTIVITY_TIMEOUT="0"
  53 IPSEC_DEFAULT_MODE="tunnel"
  54 IPSEC_DEFAULT_SECURITY_POLICY="system"
  55 IPSEC_DEFAULT_START_ACTION="on-demand"
  56
  57 IPSEC_VALID_MODES="gre-transport tunnel vti"
  58 IPSEC_VALID_AUTH_MODES="PSK"
  59
  60 cli_ipsec() {
  61         local action=${1}
  62         shift 1
  63
  64         case "${action}" in
  65                 connection)
  66                         cli_ipsec_connection $@
  67                         ;;
  68                 pool)
  69                         cli_ipsec_pool $@
  70                         ;;
  71                 *)
  72                         error "Unrecognized argument: ${action}"
  73                         exit ${EXIT_ERROR}
  74                         ;;
  75         esac
  76 }
  77
  78 cli_ipsec_connection() {
  79         if ipsec_connection_exists ${1}; then
  80                 local connection=${1}
  81                 local key=${2}
  82                 key=${key//-/_}
  83                 shift 2
  84
  85                 case "${key}" in
  86                         authentication|down|disable|dpd|enable|inactivity_timeout|local|mode|peer|pool|remote|security_policy|start_action|up)
  87                                 ipsec_connection_${key} ${connection} $@
  88                                 ;;
  89                         show)
  90                                 cli_ipsec_connection_show "${connection}"
  91                                 exit $?
  92                                 ;;
  93                         *)
  94                                 error "Unrecognized argument: ${key}"
  95                                 exit ${EXIT_ERROR}
  96                                 ;;
  97                 esac
  98         else
  99                 local action=${1}
 100                 shift
 101
 102                 case "${action}" in
 103                         new)
 104                                 ipsec_connection_new $@
 105                                 ;;
 106                         destroy)
 107                                 cli_ipsec_connection_destroy $@
 108                                 ;;
 109                         ""|*)
 110                                 if [ -n "${action}" ]; then
 111                                         error "Unrecognized argument: '${action}'"
 112                                 fi
 113                                 exit ${EXIT_ERROR}
 114                                 ;;
 115                 esac
 116         fi
 117 }
 118
 119 cli_ipsec_pool() {
 120         if ipsec_pool_exists ${1}; then
 121                 local pool=${1}
 122                 local key=${2}
 123                 key=${key//-/_}
 124                 shift 2
 125
 126                 case "${key}" in
 127                         dns_server|network)
 128                                 ipsec_pool_${key} ${pool} $@
 129                                 ;;
 130                         show)
 131                                 cli_ipsec_pool_show "${pool}"
 132                                 exit $?
 133                                 ;;
 134                         *)
 135                                 error "Unrecognized argument: ${key}"
 136                                 exit ${EXIT_ERROR}
 137                                 ;;
 138                 esac
 139         else
 140                 local action=${1}
 141                 shift
 142
 143                 case "${action}" in
 144                         new)
 145                                 ipsec_pool_new $@
 146                                 ;;
 147                         destroy)
 148                                 ipsec_pool_destroy $@
 149                                 ;;
 150                         ""|*)
 151                                 if [ -n "${action}" ]; then
 152                                         error "Unrecognized argument: '${action}'"
 153                                 fi
 154                                 exit ${EXIT_ERROR}
 155                                 ;;
 156                 esac
 157         fi
 158 }
 159
 160 cli_ipsec_connection_destroy() {
 161         local connection="${1}"
 162
 163         if ! ipsec_connection_destroy "${connection}"; then
 164                 return ${EXIT_ERROR}
 165         fi
 166
 167         # Inform strongswan about the changes
 168         ipsec_strongswan_load
 169
 170         # Configure strongswan autostart
 171         ipsec_strongswan_autostart
 172 }
 173
 174 cli_ipsec_connection_show() {
 175         local connection="${1}"
 176
 177         # Read the config settings
 178         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 179         if ! ipsec_connection_read_config "${connection}"; then
 180                 error "Could not read the connection configuration"
 181                 return ${EXIT_ERROR}
 182         fi
 183
 184         cli_headline 0 "IPsec VPN Connection: ${connection}"
 185         cli_space
 186
 187         # Peer
 188         if isset PEER; then
 189                 cli_print_fmt1 1 "Peer" "${PEER}"
 190         fi
 191
 192         # Security Policy
 193         cli_print_fmt1 1 "Security Policy" "${SECURITY_POLICY-${IPSEC_DEFAULT_SECURITY_POLICY}}"
 194         cli_space
 195
 196         cli_headline 2 "Authentication"
 197         case "${AUTH_MODE^^}" in
 198                 PSK)
 199                         cli_print_fmt1 2 "Mode" "Pre-Shared-Key"
 200
 201                         if isset PSK; then
 202                                 cli_print_fmt1 2 "Pre-Shared-Key" "****"
 203                         else
 204                                 cli_print_fmt1 2 "Pre-Shared-Key" "- is not set -"
 205                         fi
 206                         ;;
 207                 X509)
 208                         : # TODO
 209                         ;;
 210         esac
 211         cli_space
 212
 213         local i
 214         for i in LOCAL REMOTE; do
 215                 case "${i}" in
 216                         LOCAL)
 217                                 cli_headline 2 "Local"
 218                                 ;;
 219                         REMOTE)
 220                                 cli_headline 2 "Remote"
 221                                 ;;
 222                 esac
 223
 224                 local id_var="${i}_ID"
 225                 if [ -n "${!id_var}" ]; then
 226                         cli_print_fmt1 2 "ID" "${!id_var}"
 227                 fi
 228
 229                 local prefix_var="${i}_PREFIX"
 230                 if isset ${prefix_var}; then
 231                         cli_headline 3 "Prefix(es)"
 232
 233                         local prefix
 234                         for prefix in ${!prefix_var}; do
 235                                 cli_print_fmt1 3 "${prefix}"
 236                         done
 237                 fi
 238
 239                 cli_space
 240         done
 241
 242         cli_headline 2 "Misc."
