src/functions/functions.ipsec-pool

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2017  IPFire Network Development Team                         #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 IPSEC_POOL_CONFIG_SETTINGS="\
  23         DNS_SERVER \
  24         NETWORK \
  25         TYPE"
  26
  27 cli_ipsec_pool() {
  28         if ipsec_pool_exists ${1}; then
  29                 local pool=${1}
  30                 local key=${2}
  31                 key=${key//-/_}
  32                 shift 2
  33
  34                 case "${key}" in
  35                         dns_server|network)
  36                                 ipsec_pool_${key} ${pool} "$@"
  37                                 ;;
  38                         show)
  39                                 cli_ipsec_pool_show "${pool}"
  40                                 exit $?
  41                                 ;;
  42                         *)
  43                                 error "Unrecognized argument: ${key}"
  44                                 exit ${EXIT_ERROR}
  45                                 ;;
  46                 esac
  47         else
  48                 local action=${1}
  49                 shift
  50
  51                 case "${action}" in
  52                         new)
  53                                 ipsec_pool_new "$@"
  54                                 ;;
  55                         destroy)
  56                                 ipsec_pool_destroy "$@"
  57                                 ;;
  58                         ""|*)
  59                                 if [ -n "${action}" ]; then
  60                                         error "Unrecognized argument: '${action}'"
  61                                 fi
  62                                 exit ${EXIT_ERROR}
  63                                 ;;
  64                 esac
  65         fi
  66 }
  67
  68 # This function writes all values to a via ${pool} specificated VPN IPsec pool configuration file
  69 ipsec_pool_write_config() {
  70         assert [ $# -ge 1 ]
  71
  72         local pool="${1}"
  73
  74         if ! ipsec_pool_exists "${pool}"; then
  75                 log ERROR "No such VPN IPsec pool: ${pool}"
  76                 return ${EXIT_ERROR}
  77         fi
  78
  79         local path="${NETWORK_IPSEC_POOLS_DIR}/${pool}/settings"
  80
  81         if ! settings_write "${path}" ${IPSEC_POOL_CONFIG_SETTINGS}; then
  82                 log ERROR "Could not write configuration settings for VPN IPsec pool ${pool}"
  83                 return ${EXIT_ERROR}
  84         fi
  85
  86         if ! ipsec_pool_reload ${pool}; then
  87                 log WARNING "Could not reload IPsec pool ${pool}"
  88         fi
  89
  90         # When we get here the writing of the config file was successful
  91         return ${EXIT_OK}
  92 }
  93
  94 # This funtion writes the value for one key to a via ${connection} specificated
  95 # VPN IPsec pool configuration file
  96 ipsec_pool_write_config_key() {
  97         assert [ $# -ge 3 ]
  98
  99         local pool=${1}
 100         local key=${2}
 101         shift 2
 102
 103         local value="$@"
 104
 105         if ! ipsec_pool_exists "${pool}"; then
 106                 log ERROR "No such VPN IPsec pool: ${pool}"
 107                 return ${EXIT_ERROR}
 108         fi
 109
 110         log DEBUG "Set '${key}' to new value '${value}' in VPN IPsec pool '${pool}'"
 111
 112         local ${IPSEC_POOL_CONFIG_SETTINGS}
 113
 114         # Read the config settings
 115         if ! ipsec_pool_read_config "${pool}"; then
 116                 return ${EXIT_ERROR}
 117         fi
 118
 119         # Set the key to a new value
 120         assign "${key}" "${value}"
 121
 122         if ! ipsec_pool_write_config "${pool}"; then
 123                 return ${EXIT_ERROR}
 124         fi
 125
 126         return ${EXIT_TRUE}
 127 }
 128
 129 # Reads one or more keys out of a settings file or all if no key is provided.
