ipsec: Allow adding a zone to a VPN connection

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/src/bash-completion/network b/src/bash-completion/network
index 2621628a1e4b6a3c43a9eb7c0b75af1b2d884dd9..d19dcf2731a341dfd239448de12f95aca3bf5065 100644 (file)
--- a/src/bash-completion/network
+++ b/src/bash-completion/network
@@ -413,7 +413,7 @@ _network_vpn_ipsec_connection_subcommands() {
        shift
        local words=( $@ )
 
-       local commands="authentication color description down inactivity-timeout local mode peer remote security-policy show up"
+       local commands="authentication color description down inactivity-timeout local mode peer remote security-policy show up zone"
        local cmd="$(_network_find_on_cmdline "${commands}")"
        if [[ -z "${cmd}" ]]; then
                COMPREPLY=( $(compgen -W "${commands}" -- "${cur}") )
@@ -444,7 +444,10 @@ _network_vpn_ipsec_connection_subcommands() {
                security-policy)
                        _network_vpn_ipsec_connection_subcommands_security_policy ${args}
                        ;;
-               esac
+               zone)
+                       _network_vpn_ipsec_connection_subcommands_zone "${connection}" ${args}
+                       ;;
+       esac
 }
 
 _network_vpn_ipsec_connection_subcommands_authentication() {
@@ -529,6 +532,15 @@ _network_vpn_ipsec_connection_subcommands_security_policy() {
        fi
 }
 
+_network_vpn_ipsec_connection_subcommands_zone() {
+       local connection="${1}"
+       shift
+
+       local words=( $@ )
+
+       # XXX TODO find zones that can be attached here
+}
+
 _network_vpn_security_policies() {
        local words=( $@ )
 

diff --git a/src/functions/functions.ipsec b/src/functions/functions.ipsec
index d8206e01a46f9a2262eda8d01a1198137a1cb7a9..b7e09a4c67119624a2365f22a5267dc2b9c4869c 100644 (file)
--- a/src/functions/functions.ipsec
+++ b/src/functions/functions.ipsec
@@ -37,7 +37,8 @@ IPSEC_CONNECTION_CONFIG_SETTINGS="\
        SECURITY_POLICY \
        START_ACTION \
        TYPE \
-       ENABLED"
+       ENABLED \
+       ZONE"
 
 # Default values
 IPSEC_DEFAULT_AUTH_MODE="PSK"
@@ -80,7 +81,7 @@ cli_ipsec_connection() {
                shift 2
 
                case "${key}" in
-                       authentication|down|disable|dpd|enable|inactivity_timeout|local|mode|peer|pool|remote|security_policy|start_action|up)
+                       authentication|down|disable|dpd|enable|inactivity_timeout|local|mode|peer|pool|remote|security_policy|start_action|up|zone)
                                ipsec_connection_${key} ${connection} "$@"
                                ;;
                        color)
@@ -710,6 +711,70 @@ ipsec_connection_mode() {
        return ${EXIT_OK}
 }
 
+ipsec_connection_zone() {
+       local connection="${1}"
+       local zone="${2}"
+       shift 2
+
+       # Check if we got an argument
+       if ! isset zone; then
+               error "Zone is not set"
+               return ${EXIT_ERROR}
+       fi
+
+       local ZONE
+       case "${zone}" in
+               -)
+                       if ! ipsec_connection_read_config "${connection}" "ZONE"; then
+                               log ERROR "Could not read configuration for IPsec connection ${connection}"
+                               return ${EXIT_ERROR}
+                       fi
+
+                       # Removes zone setting
+                       zone=""
+
+                       if isset ZONE; then
+                               log INFO "Removing zone ${ZONE} from IPsec connection '${connection}'"
+                       fi
+                       ;;
+
+               *)
+                       # Check if the zone exists
+                       if ! zone_exists "${zone}"; then
+                               error "Zone ${zone} does not exist"
+                               return ${EXIT_ERROR}
+                       fi
+
+                       # Zone must be of type tunnel
+                       local hook="$(zone_get_hook "${zone}")"
+
+                       case "${hook}" in
+                               ip-tunnel)
+                                       # We support ip-tunnels
+                                       ;;
+
+                               *)
+                                       error "Zones of type ${hook} are not supported"
+                                       return ${EXIT_ERROR}
+                                       ;;
+                       esac
+
+                       # Check if this zone is alreadz attached to another IPsec connection
+                       # XXX
+
+                       log INFO "Adding zone ${zone} to IPsec connection '${connection}'"
+                       ;;
+       esac
+
+       # Save settings
+       if ! ipsec_connection_write_config_key "${connection}" "ZONE" "${zone}"; then
+               error "Could not write configuration settings"
+               return ${EXIT_ERROR}
+       fi
+
+       return ${EXIT_OK}
+}
+
 # Set the local address
 ipsec_connection_local_address() {
        if [ ! $# -eq 2 ]; then