src/functions/functions.ipsec

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2017  IPFire Network Development Team                         #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 IPSEC_CONNECTION_CONFIG_SETTINGS="\
  23         AUTH_MODE \
  24         DPD_ACTION \
  25         DPD_DELAY \
  26         DPD_TIMEOUT \
  27         INACTIVITY_TIMEOUT \
  28         LOCAL_ADDRESS \
  29         LOCAL_ID \
  30         LOCAL_PREFIX \
  31         MODE \
  32         PEER \
  33         PSK \
  34         REMOTE_ID \
  35         REMOTE_PREFIX \
  36         SECURITY_POLICY \
  37         START_ACTION \
  38         ENABLED"
  39
  40 IPSEC_POOL_CONFIG_SETTINGS="\
  41         DNS_SERVERS \
  42         NETWORKS"
  43
  44 # Default values
  45 IPSEC_DEFAULT_AUTH_MODE="PSK"
  46 IPSEC_DEFAULT_DPD_ACTION="restart"
  47 IPSEC_DEFAULT_DPD_DELAY="30"
  48 IPSEC_DEFAULT_DPD_TIMEOUT="120"
  49 IPSEC_DEFAULT_ENABLED="true"
  50 IPSEC_DEFAULT_INACTIVITY_TIMEOUT="0"
  51 IPSEC_DEFAULT_MODE="tunnel"
  52 IPSEC_DEFAULT_SECURITY_POLICY="system"
  53 IPSEC_DEFAULT_START_ACTION="on-demand"
  54
  55 IPSEC_VALID_MODES="gre-transport tunnel vti"
  56 IPSEC_VALID_AUTH_MODES="PSK"
  57
  58 cli_ipsec() {
  59         local action=${1}
  60         shift 1
  61
  62         case "${action}" in
  63                 connection)
  64                         cli_ipsec_connection $@
  65                         ;;
  66                 pool)
  67                         cli_ipsec_pool $@
  68                         ;;
  69                 *)
  70                         error "Unrecognized argument: ${action}"
  71                         exit ${EXIT_ERROR}
  72                         ;;
  73         esac
  74 }
  75
  76 cli_ipsec_connection() {
  77         if ipsec_connection_exists ${1}; then
  78                 local connection=${1}
  79                 local key=${2}
  80                 key=${key//-/_}
  81                 shift 2
  82
  83                 case "${key}" in
  84                         authentication|down|disable|dpd|enable|inactivity_timeout|local|mode|peer|remote|security_policy|start_action|up)
  85                                 ipsec_connection_${key} ${connection} $@
  86                                 ;;
  87                         show)
  88                                 cli_ipsec_connection_show "${connection}"
  89                                 exit $?
  90                                 ;;
  91                         *)
  92                                 error "Unrecognized argument: ${key}"
  93                                 exit ${EXIT_ERROR}
  94                                 ;;
  95                 esac
  96         else
  97                 local action=${1}
  98                 shift
  99
 100                 case "${action}" in
 101                         new)
 102                                 ipsec_connection_new $@
 103                                 ;;
 104                         destroy)
 105                                 cli_ipsec_connection_destroy $@
 106                                 ;;
 107                         ""|*)
 108                                 if [ -n "${action}" ]; then
 109                                         error "Unrecognized argument: '${action}'"
 110                                 fi
 111                                 exit ${EXIT_ERROR}
 112                                 ;;
 113                 esac
 114         fi
 115 }
 116
 117 cli_ipsec_pool() {
 118         if ipsec_pool_exists ${1}; then
 119                 local pool=${1}
 120                 local key=${2}
 121                 key=${key//-/_}
 122                 shift 2
 123
 124                 case "${key}" in
 125                         dns_server|network)
 126                                 ipsec_pool_${key} ${pool} $@
 127                                 ;;
 128                         show)
 129                                 cli_ipsec_pool_show "${pool}"
 130                                 exit $?
 131                                 ;;
 132                         *)
 133                                 error "Unrecognized argument: ${key}"
 134                                 exit ${EXIT_ERROR}
 135                                 ;;
 136                 esac
 137         else
 138                 local action=${1}
 139                 shift
 140
 141                 case "${action}" in
 142                         new)
 143                                 ipsec_pool_new $@
 144                                 ;;
 145                         destroy)
 146                                 ipsec_pool_destroy $@
 147                                 ;;
 148                         ""|*)
 149                                 if [ -n "${action}" ]; then
 150                                         error "Unrecognized argument: '${action}'"
 151                                 fi
 152                                 exit ${EXIT_ERROR}
 153                                 ;;
 154                 esac
 155         fi
 156 }
 157
 158 cli_ipsec_connection_destroy() {
 159         local connection="${1}"
 160
 161         if ! ipsec_connection_destroy "${connection}"; then
 162                 return ${EXIT_ERROR}
 163         fi
 164
 165         # Inform strongswan about the changes
 166         ipsec_strongswan_load
 167
 168         # Configure strongswan autostart
 169         ipsec_strongswan_autostart
 170 }
 171
 172 cli_ipsec_connection_show() {
 173         local connection="${1}"
 174
 175         # Read the config settings
 176         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 177         if ! ipsec_connection_read_config "${connection}"; then
 178                 error "Could not read the connection configuration"
 179                 return ${EXIT_ERROR}
 180         fi
 181
 182         cli_headline 0 "IPsec VPN Connection: ${connection}"
 183         cli_space
 184
 185         # Peer
 186         if isset PEER; then
 187                 cli_print_fmt1 1 "Peer" "${PEER}"
 188         fi
 189
 190         # Security Policy
 191         cli_print_fmt1 1 "Security Policy" "${SECURITY_POLICY-${IPSEC_DEFAULT_SECURITY_POLICY}}"
 192         cli_space
 193
 194         cli_headline 2 "Authentication"
 195         case "${AUTH_MODE^^}" in
 196                 PSK)
 197                         cli_print_fmt1 2 "Mode" "Pre-Shared-Key"
 198
 199                         if isset PSK; then
 200                                 cli_print_fmt1 2 "Pre-Shared-Key" "****"
 201                         else
 202                                 cli_print_fmt1 2 "Pre-Shared-Key" "- is not set -"
 203                         fi
 204                         ;;
 205                 X509)
 206                         : # TODO
 207                         ;;
 208         esac
 209         cli_space
 210
 211         local i
 212         for i in LOCAL REMOTE; do
 213                 case "${i}" in
 214                         LOCAL)
 215                                 cli_headline 2 "Local"
 216                                 ;;
 217                         REMOTE)
 218                                 cli_headline 2 "Remote"
 219                                 ;;
 220                 esac
 221
 222                 local id_var="${i}_ID"
 223                 if [ -n "${!id_var}" ]; then
 224                         cli_print_fmt1 2 "ID" "${!id_var}"
 225                 fi
 226
 227                 local prefix_var="${i}_PREFIX"
 228                 if isset ${prefix_var}; then
 229                         cli_headline 3 "Prefix(es)"
 230
 231                         local prefix
 232                         for prefix in ${!prefix_var}; do
 233                                 cli_print_fmt1 3 "${prefix}"
 234                         done
 235                 fi
 236
 237                 cli_space
 238         done
 239
 240         cli_headline 2 "Misc."