 243
 244         case "${MODE}" in
 245                 gre-transport)
 246                         cli_print_fmt1 2 "Transport Mode" "GRE Transport"
 247                         ;;
 248                 tunnel)
 249                         cli_print_fmt1 2 "Transport Mode" "Tunnel"
 250                         ;;
 251                 vti)
 252                         cli_print_fmt1 2 "Transport Mode" "Virtual Tunnel Interface"
 253                         ;;
 254                 *)
 255                         cli_print_fmt1 2 "Transport Mode" "- Unknown -"
 256                         ;;
 257         esac
 258
 259         # Inactivity timeout
 260         if isset INACTIVITY_TIMEOUT && [ ${INACTIVITY_TIMEOUT} -gt 0 ]; then
 261                 cli_print_fmt1 2 "Inactivity Timeout" "$(format_time ${INACTIVITY_TIMEOUT})"
 262         fi
 263         cli_space
 264
 265         return ${EXIT_OK}
 266 }
 267
 268 ipsec_connection_disable() {
 269         local connection=${1}
 270
 271         if ! ipsec_connection_write_config_key "${connection}" "ENABLED" "false"; then
 272                 log ERROR "Could not write configuration settings"
 273                 return ${EXIT_ERROR}
 274         fi
 275
 276         # Configure strongswan autostart
 277         ipsec_strongswan_autostart
 278 }
 279
 280 ipsec_connection_enable() {
 281         local connection=${1}
 282
 283         if ! ipsec_connection_write_config_key "${connection}" "ENABLED" "true"; then
 284                 log ERROR "Could not write configuration settings"
 285                 return ${EXIT_ERROR}
 286         fi
 287
 288         # Configure strongswan autostart
 289         ipsec_strongswan_autostart
 290 }
 291
 292 # This function writes all values to a via ${connection} specificated VPN IPsec configuration file
 293 ipsec_connection_write_config() {
 294         assert [ $# -ge 1 ]
 295
 296         local connection="${1}"
 297
 298         if ! ipsec_connection_exists "${connection}"; then
 299                 log ERROR "No such VPN IPsec connection: ${connection}"
 300                 return ${EXIT_ERROR}
 301         fi
 302
 303         local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
 304
 305         if ! settings_write "${path}" ${IPSEC_CONNECTION_CONFIG_SETTINGS}; then
 306                 log ERROR "Could not write configuration settings for VPN IPsec connection ${connection}"
 307                 return ${EXIT_ERROR}
 308         fi
 309
 310         ipsec_reload ${connection}
 311 }
 312
 313 # This funtion writes the value for one key to a via ${connection} specificated VPN IPsec connection configuration file
 314 ipsec_connection_write_config_key() {
 315         assert [ $# -ge 3 ]
 316
 317         local connection=${1}
 318         local key=${2}
 319         shift 2
 320
 321         local value="$@"
 322
 323         if ! ipsec_connection_exists "${connection}"; then
 324                 log ERROR "No such VPN ipsec connection: ${connection}"
 325                 return ${EXIT_ERROR}
 326         fi
 327
 328         log DEBUG "Set '${key}' to new value '${value}' in VPN ipsec connection '${connection}'"
 329
 330         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 331
 332         # Read the config settings
 333         if ! ipsec_connection_read_config "${connection}"; then
 334                 return ${EXIT_ERROR}
 335         fi
 336
 337         # Set the key to a new value
 338         assign "${key}" "${value}"
 339
 340         if ! ipsec_connection_write_config "${connection}"; then
 341                 return ${EXIT_ERROR}
 342         fi
 343
 344         return ${EXIT_TRUE}
 345 }
 346
 347 # Reads one or more keys out of a settings file or all if no key is provided.
 348 ipsec_connection_read_config() {
 349         assert [ $# -ge 1 ]
 350
 351         local connection="${1}"
 352         shift 1
 353
 354         if ! ipsec_connection_exists "${connection}"; then
 355                 log ERROR "No such VPN IPsec connection : ${connection}"
 356                 return ${EXIT_ERROR}
 357         fi
 358
 359
 360         local args
 361         if [ $# -eq 0 ] && [ -n "${IPSEC_CONNECTION_CONFIG_SETTINGS}" ]; then
 362                 list_append args ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 363         else
 364                 list_append args $@
 365         fi
 366
 367         local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
 368
 369         if ! settings_read "${path}" ${args}; then
 370                 log ERROR "Could not read settings for VPN IPsec connection ${connection}"
 371                 return ${EXIT_ERROR}
 372         fi
 373 }
 374
 375 # This function checks if a vpn ipsec connection exists
 376 # Returns True when yes and false when not
 377 ipsec_connection_exists() {
 378         assert [ $# -eq 1 ]
 379
 380         local connection=${1}
 381
 382         local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}"
 383
 384         [ -d "${path}" ] && return ${EXIT_TRUE} || return ${EXIT_FALSE}
 385 }
 386
 387 # Determines if strongswan should be automatically started
 388 # when the system boots up.
 389 ipsec_strongswan_autostart() {
 390         local autostart_needed="false"
 391
 392         local connection
 393         for connection in $(ipsec_list_connections); do
 394                 local ENABLED
 395
 396                 if ! ipsec_connection_read_config "${connection}" "ENABLED"; then
 397                         log WARNING "Could not read configuation"
 398                         continue
 399                 fi
 400
 401                 if enabled ENABLED; then
 402                         autostart_needed="true"
 403                         break
 404                 fi
 405         done
 406
 407         # Start strongswan when we need it and when it is not yet enabled
 408         if ${autostart_needed}; then
 409                 if ! service_is_enabled "strongswan"; then
 410                         service_enable "strongswan"
 411                 fi
 412
 413                 if ! service_is_active "strongswan"; then
 414                         service_start "strongswan"
 415                 fi
 416
 417         # Disable strongswan when we do not need it but it is enabled
 418         elif ! ${autostart_needed}; then
 419                 if service_is_enabled "strongswan"; then
 420                         service_disable "strongswan"
 421                 fi
 422
 423                 if service_is_active "strongswan"; then
 424                         service_stop "strongswan"
 425                 fi
 426         fi
 427 }
 428
 429 ipsec_strongswan_load() {
 430         # Do nothing if strongswan is not running
 431         if ! service_is_active "strongswan"; then
 432                 return ${EXIT_OK}
 433         fi
 434
 435         if ! cmd swanctl --load-all; then
 436                 log ERROR "Could not reload strongswan config"
 437                 return ${EXIT_ERROR}
 438         fi
 439 }
 440
 441 # Reloads the connection after config changes
 442 ipsec_reload() {
 443         local connection=${1}
 444
 445         local ENABLED
 446
 447         if ! ipsec_connection_read_config "${connection}" "ENABLED"; then
 448                 log ERROR "Could not read configuration for IPsec connection ${connection}"
 449                 return ${EXIT_ERROR}
 450         fi
 451
 452         if enabled ENABLED; then
 453                 if ! ipsec_connection_to_strongswan ${connection}; then
 454                         log ERROR "Could not generate strongswan config for ${connnection}"
 455                         return ${EXIT_ERROR}
 456                 fi
 457         else
 458                 log DEBUG "Deleting strongswan config ${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf"
 459                 unlink "${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf"
 460         fi
 461
 462         ipsec_strongswan_load
 463 }
 464
 465 # Handle the cli after authentification
 466 ipsec_connection_authentication() {
 467         if [ ! $# -gt 1 ]; then
 468                 log ERROR "Not enough arguments"
 469                 return ${EXIT_ERROR}
 470         fi
 471
 472         local connection=${1}
 473         local cmd=${2}
 474         shift 2
 475
 476         case ${cmd} in
 477                 mode)
 478                         ipsec_connection_authentication_mode "${connection}" $@
 479                         ;;
 480                 pre-shared-key)
 481                         ipsec_connection_authentication_psk "${connection}" $@
 482                         ;;
 483                 *)
 484                         log ERROR "Unrecognized argument: ${cmd}"
 485                         return ${EXIT_ERROR}
 486                         ;;
 487         esac
 488 }
 489
 490 # Set the authentification mode
 491 ipsec_connection_authentication_mode() {
 492         if [ ! $# -eq 2 ]; then
 493                 log ERROR "Not enough arguments"
 494                 return ${EXIT_ERROR}
 495         fi
 496         local connection=${1}
 497         local mode=${2}
 498
 499         if ! isoneof mode ${IPSEC_VALID_AUTH_MODES}; then
 500                 log ERROR "Auth mode '${mode}' is invalid"
 501                 return ${EXIT_ERROR}
 502         fi
 503
 504         if ! ipsec_connection_write_config_key "${connection}" "AUTH_MODE" ${mode^^}; then
 505                 log ERROR "Could not write configuration settings"
