src/functions/functions.ipsec

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2017  IPFire Network Development Team                         #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 IPSEC_CONNECTION_CONFIG_SETTINGS="AUTH_MODE DPD_ACTION DPD_DELAY DPD_TIMEOUT"
  23 IPSEC_CONNECTION_CONFIG_SETTINGS="INACTIVITY_TIMEOUT LOCAL_ADDRESS LOCAL_ID LOCAL_PREFIX"
  24 IPSEC_CONNECTION_CONFIG_SETTINGS="${IPSEC_CONNECTION_CONFIG_SETTINGS} MODE PEER PSK"
  25 IPSEC_CONNECTION_CONFIG_SETTINGS="${IPSEC_CONNECTION_CONFIG_SETTINGS} REMOTE_ID REMOTE_PREFIX"
  26 IPSEC_CONNECTION_CONFIG_SETTINGS="${IPSEC_CONNECTION_CONFIG_SETTINGS} SECURITY_POLICY"
  27
  28 # Default values
  29 IPSEC_DEFAULT_AUTH_MODE="PSK"
  30 IPSEC_DEFAULT_DPD_ACTION="restart"
  31 IPSEC_DEFAULT_DPD_DELAY="30"
  32 IPSEC_DEFAULT_DPD_TIMEOUT="120"
  33 IPSEC_DEFAULT_INACTIVITY_TIMEOUT="0"
  34 IPSEC_DEFAULT_MODE="tunnel"
  35 IPSEC_DEFAULT_SECURITY_POLICY="system"
  36 IPSEC_DEFAULT_START_ACTION="on-demand"
  37
  38 IPSEC_VALID_MODES="gre-transport tunnel vti"
  39 IPSEC_VALID_AUTH_MODES="PSK"
  40
  41 cli_ipsec() {
  42         local action=${1}
  43         shift 1
  44
  45         case "${action}" in
  46                 connection)
  47                         cli_ipsec_connection $@
  48                         ;;
  49                 *)
  50                         error "Unrecognized argument: ${action}"
  51                         exit ${EXIT_ERROR}
  52                         ;;
  53         esac
  54 }
  55
  56 cli_ipsec_connection() {
  57         if ipsec_connection_exists ${1}; then
  58                 local connection=${1}
  59                 local key=${2}
  60                 key=${key//-/_}
  61                 shift 2
  62
  63                 case "${key}" in
  64                         authentication|dpd|inactivity_timeout|local|mode|peer|remote|security_policy|start_action)
  65                                 ipsec_connection_${key} ${connection} $@
  66                                 ;;
  67                         show)
  68                                 cli_ipsec_connection_show "${connection}"
  69                                 exit $?
  70                                 ;;
  71                         *)
  72                                 error "Unrecognized argument: ${key}"
  73                                 exit ${EXIT_ERROR}
  74                                 ;;
  75                 esac
  76         else
  77                 local action=${1}
  78                 shift
  79
  80                 case "${action}" in
  81                         new)
  82                                 ipsec_connection_new $@
  83                                 ;;
  84                         destroy)
  85                                 ipsec_connection_destroy $@
  86                                 ;;
  87                         ""|*)
  88                                 if [ -n "${action}" ]; then
  89                                         error "Unrecognized argument: '${action}'"
  90                                 fi
  91                                 exit ${EXIT_ERROR}
  92                                 ;;
  93                 esac
  94         fi
  95 }
  96
  97 cli_ipsec_connection_show() {
  98         local connection="${1}"
  99
 100         # Read the config settings
 101         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 102         if ! ipsec_connection_read_config "${connection}"; then
 103                 error "Could not read the connection configuration"
 104                 return ${EXIT_ERROR}
 105         fi
 106
 107         cli_headline 0 "IPsec VPN Connection: ${connection}"
 108         cli_space
 109
 110         # Peer
 111         if isset PEER; then
 112                 cli_print_fmt1 1 "Peer" "${PEER}"
 113         fi
 114
 115         # Security Policy
 116         cli_print_fmt1 1 "Security Policy" "${SECURITY_POLICY-${IPSEC_DEFAULT_SECURITY_POLICY}}"
 117         cli_space
 118
 119         cli_headline 2 "Authentication"
 120         case "${AUTH_MODE^^}" in
 121                 PSK)
 122                         cli_print_fmt1 2 "Mode" "Pre-Shared-Key"
 123
 124                         if isset PSK; then
 125                                 cli_print_fmt1 2 "Pre-Shared-Key" "****"
 126                         else
 127                                 cli_print_fmt1 2 "Pre-Shared-Key" "- is not set -"
 128                         fi
 129                         ;;
 130                 X509)
 131                         : # TODO
 132                         ;;
 133         esac
 134         cli_space
 135
 136         local i
 137         for i in LOCAL REMOTE; do
 138                 case "${i}" in
 139                         LOCAL)
 140                                 cli_headline 2 "Local"
 141                                 ;;
 142                         REMOTE)
 143                                 cli_headline 2 "Remote"
 144                                 ;;
 145                 esac
 146
 147                 local id_var="${i}_ID"
 148                 if [ -n "${!id_var}" ]; then
 149                         cli_print_fmt1 2 "ID" "${!id_var}"
 150                 fi
 151
 152                 local prefix_var="${i}_PREFIX"
 153                 if isset ${prefix_var}; then
 154                         cli_headline 3 "Prefix(es)"
 155
 156                         local prefix
 157                         for prefix in ${!prefix_var}; do
 158                                 cli_print_fmt1 3 "${prefix}"
 159                         done
 160                 fi
 161
 162                 cli_space
 163         done
 164
 165         cli_headline 2 "Misc."