 241
 242         case "${MODE}" in
 243                 gre-transport)
 244                         cli_print_fmt1 2 "Transport Mode" "GRE Transport"
 245                         ;;
 246                 tunnel)
 247                         cli_print_fmt1 2 "Transport Mode" "Tunnel"
 248                         ;;
 249                 vti)
 250                         cli_print_fmt1 2 "Transport Mode" "Virtual Tunnel Interface"
 251                         ;;
 252                 *)
 253                         cli_print_fmt1 2 "Transport Mode" "- Unknown -"
 254                         ;;
 255         esac
 256
 257         # Inactivity timeout
 258         if isset INACTIVITY_TIMEOUT && [ ${INACTIVITY_TIMEOUT} -gt 0 ]; then
 259                 cli_print_fmt1 2 "Inactivity Timeout" "$(format_time ${INACTIVITY_TIMEOUT})"
 260         fi
 261         cli_space
 262
 263         return ${EXIT_OK}
 264 }
 265
 266 ipsec_connection_disable() {
 267         local connection=${1}
 268
 269         if ! ipsec_connection_write_config_key "${connection}" "ENABLED" "false"; then
 270                 log ERROR "Could not write configuration settings"
 271                 return ${EXIT_ERROR}
 272         fi
 273
 274         # Configure strongswan autostart
 275         ipsec_strongswan_autostart
 276 }
 277
 278 ipsec_connection_enable() {
 279         local connection=${1}
 280
 281         if ! ipsec_connection_write_config_key "${connection}" "ENABLED" "true"; then
 282                 log ERROR "Could not write configuration settings"
 283                 return ${EXIT_ERROR}
 284         fi
 285
 286         # Configure strongswan autostart
 287         ipsec_strongswan_autostart
 288 }
 289
 290 # This function writes all values to a via ${connection} specificated VPN IPsec configuration file
 291 ipsec_connection_write_config() {
 292         assert [ $# -ge 1 ]
 293
 294         local connection="${1}"
 295
 296         if ! ipsec_connection_exists "${connection}"; then
 297                 log ERROR "No such VPN IPsec connection: ${connection}"
 298                 return ${EXIT_ERROR}
 299         fi
 300
 301         local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
 302
 303         if ! settings_write "${path}" ${IPSEC_CONNECTION_CONFIG_SETTINGS}; then
 304                 log ERROR "Could not write configuration settings for VPN IPsec connection ${connection}"
 305                 return ${EXIT_ERROR}
 306         fi
 307
 308         ipsec_reload ${connection}
 309 }
 310
 311 # This funtion writes the value for one key to a via ${connection} specificated VPN IPsec connection configuration file
 312 ipsec_connection_write_config_key() {
 313         assert [ $# -ge 3 ]
 314
 315         local connection=${1}
 316         local key=${2}
 317         shift 2
 318
 319         local value="$@"
 320
 321         if ! ipsec_connection_exists "${connection}"; then
 322                 log ERROR "No such VPN ipsec connection: ${connection}"
 323                 return ${EXIT_ERROR}
 324         fi
 325
 326         log DEBUG "Set '${key}' to new value '${value}' in VPN ipsec connection '${connection}'"
 327
 328         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 329
 330         # Read the config settings
 331         if ! ipsec_connection_read_config "${connection}"; then
 332                 return ${EXIT_ERROR}
 333         fi
 334
 335         # Set the key to a new value
 336         assign "${key}" "${value}"
 337
 338         if ! ipsec_connection_write_config "${connection}"; then
 339                 return ${EXIT_ERROR}
 340         fi
 341
 342         return ${EXIT_TRUE}
 343 }
 344
 345 # Reads one or more keys out of a settings file or all if no key is provided.
 346 ipsec_connection_read_config() {
 347         assert [ $# -ge 1 ]
 348
 349         local connection="${1}"
 350         shift 1
 351
 352         if ! ipsec_connection_exists "${connection}"; then
 353                 log ERROR "No such VPN IPsec connection : ${connection}"
 354                 return ${EXIT_ERROR}
 355         fi
 356
 357
 358         local args
 359         if [ $# -eq 0 ] && [ -n "${IPSEC_CONNECTION_CONFIG_SETTINGS}" ]; then
 360                 list_append args ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 361         else
 362                 list_append args $@
 363         fi
 364
 365         local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
 366
 367         if ! settings_read "${path}" ${args}; then
 368                 log ERROR "Could not read settings for VPN IPsec connection ${connection}"
 369                 return ${EXIT_ERROR}
 370         fi
 371 }
 372
 373 # This function checks if a vpn ipsec connection exists
 374 # Returns True when yes and false when not
 375 ipsec_connection_exists() {
 376         assert [ $# -eq 1 ]
 377
 378         local connection=${1}
 379
 380         local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}"
 381
 382         [ -d "${path}" ] && return ${EXIT_TRUE} || return ${EXIT_FALSE}
 383 }
 384
 385 # Determines if strongswan should be automatically started
 386 # when the system boots up.
 387 ipsec_strongswan_autostart() {
 388         local autostart_needed="false"
 389
 390         local connection
 391         for connection in $(ipsec_list_connections); do
 392                 local ENABLED
 393
 394                 if ! ipsec_connection_read_config "${connection}" "ENABLED"; then
 395                         log WARNING "Could not read configuation"
 396                         continue
 397                 fi
 398
 399                 if enabled ENABLED; then
 400                         autostart_needed="true"
 401                         break
 402                 fi
 403         done
 404
 405         # Start strongswan when we need it and when it is not yet enabled
 406         if ${autostart_needed}; then
 407                 if ! service_is_enabled "strongswan"; then
 408                         service_enable "strongswan"
 409                 fi
 410
 411                 if ! service_is_active "strongswan"; then
 412                         service_start "strongswan"
 413                 fi
 414
 415         # Disable strongswan when we do not need it but it is enabled
 416         elif ! ${autostart_needed}; then
 417                 if service_is_enabled "strongswan"; then
 418                         service_disable "strongswan"
 419                 fi
 420
 421                 if service_is_active "strongswan"; then
 422                         service_stop "strongswan"
 423                 fi
 424         fi
 425 }
 426
 427 ipsec_strongswan_load() {
 428         # Do nothing if strongswan is not running
 429         if ! service_is_active "strongswan"; then
 430                 return ${EXIT_OK}
 431         fi
 432
 433         if ! cmd swanctl --load-all; then
 434                 log ERROR "Could not reload strongswan config"
 435                 return ${EXIT_ERROR}
 436         fi
 437 }
 438
 439 # Reloads the connection after config changes
 440 ipsec_reload() {
 441         local connection=${1}
 442
 443         local ENABLED
 444
 445         if ! ipsec_connection_read_config "${connection}" "ENABLED"; then
 446                 log ERROR "Could not read configuration for IPsec connection ${connection}"
 447                 return ${EXIT_ERROR}
 448         fi