 130 ipsec_pool_read_config() {
 131         assert [ $# -ge 1 ]
 132
 133         local pool="${1}"
 134         shift 1
 135
 136         if ! ipsec_pool_exists "${pool}"; then
 137                 log ERROR "No such VPN IPsec pool : ${pool}"
 138                 return ${EXIT_ERROR}
 139         fi
 140
 141         local args
 142         if [ $# -eq 0 ] && [ -n "${IPSEC_POOL_CONFIG_SETTINGS}" ]; then
 143                 list_append args ${IPSEC_POOL_CONFIG_SETTINGS}
 144         else
 145                 list_append args $@
 146         fi
 147
 148         local path="${NETWORK_IPSEC_POOLS_DIR}/${pool}/settings"
 149
 150         if ! settings_read "${path}" ${args}; then
 151                 log ERROR "Could not read settings for VPN IPsec pool ${pool}"
 152                 return ${EXIT_ERROR}
 153         fi
 154 }
 155
 156 # This function checks if a vpn IPsec pool exists
 157 # Returns True when yes and false when not
 158 ipsec_pool_exists() {
 159         assert [ $# -eq 1 ]
 160
 161         local pool=${1}
 162
 163         local path="${NETWORK_IPSEC_POOLS_DIR}/${pool}"
 164
 165         [ -d "${path}" ] && return ${EXIT_TRUE} || return ${EXIT_FALSE}
 166 }
 167
 168 # This function checks if a VPN IPsec pool name is valid
 169 # Allowed are only A-Za-z0-9
 170 ipsec_pool_check_name() {
 171         assert [ $# -eq 1 ]
 172
 173         local pool=${1}
 174
 175         # These are special words in strongswan
 176         if isoneof pool dhcp radius; then
 177                 return ${EXIT_ERROR}
 178         fi
 179
 180         [[ "${pool}" =~ [^[:alnum:]$] ]]
 181 }
 182
 183 ipsec_pool_new() {
 184         if [ $# -gt 1 ]; then
 185                 error "Too many arguments"
 186                 return ${EXIT_ERROR}
 187         fi
 188
 189         local pool="${1}"
 190         if ! isset pool; then
 191                 error "Please provide a pool name"
 192                 return ${EXIT_ERROR}
 193         fi
 194
 195         # Check for duplicates
 196         if ipsec_pool_exists "${pool}"; then
 197                 error "The VPN IPsec pool ${pool} already exists"
 198                 return ${EXIT_ERROR}
 199         fi
 200
 201         # Check if the name of the connection is valid
 202         if  ipsec_pool_check_name "${pool}"; then
 203                 error "'${pool}' contains illegal characters"
 204                 return ${EXIT_ERROR}
 205         fi
 206
 207         log DEBUG "Creating VPN IPsec pool ${pool}"
 208
 209         if ! mkdir -p "${NETWORK_IPSEC_POOLS_DIR}/${pool}"; then
 210                 log ERROR "Could not create config directory for ${pool}"
 211                 return ${EXIT_ERROR}
 212         fi
 213
 214         local ${IPSEC_POOL_CONFIG_SETTINGS}
 215
 216         if ! ipsec_pool_write_config "${pool}"; then
 217                 log ERROR "Could not write new config file"
 218                 return ${EXIT_ERROR}
 219         fi
 220 }
 221
 222 # Function that deletes based on the passed parameters
 223 # one ore more vpn ipsec pools
 224 ipsec_pool_destroy() {
 225         local pool
 226         for pool in $@; do
 227                 if ! ipsec_pool_exists "${pool}"; then
 228                         log ERROR "The VPN IPsec pool ${pool} does not exist."
 229                         continue
 230                 fi
 231
 232                 log DEBUG "Deleting VPN IPsec pool ${pool}"
 233
 234                 if ! rm -rf "${NETWORK_IPSEC_POOLS_DIR}/${pool}"; then
 235                         log ERROR "Deleting the VPN IPsec pool ${pool} was not sucessful"
 236                         return ${EXIT_ERROR}
 237                 fi
 238         done
 239 }
 240
 241 ipsec_pool_set_type() {
 242         local pool=${1}
 243         local ip=${2}
 244         assert isset pool
 245         assert isset ip
 246
 247         local type=$(ip_detect_protocol ${ip})
 248
 249         if ! isset type; then
 250                 error "Cannot detect IP protocol of ${ip}"
 251                 return ${EXIT_ERROR}
 252         else
 253                 log DEBUG "IP protocol of ${ip} is ${type}"
 254                 if ! ipsec_pool_write_config_key "${pool}" "TYPE" ${type}; then
 255                         log ERROR "Could not write configuration settings"
 256                         return ${EXIT_ERROR}
 257                 fi
 258         fi
 259 }
 260
 261 ipsec_pool_network() {
 262         if [ ! $# -eq 2 ]; then
 263                 log ERROR "Not enough arguments"
 264                 return ${EXIT_ERROR}
 265         fi
 266         local pool=${1}
 267         local network=${2}
 268
 269         local TYPE
 270         if ! ipsec_pool_read_config ${pool} "TYPE"; then
 271                 error "Failed to read configuration settings for pool '${pool}'"
 272                 return ${EXIT_ERROR}
 273         fi
 274
 275         if ! isset TYPE; then
 276                 if ! ip_net_is_valid ${network}; then
 277                         log ERROR "Network '${network}' is invalid"
 278                         return ${EXIT_ERROR}
 279                 fi
 280
 281                 if ! ipsec_pool_set_type ${pool} ${network}; then
 282                         log ERROR "Could not set type for IPsec pool ${pool}"