 506                 return ${EXIT_ERROR}
 507         fi
 508 }
 509
 510 # Set the psk
 511 ipsec_connection_authentication_psk() {
 512         if [ ! $# -eq 2 ]; then
 513                 log ERROR "Not enough arguments"
 514                 return ${EXIT_ERROR}
 515         fi
 516
 517         local connection=${1}
 518         local psk=${2}
 519
 520         local length=${#psk}
 521
 522         if [ ${length} -lt 4 ]; then
 523                 error "The PSK must be longer than four characters"
 524                 return ${EXIT_ERROR}
 525         fi
 526
 527         if [ ${length} -gt 128 ]; then
 528                 error "The PSK cannot be longer than 128 characters"
 529                 return ${EXIT_ERROR}
 530         fi
 531
 532         if ! ipsec_connection_write_config_key "${connection}" "PSK" "${psk}"; then
 533                 log ERROR "Could not write configuration settings"
 534                 return ${EXIT_ERROR}
 535         fi
 536
 537         return ${EXIT_OK}
 538 }
 539
 540 ipsec_connection_up() {
 541         local connection="${1}"
 542
 543         if ! ipsec_connection_exists "${connection}"; then
 544                 error "No such VPN IPsec connection: ${connection}"
 545                 return ${EXIT_ERROR}
 546         fi
 547
 548         cmd swanctl --initiate --child "${connection}"
 549 }
 550
 551 ipsec_connection_down() {
 552         local connection="${1}"
 553
 554         if ! ipsec_connection_exists "${connection}"; then
 555                 error "No such VPN IPsec connection: ${connection}"
 556                 return ${EXIT_ERROR}
 557         fi
 558
 559         cmd swanctl --terminate --ike "${connection}"
 560 }
 561
 562 # Handle the cli after authentification
 563 ipsec_connection_dpd() {
 564         if [ ! $# -gt 1 ]; then
 565                 log ERROR "Not enough arguments"
 566                 return ${EXIT_ERROR}
 567         fi
 568
 569         local connection=${1}
 570         local cmd=${2}
 571         shift 2
 572
 573         case ${cmd} in
 574                 action)
 575                         ipsec_connection_dpd_action "${connection}" $@
 576                         ;;
 577                 delay)
 578                         ipsec_connection_dpd_delay "${connection}" $@
 579                         ;;
 580                 timeout)
 581                         ipsec_connection_dpd_timeout "${connection}" $@
 582                         ;;
 583                 *)
 584                         log ERROR "Unrecognized argument: ${cmd}"
 585                         return ${EXIT_ERROR}
 586                         ;;
 587         esac
 588 }
 589
 590 # Set the default dpd action
 591 ipsec_connection_dpd_action() {
 592         if [ ! $# -eq 2 ]; then
 593                 log ERROR "Not enough arguments"
 594                 return ${EXIT_ERROR}
 595         fi
 596         local connection=${1}
 597         local action=${2}
 598
 599         if ! isoneof action "restart" "clear"; then
 600                 log ERROR "dpd action '${action}' is invalid"
 601                 return ${EXIT_ERROR}
 602         fi
 603
 604         if ! ipsec_connection_write_config_key "${connection}" "DPD_ACTION" ${action}; then
 605                 log ERROR "Could not write configuration settings"
 606                 return ${EXIT_ERROR}
 607         fi
 608 }
 609
 610 # Set the dpd delay
 611 ipsec_connection_dpd_delay() {
 612         if [ ! $# -ge 2 ]; then
 613                 log ERROR "Not enough arguments"
 614                 return ${EXIT_ERROR}
 615         fi
 616
 617         local connection=${1}
 618         shift 1
 619         local value=$@
 620
 621         if ! isinteger value; then
 622                 value=$(parse_time $@)
 623                 if [ ! $? -eq 0 ]; then
 624                         log ERROR "Parsing the passed time was not sucessful please check the passed values."
 625                         return ${EXIT_ERROR}
 626                 fi
 627         fi
 628
 629         if [ ${value} -lt 0 ]; then
 630                 log ERROR "The passed time value must be in the sum greater or equal zero seconds."
 631                 return ${EXIT_ERROR}
 632         fi
 633
 634         if ! ipsec_connection_write_config_key "${connection}" "DPD_DELAY" ${value}; then
 635                 log ERROR "Could not write configuration settings"
 636                 return ${EXIT_ERROR}
 637         fi
 638
 639         return ${EXIT_OK}
 640 }
 641
 642 # Set the dpd timeout
 643 ipsec_connection_dpd_timeout() {
 644         if [ ! $# -ge 2 ]; then
 645                 log ERROR "Not enough arguments"
 646                 return ${EXIT_ERROR}
 647         fi
 648
 649         local connection=${1}
 650         shift 1
 651         local value=$@
 652
 653         if ! isinteger value; then
 654                 value=$(parse_time $@)
 655                 if [ ! $? -eq 0 ]; then
 656                         log ERROR "Parsing the passed time was not sucessful please check the passed values."
 657                         return ${EXIT_ERROR}
 658                 fi
 659         fi
 660
 661         if [ ${value} -le 0 ]; then
 662                 log ERROR "The passed time value must be in the sum greater or equal zero seconds."
 663                 return ${EXIT_ERROR}
 664         fi
 665
 666         if ! ipsec_connection_write_config_key "${connection}" "DPD_TIMEOUT" ${value}; then
 667                 log ERROR "Could not write configuration settings"
 668                 return ${EXIT_ERROR}
 669         fi
 670
 671         return ${EXIT_OK}
 672 }
 673
 674 # Handle the cli after local
 675 ipsec_connection_local() {
 676         if [ ! $# -ge 2 ]; then
 677                 log ERROR "Not enough arguments"
 678                 return ${EXIT_ERROR}
 679         fi
 680
 681         local connection=${1}
 682         local cmd=${2}
 683         shift 2
 684
 685         case ${cmd} in
 686                 address)
 687                         ipsec_connection_local_address "${connection}" $@
 688                         ;;
 689                 id)
 690                         ipsec_connection_id "${connection}" "LOCAL" $@
 691                         ;;
 692                 prefix)
 693                         ipsec_connection_prefix "${connection}" "LOCAL" $@
 694                         ;;
 695                 *)
 696                         log ERROR "Unrecognized argument: ${cmd}"
 697                         return ${EXIT_ERROR}
 698                         ;;
 699         esac
 700
 701         return ${EXIT_OK}
 702 }
 703
 704 # Set the connection mode
 705 ipsec_connection_mode() {
 706         if [ ! $# -eq 2 ]; then
 707                 log ERROR "Not enough arguments"
 708                 return ${EXIT_ERROR}
 709         fi
 710         local connection=${1}
 711         local mode=${2}
 712
 713         if ! isoneof mode ${IPSEC_VALID_MODES}; then
 714                 log ERROR "Mode '${mode}' is invalid"
 715                 return ${EXIT_ERROR}
 716         fi
 717
 718         if ! ipsec_connection_write_config_key "${connection}" "MODE" ${mode}; then
 719                 log ERROR "Could not write configuration settings"
 720                 return ${EXIT_ERROR}
 721         fi
 722
 723         return ${EXIT_OK}
 724 }
 725
 726 # Set the local address
 727 ipsec_connection_local_address() {
 728         if [ ! $# -eq 2 ]; then
 729                 log ERROR "Not enough arguments"
 730                 return ${EXIT_ERROR}
 731         fi
 732         local connection=${1}
 733         local local_address=${2}
 734
 735         if ! ipsec_connection_check_peer ${local_address}; then
 736                 log ERROR "Local address '${local_address}' is invalid"
 737                 return ${EXIT_ERROR}
 738         fi
 739
 740         if ! ipsec_connection_write_config_key "${connection}" "LOCAL_ADDRESS" ${local_address}; then
 741                 log ERROR "Could not write configuration settings"
 742                 return ${EXIT_ERROR}
 743         fi
 744
 745         return ${EXIT_OK}
 746 }
 747
 748 # Set the peer to connect to
 749 ipsec_connection_peer() {
 750         if [ ! $# -eq 2 ]; then
 751                 log ERROR "Not enough arguments"
 752                 return ${EXIT_ERROR}
 753         fi
 754         local connection=${1}
 755         local peer=${2}
 756
 757         if ! ipsec_connection_check_peer ${peer}; then
 758                 log ERROR "Peer '${peer}' is invalid"
 759                 return ${EXIT_ERROR}
 760         fi
 761
 762         if ! ipsec_connection_write_config_key "${connection}" "PEER" ${peer}; then
 763                 log ERROR "Could not write configuration settings"
 764                 return ${EXIT_ERROR}
 765         fi
 766
 767         return ${EXIT_OK}
 768 }
 769
 770 #Set the local or remote id
 771 ipsec_connection_id() {
 772         if [ ! $# -eq 3 ]; then
 773                 log ERROR "Not enough arguments"
 774                 return ${EXIT_ERROR}
 775         fi
 776         local connection=${1}
 777         local type=${2}
 778         local id=${3}
 779
 780         if ! ipsec_connection_check_id ${id}; then
 781                 log ERROR "Id '${id}' is invalid"
 782                 return ${EXIT_ERROR}
 783         fi
 784
 785         if ! ipsec_connection_write_config_key "${connection}" "${type}_ID" ${id}; then