 449
 450         if enabled ENABLED; then
 451                 if ! ipsec_connection_to_strongswan ${connection}; then
 452                         log ERROR "Could not generate strongswan config for ${connnection}"
 453                         return ${EXIT_ERROR}
 454                 fi
 455         else
 456                 log DEBUG "Deleting strongswan config ${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf"
 457                 unlink "${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf"
 458         fi
 459
 460         ipsec_strongswan_load
 461 }
 462
 463 # Handle the cli after authentification
 464 ipsec_connection_authentication() {
 465         if [ ! $# -gt 1 ]; then
 466                 log ERROR "Not enough arguments"
 467                 return ${EXIT_ERROR}
 468         fi
 469
 470         local connection=${1}
 471         local cmd=${2}
 472         shift 2
 473
 474         case ${cmd} in
 475                 mode)
 476                         ipsec_connection_authentication_mode "${connection}" $@
 477                         ;;
 478                 pre-shared-key)
 479                         ipsec_connection_authentication_psk "${connection}" $@
 480                         ;;
 481                 *)
 482                         log ERROR "Unrecognized argument: ${cmd}"
 483                         return ${EXIT_ERROR}
 484                         ;;
 485         esac
 486 }
 487
 488 # Set the authentification mode
 489 ipsec_connection_authentication_mode() {
 490         if [ ! $# -eq 2 ]; then
 491                 log ERROR "Not enough arguments"
 492                 return ${EXIT_ERROR}
 493         fi
 494         local connection=${1}
 495         local mode=${2}
 496
 497         if ! isoneof mode ${IPSEC_VALID_AUTH_MODES}; then
 498                 log ERROR "Auth mode '${mode}' is invalid"
 499                 return ${EXIT_ERROR}
 500         fi
 501
 502         if ! ipsec_connection_write_config_key "${connection}" "AUTH_MODE" ${mode^^}; then
 503                 log ERROR "Could not write configuration settings"
 504                 return ${EXIT_ERROR}
 505         fi
 506 }
 507
 508 # Set the psk
 509 ipsec_connection_authentication_psk() {
 510         if [ ! $# -eq 2 ]; then
 511                 log ERROR "Not enough arguments"
 512                 return ${EXIT_ERROR}
 513         fi
 514
 515         local connection=${1}
 516         local psk=${2}
 517
 518         local length=${#psk}
 519
 520         if [ ${length} -lt 4 ]; then
 521                 error "The PSK must be longer than four characters"
 522                 return ${EXIT_ERROR}
 523         fi
 524
 525         if [ ${length} -gt 128 ]; then
 526                 error "The PSK cannot be longer than 128 characters"
 527                 return ${EXIT_ERROR}
 528         fi
 529
 530         if ! ipsec_connection_write_config_key "${connection}" "PSK" "${psk}"; then
 531                 log ERROR "Could not write configuration settings"
 532                 return ${EXIT_ERROR}
 533         fi
 534
 535         return ${EXIT_OK}
 536 }
 537
 538 ipsec_connection_up() {
 539         local connection="${1}"
 540
 541         if ! ipsec_connection_exists "${connection}"; then
 542                 error "No such VPN IPsec connection: ${connection}"
 543                 return ${EXIT_ERROR}
 544         fi
 545
 546         cmd swanctl --initiate --child "${connection}"
 547 }
 548
 549 ipsec_connection_down() {
 550         local connection="${1}"
 551
 552         if ! ipsec_connection_exists "${connection}"; then
 553                 error "No such VPN IPsec connection: ${connection}"
 554                 return ${EXIT_ERROR}
 555         fi
 556
 557         cmd swanctl --terminate --ike "${connection}"
 558 }
 559
 560 # Handle the cli after authentification
 561 ipsec_connection_dpd() {
 562         if [ ! $# -gt 1 ]; then
 563                 log ERROR "Not enough arguments"
 564                 return ${EXIT_ERROR}
 565         fi
 566
 567         local connection=${1}
 568         local cmd=${2}
 569         shift 2
 570
 571         case ${cmd} in
 572                 action)
 573                         ipsec_connection_dpd_action "${connection}" $@
 574                         ;;
 575                 delay)
 576                         ipsec_connection_dpd_delay "${connection}" $@
 577                         ;;
 578                 timeout)
 579                         ipsec_connection_dpd_timeout "${connection}" $@
 580                         ;;
 581                 *)
 582                         log ERROR "Unrecognized argument: ${cmd}"
 583                         return ${EXIT_ERROR}
 584                         ;;
 585         esac
 586 }
 587
 588 # Set the default dpd action
 589 ipsec_connection_dpd_action() {
 590         if [ ! $# -eq 2 ]; then
 591                 log ERROR "Not enough arguments"
 592                 return ${EXIT_ERROR}
 593         fi
 594         local connection=${1}
 595         local action=${2}
 596
 597         if ! isoneof action "restart" "clear"; then
 598                 log ERROR "dpd action '${action}' is invalid"
 599                 return ${EXIT_ERROR}
 600         fi
 601
 602         if ! ipsec_connection_write_config_key "${connection}" "DPD_ACTION" ${action}; then
 603                 log ERROR "Could not write configuration settings"
 604                 return ${EXIT_ERROR}
 605         fi
 606 }
 607
 608 # Set the dpd delay
 609 ipsec_connection_dpd_delay() {
 610         if [ ! $# -ge 2 ]; then
 611                 log ERROR "Not enough arguments"
 612                 return ${EXIT_ERROR}
 613         fi
 614
 615         local connection=${1}
 616         shift 1
 617         local value=$@
 618
 619         if ! isinteger value; then
 620                 value=$(parse_time $@)
 621                 if [ ! $? -eq 0 ]; then
 622                         log ERROR "Parsing the passed time was not sucessful please check the passed values."
 623                         return ${EXIT_ERROR}
 624                 fi
 625         fi
 626
 627         if [ ${value} -lt 0 ]; then
 628                 log ERROR "The passed time value must be in the sum greater or equal zero seconds."
 629                 return ${EXIT_ERROR}
 630         fi
 631
 632         if ! ipsec_connection_write_config_key "${connection}" "DPD_DELAY" ${value}; then
 633                 log ERROR "Could not write configuration settings"
 634                 return ${EXIT_ERROR}
 635         fi
 636
 637         return ${EXIT_OK}
 638 }
 639
 640 # Set the dpd timeout
 641 ipsec_connection_dpd_timeout() {
 642         if [ ! $# -ge 2 ]; then
 643                 log ERROR "Not enough arguments"
 644                 return ${EXIT_ERROR}
 645         fi
 646
 647         local connection=${1}
 648         shift 1
 649         local value=$@
 650
 651         if ! isinteger value; then
 652                 value=$(parse_time $@)
 653                 if [ ! $? -eq 0 ]; then
 654                         log ERROR "Parsing the passed time was not sucessful please check the passed values."
 655                         return ${EXIT_ERROR}
 656                 fi
 657         fi
 658
 659         if [ ${value} -le 0 ]; then
 660                 log ERROR "The passed time value must be in the sum greater or equal zero seconds."
