src/functions/functions.vpn-security-policies

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2017  IPFire Network Development Team                         #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 VPN_SECURITY_POLICIES_CONFIG_SETTINGS="CIPHER COMPRESSION GROUP_TYPE INTEGRITY KEY_EXCHANGE LIFETIME PFS"
  23 VPN_SECURITY_POLICIES_READONLY="system"
  24
  25 VPN_DEFAULT_SECURITY_POLICY="system"
  26
  27 declare -A VPN_SUPPORTED_CIPHERS=(
  28         [AES256-CBC]="256 bit AES-CBC"
  29         [AES192-CBC]="192 bit AES-CBC"
  30         [AES128-CBC]="128 bit AES-CBC"
  31 )
  32
  33 VPN_SUPPORTED_INTEGRITY="SHA512 SHA256 SHA128"
  34 VPN_SUPPORTED_GROUP_TYPES="MODP8192 MODP4096"
  35
  36 # This functions checks if a policy is readonly
  37 # returns true when yes and false when no
  38 vpn_security_policies_check_readonly() {
  39         if isoneof name ${VPN_SECURITY_POLICIES_READONLY}; then
  40                 return ${EXIT_TRUE}
  41         else
  42                 return ${EXIT_FALSE}
  43         fi
  44 }
  45
  46 # This function writes all values to a via ${name} specificated vpn security policy configuration file
  47 vpn_security_policies_write_config() {
  48         assert [ $# -ge 1 ]
  49
  50         local name="${1}"
  51
  52         if ! vpn_security_policy_exists "${name}"; then
  53                 log ERROR "No such vpn security policy: ${name}"
  54                 return ${EXIT_ERROR}
  55         fi
  56
  57         if vpn_security_policies_check_readonly "${name}"; then
  58                 log ERROR "The ${name} vpn security policy cannot be changed."
  59                 return ${EXIT_ERROR}
  60         fi
  61
  62         local path="$(vpn_security_policies_path "${name}")"
  63         if [ ! -w ${path} ]; then
  64                 log ERROR "${path} is not writeable"
  65                 return ${EXIT_ERROR}
  66         fi
  67
  68         if ! settings_write "${path}" ${VPN_SECURITY_POLICIES_CONFIG_SETTINGS}; then
  69                 log ERROR "Could not write configuration settings for vpn security policy ${name}"
  70                 return ${EXIT_ERROR}
  71         fi
  72
  73         # TODO everytime we successfully write a config we should call some trigger to take the changes into effect
  74 }
  75
  76 # This funtion writes the value for one key to a via ${name} specificated vpn security policy configuration file
  77 vpn_security_policies_write_config_key() {
  78         assert [ $# -ge 3 ]
  79
  80         local name=${1}
  81         local key=${2}
  82         shift 2
  83
  84         local value="$@"
  85
  86         if ! vpn_security_policy_exists "${name}"; then
  87                 log ERROR "No such vpn security policy: ${name}"
  88                 return ${EXIT_ERROR}
  89         fi
  90
  91         log DEBUG "Set '${key}' to new value '${value}' in vpn security policy ${name}"
  92
  93         local ${VPN_SECURITY_POLICIES_CONFIG_SETTINGS}
  94
  95         # Read the config settings
  96         if ! vpn_security_policies_read_config "${name}"; then
  97                 return ${EXIT_ERROR}
  98         fi
  99
 100         # Set the key to a new value
 101         assign "${key}" "${value}"
 102
 103         if ! vpn_security_policies_write_config "${name}"; then
 104                 return ${EXIT_ERROR}
 105         fi
 106
 107         return ${EXIT_TRUE}
 108 }
 109
 110 # Reads one or more keys out of a settings file or all if no key is provided.