 786                 log ERROR "Could not write configuration settings"
 787                 return ${EXIT_ERROR}
 788         fi
 789
 790         return ${EXIT_OK}
 791 }
 792
 793 # Set the local or remote prefix
 794 ipsec_connection_prefix() {
 795         if [ ! $# -ge 3 ]; then
 796                 log ERROR "Not enough arguments"
 797                 return ${EXIT_ERROR}
 798         fi
 799         local connection=${1}
 800         local type=${2}
 801         shift 2
 802
 803         local _prefix="${type}_PREFIX"
 804         local "${_prefix}"
 805         if ! ipsec_connection_read_config "${connection}" "${_prefix}"; then
 806                 return ${EXIT_ERROR}
 807         fi
 808
 809         # Remove duplicated entries to proceed the list safely
 810         assign "${_prefix}" "$(list_unique ${!_prefix} )"
 811
 812         local prefixes_added
 813         local prefixes_removed
 814         local prefixes_set
 815
 816         while [ $# -gt 0 ]; do
 817                 local arg="${1}"
 818
 819                 case "${arg}" in
 820                         +*)
 821                                 list_append prefixes_added "${arg:1}"
 822                                 ;;
 823                         -*)
 824                                 list_append prefixes_removed "${arg:1}"
 825                                 ;;
 826                         [A-Fa-f0-9]*)
 827                                 list_append prefixes_set "${arg}"
 828                                 ;;
 829                         *)
 830                                 error "Invalid argument: ${arg}"
 831                                 return ${EXIT_ERROR}
 832                                 ;;
 833                 esac
 834                 shift
 835         done
 836
 837         # Check if the user is trying a mixed operation
 838         if ! list_is_empty prefixes_set && (! list_is_empty prefixes_added || ! list_is_empty prefixes_removed); then
 839                 error "You cannot reset the prefix list and add or remove prefixes at the same time"
 840                 return ${EXIT_ERROR}
 841         fi
 842
 843         # Set new prefix list
 844         if ! list_is_empty prefixes_set; then
 845                 # Check if all prefixes are valid
 846                 local prefix
 847                 for prefix in ${prefixes_set}; do
 848                         if ! ip_net_is_valid ${prefix}; then
 849                                 error "Unsupported prefix: ${prefix}"
 850                                 return ${EXIT_ERROR}
 851                         fi
 852                 done
 853
 854                 assign "${_prefix}" "${prefixes_set}"
 855
 856         # Perform incremental updates
 857         else
 858                 local prefix
 859
 860                 # Perform all removals
 861                 for prefix in ${prefixes_removed}; do
 862                         if ! list_remove "${_prefix}" ${prefix}; then
 863                                 warning "${prefix} was not on the list and could not be removed"
 864                         fi
 865                 done
 866
 867
 868                 for prefix in ${prefixes_added}; do
 869                         if ip_net_is_valid ${prefix}; then
 870                                 if ! list_append_unique "${_prefix}" ${prefix}; then
 871                                         warning "${prefix} is already on the prefix list"
 872                                 fi
 873                         else
 874                                 warning "${prefix} is not a valid IP network and could not be added"
 875                         fi
 876                 done
 877         fi
 878
 879         # Check if the list contain at least one valid prefix
 880         if list_is_empty ${_prefix}; then
 881                 error "Cannot save an empty prefix list"
 882                 return ${EXIT_ERROR}
 883         fi
 884
 885         # Save everything
 886         if ! ipsec_connection_write_config_key "${connection}" "${_prefix}" ${!_prefix}; then
 887                 log ERROR "Could not write configuration settings"
 888         fi
 889
 890         return ${EXIT_OK}
 891 }
 892
 893 # Set the pools to use
 894 ipsec_connection_pool() {
 895         if [ ! $# -ge 2 ]; then
 896                 log ERROR "Not enough arguments"
 897                 return ${EXIT_ERROR}
 898         fi
 899         local connection=${1}
 900         shift
 901
 902         local POOLS
 903         if ! ipsec_connection_read_config "${connection}" "POOLS"; then
 904                 return ${EXIT_ERROR}
 905         fi
 906
 907         # Remove duplicated entries to proceed the list safely
 908         assign "POOLS" "$(list_unique ${POOLS})"
 909
 910         local pools_added
 911         local pools_removed
 912         local pools_set
 913
 914         while [ $# -gt 0 ]; do
 915                 local arg="${1}"
 916
 917                 case "${arg}" in
 918                         +*)
 919                                 list_append pools_added "${arg:1}"
 920                                 ;;
 921                         -*)
 922                                 list_append pools_removed "${arg:1}"
 923                                 ;;
 924                         [A-Za-z0-9]*)
 925                                 list_append pools_set "${arg}"
 926                                 ;;
 927                         *)
 928                                 error "Invalid argument: ${arg}"
 929                                 return ${EXIT_ERROR}
 930                                 ;;
 931                 esac
 932                 shift
 933         done
 934
 935         # Check if the user is trying a mixed operation
 936         if ! list_is_empty pools_set && (! list_is_empty pools_added || ! list_is_empty pools_removed); then
 937                 error "You cannot reset the pools list and add or remove pools at the same time"
 938                 return ${EXIT_ERROR}
 939         fi
 940
 941         # Set new pools list
 942         if ! list_is_empty pools_set; then
 943                 # Check if all pools are valid
 944                 local pool
 945                 for pool in ${pools_set}; do
 946                         if ! ipsec_pool_exists ${pool} || ! ipsec_pool_check_config ${pool}; then
 947                                 error "Pool ${pool} is not valid"
 948                                 return ${EXIT_ERROR}
 949                         fi
 950                 done
 951
 952                 assign "POOLS" "${pools_set}"
 953
 954         # Perform incremental updates
 955         else
 956                 local pool
 957
 958                 # Perform all removals
 959                 for pool in ${pools_removed}; do
 960                         if ! list_remove "POOLS" ${pool}; then
 961                                 warning "${pool} was not on the list and could not be removed"
 962                         fi
 963                 done
 964
 965
 966                 for pool in ${pools_added}; do
 967                         if ! ipsec_pool_exists ${pool} && ! ipsec_pool_check_config ${pool}; then
 968                                 if ! list_append_unique "POOLS" ${pool}; then
 969                                         warning "${pool} is already on the prefix list"
 970                                 fi
 971                         else
 972                                 warning "${pool} is not a valid pool"
 973                         fi
 974                 done
 975         fi
 976
 977         # Check if the list contain at least one valid pool
 978         if list_is_empty POOLS; then
 979                 error "Cannot save an empty pool list"
 980                 return ${EXIT_ERROR}
 981         fi
 982
 983         # Save everything
 984         if ! ipsec_connection_write_config_key "${connection}" "POOLS" ${POOLS}; then
 985                 log ERROR "Could not write configuration settings"
 986         fi
 987
 988         return ${EXIT_OK}
 989 }
 990
 991 # Handle the cli after remote
 992 ipsec_connection_remote() {
 993         if [ ! $# -ge 2 ]; then
 994                 log ERROR "Not enough arguments"
 995                 return ${EXIT_ERROR}
 996         fi
 997
 998         local connection=${1}
 999         local cmd=${2}
1000         shift 2
1001
1002         case ${cmd} in
1003                 id)
1004                         ipsec_connection_id "${connection}" "REMOTE" $@
1005                         ;;
1006
1007                 prefix)
1008                         ipsec_connection_prefix "${connection}" "REMOTE" $@
1009                         ;;
1010                 *)
1011                         log ERROR "Unrecognized argument: ${cmd}"
1012                         return ${EXIT_ERROR}
1013                         ;;
1014         esac
1015
1016         return ${EXIT_OK}
1017 }
1018
1019 # Set the inactivity timeout
1020 ipsec_connection_inactivity_timeout() {
1021         if [ ! $# -ge 2 ]; then
1022                 log ERROR "Not enough arguments"
1023                 return ${EXIT_ERROR}
1024         fi
1025
1026         local connection=${1}
1027         shift 1
1028         local value=$@
1029
1030         if ! isinteger value; then
1031                 value=$(parse_time $@)
1032                 if [ ! $? -eq 0 ]; then
1033                         log ERROR "Parsing the passed time was not sucessful please check the passed values."