 661                 return ${EXIT_ERROR}
 662         fi
 663
 664         if ! ipsec_connection_write_config_key "${connection}" "DPD_TIMEOUT" ${value}; then
 665                 log ERROR "Could not write configuration settings"
 666                 return ${EXIT_ERROR}
 667         fi
 668
 669         return ${EXIT_OK}
 670 }
 671
 672 # Handle the cli after local
 673 ipsec_connection_local() {
 674         if [ ! $# -ge 2 ]; then
 675                 log ERROR "Not enough arguments"
 676                 return ${EXIT_ERROR}
 677         fi
 678
 679         local connection=${1}
 680         local cmd=${2}
 681         shift 2
 682
 683         case ${cmd} in
 684                 address)
 685                         ipsec_connection_local_address "${connection}" $@
 686                         ;;
 687                 id)
 688                         ipsec_connection_id "${connection}" "LOCAL" $@
 689                         ;;
 690                 prefix)
 691                         ipsec_connection_prefix "${connection}" "LOCAL" $@
 692                         ;;
 693                 *)
 694                         log ERROR "Unrecognized argument: ${cmd}"
 695                         return ${EXIT_ERROR}
 696                         ;;
 697         esac
 698
 699         return ${EXIT_OK}
 700 }
 701
 702 # Set the connection mode
 703 ipsec_connection_mode() {
 704         if [ ! $# -eq 2 ]; then
 705                 log ERROR "Not enough arguments"
 706                 return ${EXIT_ERROR}
 707         fi
 708         local connection=${1}
 709         local mode=${2}
 710
 711         if ! isoneof mode ${IPSEC_VALID_MODES}; then
 712                 log ERROR "Mode '${mode}' is invalid"
 713                 return ${EXIT_ERROR}
 714         fi
 715
 716         if ! ipsec_connection_write_config_key "${connection}" "MODE" ${mode}; then
 717                 log ERROR "Could not write configuration settings"
 718                 return ${EXIT_ERROR}
 719         fi
 720
 721         return ${EXIT_OK}
 722 }
 723
 724 # Set the local address
 725 ipsec_connection_local_address() {
 726         if [ ! $# -eq 2 ]; then
 727                 log ERROR "Not enough arguments"
 728                 return ${EXIT_ERROR}
 729         fi
 730         local connection=${1}
 731         local local_address=${2}
 732
 733         if ! ipsec_connection_check_peer ${local_address}; then
 734                 log ERROR "Local address '${local_address}' is invalid"
 735                 return ${EXIT_ERROR}
 736         fi
 737
 738         if ! ipsec_connection_write_config_key "${connection}" "LOCAL_ADDRESS" ${local_address}; then
 739                 log ERROR "Could not write configuration settings"
 740                 return ${EXIT_ERROR}
 741         fi
 742
 743         return ${EXIT_OK}
 744 }
 745
 746 # Set the peer to connect to
 747 ipsec_connection_peer() {
 748         if [ ! $# -eq 2 ]; then
 749                 log ERROR "Not enough arguments"
 750                 return ${EXIT_ERROR}
 751         fi
 752         local connection=${1}
 753         local peer=${2}
 754
 755         if ! ipsec_connection_check_peer ${peer}; then
 756                 log ERROR "Peer '${peer}' is invalid"
 757                 return ${EXIT_ERROR}
 758         fi
 759
 760         if ! ipsec_connection_write_config_key "${connection}" "PEER" ${peer}; then
 761                 log ERROR "Could not write configuration settings"
 762                 return ${EXIT_ERROR}
 763         fi
 764
 765         return ${EXIT_OK}
 766 }
 767
 768 #Set the local or remote id
 769 ipsec_connection_id() {
 770         if [ ! $# -eq 3 ]; then
 771                 log ERROR "Not enough arguments"
 772                 return ${EXIT_ERROR}
 773         fi
 774         local connection=${1}
 775         local type=${2}
 776         local id=${3}
 777
 778         if ! ipsec_connection_check_id ${id}; then
 779                 log ERROR "Id '${id}' is invalid"
 780                 return ${EXIT_ERROR}
 781         fi
 782
 783         if ! ipsec_connection_write_config_key "${connection}" "${type}_ID" ${id}; then
 784                 log ERROR "Could not write configuration settings"
 785                 return ${EXIT_ERROR}
 786         fi
 787
 788         return ${EXIT_OK}
 789 }
 790
 791 # Set the local or remote prefix
 792 ipsec_connection_prefix() {
 793         if [ ! $# -ge 3 ]; then
 794                 log ERROR "Not enough arguments"
 795                 return ${EXIT_ERROR}
 796         fi
 797         local connection=${1}
 798         local type=${2}
 799         shift 2
 800
 801         local _prefix="${type}_PREFIX"
 802         local "${_prefix}"
 803         if ! ipsec_connection_read_config "${connection}" "${_prefix}"; then
 804                 return ${EXIT_ERROR}
 805         fi
 806
 807         # Remove duplicated entries to proceed the list safely
 808         assign "${_prefix}" "$(list_unique ${!_prefix} )"
 809
 810         local prefixes_added
 811         local prefixes_removed
 812         local prefixes_set
 813
 814         while [ $# -gt 0 ]; do
 815                 local arg="${1}"
 816
 817                 case "${arg}" in
 818                         +*)
 819                                 list_append prefixes_added "${arg:1}"
 820                                 ;;
 821                         -*)
 822                                 list_append prefixes_removed "${arg:1}"
 823                                 ;;
 824                         [A-Fa-f0-9]*)
 825                                 list_append prefixes_set "${arg}"
 826                                 ;;
 827                         *)
 828                                 error "Invalid argument: ${arg}"
 829                                 return ${EXIT_ERROR}
 830                                 ;;
 831                 esac
 832                 shift
 833         done
 834
 835         # Check if the user is trying a mixed operation
 836         if ! list_is_empty prefixes_set && (! list_is_empty prefixes_added || ! list_is_empty prefixes_removed); then
 837                 error "You cannot reset the prefix list and add or remove prefixes at the same time"
 838                 return ${EXIT_ERROR}
 839         fi
 840
 841         # Set new prefix list
 842         if ! list_is_empty prefixes_set; then
 843                 # Check if all prefixes are valid
 844                 local prefix
 845                 for prefix in ${prefixes_set}; do
 846                         if ! ip_net_is_valid ${prefix}; then
 847                                 error "Unsupported prefix: ${prefix}"
 848                                 return ${EXIT_ERROR}
 849                         fi
 850                 done
 851
 852                 assign "${_prefix}" "${prefixes_set}"
 853
 854         # Perform incremental updates
 855         else
 856                 local prefix
 857
 858                 # Perform all removals
 859                 for prefix in ${prefixes_removed}; do
 860                         if ! list_remove "${_prefix}" ${prefix}; then
 861                                 warning "${prefix} was not on the list and could not be removed"
 862                         fi
 863                 done
 864
 865
 866                 for prefix in ${prefixes_added}; do
 867                         if ip_net_is_valid ${prefix}; then
 868                                 if ! list_append_unique "${_prefix}" ${prefix}; then
 869                                         warning "${prefix} is already on the prefix list"
 870                                 fi
 871                         else
 872                                 warning "${prefix} is not a valid IP network and could not be added"
 873                         fi
 874                 done
 875         fi
 876
 877         # Check if the list contain at least one valid prefix
 878         if list_is_empty ${_prefix}; then
 879                 error "Cannot save an empty prefix list"
 880                 return ${EXIT_ERROR}
 881         fi
 882
 883         # Save everything
 884         if ! ipsec_connection_write_config_key "${connection}" "${_prefix}" ${!_prefix}; then
 885                 log ERROR "Could not write configuration settings"
 886         fi
 887
 888         return ${EXIT_OK}
 889 }
 890
 891 # Handle the cli after remote
 892 ipsec_connection_remote() {
 893         if [ ! $# -ge 2 ]; then
 894                 log ERROR "Not enough arguments"
 895                 return ${EXIT_ERROR}
 896         fi
 897
 898         local connection=${1}
 899         local cmd=${2}
 900         shift 2
 901
 902         case ${cmd} in
 903                 id)
 904                         ipsec_connection_id "${connection}" "REMOTE" $@
 905                         ;;
 906
 907                 prefix)
 908                         ipsec_connection_prefix "${connection}" "REMOTE" $@
 909                         ;;
 910                 *)
 911                         log ERROR "Unrecognized argument: ${cmd}"
 912                         return ${EXIT_ERROR}
 913                         ;;
 914         esac
 915
 916         return ${EXIT_OK}
 917 }
 918
 919 # Set the inactivity timeout
 920 ipsec_connection_inactivity_timeout() {
 921         if [ ! $# -ge 2 ]; then
 922                 log ERROR "Not enough arguments"
 923                 return ${EXIT_ERROR}
 924         fi
 925
 926         local connection=${1}
 927         shift 1
 928         local value=$@
 929
 930         if ! isinteger value; then
 931                 value=$(parse_time $@)
 932                 if [ ! $? -eq 0 ]; then
 933                         log ERROR "Parsing the passed time was not sucessful please check the passed values."