 111 vpn_security_policies_read_config() {
 112         assert [ $# -ge 1 ]
 113
 114         local name="${1}"
 115         shift 1
 116
 117         if ! vpn_security_policy_exists "${name}"; then
 118                 log ERROR "No such vpn security policy: ${name}"
 119                 return ${EXIT_ERROR}
 120         fi
 121
 122
 123         local args
 124         if [ $# -eq 0 ] && [ -n "${VPN_SECURITY_POLICIES_CONFIG_SETTINGS}" ]; then
 125                 list_append args ${VPN_SECURITY_POLICIES_CONFIG_SETTINGS}
 126         else
 127                 list_append args $@
 128         fi
 129
 130         local path="$(vpn_security_policies_path ${name})"
 131
 132         if ! settings_read "${path}" ${args}; then
 133                 log ERROR "Could not read settings for vpn security policy ${name}"
 134                 return ${EXIT_ERROR}
 135         fi
 136 }
 137
 138 # Returns the path to a the configuration fora given name
 139 vpn_security_policies_path() {
 140         assert [ $# -eq 1 ]
 141
 142         local name=${1}
 143
 144         if vpn_security_policies_check_readonly "${name}"; then
 145                 echo "${NETWORK_SHARE_DIR}/vpn/security-policies/${name}"
 146         else
 147                 echo "${NETWORK_CONFIG_DIR}/vpn/security-policies/${name}"
 148         fi
 149 }
 150
 151 # Print the content of a vpn security policy configuration file in a nice way
 152 vpn_security_policies_show() {
 153         assert [ $# -eq 1 ]
 154
 155         local name=${1}
 156
 157         local ${VPN_SECURITY_POLICIES_CONFIG_SETTINGS}
 158         if ! vpn_security_policies_read_config ${name}; then
 159                 return ${EXIT_ERROR}
 160         fi
 161
 162         cli_print_fmt1 0 "Security Policy: ${name}"
 163         cli_space
 164
 165         # This could be done in a loop but a loop is much more complicated
 166         # because we print 'Group Types' but the variable is named 'GROUP_TYPES'
 167         cli_print_fmt1 1 "Ciphers:"
 168         cli_print_fmt1 2 "${CIPHER}"
 169         cli_space
 170
 171         cli_print_fmt1 1 "Integrity:"
 172         cli_print_fmt1 2 "${INTEGRITY}"
 173         cli_space
 174
 175         cli_print_fmt1 1 "Group Types:"
 176         cli_print_fmt1 2 "${GROUP_TYPE}"
 177         cli_space
 178
 179         cli_print_fmt1 1 "Key Exchange:" "${KEY_EXCHANGE}"
 180
 181         # Key Lifetime
 182         if isinteger LIFETIME && [ ${LIFETIME} -gt 0 ]; then
 183                 cli_print_fmt1 1 "Key Lifetime:" "$(format_time ${LIFETIME})"
 184         else
 185                 log ERROR "The value for Key Lifetime is not a valid integer greater zero."
 186         fi
 187
 188         # PFS
 189         if enabled PFS; then
 190                 cli_print_fmt1 1 "Perfect Forward Secrecy:" "enabled"
 191         else
 192                 cli_print_fmt1 1 "Perfect Forward Secrecy:" "disabled"
 193         fi
 194         cli_space
 195
 196         # Compression
 197         if enabled COMPRESSION; then
 198                 cli_print_fmt1 1 "Compression:" "enabled"
 199         else
 200                 cli_print_fmt1 1 "Compression:" "disabled"
 201         fi
 202         cli_space
 203 }
 204
 205 # This function checks if a vpn security policy exists
 206 # Returns True when yes and false when not
 207 vpn_security_policy_exists() {
 208         assert [ $# -eq 1 ]
 209
 210         local name=${1}
 211
 212         local path=$(vpn_security_policies_path "${name}")
 213
 214         [ -f ${path} ] && return ${EXIT_TRUE} || return ${EXIT_FALSE}
 215 }
 216
 217
 218 # This function parses the parameters for the 'cipher' command
 219 vpn_security_policies_cipher(){
 220         local name=${1}
 221         shift
 222
 223         if [ $# -eq 0 ]; then
 224                 log ERROR "You must pass at least one value after cipher"
 225                 return ${EXIT_ERROR}
 226         fi
 227
 228         local CIPHER
 229         if ! vpn_security_policies_read_config ${name} "CIPHER"; then
 230                 return ${EXIT_ERROR}
 231         fi
 232
 233         # Remove duplicated entries to proceed the list safely
 234         CIPHER="$(list_unique ${CIPHER})"
 235
 236         while [ $# -gt 0 ]; do
 237                 case "${1}" in
 238                         -*)
 239                                 value=${1#-}
 240                                 # Check if the cipher is in the list of ciphers and
 241                                 # check if the list has after removing this cipher at least one valid value
 242                                 if list_match ${value} ${CIPHER}; then
 243                                         list_remove CIPHER ${value}
 244                                 else
 245                                         # We do not break here because this error does not break the processing of the next maybe valid values.