1034                         return ${EXIT_ERROR}
1035                 fi
1036         fi
1037
1038         if [ ${value} -le 0 ]; then
1039                 log ERROR "The passed time value must be in the sum greater zero seconds."
1040                 return ${EXIT_ERROR}
1041         fi
1042
1043         if ! ipsec_connection_write_config_key "${connection}" "INACTIVITY_TIMEOUT" ${value}; then
1044                 log ERROR "Could not write configuration settings"
1045                 return ${EXIT_ERROR}
1046         fi
1047
1048         return ${EXIT_OK}
1049 }
1050
1051 # Set the default start action
1052 ipsec_connection_start_action() {
1053         if [ ! $# -eq 2 ]; then
1054                 log ERROR "Not enough arguments"
1055                 return ${EXIT_ERROR}
1056         fi
1057         local connection=${1}
1058         local action=${2}
1059
1060         if ! isoneof action "on-demand" "always-on"; then
1061                 log ERROR "Start action '${action}' is invalid"
1062                 return ${EXIT_ERROR}
1063         fi
1064
1065         if ! ipsec_connection_write_config_key "${connection}" "START_ACTION" ${action}; then
1066                 log ERROR "Could not write configuration settings"
1067                 return ${EXIT_ERROR}
1068         fi
1069 }
1070
1071 # Set the security policy to use
1072 ipsec_connection_security_policy() {
1073         if [ ! $# -eq 2 ]; then
1074                 log ERROR "Not enough arguments"
1075                 return ${EXIT_ERROR}
1076         fi
1077         local connection=${1}
1078         local security_policy=${2}
1079
1080         if ! vpn_security_policy_exists ${security_policy}; then
1081                 log ERROR "No such vpn security policy '${security_policy}'"
1082                 return ${EXIT_ERROR}
1083         fi
1084
1085         if ! ipsec_connection_write_config_key "${connection}" "SECURITY_POLICY" ${security_policy}; then
1086                 log ERROR "Could not write configuration settings"
1087                 return ${EXIT_ERROR}
1088         fi
1089 }
1090
1091 # Check if a id is valid
1092 ipsec_connection_check_id() {
1093         assert [ $# -eq 1 ]
1094         local id=${1}
1095
1096         if [[ ${id} =~ ^@[[:alnum:]]+$ ]] || ip_is_valid ${id}; then
1097                 return ${EXIT_TRUE}
1098         else
1099                 return ${EXIT_FALSE}
1100         fi
1101 }
1102
1103 # Checks if a peer is valid
1104 ipsec_connection_check_peer() {
1105         assert [ $# -eq 1 ]
1106         local peer=${1}
1107
1108         # TODO Accept also FQDNs
1109         if ip_is_valid ${peer}; then
1110                 return ${EXIT_TRUE}
1111         else
1112                 return ${EXIT_FALSE}
1113         fi
1114 }
1115
1116 # This function checks if a VPN IPsec connection name is valid
1117 # Allowed are only A-Za-z0-9
1118 ipsec_connection_check_name() {
1119         assert [ $# -eq 1 ]
1120
1121         local connection=${1}
1122
1123         [[ "${connection}" =~ [^[:alnum:]$] ]]
1124 }
1125
1126 # Function that creates one VPN IPsec connection
1127 ipsec_connection_new() {
1128         if [ $# -gt 1 ]; then
1129                 error "Too many arguments"
1130                 return ${EXIT_ERROR}
1131         fi
1132
1133         local connection="${1}"
1134         if ! isset connection; then
1135                 error "Please provide a connection name"
1136                 return ${EXIT_ERROR}
1137         fi
1138
1139         # Check for duplicates
1140         if ipsec_connection_exists "${connection}"; then
1141                 error "The VPN IPsec connection ${connection} already exists"
1142                 return ${EXIT_ERROR}
1143         fi
1144
1145         # Check if the name of the connection is valid
1146         if  ipsec_connection_check_name "${connection}"; then
1147                 error "'${connection}' contains illegal characters"
1148                 return ${EXIT_ERROR}
1149         fi
1150
1151         log DEBUG "Creating VPN IPsec connection ${connection}"
1152
1153         if ! mkdir -p "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
1154                 log ERROR "Could not create config directory for ${connection}"
1155                 return ${EXIT_ERROR}
1156         fi
1157
1158         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
1159
1160         AUTH_MODE=${IPSEC_DEFAULT_AUTH_MODE}
1161         DPD_ACTION=${IPSEC_DEFAULT_DPD_ACTION}
1162         DPD_DELAY=${IPSEC_DEFAULT_DPD_DELAY}
1163         DPD_TIMEOUT=${IPSEC_DEFAULT_DPD_TIMEOUT}
1164         ENABLED=${IPSEC_DEFAULT_ENABLED}
1165         MODE=${IPSEC_DEFAULT_MODE}
1166         START_ACTION=${IPSEC_DEFAULT_START_ACTION}
1167
1168         INACTIVITY_TIMEOUT=${IPSEC_DEFAULT_INACTIVITY_TIMEOUT}
1169         SECURITY_POLICY=${IPSEC_DEFAULT_SECURITY_POLICY}
1170
1171         if ! ipsec_connection_write_config "${connection}"; then
1172                 log ERROR "Could not write new config file"
1173                 return ${EXIT_ERROR}
1174         fi
1175
1176         # Configure strongswan autostart
1177         ipsec_strongswan_autostart
1178 }
1179
1180 # Function that deletes based on the passed parameters one ore more vpn security policies
1181 ipsec_connection_destroy() {
1182         local connection
1183         for connection in $@; do
1184                 if ! ipsec_connection_exists "${connection}"; then
1185                         log ERROR "The VPN IPsec connection ${connection} does not exist."