 934                         return ${EXIT_ERROR}
 935                 fi
 936         fi
 937
 938         if [ ${value} -le 0 ]; then
 939                 log ERROR "The passed time value must be in the sum greater zero seconds."
 940                 return ${EXIT_ERROR}
 941         fi
 942
 943         if ! ipsec_connection_write_config_key "${connection}" "INACTIVITY_TIMEOUT" ${value}; then
 944                 log ERROR "Could not write configuration settings"
 945                 return ${EXIT_ERROR}
 946         fi
 947
 948         return ${EXIT_OK}
 949 }
 950
 951 # Set the default start action
 952 ipsec_connection_start_action() {
 953         if [ ! $# -eq 2 ]; then
 954                 log ERROR "Not enough arguments"
 955                 return ${EXIT_ERROR}
 956         fi
 957         local connection=${1}
 958         local action=${2}
 959
 960         if ! isoneof action "on-demand" "always-on"; then
 961                 log ERROR "Start action '${action}' is invalid"
 962                 return ${EXIT_ERROR}
 963         fi
 964
 965         if ! ipsec_connection_write_config_key "${connection}" "START_ACTION" ${action}; then
 966                 log ERROR "Could not write configuration settings"
 967                 return ${EXIT_ERROR}
 968         fi
 969 }
 970
 971 # Set the security policy to use
 972 ipsec_connection_security_policy() {
 973         if [ ! $# -eq 2 ]; then
 974                 log ERROR "Not enough arguments"
 975                 return ${EXIT_ERROR}
 976         fi
 977         local connection=${1}
 978         local security_policy=${2}
 979
 980         if ! vpn_security_policy_exists ${security_policy}; then
 981                 log ERROR "No such vpn security policy '${security_policy}'"
 982                 return ${EXIT_ERROR}
 983         fi
 984
 985         if ! ipsec_connection_write_config_key "${connection}" "SECURITY_POLICY" ${security_policy}; then
 986                 log ERROR "Could not write configuration settings"
 987                 return ${EXIT_ERROR}
 988         fi
 989 }
 990
 991 # Check if a id is valid
 992 ipsec_connection_check_id() {
 993         assert [ $# -eq 1 ]
 994         local id=${1}
 995
 996         if [[ ${id} =~ ^@[[:alnum:]]+$ ]] || ip_is_valid ${id}; then
 997                 return ${EXIT_TRUE}
 998         else
 999                 return ${EXIT_FALSE}
1000         fi
1001 }
1002
1003 # Checks if a peer is valid
1004 ipsec_connection_check_peer() {
1005         assert [ $# -eq 1 ]
1006         local peer=${1}
1007
1008         # TODO Accept also FQDNs
1009         if ip_is_valid ${peer}; then
1010                 return ${EXIT_TRUE}
1011         else
1012                 return ${EXIT_FALSE}
1013         fi
1014 }
1015
1016 # This function checks if a VPN IPsec connection name is valid
1017 # Allowed are only A-Za-z0-9
1018 ipsec_connection_check_name() {
1019         assert [ $# -eq 1 ]
1020
1021         local connection=${1}
1022
1023         [[ "${connection}" =~ [^[:alnum:]$] ]]
1024 }
1025
1026 # Function that creates one VPN IPsec connection
1027 ipsec_connection_new() {
1028         if [ $# -gt 1 ]; then
1029                 error "Too many arguments"
1030                 return ${EXIT_ERROR}
1031         fi
1032
1033         local connection="${1}"
1034         if ! isset connection; then
1035                 error "Please provide a connection name"
1036                 return ${EXIT_ERROR}
1037         fi
1038
1039         # Check for duplicates
1040         if ipsec_connection_exists "${connection}"; then
1041                 error "The VPN IPsec connection ${connection} already exists"
1042                 return ${EXIT_ERROR}
1043         fi
1044
1045         # Check if the name of the connection is valid
1046         if  ipsec_connection_check_name "${connection}"; then
1047                 error "'${connection}' contains illegal characters"
1048                 return ${EXIT_ERROR}
1049         fi
1050
1051         log DEBUG "Creating VPN IPsec connection ${connection}"
1052
1053         if ! mkdir -p "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
1054                 log ERROR "Could not create config directory for ${connection}"
1055                 return ${EXIT_ERROR}
1056         fi
1057
1058         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
1059
1060         AUTH_MODE=${IPSEC_DEFAULT_AUTH_MODE}
1061         DPD_ACTION=${IPSEC_DEFAULT_DPD_ACTION}
1062         DPD_DELAY=${IPSEC_DEFAULT_DPD_DELAY}
1063         DPD_TIMEOUT=${IPSEC_DEFAULT_DPD_TIMEOUT}
1064         ENABLED=${IPSEC_DEFAULT_ENABLED}
1065         MODE=${IPSEC_DEFAULT_MODE}
1066         START_ACTION=${IPSEC_DEFAULT_START_ACTION}
1067
1068         INACTIVITY_TIMEOUT=${IPSEC_DEFAULT_INACTIVITY_TIMEOUT}
1069         SECURITY_POLICY=${IPSEC_DEFAULT_SECURITY_POLICY}
1070
1071         if ! ipsec_connection_write_config "${connection}"; then
1072                 log ERROR "Could not write new config file"
1073                 return ${EXIT_ERROR}
1074         fi
1075
1076         # Configure strongswan autostart
1077         ipsec_strongswan_autostart
1078 }
1079
1080 # Function that deletes based on the passed parameters one ore more vpn security policies
1081 ipsec_connection_destroy() {
1082         local connection
1083         for connection in $@; do
1084                 if ! ipsec_connection_exists "${connection}"; then
1085                         log ERROR "The VPN IPsec connection ${connection} does not exist."