 246                                         log ERROR "Can not remove ${value} from the list of Ciphers because ${value} is not in the list."
 247                                 fi
 248                                 ;;
 249                         +*)
 250                                 value=${1#+}
 251                                 # Check if the Ciphers is in the list of supported ciphers.
 252                                 if ! isoneof value ${!VPN_SUPPORTED_CIPHERS[@]}; then
 253                                         # We do not break here because this error does not break the processing of the next maybe valid values.
 254                                         log ERROR "${value} is not a supported cipher and can thats why not added to the list of ciphers."
 255                                 else
 256                                         if list_match ${value} ${CIPHER}; then
 257                                                 log WARNING "${value} is already in the list of ciphers of this policy."
 258                                         else
 259                                                 list_append CIPHER ${value}
 260                                         fi
 261                                 fi
 262                                 ;;
 263                 esac
 264                 shift
 265         done
 266
 267         # Check if the list contain at least one valid cipher
 268         if [ $(list_length ${CIPHER}) -ge 1 ]; then
 269                 if ! vpn_security_policies_write_config_key ${name} "CIPHER" ${CIPHER}; then
 270                         log ERROR "The changes for the vpn security policy ${name} could not be written."
 271                 fi
 272         else
 273                 log ERROR "After proceding all ciphers the list is empty and thats why no changes are written."
 274                 return ${EXIT_ERROR}
 275         fi
 276 }
 277
 278 # This function parses the parameters for the 'compression' command
 279 vpn_security_policies_compression(){
 280         local name=${1}
 281         local value=${2}
 282
 283         # Check if we get only one argument after compression <name>
 284         if [ ! $# -eq 2 ]; then
 285                 log ERROR "The number of arguments do not match. Only one argument after compression is allowed."
 286                 return ${EXIT_ERROR}
 287         fi
 288
 289         if ! isbool value; then
 290                 # We suggest only two values to avoid overburding the user.
 291                 log ERROR "Invalid Argument ${value}"
 292                 return ${EXIT_ERROR}
 293         fi
 294
 295         vpn_security_policies_write_config_key "${name}" "COMPRESSION" "${value}"
 296 }
 297
 298 # This function parses the parameters for the 'group-type' command
 299 vpn_security_policies_group_type(){
 300         local name=${1}
 301         shift
 302
 303         if [ $# -eq 0 ]; then
 304                 log ERROR "You must pass at least one value after group-type"
 305                 return ${EXIT_ERROR}
 306         fi
 307
 308         local GROUP_TYPE
 309         if ! vpn_security_policies_read_config ${name} "GROUP_TYPE"; then
 310                 return ${EXIT_ERROR}
 311         fi
 312
 313         # Remove duplicated entries to proceed the list safely
 314         GROUP_TYPE="$(list_unique ${GROUP_TYPE})"
 315
 316         while [ $# -gt 0 ]; do
 317                 case "${1}" in
 318                         -*)
 319                                 value=${1#-}
 320                                 # Check if the group type is in the list of group types and
 321                                 # check if the list has after removing this group type at leatst one valid value
 322                                 if list_match ${value} ${GROUP_TYPE}; then
 323                                         list_remove GROUP_TYPE ${value}
 324                                 else
 325                                         # We do not break here because this error does not break the processing of the next maybe valid values.
 326                                         log ERROR "Can not remove ${value} from the list of group types because ${value} is not in the list."
 327                                 fi
 328                                 ;;
 329                         +*)
 330                                 value=${1#+}
 331                                 # Check if the group type is in the list of supported group types.
 332                                 if ! isoneof value ${VPN_SUPPORTED_GROUP_TYPES}; then
 333                                         # We do not break here because the processing of other maybe valid values are indepent from this error.
 334                                         log ERROR "${value} is not a supported group type and can thats why not added to the list of group types."
 335                                 else
 336                                         if list_match ${value} ${GROUP_TYPE}; then
 337                                                 log WARNING "${value} is already in the list of group-types of this policy."
 338                                         else
 339                                                 list_append GROUP_TYPE ${value}
 340                                         fi
 341                                 fi
 342                                 ;;
 343                 esac
 344                 shift
 345         done
 346
 347         # Check if the list contain at least one valid group-type
 348         if [ $(list_length ${GROUP_TYPE}) -ge 1 ]; then
 349                 if ! vpn_security_policies_write_config_key ${name} "GROUP_TYPE" ${GROUP_TYPE}; then
 350                         log ERROR "The changes for the vpn security policy ${name} could not be written."