 166
 167         case "${MODE}" in
 168                 gre-transport)
 169                         cli_print_fmt1 2 "Transport Mode" "GRE Transport"
 170                         ;;
 171                 tunnel)
 172                         cli_print_fmt1 2 "Transport Mode" "Tunnel"
 173                         ;;
 174                 vti)
 175                         cli_print_fmt1 2 "Transport Mode" "Virtual Tunnel Interface"
 176                         ;;
 177                 *)
 178                         cli_print_fmt1 2 "Transport Mode" "- Unknown -"
 179                         ;;
 180         esac
 181
 182         # Inactivity timeout
 183         if isset INACTIVITY_TIMEOUT && [ ${INACTIVITY_TIMEOUT} -gt 0 ]; then
 184                 cli_print_fmt1 2 "Inactivity Timeout" "$(format_time ${INACTIVITY_TIMEOUT})"
 185         fi
 186         cli_space
 187
 188         return ${EXIT_OK}
 189 }
 190
 191 # This function writes all values to a via ${connection} specificated VPN IPsec configuration file
 192 ipsec_connection_write_config() {
 193         assert [ $# -ge 1 ]
 194
 195         local connection="${1}"
 196
 197         if ! ipsec_connection_exists "${connection}"; then
 198                 log ERROR "No such VPN IPsec connection: ${connection}"
 199                 return ${EXIT_ERROR}
 200         fi
 201
 202         local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
 203
 204         if ! settings_write "${path}" ${IPSEC_CONNECTION_CONFIG_SETTINGS}; then
 205                 log ERROR "Could not write configuration settings for VPN IPsec connection ${connection}"
 206                 return ${EXIT_ERROR}
 207         fi
 208
 209         ipsec_reload ${connection}
 210 }
 211
 212 # This funtion writes the value for one key to a via ${connection} specificated VPN IPsec connection configuration file
 213 ipsec_connection_write_config_key() {
 214         assert [ $# -ge 3 ]
 215
 216         local connection=${1}
 217         local key=${2}
 218         shift 2
 219
 220         local value="$@"
 221
 222         if ! ipsec_connection_exists "${connection}"; then
 223                 log ERROR "No such VPN ipsec connection: ${connection}"
 224                 return ${EXIT_ERROR}
 225         fi
 226
 227         log DEBUG "Set '${key}' to new value '${value}' in VPN ipsec connection '${connection}'"
 228
 229         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 230
 231         # Read the config settings
 232         if ! ipsec_connection_read_config "${connection}"; then
 233                 return ${EXIT_ERROR}
 234         fi
 235
 236         # Set the key to a new value
 237         assign "${key}" "${value}"
 238
 239         if ! ipsec_connection_write_config "${connection}"; then
 240                 return ${EXIT_ERROR}
 241         fi
 242
 243         return ${EXIT_TRUE}
 244 }
 245
 246 # Reads one or more keys out of a settings file or all if no key is provided.