1086                         continue
1087                 fi
1088
1089                 log DEBUG "Deleting VPN IPsec connection ${connection}"
1090
1091                 # Delete strongswan configuration file
1092                 file_delete "${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf"
1093
1094                 if ! rm -rf "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
1095                         log ERROR "Deleting the VPN IPsec connection ${connection} was not sucessful"
1096                         return ${EXIT_ERROR}
1097                 fi
1098
1099         done
1100 }
1101
1102 # List all ipsec connections
1103 ipsec_list_connections() {
1104         local connection
1105         for connection in ${NETWORK_IPSEC_CONNS_DIR}/*; do
1106                 [ -d ${connection} ] || continue
1107                 basename ${connection}
1108         done
1109 }
1110
1111 ipsec_connection_to_strongswan() {
1112         local connection="${1}"
1113
1114         # Read the config settings
1115         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
1116         if ! ipsec_connection_read_config "${connection}"; then
1117                 error "Could not read the connection ${connection}"
1118                 return ${EXIT_ERROR}
1119         fi
1120
1121         local path="${NETWORK_IPSEC_SWANCTL_CONNECTIONS_DIR}/${connection}.conf"
1122
1123         (
1124                 # Write the connection section
1125                 _ipsec_connection_to_strongswan_connection "${connection}"
1126
1127                 # Write the secrets section
1128                 _ipsec_connection_to_strongswan_secrets "${connection}"
1129
1130         ) > ${path}
1131 }
1132
1133 _ipsec_connection_to_strongswan_connection() {
1134         local connection="${1}"
1135
1136         # Read the security policy
1137         local ${VPN_SECURITY_POLICIES_CONFIG_SETTINGS}
1138         if ! vpn_security_policies_read_config "${SECURITY_POLICY}"; then
1139                 return ${EXIT_ERROR}
1140         fi
1141
1142         # Is DPD enabled?
1143         local dpd="false"
1144         if isset DPD_DELAY && isinteger DPD_DELAY && [ ${DPD_DELAY} -gt 0 ]; then
1145                 dpd="true"
1146         fi
1147
1148         # Write configuration header
1149         config_header "strongSwan configuration for ${connection}"
1150
1151         print_indent 0 "connections {"
1152         print_indent 1 "${connection} {"
1153
1154         # IKE Version
1155         print_indent 2 "# IKE Version"
1156         case "${KEY_EXCHANGE^^}" in
1157                 IKEV1)
1158                         print_indent 2 "version = 1"
1159                         ;;
1160
1161                 # Fall back to IKEv2 for any random values
1162                 IKEV2|*)
1163                         print_indent 2 "version = 2"
1164                         ;;
1165         esac
1166         print # empty line
1167
1168         # Always only keep one connection open at a time
1169         print_indent 2 "# Unique IDs"
1170         print_indent 2 "unique = replace"
1171         print
1172
1173         # Local Address
1174         print_indent 2 "# Local Address"
1175         if isset LOCAL_ADDRESS; then
1176                 print_indent 2 "local_addrs = ${LOCAL_ADDRESS}"
1177         else
1178                 print_indent 2 "local_addrs = %any"
1179         fi
1180         print
1181
1182         # Remote Address
1183         print_indent 2 "# Remote Address"
1184         if isset PEER; then
1185                 print_indent 2 "remote_addrs = ${PEER}"
1186         else
1187                 print_indent 2 "remote_addrs = %any"
1188         fi
1189         print
1190
1191         # IKE Proposals
1192         print_indent 2 "# IKE Proposals"
1193         print_indent 2 "proposals = $(vpn_security_policies_make_ike_proposal ${SECURITY_POLICY})"
1194         print
1195
1196         # DPD Settings
1197         if enabled dpd; then
1198                 print_indent 2 "# Dead Peer Detection"
1199                 print_indent 2 "dpd_delay = ${DPD_DELAY}"
1200
1201                 if isset DPD_TIMEOUT; then
1202                         print_indent 2 "dpd_timeout = ${DPD_TIMEOUT}"
1203                 fi
1204
1205                 print
1206         fi
1207
1208         # Fragmentation
1209         print_indent 2 "# Fragmentation"
1210         print_indent 2 "fragmentation = yes"
1211         print
1212
1213         # Local
1214         print_indent 2 "local {"
1215
1216         # Local ID
1217         if isset LOCAL_ID; then
1218                 print_indent 3 "id = ${LOCAL_ID}"
1219         fi
1220
1221         # Authentication
1222         case "${AUTH_MODE}" in
1223                 PSK)
1224                         print_indent 3 "auth = psk"
1225                         ;;
1226         esac
1227
1228         print_indent 2 "}"
1229         print
1230
1231         # Remote
1232         print_indent 2 "remote {"
1233
1234         # Remote ID
1235         if isset REMOTE_ID; then
1236                 print_indent 3 "id = ${REMOTE_ID}"
1237         fi
1238
1239         # Authentication
1240         case "${AUTH_MODE}" in
1241                 PSK)
1242                         print_indent 3 "auth = psk"
1243                         ;;
1244         esac
1245
1246         print_indent 2 "}"
1247         print
1248
1249         # Children
1250
1251         print_indent 2 "children {"
1252         print_indent 3 "${connection} {"
1253
1254         print_indent 4 "# ESP Proposals"
1255         print_indent 4 "esp_proposals = $(vpn_security_policies_make_esp_proposal ${SECURITY_POLICY})"
1256         print
1257
1258         # Traffic Selectors
1259
1260         case "${MODE}" in
1261                 gre-*)
1262                         print_indent 4 "local_ts = dynamic[gre]"
1263                         print_indent 4 "remote_ts = dynamic[gre]"
1264                         ;;
1265                 *)
1266                         # Local Prefixes
1267                         if isset LOCAL_PREFIX; then
1268                                 print_indent 4 "local_ts = $(list_join LOCAL_PREFIX ,)"
1269                         else
1270                                 print_indent 4 "local_ts = dynamic"
1271                         fi
1272
1273                         # Remote Prefixes
1274                         if isset REMOTE_PREFIX; then
1275                                 print_indent 4 "remote_ts = $(list_join REMOTE_PREFIX ,)"
1276                         else
1277                                 print_indent 4 "remote_ts = dynamic"
1278                         fi
1279                         ;;
1280         esac
1281         print
1282
1283         # Netfilter Marks
1284         case "${MODE}" in
1285                 vti)
1286                         print_indent 4 "# Netfilter Marks"
1287                         print_indent 4 "mark_in = %unique"
1288                         print_indent 4 "mark_out = %unique"
1289                         print
1290                         ;;
1291         esac
1292
1293         # Dead Peer Detection
1294         if enabled dpd; then
1295                 print_indent 4 "# Dead Peer Detection"
1296                 print_indent 4 "dpd_action = ${DPD_ACTION}"
1297                 print
1298         fi
1299
1300         # Rekeying
1301         if isset LIFETIME; then
1302                 print_indent 4 "# Rekey Time"
1303                 print_indent 4 "rekey_time = ${LIFETIME}"
1304                 print
1305         fi
1306
1307         # Updown Script
1308         print_indent 4 "updown = ${NETWORK_HELPERS_DIR}/ipsec-updown"
1309         print
1310