1186                         continue
1187                 fi
1188
1189                 log DEBUG "Deleting VPN IPsec connection ${connection}"
1190
1191                 # Delete strongswan configuration file
1192                 file_delete "${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf"
1193
1194                 if ! rm -rf "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
1195                         log ERROR "Deleting the VPN IPsec connection ${connection} was not sucessful"
1196                         return ${EXIT_ERROR}
1197                 fi
1198
1199         done
1200 }
1201
1202 # List all ipsec connections
1203 ipsec_list_connections() {
1204         local connection
1205         for connection in ${NETWORK_IPSEC_CONNS_DIR}/*; do
1206                 [ -d ${connection} ] || continue
1207                 basename ${connection}
1208         done
1209 }
1210
1211 ipsec_connection_to_strongswan() {
1212         local connection="${1}"
1213
1214         # Read the config settings
1215         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
1216         if ! ipsec_connection_read_config "${connection}"; then
1217                 error "Could not read the connection ${connection}"
1218                 return ${EXIT_ERROR}
1219         fi
1220
1221         local path="${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf"
1222
1223         (
1224                 # Write the connection section
1225                 _ipsec_connection_to_strongswan_connection "${connection}"
1226
1227                 # Write the secrets section
1228                 _ipsec_connection_to_strongswan_secrets "${connection}"
1229
1230         ) > ${path}
1231 }
1232
1233 _ipsec_connection_to_strongswan_connection() {
1234         local connection="${1}"
1235
1236         # Read the security policy
1237         local ${VPN_SECURITY_POLICIES_CONFIG_SETTINGS}
1238         if ! vpn_security_policies_read_config "${SECURITY_POLICY}"; then
1239                 return ${EXIT_ERROR}
1240         fi
1241
1242         # Is DPD enabled?
1243         local dpd="false"
1244         if isset DPD_DELAY && isinteger DPD_DELAY && [ ${DPD_DELAY} -gt 0 ]; then
1245                 dpd="true"
1246         fi
1247
1248         # Write configuration header
1249         config_header "strongSwan configuration for ${connection}"
1250
1251         print_indent 0 "connections {"
1252         print_indent 1 "${connection} {"
1253
1254         # IKE Version
1255         print_indent 2 "# IKE Version"
1256         case "${KEY_EXCHANGE^^}" in
1257                 IKEV1)
1258                         print_indent 2 "version = 1"
1259                         ;;
1260
1261                 # Fall back to IKEv2 for any random values
1262                 IKEV2|*)
1263                         print_indent 2 "version = 2"
1264                         ;;
1265         esac
1266         print # empty line
1267
1268         # Always only keep one connection open at a time
1269         print_indent 2 "# Unique IDs"
1270         print_indent 2 "unique = replace"
1271         print
1272
1273         # Local Address
1274         print_indent 2 "# Local Address"
1275         if isset LOCAL_ADDRESS; then
1276                 print_indent 2 "local_addrs = ${LOCAL_ADDRESS}"
1277         else
1278                 print_indent 2 "local_addrs = %any"
1279         fi
1280         print
1281
1282         # Remote Address
1283         print_indent 2 "# Remote Address"
1284         if isset PEER; then
1285                 print_indent 2 "remote_addrs = ${PEER}"
1286         else
1287                 print_indent 2 "remote_addrs = %any"
1288         fi
1289         print
1290
1291         # IKE Proposals
1292         print_indent 2 "# IKE Proposals"
1293         print_indent 2 "proposals = $(vpn_security_policies_make_ike_proposal ${SECURITY_POLICY})"
1294         print
1295
1296         # DPD Settings
1297         if enabled dpd; then
1298                 print_indent 2 "# Dead Peer Detection"
1299                 print_indent 2 "dpd_delay = ${DPD_DELAY}"
1300
1301                 if isset DPD_TIMEOUT; then
1302                         print_indent 2 "dpd_timeout = ${DPD_TIMEOUT}"
1303                 fi
1304
1305                 print
1306         fi
1307
1308         # Fragmentation
1309         print_indent 2 "# Fragmentation"
1310         print_indent 2 "fragmentation = yes"
1311         print
1312
1313         # Pools
1314         if isset POOLS; then
1315                 print_indent 2 "# Pools"
1316                 print_indent 2 "pools = $(list_join POOLS ", ")"
1317                 print
1318         fi
1319
1320         # Local
1321         print_indent 2 "local {"
1322
1323         # Local ID
1324         if isset LOCAL_ID; then
1325                 print_indent 3 "id = ${LOCAL_ID}"
1326         fi
1327
1328         # Authentication
1329         case "${AUTH_MODE}" in
1330                 PSK)
1331                         print_indent 3 "auth = psk"
1332                         ;;
1333         esac
1334
1335         print_indent 2 "}"
1336         print
1337
1338         # Remote
1339         print_indent 2 "remote {"
1340
1341         # Remote ID
1342         if isset REMOTE_ID; then
1343                 print_indent 3 "id = ${REMOTE_ID}"
1344         fi
1345
1346         # Authentication
1347         case "${AUTH_MODE}" in
1348                 PSK)
1349                         print_indent 3 "auth = psk"
1350                         ;;
1351         esac
1352
1353         print_indent 2 "}"
1354         print
1355
1356         # Children
1357
1358         print_indent 2 "children {"
1359         print_indent 3 "${connection} {"
1360
1361         print_indent 4 "# ESP Proposals"
1362         print_indent 4 "esp_proposals = $(vpn_security_policies_make_esp_proposal ${SECURITY_POLICY})"
1363         print
1364
1365         # Traffic Selectors
1366
1367         case "${MODE}" in
1368                 gre-*)
1369                         print_indent 4 "local_ts = dynamic[gre]"
1370                         print_indent 4 "remote_ts = dynamic[gre]"
1371                         ;;
1372                 *)
1373                         # Local Prefixes
1374                         if isset LOCAL_PREFIX; then
1375                                 print_indent 4 "local_ts = $(list_join LOCAL_PREFIX ,)"
1376                         else
1377                                 print_indent 4 "local_ts = dynamic"
1378                         fi
1379
1380                         # Remote Prefixes
1381                         if isset REMOTE_PREFIX; then
1382                                 print_indent 4 "remote_ts = $(list_join REMOTE_PREFIX ,)"
1383                         else
1384                                 print_indent 4 "remote_ts = dynamic"
1385                         fi
1386                         ;;
1387         esac
1388         print
1389
1390         # Netfilter Marks
1391         case "${MODE}" in
1392                 vti)
1393                         print_indent 4 "# Netfilter Marks"
1394                         print_indent 4 "mark_in = %unique"
1395                         print_indent 4 "mark_out = %unique"
1396                         print
1397                         ;;
1398         esac
1399
1400         # Dead Peer Detection
1401         if enabled dpd; then
1402                 print_indent 4 "# Dead Peer Detection"
1403                 print_indent 4 "dpd_action = ${DPD_ACTION}"
1404                 print
1405         fi
1406
1407         # Rekeying
1408         if isset LIFETIME; then
1409                 print_indent 4 "# Rekey Time"
1410                 print_indent 4 "rekey_time = ${LIFETIME}"
1411                 print
1412         fi
1413
1414         # Updown Script
1415         print_indent 4 "updown = ${NETWORK_HELPERS_DIR}/ipsec-updown"
1416         print
1417
1418         # Mode