 247 ipsec_connection_read_config() {
 248         assert [ $# -ge 1 ]
 249
 250         local connection="${1}"
 251         shift 1
 252
 253         if ! ipsec_connection_exists "${connection}"; then
 254                 log ERROR "No such VPN IPsec connection : ${connection}"
 255                 return ${EXIT_ERROR}
 256         fi
 257
 258
 259         local args
 260         if [ $# -eq 0 ] && [ -n "${IPSEC_CONNECTION_CONFIG_SETTINGS}" ]; then
 261                 list_append args ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 262         else
 263                 list_append args $@
 264         fi
 265
 266         local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
 267
 268         if ! settings_read "${path}" ${args}; then
 269                 log ERROR "Could not read settings for VPN IPsec connection ${connection}"
 270                 return ${EXIT_ERROR}
 271         fi
 272 }
 273
 274 # This function checks if a vpn ipsec connection exists
 275 # Returns True when yes and false when not
 276 ipsec_connection_exists() {
 277         assert [ $# -eq 1 ]
 278
 279         local connection=${1}
 280
 281         local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}"
 282
 283         [ -d "${path}" ] && return ${EXIT_TRUE} || return ${EXIT_FALSE}
 284 }
 285
 286 # Reloads the connection after config changes
 287 ipsec_reload() {
 288         return ${EXIT_TRUE}
 289 }
 290
 291 # Handle the cli after authentification
 292 ipsec_connection_authentication() {
 293         if [ ! $# -gt 1 ]; then
 294                 log ERROR "Not enough arguments"
 295                 return ${EXIT_ERROR}
 296         fi
 297
 298         local connection=${1}
 299         local cmd=${2}
 300         shift 2
 301
 302         case ${cmd} in
 303                 mode)
 304                         ipsec_connection_authentication_mode "${connection}" $@
 305                         ;;
 306                 pre-shared-key)
 307                         ipsec_connection_authentication_psk "${connection}" $@
 308                         ;;
 309                 *)
 310                         log ERROR "Unrecognized argument: ${cmd}"
 311                         return ${EXIT_ERROR}
 312                         ;;
 313         esac
 314 }
 315
 316 # Set the authentification mode
 317 ipsec_connection_authentication_mode() {
 318         if [ ! $# -eq 2 ]; then
 319                 log ERROR "Not enough arguments"
 320                 return ${EXIT_ERROR}
 321         fi
 322         local connection=${1}
 323         local mode=${2}
 324
 325         if ! isoneof mode ${IPSEC_VALID_AUTH_MODES}; then
 326                 log ERROR "Auth mode '${mode}' is invalid"
 327                 return ${EXIT_ERROR}
 328         fi
 329
 330         if ! ipsec_connection_write_config_key "${connection}" "AUTH_MODE" ${mode^^}; then
 331                 log ERROR "Could not write configuration settings"
 332                 return ${EXIT_ERROR}
 333         fi
 334 }
 335
 336 # Set the psk
 337 ipsec_connection_authentication_psk() {
 338         if [ ! $# -eq 2 ]; then
 339                 log ERROR "Not enough arguments"
 340                 return ${EXIT_ERROR}
 341         fi
 342
 343         local connection=${1}
 344         local psk=${2}
 345
 346         local length=${#psk}
 347
 348         if [ ${length} -lt 4 ]; then
 349                 error "The PSK must be longer than four characters"
 350                 return ${EXIT_ERROR}
 351         fi
 352
 353         if [ ${length} -gt 128 ]; then
 354                 error "The PSK cannot be longer than 128 characters"
 355                 return ${EXIT_ERROR}
 356         fi
 357
 358         if ! ipsec_connection_write_config_key "${connection}" "PSK" "${psk}"; then
 359                 log ERROR "Could not write configuration settings"
 360                 return ${EXIT_ERROR}
 361         fi
 362
 363         return ${EXIT_OK}
 364 }
 365
 366
 367 # Handle the cli after authentification
 368 ipsec_connection_dpd() {
 369         if [ ! $# -gt 1 ]; then
 370                 log ERROR "Not enough arguments"
 371                 return ${EXIT_ERROR}
 372         fi
 373
 374         local connection=${1}
 375         local cmd=${2}
 376         shift 2
 377
 378         case ${cmd} in
 379                 action)
 380                         ipsec_connection_dpd_action "${connection}" $@
 381                         ;;
 382                 delay)
 383                         ipsec_connection_dpd_delay "${connection}" $@
 384                         ;;
 385                 timeout)
 386                         ipsec_connection_dpd_timeout "${connection}" $@
 387                         ;;
 388                 *)
 389                         log ERROR "Unrecognized argument: ${cmd}"
 390                         return ${EXIT_ERROR}
 391                         ;;
 392         esac
 393 }
 394
 395 # Set the default dpd action
 396 ipsec_connection_dpd_action() {
 397         if [ ! $# -eq 2 ]; then
 398                 log ERROR "Not enough arguments"
 399                 return ${EXIT_ERROR}
 400         fi
 401         local connection=${1}
 402         local action=${2}
 403
 404         if ! isoneof action "restart" "clear"; then
 405                 log ERROR "dpd action '${action}' is invalid"
 406                 return ${EXIT_ERROR}
 407         fi
 408
 409         if ! ipsec_connection_write_config_key "${connection}" "DPD_ACTION" ${action}; then
 410                 log ERROR "Could not write configuration settings"
 411                 return ${EXIT_ERROR}
 412         fi
 413 }
 414
 415 # Set the dpd delay
 416 ipsec_connection_dpd_delay() {
 417         if [ ! $# -ge 2 ]; then
 418                 log ERROR "Not enough arguments"
 419                 return ${EXIT_ERROR}
 420         fi
 421
 422         local connection=${1}
 423         shift 1
 424         local value=$@
 425
 426         if ! isinteger value; then
 427                 value=$(parse_time $@)
 428                 if [ ! $? -eq 0 ]; then
 429                         log ERROR "Parsing the passed time was not sucessful please check the passed values."