1311         # Mode
1312         print_indent 4 "# Mode"
1313         case "${MODE}" in
1314                 gre-transport)
1315                         print_indent 4 "mode = transport"
1316                         ;;
1317                 tunnel|vti|*)
1318                         print_indent 4 "mode = tunnel"
1319                         ;;
1320         esac
1321         print
1322
1323         # Compression
1324         print_indent 4 "# Compression"
1325         if enabled COMPRESSION; then
1326                 print_indent 4 "ipcomp = yes"
1327         else
1328                 print_indent 4 "ipcomp = no"
1329         fi
1330         print
1331
1332         # Inactivity Timeout
1333         if isset INACTIVITY_TIMEOUT; then
1334                 print_indent 4 "# Inactivity Timeout"
1335                 print_indent 4 "inactivity = ${INACTIVITY_TIMEOUT}"
1336                 print
1337         fi
1338
1339         # Start Action
1340         print_indent 4 "# Start Action"
1341         case "${START_ACTION}" in
1342                 on-demand)
1343                         print_indent 4 "start_action = trap"
1344                         print_indent 4 "close_action = trap"
1345                         ;;
1346                 wait)
1347                         print_indent 4 "start_action = none"
1348                         print_indent 4 "close_action = none"
1349                         ;;
1350                 always-on|*)
1351                         print_indent 4 "start_action = start"
1352                         print_indent 4 "close_action = start"
1353                         ;;
1354         esac
1355         print
1356
1357         print_indent 3 "}"
1358         print_indent 2 "}"
1359         print
1360
1361         print_indent 1 "}"
1362         print_indent 0 "}"
1363         print
1364 }
1365
1366 _ipsec_connection_to_strongswan_secrets() {
1367         local connection="${1}"
1368
1369         print_indent 0 "secrets {"
1370
1371         case "${AUTH_MODE}" in
1372                 PSK)
1373                         print_indent 1 "ike {"
1374
1375                         # Secret
1376                         print_indent 2 "secret = ${PSK}"
1377
1378                         # ID
1379                         if isset REMOTE_ID; then
1380                                 print_indent 2 "id = ${REMOTE_ID}"
1381                         fi
1382
1383                         print_indent 1 "}"
1384                         ;;
1385         esac
1386
1387         print_indent 0 "}"
1388 }
1389
1390 # This function writes all values to a via ${pool} specificated VPN IPsec pool configuration file
1391 ipsec_pool_write_config() {
1392         assert [ $# -ge 1 ]
1393
1394         local pool="${1}"
1395
1396         if ! ipsec_pool_exists "${pool}"; then
1397                 log ERROR "No such VPN IPsec pool: ${pool}"
1398                 return ${EXIT_ERROR}
1399         fi
1400
1401         local path="${NETWORK_IPSEC_POOLS_DIR}/${pool}/settings"
1402
1403         if ! settings_write "${path}" ${IPSEC_POOL_CONFIG_SETTINGS}; then
1404                 log ERROR "Could not write configuration settings for VPN IPsec pool ${pool}"
1405                 return ${EXIT_ERROR}
1406         fi
1407 }
1408
1409 # This funtion writes the value for one key to a via ${connection} specificated
1410 # VPN IPsec pool configuration file
1411 ipsec_pool_write_config_key() {
1412         assert [ $# -ge 3 ]
1413
1414         local pool=${1}
1415         local key=${2}
1416         shift 2
1417
1418         local value="$@"
1419
1420         if ! ipsec_pool_exists "${pool}"; then
1421                 log ERROR "No such VPN IPsec pool: ${pool}"
1422                 return ${EXIT_ERROR}
1423         fi
1424
1425         log DEBUG "Set '${key}' to new value '${value}' in VPN IPsec pool '${pool}'"
1426
1427         local ${IPSEC_POOL_CONFIG_SETTINGS}
1428
1429         # Read the config settings
1430         if ! ipsec_pool_read_config "${pool}"; then
1431                 return ${EXIT_ERROR}
1432         fi
1433
1434         # Set the key to a new value
1435         assign "${key}" "${value}"
1436
1437         if ! ipsec_pool_write_config "${pool}"; then
1438                 return ${EXIT_ERROR}
1439         fi
1440
1441         return ${EXIT_TRUE}
1442 }
1443
1444 # Reads one or more keys out of a settings file or all if no key is provided.
1445 ipsec_pool_read_config() {
1446         assert [ $# -ge 1 ]
1447
1448         local pool="${1}"
1449         shift 1
1450
1451         if ! ipsec_pool_exists "${pool}"; then
1452                 log ERROR "No such VPN IPsec pool : ${pool}"
1453                 return ${EXIT_ERROR}
1454         fi
1455
1456         local args
1457         if [ $# -eq 0 ] && [ -n "${IPSEC_POOL_CONFIG_SETTINGS}" ]; then
1458                 list_append args ${IPSEC_POOL_CONFIG_SETTINGS}
1459         else
1460                 list_append args $@
1461         fi
1462
1463         local path="${NETWORK_IPSEC_POOLS_DIR}/${pool}/settings"
1464
1465         if ! settings_read "${path}" ${args}; then
1466                 log ERROR "Could not read settings for VPN IPsec pool ${pool}"
1467                 return ${EXIT_ERROR}
1468         fi
1469 }
1470
1471 # This function checks if a vpn IPsec pool exists
1472 # Returns True when yes and false when not
1473 ipsec_pool_exists() {
1474         assert [ $# -eq 1 ]
1475
1476         local pool=${1}
1477
1478         local path="${NETWORK_IPSEC_POOLS_DIR}/${pool}"
1479
1480         [ -d "${path}" ] && return ${EXIT_TRUE} || return ${EXIT_FALSE}
1481 }
1482
1483 # This function checks if a VPN IPsec pool name is valid
1484 # Allowed are only A-Za-z0-9
1485 ipsec_pool_check_name() {
1486         assert [ $# -eq 1 ]
1487
1488         local pool=${1}
1489
1490         # These are special words in strongswan
1491         if isoneof pool dhcp radius; then
1492                 return ${EXIT_ERROR}
1493         fi
1494
1495         [[ "${pool}" =~ [^[:alnum:]$] ]]
1496 }
1497
1498 ipsec_pool_new() {
1499         if [ $# -gt 1 ]; then
1500                 error "Too many arguments"
1501                 return ${EXIT_ERROR}
1502         fi
1503
1504         local pool="${1}"
1505         if ! isset pool; then
1506                 error "Please provide a pool name"
1507                 return ${EXIT_ERROR}
1508         fi
1509
1510         # Check for duplicates
1511         if ipsec_pool_exists "${pool}"; then
1512                 error "The VPN IPsec pool ${pool} already exists"
1513                 return ${EXIT_ERROR}
1514         fi
1515
1516         # Check if the name of the connection is valid
1517         if  ipsec_pool_check_name "${pool}"; then
1518                 error "'${pool}' contains illegal characters"
1519                 return ${EXIT_ERROR}
1520         fi
1521
1522         log DEBUG "Creating VPN IPsec pool ${pool}"
1523
1524         if ! mkdir -p "${NETWORK_IPSEC_POOLS_DIR}/${pool}"; then
1525                 log ERROR "Could not create config directory for ${pool}"
1526                 return ${EXIT_ERROR}
1527         fi
1528
1529         local ${IPSEC_POOL_CONFIG_SETTINGS}
1530
1531         if ! ipsec_pool_write_config "${pool}"; then
1532                 log ERROR "Could not write new config file"
1533                 return ${EXIT_ERROR}
1534         fi
1535 }
1536
1537 # Function that deletes based on the passed parameters
1538 # one ore more vpn ipsec pools
1539 ipsec_pool_destroy() {
1540         local pool
1541         for pool in $@; do
1542                 if ! ipsec_pool_exists "${pool}"; then
1543                         log ERROR "The VPN IPsec pool ${pool} does not exist."