1419         print_indent 4 "# Mode"
1420         case "${MODE}" in
1421                 gre-transport)
1422                         print_indent 4 "mode = transport"
1423                         ;;
1424                 tunnel|vti|*)
1425                         print_indent 4 "mode = tunnel"
1426                         ;;
1427         esac
1428         print
1429
1430         # Compression
1431         print_indent 4 "# Compression"
1432         if enabled COMPRESSION; then
1433                 print_indent 4 "ipcomp = yes"
1434         else
1435                 print_indent 4 "ipcomp = no"
1436         fi
1437         print
1438
1439         # Inactivity Timeout
1440         if isset INACTIVITY_TIMEOUT; then
1441                 print_indent 4 "# Inactivity Timeout"
1442                 print_indent 4 "inactivity = ${INACTIVITY_TIMEOUT}"
1443                 print
1444         fi
1445
1446         # Start Action
1447         print_indent 4 "# Start Action"
1448         case "${START_ACTION}" in
1449                 on-demand)
1450                         print_indent 4 "start_action = trap"
1451                         print_indent 4 "close_action = trap"
1452                         ;;
1453                 wait)
1454                         print_indent 4 "start_action = none"
1455                         print_indent 4 "close_action = none"
1456                         ;;
1457                 always-on|*)
1458                         print_indent 4 "start_action = start"
1459                         print_indent 4 "close_action = start"
1460                         ;;
1461         esac
1462         print
1463
1464         print_indent 3 "}"
1465         print_indent 2 "}"
1466         print
1467
1468         print_indent 1 "}"
1469         print_indent 0 "}"
1470         print
1471 }
1472
1473 _ipsec_connection_to_strongswan_secrets() {
1474         local connection="${1}"
1475
1476         print_indent 0 "secrets {"
1477
1478         case "${AUTH_MODE}" in
1479                 PSK)
1480                         print_indent 1 "ike {"
1481
1482                         # Secret
1483                         print_indent 2 "secret = ${PSK}"
1484
1485                         # ID
1486                         if isset REMOTE_ID; then
1487                                 print_indent 2 "id = ${REMOTE_ID}"
1488                         fi
1489
1490                         print_indent 1 "}"
1491                         ;;
1492         esac
1493
1494         print_indent 0 "}"
1495 }
1496
1497 # This function writes all values to a via ${pool} specificated VPN IPsec pool configuration file
1498 ipsec_pool_write_config() {
1499         assert [ $# -ge 1 ]
1500
1501         local pool="${1}"
1502
1503         if ! ipsec_pool_exists "${pool}"; then
1504                 log ERROR "No such VPN IPsec pool: ${pool}"
1505                 return ${EXIT_ERROR}
1506         fi
1507
1508         local path="${NETWORK_IPSEC_POOLS_DIR}/${pool}/settings"
1509
1510         if ! settings_write "${path}" ${IPSEC_POOL_CONFIG_SETTINGS}; then
1511                 log ERROR "Could not write configuration settings for VPN IPsec pool ${pool}"
1512                 return ${EXIT_ERROR}
1513         fi
1514
1515         if ! ipsec_pool_reload ${pool}; then
1516                 log WARNING "Could not reload IPsec pool ${pool}"
1517         fi
1518
1519         # When we get here the writing of the config file was successful
1520         return ${EXIT_OK}
1521 }
1522
1523 # This funtion writes the value for one key to a via ${connection} specificated
1524 # VPN IPsec pool configuration file
1525 ipsec_pool_write_config_key() {
1526         assert [ $# -ge 3 ]
1527
1528         local pool=${1}
1529         local key=${2}
1530         shift 2
1531
1532         local value="$@"
1533
1534         if ! ipsec_pool_exists "${pool}"; then
1535                 log ERROR "No such VPN IPsec pool: ${pool}"
1536                 return ${EXIT_ERROR}
1537         fi
1538
1539         log DEBUG "Set '${key}' to new value '${value}' in VPN IPsec pool '${pool}'"
1540
1541         local ${IPSEC_POOL_CONFIG_SETTINGS}
1542
1543         # Read the config settings
1544         if ! ipsec_pool_read_config "${pool}"; then
1545                 return ${EXIT_ERROR}
1546         fi
1547
1548         # Set the key to a new value
1549         assign "${key}" "${value}"
1550
1551         if ! ipsec_pool_write_config "${pool}"; then
1552                 return ${EXIT_ERROR}
1553         fi
1554
1555         return ${EXIT_TRUE}
1556 }
1557
1558 # Reads one or more keys out of a settings file or all if no key is provided.
1559 ipsec_pool_read_config() {
1560         assert [ $# -ge 1 ]
1561
1562         local pool="${1}"
1563         shift 1
1564
1565         if ! ipsec_pool_exists "${pool}"; then
1566                 log ERROR "No such VPN IPsec pool : ${pool}"
1567                 return ${EXIT_ERROR}
1568         fi
1569
1570         local args
1571         if [ $# -eq 0 ] && [ -n "${IPSEC_POOL_CONFIG_SETTINGS}" ]; then
1572                 list_append args ${IPSEC_POOL_CONFIG_SETTINGS}
1573         else
1574                 list_append args $@
1575         fi
1576
1577         local path="${NETWORK_IPSEC_POOLS_DIR}/${pool}/settings"
1578
1579         if ! settings_read "${path}" ${args}; then
1580                 log ERROR "Could not read settings for VPN IPsec pool ${pool}"
1581                 return ${EXIT_ERROR}
1582         fi
1583 }
1584
1585 # This function checks if a vpn IPsec pool exists
1586 # Returns True when yes and false when not
1587 ipsec_pool_exists() {
1588         assert [ $# -eq 1 ]
1589
1590         local pool=${1}
1591
1592         local path="${NETWORK_IPSEC_POOLS_DIR}/${pool}"
1593
1594         [ -d "${path}" ] && return ${EXIT_TRUE} || return ${EXIT_FALSE}
1595 }
1596
1597 # This function checks if a VPN IPsec pool name is valid
1598 # Allowed are only A-Za-z0-9
1599 ipsec_pool_check_name() {
1600         assert [ $# -eq 1 ]
1601
1602         local pool=${1}
1603
1604         # These are special words in strongswan
1605         if isoneof pool dhcp radius; then
1606                 return ${EXIT_ERROR}
1607         fi
1608
1609         [[ "${pool}" =~ [^[:alnum:]$] ]]
1610 }
1611
1612 ipsec_pool_new() {
1613         if [ $# -gt 1 ]; then
1614                 error "Too many arguments"
1615                 return ${EXIT_ERROR}
1616         fi
1617
1618         local pool="${1}"
1619         if ! isset pool; then
1620                 error "Please provide a pool name"
1621                 return ${EXIT_ERROR}
1622         fi
1623
1624         # Check for duplicates
1625         if ipsec_pool_exists "${pool}"; then
1626                 error "The VPN IPsec pool ${pool} already exists"
1627                 return ${EXIT_ERROR}
1628         fi
1629
1630         # Check if the name of the connection is valid
1631         if  ipsec_pool_check_name "${pool}"; then
1632                 error "'${pool}' contains illegal characters"
1633                 return ${EXIT_ERROR}
1634         fi
1635
1636         log DEBUG "Creating VPN IPsec pool ${pool}"
1637
1638         if ! mkdir -p "${NETWORK_IPSEC_POOLS_DIR}/${pool}"; then
1639                 log ERROR "Could not create config directory for ${pool}"
1640                 return ${EXIT_ERROR}
1641         fi
1642
1643         local ${IPSEC_POOL_CONFIG_SETTINGS}
1644
1645         if ! ipsec_pool_write_config "${pool}"; then
1646                 log ERROR "Could not write new config file"
1647                 return ${EXIT_ERROR}
1648         fi
1649 }
1650
1651 # Function that deletes based on the passed parameters
1652 # one ore more vpn ipsec pools
1653 ipsec_pool_destroy() {
1654         local pool
1655         for pool in $@; do
1656                 if ! ipsec_pool_exists "${pool}"; then
1657                         log ERROR "The VPN IPsec pool ${pool} does not exist."