 351                 fi
 352         else
 353                 log ERROR "After proceding all group types the list is empty and thats why no changes are written."
 354                 return ${EXIT_ERROR}
 355         fi
 356 }
 357
 358 # This function parses the parameters for the 'integrity' command
 359 vpn_security_policies_integrity(){
 360         local name=${1}
 361         shift
 362
 363         if [ $# -eq 0 ]; then
 364                 log ERROR "You must pass at least one value after integrity."
 365                 return ${EXIT_ERROR}
 366         fi
 367
 368         local INTEGRITY
 369         if ! vpn_security_policies_read_config ${name} "INTEGRITY"; then
 370                 return ${EXIT_ERROR}
 371         fi
 372
 373         # Remove duplicated entries to proceed the list safely
 374         INTEGRITY="$(list_unique ${INTEGRITY})"
 375
 376         while [ $# -gt 0 ]; do
 377                 case "${1}" in
 378                         -*)
 379                                 value=${1#-}
 380                                 # Check if the integrity hash is in the list of integrity hashes and
 381                                 # check if the list has after removing this  integrity hash at least one valid value
 382                                 if list_match ${value} ${INTEGRITY}; then
 383                                         list_remove INTEGRITY ${value}
 384                                 else
 385                                         # We do not break here because the processing of other maybe valid values are indepent from this error.
 386                                         log ERROR "Can not remove ${value} from the list of integrity hashes because ${value} is not in the list."
 387                                 fi
 388                                 ;;
 389                         +*)
 390                                 value=${1#+}
 391                                 # Check if the Ciphers is in the list of supported integrity hashes.
 392                                 if ! isoneof value ${VPN_SUPPORTED_INTEGRITY}; then
 393                                         # We do not break here because the processing of other maybe valid values are indepent from this error.
 394                                         log ERROR "${value} is not a supported integrity hash and can thats why not added to the list of integrity hashes."
 395                                 else
 396                                         if list_match ${value} ${INTEGRITY}; then
 397                                                 log WARNING "${value} is already in the list of integrety hashes of this policy."
 398                                         else
 399                                                 list_append INTEGRITY ${value}
 400                                         fi
 401                                 fi
 402                                 ;;
 403                 esac
 404                 shift
 405         done
 406
 407         # Check if the list contain at least one valid group-type
 408         if [ $(list_length ${INTEGRITY}) -ge 1 ]; then
 409                 if ! vpn_security_policies_write_config_key ${name} "INTEGRITY" ${INTEGRITY}; then
 410                         log ERROR "The changes for the vpn security policy ${name} could not be written."
 411                 fi
 412         else
 413                 log ERROR "After proceding all integrity hashes the list is empty and thats why no changes are written."
 414                 return ${EXIT_ERROR}
 415         fi
 416 }
 417
 418 # This function parses the parameters for the 'key-exchange' command
 419 vpn_security_policies_key_exchange() {
 420         local name=${1}
 421         local value=${2}
 422
 423         # Check if we get only one argument after key-exchange <name>
 424         if [ ! $# -eq 2 ]; then
 425                 log ERROR "The number of arguments do not match. Only argument after key-exchange is allowed."
 426                 return ${EXIT_ERROR}
 427         fi
 428
 429         if ! isoneof value "ikev1" "ikev2" "IKEV1" "IKEV2"; then
 430                 log ERROR "Invalid Argument ${value}"
 431                 return ${EXIT_ERROR}
 432         fi
 433
 434         vpn_security_policies_write_config_key "${name}" "KEY_EXCHANGE" "${value,,}"
 435 }
 436
 437 # This function parses the parameters for the 'lifetime' command.
 438 vpn_security_policies_lifetime(){
 439         local name=${1}
 440         shift
 441
 442         local value=$@
 443
 444         # Check if we get only one argument after lifetime <name>
 445         if [ ! $# -ge 1 ]; then
 446                 log ERROR "The number of arguments do not match you must provide at least one integer value or a valid time with the format  <hours>h <minutes>m <seconds>s"
 447                 return ${EXIT_ERROR}
 448         fi
 449
 450         if ! isinteger value; then
 451                 value=$(parse_time $@)
 452                 if [ ! $? -eq 0 ]; then
 453                         log ERROR "Parsing the passed time was not sucessful please check the passed values."