 283                         return ${EXIT_ERROR}
 284                 fi
 285         else
 286                 if ! ${TYPE}_net_is_valid ${network}; then
 287                         log ERROR "Network '${network}' is invalid"
 288                         return ${EXIT_ERROR}
 289                 fi
 290         fi
 291
 292         if ! ipsec_pool_write_config_key "${pool}" "NETWORK" ${network}; then
 293                 log ERROR "Could not write configuration settings"
 294                 return ${EXIT_ERROR}
 295         fi
 296 }
 297
 298 ipsec_pool_dns_server() {
 299         if [ ! $# -eq 2 ]; then
 300                 log ERROR "Not enough arguments"
 301                 return ${EXIT_ERROR}
 302         fi
 303         local pool=${1}
 304         local dns_server=${2}
 305
 306         local TYPE
 307         if ! ipsec_pool_read_config ${pool} "TYPE"; then
 308                 error "Failed to read configuration settings for pool '${pool}'"
 309                 return ${EXIT_ERROR}
 310         fi
 311
 312         if ! isset TYPE; then
 313                 if ! ip_is_valid ${dns_server}; then
 314                         log ERROR "DNS server '${dns_server}' is invalid"
 315                         return ${EXIT_ERROR}
 316                 fi
 317
 318                 if ! ipsec_pool_set_type ${pool} ${dns_server}; then
 319                         log ERROR "Could not set type for IPsec pool ${pool}"
 320                         return ${EXIT_ERROR}
 321                 fi
 322         else
 323                 if ! ${TYPE}_is_valid ${dns_server}; then
 324                         log ERROR "DNS server '${dns_server}' is invalid"
 325                         return ${EXIT_ERROR}
 326                 fi
 327         fi
 328
 329         if ! ipsec_pool_write_config_key "${pool}" "DNS_SERVER" ${dns_server}; then
 330                 log ERROR "Could not write configuration settings"
 331                 return ${EXIT_ERROR}
 332         fi
 333 }
 334
 335 ipsec_pool_check_config() {
 336         local pool=${1}
 337         assert isset pool
 338
 339         local ${IPSEC_POOL_CONFIG_SETTINGS}
 340         if ! ipsec_pool_read_config "${pool}"; then
 341                 log ERROR "Could not read configuration settings"
 342                 return ${EXIT_ERROR}
 343         fi
 344
 345         if ! isset NETWORK; then
 346                 log ERROR "Network for IPSec pool ${pool} is not set"
 347                 return ${EXIT_ERROR}
 348         fi
 349
 350         if ! isset TYPE; then
 351                 TYPE=$(ip_detect_protocol ${NETWORK})
 352                 log DEBUG "IP protocol of ${NETWORK} is ${TYPE}"
 353                 if ! isset TYPE; then
 354                         error "Cannot detect IP protocol of ${NETWORK}"
 355                         return ${EXIT_ERROR}
 356                 else
 357                         if ! ipsec_pool_write_config_key "${pool}" "TYPE" ${TYPE}; then
 358                                 log ERROR "Could not write configuration settings"
 359                                 return ${EXIT_ERROR}
 360                         fi
 361                 fi
 362         else
 363                 if ! ${TYPE}_net_is_valid ${NETWORK}; then
 364                         log ERROR "NETWORK '${NETWORK}' is invalid"
 365                         return ${EXIT_ERROR}
 366                 fi
 367
 368                 if isset DNS_SERVER && ! ${TYPE}_is_valid ${DNS_SERVER}; then
 369                         log ERROR "DNS server '${DNS_SERVER}' is invalid"
 370                         return ${EXIT_ERROR}
 371                 fi
 372         fi
 373
 374         return ${EXIT_OK}
 375 }
 376
 377 ipsec_pool_reload() {
 378         local pool=${1}
 379
 380         if ! ipsec_pool_to_strongswan ${pool}; then
 381                 log ERROR "Could not generate strongswan config for ${pool}"
 382                 return ${EXIT_ERROR}
 383         fi
 384
 385         ipsec_strongswan_load
 386 }
 387
 388 ipsec_pool_to_strongswan() {
 389         local pool=${1}
 390
 391         log DEBUG "Generating IPsec pool config for ${pool}"
 392
 393         local ${IPSEC_POOL_CONFIG_SETTINGS}
 394         if ! ipsec_pool_read_config "${pool}"; then
 395                 return ${EXIT_ERROR}
 396         fi
 397
 398         if isset NETWORK && ! ipsec_pool_check_config "${pool}"; then
 399                 log ERROR "Configuration of ${pool} seems to be invalid"
 400                 return ${EXIT_ERROR}
 401         fi
 402
 403         local path="${NETWORK_IPSEC_SWANCTL_POOLS_DIR}/${pool}.conf"
 404
 405         (
 406                 config_header "strongSwan pool configuration"
 407
 408                 if isset NETWORK; then
 409                         print_indent 0 "pools {"
 410
 411                         print_indent 1 "${pool} {"
 412                         print_indent 2 "addrs = ${NETWORK}"
 413
 414                         if isset DNS_SERVER; then
 415                                 print_indent 2 "dns = ${DNS_SERVER}"
 416                         fi
 417
 418                         print_indent 1 "}"
 419                         print_indent 0 "}"
 420                 fi
 421         ) > ${path}
 422 }