 430                         return ${EXIT_ERROR}
 431                 fi
 432         fi
 433
 434         if [ ${value} -lt 0 ]; then
 435                 log ERROR "The passed time value must be in the sum greater or equal zero seconds."
 436                 return ${EXIT_ERROR}
 437         fi
 438
 439         if ! ipsec_connection_write_config_key "${connection}" "DPD_DELAY" ${value}; then
 440                 log ERROR "Could not write configuration settings"
 441                 return ${EXIT_ERROR}
 442         fi
 443
 444         return ${EXIT_OK}
 445 }
 446
 447 # Set the dpd timeout
 448 ipsec_connection_dpd_timeout() {
 449         if [ ! $# -ge 2 ]; then
 450                 log ERROR "Not enough arguments"
 451                 return ${EXIT_ERROR}
 452         fi
 453
 454         local connection=${1}
 455         shift 1
 456         local value=$@
 457
 458         if ! isinteger value; then
 459                 value=$(parse_time $@)
 460                 if [ ! $? -eq 0 ]; then
 461                         log ERROR "Parsing the passed time was not sucessful please check the passed values."
 462                         return ${EXIT_ERROR}
 463                 fi
 464         fi
 465
 466         if [ ${value} -le 0 ]; then
 467                 log ERROR "The passed time value must be in the sum greater or equal zero seconds."
 468                 return ${EXIT_ERROR}
 469         fi
 470
 471         if ! ipsec_connection_write_config_key "${connection}" "DPD_TIMEOUT" ${value}; then
 472                 log ERROR "Could not write configuration settings"
 473                 return ${EXIT_ERROR}
 474         fi
 475
 476         return ${EXIT_OK}
 477 }
 478
 479 # Handle the cli after local
 480 ipsec_connection_local() {
 481         if [ ! $# -ge 2 ]; then
 482                 log ERROR "Not enough arguments"
 483                 return ${EXIT_ERROR}
 484         fi
 485
 486         local connection=${1}
 487         local cmd=${2}
 488         shift 2
 489
 490         case ${cmd} in
 491                 address)
 492                         ipsec_connection_local_address "${connection}" $@
 493                         ;;
 494                 id)
 495                         ipsec_connection_id "${connection}" "LOCAL" $@
 496                         ;;
 497                 prefix)
 498                         ipsec_connection_prefix "${connection}" "LOCAL" $@
 499                         ;;
 500                 *)
 501                         log ERROR "Unrecognized argument: ${cmd}"
 502                         return ${EXIT_ERROR}
 503                         ;;
 504         esac
 505
 506         return ${EXIT_OK}
 507 }
 508
 509 # Set the connection mode
 510 ipsec_connection_mode() {
 511         if [ ! $# -eq 2 ]; then
 512                 log ERROR "Not enough arguments"
 513                 return ${EXIT_ERROR}
 514         fi
 515         local connection=${1}
 516         local mode=${2}
 517
 518         if ! isoneof mode ${IPSEC_VALID_MODES}; then
 519                 log ERROR "Mode '${mode}' is invalid"
 520                 return ${EXIT_ERROR}
 521         fi
 522
 523         if ! ipsec_connection_write_config_key "${connection}" "MODE" ${mode}; then
 524                 log ERROR "Could not write configuration settings"
 525                 return ${EXIT_ERROR}
 526         fi
 527
 528         return ${EXIT_OK}
 529 }
 530
 531 # Set the local address
 532 ipsec_connection_local_address() {
 533         if [ ! $# -eq 2 ]; then
 534                 log ERROR "Not enough arguments"
 535                 return ${EXIT_ERROR}
 536         fi
 537         local connection=${1}
 538         local local_address=${2}
 539
 540         if ! ipsec_connection_check_peer ${local_address}; then
 541                 log ERROR "Local address '${local_address}' is invalid"
 542                 return ${EXIT_ERROR}
 543         fi
 544
 545         if ! ipsec_connection_write_config_key "${connection}" "LOCAL_ADDRESS" ${local_address}; then
 546                 log ERROR "Could not write configuration settings"
 547                 return ${EXIT_ERROR}
 548         fi
 549
 550         return ${EXIT_OK}
 551 }
 552
 553 # Set the peer to connect to
 554 ipsec_connection_peer() {
 555         if [ ! $# -eq 2 ]; then
 556                 log ERROR "Not enough arguments"
 557                 return ${EXIT_ERROR}
 558         fi
 559         local connection=${1}
 560         local peer=${2}
 561
 562         if ! ipsec_connection_check_peer ${peer}; then
 563                 log ERROR "Peer '${peer}' is invalid"
 564                 return ${EXIT_ERROR}
 565         fi
 566
 567         if ! ipsec_connection_write_config_key "${connection}" "PEER" ${peer}; then
 568                 log ERROR "Could not write configuration settings"
 569                 return ${EXIT_ERROR}
 570         fi
 571
 572         return ${EXIT_OK}
 573 }
 574
 575 #Set the local or remote id
 576 ipsec_connection_id() {
 577         if [ ! $# -eq 3 ]; then
 578                 log ERROR "Not enough arguments"
 579                 return ${EXIT_ERROR}
 580         fi
 581         local connection=${1}
 582         local type=${2}
 583         local id=${3}
 584
 585         if ! ipsec_connection_check_id ${id}; then
 586                 log ERROR "Id '${id}' is invalid"
 587                 return ${EXIT_ERROR}
 588         fi
 589
 590         if ! ipsec_connection_write_config_key "${connection}" "${type}_ID" ${id}; then
 591                 log ERROR "Could not write configuration settings"