 454                         return ${EXIT_ERROR}
 455                 fi
 456         fi
 457
 458         if [ ${value} -le 0 ]; then
 459                 log ERROR "The passed time value must be in the sum greater zero seconds."
 460                 return ${EXIT_ERROR}
 461         fi
 462
 463         vpn_security_policies_write_config_key "${name}" "LIFETIME" "${value}"
 464 }
 465
 466 # This function parses the parameters for the 'pfs' command
 467 vpn_security_policies_pfs(){
 468         local name=${1}
 469         local value=${2}
 470
 471         # Check if we get only one argument after pfs <name>
 472         if [ ! $# -eq 2 ]; then
 473                 log ERROR "The number of arguments do not match. Only argument after pfs is allowed."
 474                 return ${EXIT_ERROR}
 475         fi
 476
 477         if [ ! $# -eq 2 ] || ! isbool value; then
 478                 # We suggest only two values to avoid overburding the user.
 479                 log ERROR "Invalid Argument ${value}"
 480                 return ${EXIT_ERROR}
 481         fi
 482
 483         vpn_security_policies_write_config_key "${name}" "PFS" "${value}"
 484 }
 485
 486 # This function checks if a vpn security policy name is valid
 487 # Allowed are only A-Za-z0-9
 488 vpn_security_policies_check_name() {
 489         assert [ $# -eq 1 ]
 490
 491         local name=${1}
 492
 493         [[ ${name} =~ [^[:alnum:]$] ]]
 494 }
 495
 496 # Function that creates based on the paramters one ore more new vpn security policies
 497 vpn_security_policies_new() {
 498         if [ $# -gt 1 ]; then
 499                 error "Too many arguments"
 500                 return ${EXIT_ERROR}
 501         fi
 502
 503         local name="${1}"
 504         if ! isset name; then
 505                 error "Please provide a name"
 506                 return ${EXIT_ERROR}
 507         fi
 508
 509         # Check for duplicates
 510         if vpn_security_policy_exists "${name}"; then
 511                 error "The VPN security policy with name ${name} already exists"
 512                 return ${EXIT_ERROR}
 513         fi
 514
 515         # Check if name is valid
 516         if  vpn_security_policies_check_name "${name}"; then
 517                 error "'${name}' contains illegal characters"
 518                 return ${EXIT_ERROR}
 519         fi
 520
 521         # Check if we have a read-only policy with the same name
 522         if vpn_security_policies_check_readonly "${name}"; then
 523                 error "The VPN security policy ${name} is read-only"
 524                 return ${EXIT_ERROR}
 525         fi
 526
 527         # Check if our source policy exists
 528         if ! vpn_security_policy_exists "${VPN_DEFAULT_SECURITY_POLICY}"; then
 529                 error "Default VPN Security Policy '${VPN_DEFAULT_SECURITY_POLICY}' does not exist"
 530                 return ${EXIT_ERROR}
 531         fi
 532
 533         log DEBUG "Creating VPN Security Policy ${name}"
 534
 535         if copy "$(vpn_security_policies_path "${VPN_DEFAULT_SECURITY_POLICY}")"
 536                         "$(vpn_security_policies_path ${name})"; then
 537                 log INFO "VPN Security Policy ${name} successfully created"
 538         else
 539                 log ERROR "Could not create VPN Security Policy ${name}"
 540                 return ${EXIT_ERROR}
 541         fi
 542
 543         # Show the newly created policy
 544         vpn_security_policies_show "${name}"
 545 }
 546
 547 # Function that deletes based on the passed parameters one ore more vpn security policies
 548 vpn_security_policies_destroy() {
 549         local name
 550         for name in $@; do
 551                 if ! vpn_security_policy_exists ${name}; then
 552                         log ERROR "The vpn security policy ${name} does not exist."
 553                         continue
 554                 fi
 555
 556                 if vpn_security_policies_check_readonly ${name}; then
 557                         log ERROR "The vpn security policy ${name} cannot be deleted."
 558                         continue
 559                 fi
 560
 561                 log DEBUG "Deleting vpn security policy ${name}"
 562                 settings_remove $(vpn_security_policies_path ${name})
 563         done
 564 }