1544                         continue
1545                 fi
1546
1547                 log DEBUG "Deleting VPN IPsec pool ${pool}"
1548
1549                 if ! rm -rf "${NETWORK_IPSEC_POOLS_DIR}/${pool}"; then
1550                         log ERROR "Deleting the VPN IPsec pool ${pool} was not sucessful"
1551                         return ${EXIT_ERROR}
1552                 fi
1553         done
1554 }
1555
1556 ipsec_pool_network() {
1557         if [ ! $# -ge 2 ]; then
1558                 log ERROR "Not enough arguments"
1559                 return ${EXIT_ERROR}
1560         fi
1561         local pool=${1}
1562         shift 1
1563
1564         local NETWORKS
1565         if ! ipsec_pool_read_config "${pool}" "NETWORKS"; then
1566                 return ${EXIT_ERROR}
1567         fi
1568
1569         # Remove duplicated entries to proceed the list safely
1570         assign "NETWORKS" "$(list_unique ${NETWORKS})"
1571
1572         local networks_added
1573         local networks_removed
1574         local networks_set
1575
1576         while [ $# -gt 0 ]; do
1577                 local arg="${1}"
1578
1579                 case "${arg}" in
1580                         +*)
1581                                 list_append networks_added "${arg:1}"
1582                                 ;;
1583                         -*)
1584                                 list_append networks_removed "${arg:1}"
1585                                 ;;
1586                         [A-Fa-f0-9]*)
1587                                 list_append networks_set "${arg}"
1588                                 ;;
1589                         *)
1590                                 error "Invalid argument: ${arg}"
1591                                 return ${EXIT_ERROR}
1592                                 ;;
1593                 esac
1594                 shift
1595         done
1596
1597         # Check if the user is trying a mixed operation
1598         if ! list_is_empty networks_set && (! list_is_empty networks_added || ! list_is_empty networks_removed); then
1599                 error "You cannot reset the networks list and add or remove networks at the same time"
1600                 return ${EXIT_ERROR}
1601         fi
1602
1603         # Set new prefix list
1604         if ! list_is_empty networks_set; then
1605                 # Check if all networks are valid
1606                 local network
1607                 for network in ${networks_set}; do
1608                         if ! ip_net_is_valid ${network}; then
1609                                 error "Unsupported prefix: ${network}"
1610                                 return ${EXIT_ERROR}
1611                         fi
1612                 done
1613
1614                 assign "NETWORKS" "${networks_set}"
1615
1616         # Perform incremental updates
1617         else
1618                 # Perform all removals
1619                 local network
1620                 for network in ${networks_removed}; do
1621                         if ! list_remove "NETWORKS" ${network}; then
1622                                 warning "${network} was not on the list and could not be removed"
1623                         fi
1624                 done
1625
1626                 for network in ${networks_added}; do
1627                         if ip_net_is_valid ${network}; then
1628                                 if ! list_append_unique "NETWORKS" ${network}; then
1629                                         warning "${network} is already on the network list"
1630                                 fi
1631                         else
1632                                 warning "${network} is not a valid IP network and could not be added"
1633                         fi
1634                 done
1635         fi
1636
1637         # Check if the list contain at least one valid network
1638         if list_is_empty "NETWORKS"; then
1639                 error "Cannot save an empty network list"
1640                 return ${EXIT_ERROR}
1641         fi
1642
1643         # Save everything
1644         if ! ipsec_pool_write_config_key "${pool}" "NETWORKS" "${NETWORKS}"; then
1645                 log ERROR "Could not write configuration settings"
1646         fi
1647
1648         return ${EXIT_OK}
1649 }
1650
1651 ipsec_pool_dns_server() {
1652         if [ ! $# -ge 2 ]; then
1653                 log ERROR "Not enough arguments"
1654                 return ${EXIT_ERROR}
1655         fi
1656         local pool=${1}
1657         shift 1
1658
1659         local NETWORK
1660         if ! ipsec_pool_read_config "${pool}" "DNS_SERVERS"; then
1661                 return ${EXIT_ERROR}
1662         fi
1663
1664         # Remove duplicated entries to proceed the list safely
1665         assign "DNS_SERVERS" "$(list_unique ${DNS_SERVERS})"
1666
1667         local dns_servers_added
1668         local dns_servers_removed
1669         local dns_servers_set
1670
1671         while [ $# -gt 0 ]; do
1672                 local arg="${1}"
1673
1674                 case "${arg}" in
1675                         +*)
1676                                 list_append dns_servers_added "${arg:1}"
1677                                 ;;
1678                         -*)
1679                                 list_append dns_servers_removed "${arg:1}"
1680                                 ;;
1681                         [A-Fa-f0-9]*)
1682                                 list_append dns_servers_set "${arg}"
1683                                 ;;
1684                         *)
1685                                 error "Invalid argument: ${arg}"
1686                                 return ${EXIT_ERROR}
1687                                 ;;
1688                 esac
1689                 shift
1690         done
1691
1692         # Check if the user is trying a mixed operation
1693         if ! list_is_empty dns_servers_set && (! list_is_empty dns_servers_added || ! list_is_empty dns_servers_removed); then
1694                 error "You cannot reset the DNS servers list and add or remove DNS servers at the same time"
1695                 return ${EXIT_ERROR}
1696         fi
1697
1698         # Set new dns server list
1699         if ! list_is_empty dns_servers_set; then
1700                 # Check if all dns servers are valid
1701                 local dns_server
1702                 for dns_server in ${dns_servers_set}; do
1703                         if ! ip_is_valid ${dns_server}; then
1704                                 error "Invalid DNS server: ${dns_server}"
1705                                 return ${EXIT_ERROR}
1706                         fi
1707                 done
1708
1709                 assign "DNS_SERVERS" "${dns_servers_set}"
1710
1711         # Perform incremental updates
1712         else
1713                 # Perform all removals
1714                 local dns_server
1715                 for dns_server in ${dns_servers_removed}; do
1716                         if ! list_remove "DNS_SERVERS" ${dns_server}; then
1717                                 warning "${dns_server} was not on the list and could not be removed"
1718                         fi
1719                 done
1720
1721                 for dns_server in ${dns_servers_added}; do
1722                         if ip_is_valid ${dns_server}; then
1723                                 if ! list_append_unique "DNS_SERVERS" ${dns_server}; then
1724                                         warning "${dns_server} is already on the DNS server list"
1725                                 fi
1726                         else
1727                                 warning "${dns_server} is not a valid DNS server and could not be added"
1728                         fi
1729                 done
1730         fi
1731
1732         # Check if the list contain at least one valid prefix
1733         if list_is_empty "DNS_SERVERS"; then
1734                 error "Cannot save an empty DNS server list"
1735                 return ${EXIT_ERROR}
1736         fi
1737
1738         # Save everything
1739         if ! ipsec_pool_write_config_key "${pool}" "DNS_SERVERS" "${DNS_SERVER}"; then
1740                 log ERROR "Could not write configuration settings"
1741         fi
1742
1743         return ${EXIT_OK}
1744 }