 592                 return ${EXIT_ERROR}
 593         fi
 594
 595         return ${EXIT_OK}
 596 }
 597
 598 # Set the local or remote prefix
 599 ipsec_connection_prefix() {
 600         if [ ! $# -ge 3 ]; then
 601                 log ERROR "Not enough arguments"
 602                 return ${EXIT_ERROR}
 603         fi
 604         local connection=${1}
 605         local type=${2}
 606         shift 2
 607
 608         local _prefix="${type}_PREFIX"
 609         local "${_prefix}"
 610         if ! ipsec_connection_read_config "${connection}" "${_prefix}"; then
 611                 return ${EXIT_ERROR}
 612         fi
 613
 614         # Remove duplicated entries to proceed the list safely
 615         assign "${_prefix}" "$(list_unique ${!_prefix} )"
 616
 617         local prefixes_added
 618         local prefixes_removed
 619         local prefixes_set
 620
 621         while [ $# -gt 0 ]; do
 622                 local arg="${1}"
 623
 624                 case "${arg}" in
 625                         +*)
 626                                 list_append prefixes_added "${arg:1}"
 627                                 ;;
 628                         -*)
 629                                 list_append prefixes_removed "${arg:1}"
 630                                 ;;
 631                         [A-Fa-f0-9]*)
 632                                 list_append prefixes_set "${arg}"
 633                                 ;;
 634                         *)
 635                                 error "Invalid argument: ${arg}"
 636                                 return ${EXIT_ERROR}
 637                                 ;;
 638                 esac
 639                 shift
 640         done
 641
 642         # Check if the user is trying a mixed operation
 643         if ! list_is_empty prefixes_set && (! list_is_empty prefixes_added || ! list_is_empty prefixes_removed); then
 644                 error "You cannot reset the prefix list and add or remove prefixes at the same time"
 645                 return ${EXIT_ERROR}
 646         fi
 647
 648         # Set new prefix list
 649         if ! list_is_empty prefixes_set; then
 650                 # Check if all prefixes are valid
 651                 local prefix
 652                 for prefix in ${prefixes_set}; do
 653                         if ! ip_net_is_valid ${prefix}; then
 654                                 error "Unsupported prefix: ${prefix}"
 655                                 return ${EXIT_ERROR}
 656                         fi
 657                 done
 658
 659                 assign "${_prefix}" "${prefixes_set}"
 660
 661         # Perform incremental updates
 662         else
 663                 local prefix
 664
 665                 # Perform all removals
 666                 for prefix in ${prefixes_removed}; do
 667                         if ! list_remove "${_prefix}" ${prefix}; then
 668                                 warning "${prefix} was not on the list and could not be removed"
 669                         fi
 670                 done
 671
 672
 673                 for prefix in ${prefixes_added}; do
 674                         if ip_net_is_valid ${prefix}; then
 675                                 if ! list_append_unique "${_prefix}" ${prefix}; then
 676                                         warning "${prefix} is already on the prefix list"
 677                                 fi
 678                         else
 679                                 warning "${prefix} is not a valid IP network and could not be added"
 680                         fi
 681                 done
 682         fi
 683
 684         # Check if the list contain at least one valid prefix
 685         if list_is_empty ${_prefix}; then
 686                 error "Cannot save an empty prefix list"
 687                 return ${EXIT_ERROR}
 688         fi
 689
 690         # Save everything
 691         if ! ipsec_connection_write_config_key "${connection}" "${_prefix}" ${!_prefix}; then
 692                 log ERROR "Could not write configuration settings"
 693         fi
 694
 695         return ${EXIT_OK}
 696 }
 697
 698 # Handle the cli after remote
 699 ipsec_connection_remote() {
 700         if [ ! $# -ge 2 ]; then
 701                 log ERROR "Not enough arguments"
 702                 return ${EXIT_ERROR}
 703         fi
 704
 705         local connection=${1}
 706         local cmd=${2}
 707         shift 2
 708
 709         case ${cmd} in
 710                 id)
 711                         ipsec_connection_id "${connection}" "REMOTE" $@
 712                         ;;
 713
 714                 prefix)
 715                         ipsec_connection_prefix "${connection}" "REMOTE" $@
 716                         ;;
 717                 *)
 718                         log ERROR "Unrecognized argument: ${cmd}"
 719                         return ${EXIT_ERROR}
 720                         ;;
 721         esac
 722
 723         return ${EXIT_OK}
 724 }
 725
 726 # Set the inactivity timeout
 727 ipsec_connection_inactivity_timeout() {
 728         if [ ! $# -ge 2 ]; then
 729                 log ERROR "Not enough arguments"
 730                 return ${EXIT_ERROR}
 731         fi
 732
 733         local connection=${1}
 734         shift 1
 735         local value=$@
 736
 737         if ! isinteger value; then
 738                 value=$(parse_time $@)
 739                 if [ ! $? -eq 0 ]; then
 740                         log ERROR "Parsing the passed time was not sucessful please check the passed values."