1658                         continue
1659                 fi
1660
1661                 log DEBUG "Deleting VPN IPsec pool ${pool}"
1662
1663                 if ! rm -rf "${NETWORK_IPSEC_POOLS_DIR}/${pool}"; then
1664                         log ERROR "Deleting the VPN IPsec pool ${pool} was not sucessful"
1665                         return ${EXIT_ERROR}
1666                 fi
1667         done
1668 }
1669
1670 ipsec_pool_set_type() {
1671         local pool=${1}
1672         local ip=${2}
1673         assert isset pool
1674         assert isset ip
1675
1676         local type=$(ip_detect_protocol ${ip})
1677
1678         if ! isset type; then
1679                 error "Cannot detect IP protocol of ${ip}"
1680                 return ${EXIT_ERROR}
1681         else
1682                 log DEBUG "IP protocol of ${ip} is ${type}"
1683                 if ! ipsec_pool_write_config_key "${pool}" "TYPE" ${type}; then
1684                         log ERROR "Could not write configuration settings"
1685                         return ${EXIT_ERROR}
1686                 fi
1687         fi
1688 }
1689
1690 ipsec_pool_network() {
1691         if [ ! $# -eq 2 ]; then
1692                 log ERROR "Not enough arguments"
1693                 return ${EXIT_ERROR}
1694         fi
1695         local pool=${1}
1696         local network=${2}
1697
1698         local TYPE
1699         if ! ipsec_pool_read_config ${pool} "TYPE"; then
1700                 error "Failed to read configuration settings for pool '${pool}'"
1701                 return ${EXIT_ERROR}
1702         fi
1703
1704         if ! isset TYPE; then
1705                 if ! ip_net_is_valid ${network}; then
1706                         log ERROR "Network '${network}' is invalid"
1707                         return ${EXIT_ERROR}
1708                 fi
1709
1710                 if ! ipsec_pool_set_type ${pool} ${network}; then
1711                         log ERROR "Could not set type for IPsec pool ${pool}"
1712                         return ${EXIT_ERROR}
1713                 fi
1714         else
1715                 if ! ${TYPE}_net_is_valid ${network}; then
1716                         log ERROR "Network '${network}' is invalid"
1717                         return ${EXIT_ERROR}
1718                 fi
1719         fi
1720
1721         if ! ipsec_pool_write_config_key "${pool}" "NETWORK" ${network}; then
1722                 log ERROR "Could not write configuration settings"
1723                 return ${EXIT_ERROR}
1724         fi
1725 }
1726
1727 ipsec_pool_dns_server() {
1728         if [ ! $# -eq 2 ]; then
1729                 log ERROR "Not enough arguments"
1730                 return ${EXIT_ERROR}
1731         fi
1732         local pool=${1}
1733         local dns_server=${2}
1734
1735         local TYPE
1736         if ! ipsec_pool_read_config ${pool} "TYPE"; then
1737                 error "Failed to read configuration settings for pool '${pool}'"
1738                 return ${EXIT_ERROR}
1739         fi
1740
1741         if ! isset TYPE; then
1742                 if ! ip_is_valid ${dns_server}; then
1743                         log ERROR "DNS server '${dns_server}' is invalid"
1744                         return ${EXIT_ERROR}
1745                 fi
1746
1747                 if ! ipsec_pool_set_type ${pool} ${dns_server}; then
1748                         log ERROR "Could not set type for IPsec pool ${pool}"
1749                         return ${EXIT_ERROR}
1750                 fi
1751         else
1752                 if ! ${TYPE}_is_valid ${dns_server}; then
1753                         log ERROR "DNS server '${dns_server}' is invalid"
1754                         return ${EXIT_ERROR}
1755                 fi
1756         fi
1757
1758         if ! ipsec_pool_write_config_key "${pool}" "DNS_SERVER" ${dns_server}; then
1759                 log ERROR "Could not write configuration settings"
1760                 return ${EXIT_ERROR}
1761         fi
1762 }
1763
1764 ipsec_pool_check_config() {
1765         local pool=${1}
1766         assert isset pool
1767
1768         local ${IPSEC_POOL_CONFIG_SETTINGS}
1769         if ! ipsec_pool_read_config "${pool}"; then
1770                 log ERROR "Could not read configuration settings"
1771                 return ${EXIT_ERROR}
1772         fi
1773
1774         if ! isset NETWORK; then
1775                 log ERROR "Network for IPSec pool ${pool} is not set"
1776                 return ${EXIT_ERROR}
1777         fi
1778
1779         if ! isset TYPE; then
1780                 TYPE=$(ip_detect_protocol ${NETWORK})
1781                 log DEBUG "IP protocol of ${NETWORK} is ${TYPE}"
1782                 if ! isset TYPE; then
1783                         error "Cannot detect IP protocol of ${NETWORK}"
1784                         return ${EXIT_ERROR}
1785                 else
1786                         if ! ipsec_pool_write_config_key "${pool}" "TYPE" ${TYPE}; then
1787                                 log ERROR "Could not write configuration settings"
1788                                 return ${EXIT_ERROR}
1789                         fi
1790                 fi
1791         else
1792                 if ! ${TYPE}_net_is_valid ${NETWORK}; then
1793                         log ERROR "NETWORK '${NETWORK}' is invalid"
1794                         return ${EXIT_ERROR}
1795                 fi
1796
1797                 if isset DNS_SERVER && ! ${TYPE}_is_valid ${DNS_SERVER}; then
1798                         log ERROR "DNS server '${DNS_SERVER}' is invalid"
1799                         return ${EXIT_ERROR}
1800                 fi
1801         fi
1802
1803         return ${EXIT_OK}
1804 }
1805
1806 ipsec_pool_reload() {
1807         local pool=${1}
1808
1809         if ! ipsec_pool_to_strongswan ${pool}; then
1810                 log ERROR "Could not generate strongswan config for ${pool}"
1811                 return ${EXIT_ERROR}
1812         fi
1813
1814         ipsec_strongswan_load
1815 }
1816
1817 ipsec_pool_to_strongswan() {
1818         local pool=${1}
1819
1820         log DEBUG "Generating IPsec pool config for ${pool}"
1821
1822         local ${IPSEC_POOL_CONFIG_SETTINGS}
1823         if ! ipsec_pool_read_config "${pool}"; then
1824                 return ${EXIT_ERROR}
1825         fi
1826
1827         if isset NETWORK && ! ipsec_pool_check_config "${pool}"; then
1828                 log ERROR "Configuration of ${pool} seems to be invalid"
1829                 return ${EXIT_ERROR}
1830         fi
1831
1832         local path="${NETWORK_IPSEC_SWANCTL_POOLS_DIR}/${pool}.conf"
1833
1834         (
1835                 config_header "strongSwan pool configuration"
1836
1837                 if isset NETWORK; then
1838                         print_indent 0 "pools {"
1839
1840                         print_indent 1 "${pool} {"
1841                         print_indent 2 "addrs = ${NETWORK}"
1842
1843                         if isset DNS_SERVER; then
1844                                 print_indent 2 "dns = ${DNS_SERVER}"
1845                         fi
1846
1847                         print_indent 1 "}"
1848                         print_indent 0 "}"
1849                 fi
1850         ) > ${path}
1851 }