 741                         return ${EXIT_ERROR}
 742                 fi
 743         fi
 744
 745         if [ ${value} -le 0 ]; then
 746                 log ERROR "The passed time value must be in the sum greater zero seconds."
 747                 return ${EXIT_ERROR}
 748         fi
 749
 750         if ! ipsec_connection_write_config_key "${connection}" "INACTIVITY_TIMEOUT" ${value}; then
 751                 log ERROR "Could not write configuration settings"
 752                 return ${EXIT_ERROR}
 753         fi
 754
 755         return ${EXIT_OK}
 756 }
 757
 758 # Set the default start action
 759 ipsec_connection_start_action() {
 760         if [ ! $# -eq 2 ]; then
 761                 log ERROR "Not enough arguments"
 762                 return ${EXIT_ERROR}
 763         fi
 764         local connection=${1}
 765         local action=${2}
 766
 767         if ! isoneof action "on-demand" "always-on"; then
 768                 log ERROR "Start action '${action}' is invalid"
 769                 return ${EXIT_ERROR}
 770         fi
 771
 772         if ! ipsec_connection_write_config_key "${connection}" "START_ACTION" ${action}; then
 773                 log ERROR "Could not write configuration settings"
 774                 return ${EXIT_ERROR}
 775         fi
 776 }
 777
 778 # Set the security policy to use
 779 ipsec_connection_security_policy() {
 780         if [ ! $# -eq 2 ]; then
 781                 log ERROR "Not enough arguments"
 782                 return ${EXIT_ERROR}
 783         fi
 784         local connection=${1}
 785         local security_policy=${2}
 786
 787         if ! vpn_security_policy_exists ${security_policy}; then
 788                 log ERROR "No such vpn security policy '${security_policy}'"
 789                 return ${EXIT_ERROR}
 790         fi
 791
 792         if ! ipsec_connection_write_config_key "${connection}" "SECURITY_POLICY" ${security_policy}; then
 793                 log ERROR "Could not write configuration settings"
 794                 return ${EXIT_ERROR}
 795         fi
 796 }
 797
 798 # Check if a id is valid
 799 ipsec_connection_check_id() {
 800         assert [ $# -eq 1 ]
 801         local id=${1}
 802
 803         if [[ ${id} =~ ^@[[:alnum:]]+$ ]] || ip_is_valid ${id}; then
 804                 return ${EXIT_TRUE}
 805         else
 806                 return ${EXIT_FALSE}
 807         fi
 808 }
 809
 810 # Checks if a peer is valid
 811 ipsec_connection_check_peer() {
 812         assert [ $# -eq 1 ]
 813         local peer=${1}
 814
 815         # TODO Accept also FQDNs
 816         if ip_is_valid ${peer}; then
 817                 return ${EXIT_TRUE}
 818         else
 819                 return ${EXIT_FALSE}
 820         fi
 821 }
 822
 823 # This function checks if a VPN IPsec connection name is valid
 824 # Allowed are only A-Za-z0-9
 825 ipsec_connection_check_name() {
 826         assert [ $# -eq 1 ]
 827
 828         local connection=${1}
 829
 830         [[ "${connection}" =~ [^[:alnum:]$] ]]
 831 }
 832
 833 # Function that creates one VPN IPsec connection
 834 ipsec_connection_new() {
 835         if [ $# -gt 1 ]; then
 836                 error "Too many arguments"
 837                 return ${EXIT_ERROR}
 838         fi
 839
 840         local connection="${1}"
 841         if ! isset connection; then
 842                 error "Please provide a connection name"
 843                 return ${EXIT_ERROR}
 844         fi
 845
 846         # Check for duplicates
 847         if ipsec_connection_exists "${connection}"; then
 848                 error "The VPN IPsec connection ${connection} already exists"
 849                 return ${EXIT_ERROR}
 850         fi
 851
 852         # Check if the name of the connection is valid
 853         if  ipsec_connection_check_name "${connection}"; then
 854                 error "'${connection}' contains illegal characters"
 855                 return ${EXIT_ERROR}
 856         fi
 857
 858         log DEBUG "Creating VPN IPsec connection ${connection}"
 859
 860         if ! mkdir -p "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
 861                 log ERROR "Could not create config directory for ${connection}"
 862                 return ${EXIT_ERROR}
 863         fi
 864
 865         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 866
 867         AUTH_MODE=${IPSEC_DEFAULT_AUTH_MODE}
 868         DPD_ACTION=${IPSEC_DEFAULT_DPD_ACTION}
 869         DPD_DELAY=${IPSEC_DEFAULT_DPD_DELAY}
 870         DPD_TIMEOUT=${IPSEC_DEFAULT_DPD_TIMEOUT}
 871         MODE=${IPSEC_DEFAULT_MODE}
 872         START_ACTION=${IPSEC_DEFAULT_START_ACTION}
 873
 874         INACTIVITY_TIMEOUT=${IPSEC_DEFAULT_INACTIVITY_TIMEOUT}
 875         SECURITY_POLICY=${IPSEC_DEFAULT_SECURITY_POLICY}
 876
 877         if ! ipsec_connection_write_config "${connection}"; then
 878                 log ERROR "Could not write new config file"
 879                 return ${EXIT_ERROR}
 880         fi
 881 }
 882
 883 # Function that deletes based on the passed parameters one ore more vpn security policies
 884 ipsec_connection_destroy() {
 885         local connection
 886         for connection in $@; do
 887                 if ! ipsec_connection_exists "${connection}"; then
 888                         log ERROR "The VPN IPsec connection ${connection} does not exist."
 889                         continue
 890                 fi
 891
 892                 log DEBUG "Deleting VPN IPsec connection ${connection}"
 893                 if ! rm -rf "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
 894                         log ERROR "Deleting the VPN IPsec connection ${connection} was not sucessful"
 895                         return ${EXIT_ERROR}
 896                 fi
 897         done
 898 }
 899
 900 # List all ipsec connections
 901 ipsec_list_connections() {
 902         local connection
 903         for connection in ${NETWORK_IPSEC_CONNS_DIR}/*; do
 904                 [ -d ${connection} ] || continue
 905                 basename ${connection}
 906         done
 907 }
 908
 909 ipsec_connection_to_strongswan() {
 910         local connection="${1}"
 911
 912         # Read the config settings
 913         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 914         if ! ipsec_connection_read_config "${connection}"; then
 915                 error "Could not read the connection ${connection}"
 916                 return ${EXIT_ERROR}
 917         fi
 918
 919         local path="${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf"
 920
 921         (
 922                 # Write the connection section
 923                 _ipsec_connection_to_strongswan_connection "${connection}"
 924
 925                 # Write the secrets section
 926                 _ipsec_connection_to_strongswan_secrets "${connection}"
 927
 928         ) > ${path}
 929 }
 930
 931 _ipsec_connection_to_strongswan_connection() {
 932         local connection="${1}"
 933
 934         # Read the security policy
 935         local ${VPN_SECURITY_POLICIES_CONFIG_SETTINGS}
 936         if ! vpn_security_policies_read_config "${SECURITY_POLICY}"; then
 937                 return ${EXIT_ERROR}
 938         fi
 939
 940         print_indent 0 "connections {"
 941         print_indent 1 "${connection} {"
 942
 943         # IKE Version
 944         print_indent 2 "# IKE Version"
 945         case "${KEY_EXCHANGE^^}" in
 946                 IKEV1)
 947                         print_indent 2 "version = 1"
 948                         ;;
 949
 950                 # Fall back to IKEv2 for any random values
 951                 IKEV2|*)
 952                         print_indent 2 "version = 2"
 953                         ;;
 954         esac
 955         print # empty line
 956
 957         # Local Address
 958         print_indent 2 "# Local Address"
 959         if isset LOCAL_ADDRESS; then
 960                 print_indent 2 "local_addrs = ${LOCAL_ADDRESS}"
 961         else
 962                 print_indent 2 "local_addrs = %any"
 963         fi
 964         print
 965
 966         # Remote Address
 967         print_indent 2 "# Remote Address"
 968         if isset PEER; then
 969                 print_indent 2 "remote_addrs = ${PEER}"
 970         else
 971                 print_indent 2 "remote_addrs = %any"
 972         fi
 973         print
 974
 975         # IKE Proposals
 976         print_indent 2 "# IKE Proposals"
 977         print_indent 2 "proposals = $(vpn_security_policies_make_ah_proposal ${SECURITY_POLICY})"
 978         print
 979
 980         # DPD Settings
 981         if isset DPD_DELAY && isinteger DPD_DELAY && [ ${DPD_DELAY} -gt 0 ]; then
 982                 print_indent 2 "# Dead Peer Detection"
 983
 984                 print_indent 2 "dpd_action = ${DPD_ACTION}"
 985                 print_indent 2 "dpd_delay = ${DPD_DELAY}"
 986
 987                 if isset DPD_TIMEOUT; then
 988                         print_indent 2 "dpd_timeout = ${DPD_TIMEOUT}"
 989                 fi
 990
 991                 print
 992         fi
 993
 994         # Fragmentation
 995         print_indent 2 "# Fragmentation"
 996         print_indent 2 "fragmentation = yes"
 997         print
 998
 999         # Local
1000         print_indent 2 "local {"
1001
1002         # Local ID
1003         if isset LOCAL_ID; then
1004                 print_indent 3 "id = ${LOCAL_ID}"
1005         fi
1006
1007         # Authentication
1008         case "${AUTH_MODE}" in
1009                 PSK)
1010                         print_indent 3 "auth = psk"
1011                         ;;
1012         esac
1013
1014         print_indent 2 "}"
1015         print
1016
1017         # Remote
1018         print_indent 2 "remote {"
1019
1020         # Remote ID
1021         if isset REMOTE_ID; then
1022                 print_indent 3 "id = ${REMOTE_ID}"
1023         fi
1024
1025         # Authentication
1026         case "${AUTH_MODE}" in
1027                 PSK)
1028                         print_indent 3 "auth = psk"
1029                         ;;
1030         esac
1031
1032         print_indent 2 "}"
1033         print
1034
1035         # Children
1036
1037         print_indent 2 "children {"
1038         print_indent 3 "${connection} {"
1039
1040         print_indent 4 "# ESP Proposals"
1041         print_indent 4 "esp_proposals = $(vpn_security_policies_make_esp_proposal ${SECURITY_POLICY})"
1042         print
1043
1044         # Traffic Selectors
1045
1046         # Local Prefixes
1047         if isset LOCAL_PREFIX; then
1048                 print_indent 4 "local_ts = $(list_join LOCAL_PREFIX ,)"
1049         else
1050                 print_indent 4 "local_ts = dynamic"
1051         fi
1052
1053         # Remote Prefixes
1054         if isset REMOTE_PREFIX; then
1055                 print_indent 4 "remote_ts = $(list_join REMOTE_PREFIX ,)"
1056         else
1057                 print_indent 4 "remote_ts = dynamic"
1058         fi
1059         print
1060
1061         # Rekeying
1062         if isset LIFETIME; then
1063                 print_indent 4 "# Rekey Time"
1064                 print_indent 4 "rekey_time = ${LIFETIME}"
1065                 print
1066         fi
1067
1068         # Updown Script
1069         print_indent 4 "updown = ${NETWORK_HELPERS_DIR}/ipsec-updown"
1070         print
1071
1072         # Mode
1073         print_indent 4 "# Mode"
1074         case "${MODE}" in
1075                 gre-transport)
1076                         print_indent 4 "mode = transport"
1077                         ;;
1078                 tunnel|vti|*)
1079                         print_indent 4 "mode = tunnel"
1080                         ;;
1081         esac
1082         print
1083
1084         # Compression
1085         print_indent 4 "# Compression"
1086         if enabled COMPRESSION; then
1087                 print_indent 4 "ipcomp = yes"
1088         else
1089                 print_indent 4 "ipcomp = no"
1090         fi
1091         print
1092
1093         # Inactivity Timeout
1094         if isset INACTIVITY_TIMEOUT; then
1095                 print_indent 4 "# Inactivity Timeout"
1096                 print_indent 4 "inactivity = ${INACTIVITY_TIMEOUT}"
1097                 print
1098         fi
1099
1100         # Start Action
1101         print_indent 4 "# Start Action"
1102         case "${START_ACTION}" in
1103                 on-demand)
1104                         print_indent 4 "start_action = trap"
1105                         print_indent 4 "close_action = trap"
1106                         ;;
1107                 wait)
1108                         print_indent 4 "start_action = none"
1109                         print_indent 4 "close_action = none"
1110                         ;;
1111                 always-on|*)
1112                         print_indent 4 "start_action = start"
1113                         print_indent 4 "close_action = start"
1114                         ;;
1115         esac
1116         print
1117
1118         print_indent 3 "}"
1119         print_indent 2 "}"
1120         print
1121
1122         print_indent 1 "}"
1123         print_indent 0 "}"
1124         print
1125 }
1126
1127 _ipsec_connection_to_strongswan_secrets() {
1128         local connection="${1}"
1129
1130         print_indent 0 "secrets {"
1131
1132         case "${AUTH_MODE}" in
1133                 PSK)
1134                         print_indent 1 "ike {"
1135
1136                         # Secret
1137                         print_indent 2 "secret = ${PSK}"
1138
1139                         # ID
1140                         if isset REMOTE_ID; then
1141                                 print_indent 2 "id = ${REMOTE_ID}"
1142                         fi
1143
1144                         print_indent 1 "}"
1145                         ;;
1146         esac
1147
1148         print_indent 0 "}"
1149 }