src/functions/functions.ipsec

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2017  IPFire Network Development Team                         #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 IPSEC_CONNECTION_CONFIG_SETTINGS="AUTH_MODE INACTIVITY_TIMEOUT LOCAL_ID LOCAL_PREFIX"
  23 IPSEC_CONNECTION_CONFIG_SETTINGS="${IPSEC_CONNECTION_CONFIG_SETTINGS} MODE PEER PSK"
  24 IPSEC_CONNECTION_CONFIG_SETTINGS="${IPSEC_CONNECTION_CONFIG_SETTINGS} REMOTE_ID REMOTE_PREFIX"
  25 IPSEC_CONNECTION_CONFIG_SETTINGS="${IPSEC_CONNECTION_CONFIG_SETTINGS} SECURITY_POLICY"
  26
  27 # Default values
  28 IPSEC_DEFAULT_MODE="tunnel"
  29 IPSEC_DEFAULT_AUTH_MODE="psk"
  30 IPSEC_DEFAULT_INACTIVITY_TIMEOUT="0"
  31 IPSEC_DEFAULT_SECURITY_POLICY="system"
  32
  33 IPSEC_VALID_MODES="gre-transport tunnel vti"
  34 IPSEC_VALID_AUTH_MODES="PSK psk"
  35
  36 cli_ipsec() {
  37         local action=${1}
  38         shift 1
  39
  40         case "${action}" in
  41                 connection)
  42                         cli_ipsec_connection $@
  43                         ;;
  44                 *)
  45                         error "Unrecognized argument: ${action}"
  46                         exit ${EXIT_ERROR}
  47                         ;;
  48         esac
  49 }
  50
  51 cli_ipsec_connection() {
  52         if ipsec_connection_exists ${1}; then
  53                 local connection=${1}
  54                 local key=${2}
  55                 key=${key//-/_}
  56                 shift 2
  57
  58                 case "${key}" in
  59                         authentication|inactivity-timout|local|mode|peer|remote|security-policy)
  60                                 ipsec_connection_${key} ${connection} $@
  61                                 ;;
  62                         show)
  63                                 cli_ipsec_connection_show "${connection}"
  64                                 exit $?
  65                                 ;;
  66                         *)
  67                                 error "Unrecognized argument: ${key}"
  68                                 exit ${EXIT_ERROR}
  69                                 ;;
  70                 esac
  71         else
  72                 local action=${1}
  73                 shift
  74
  75                 case "${action}" in
  76                         new)
  77                                 ipsec_connection_new $@
  78                                 ;;
  79                         destroy)
  80                                 ipsec_connection_destroy $@
  81                                 ;;
  82                         ""|*)
  83                                 if [ -n "${action}" ]; then
  84                                         error "Unrecognized argument: '${action}'"
  85                                 fi
  86                                 exit ${EXIT_ERROR}
  87                                 ;;
  88                 esac
  89         fi
  90 }
  91
  92 cli_ipsec_connection_show() {
  93         local connection="${1}"
  94
  95         # Read the config settings
  96         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
  97         if ! ipsec_connection_read_config "${connection}"; then
  98                 error "Could not read the connection configuration"
  99                 return ${EXIT_ERROR}
 100         fi
 101
 102         cli_headline 0 "IPsec VPN Connection: ${connection}"
 103         cli_space
 104
 105         # Peer
 106         if isset PEER; then
 107                 cli_print_fmt1 1 "Peer" "${PEER}"
 108         fi
 109
 110         # Security Policy
 111         cli_print_fmt1 1 "Security Policy" "${SECURITY_POLICY-${IPSEC_DEFAULT_SECURITY_POLICY}}"
 112         cli_space
 113
 114         cli_headline 2 "Authentication"
 115         case "${AUTH_MODE^^}" in
 116                 PSK)
 117                         cli_print_fmt1 2 "Mode" "Pre-Shared-Key"
 118
 119                         if isset PSK; then
 120                                 cli_print_fmt1 2 "Pre-Shared-Key" "****"
 121                         else
 122                                 cli_print_fmt1 2 "Pre-Shared-Key" "- is not set -"
 123                         fi
 124                         ;;
 125                 X509)
 126                         : # TODO
 127                         ;;
 128         esac
 129         cli_space
 130
 131         local i
 132         for i in LOCAL REMOTE; do
 133                 case "${i}" in
 134                         LOCAL)
 135                                 cli_headline 2 "Local"
 136                                 ;;
 137                         REMOTE)
 138                                 cli_headline 2 "Remote"
 139                                 ;;
 140                 esac
 141
 142                 local id_var="${i}_ID"
 143                 if [ -n "${!id_var}" ]; then
 144                         cli_print_fmt1 2 "ID" "${!id_var}"
 145                 fi
 146
 147                 local prefix_var="${i}_PREFIX"
 148                 if isset ${prefix_var}; then
 149                         cli_headline 3 "Prefix(es)"
 150
 151                         local prefix
 152                         for prefix in ${!prefix_var}; do
 153                                 cli_print_fmt1 3 "${prefix}"
 154                         done
 155                 fi
 156
 157                 cli_space
 158         done
 159
 160         cli_headline 2 "Misc."
 161
 162         case "${MODE}" in
 163                 gre-transport)
 164                         cli_print_fmt1 2 "Transport Mode" "GRE Transport"
 165                         ;;
 166                 tunnel)
 167                         cli_print_fmt1 2 "Transport Mode" "Tunnel"
 168                         ;;
 169                 vti)
 170                         cli_print_fmt1 2 "Transport Mode" "Virtual Tunnel Interface"
 171                         ;;
 172                 *)
 173                         cli_print_fmt1 2 "Transport Mode" "- Unknown -"
 174                         ;;
 175         esac
 176
 177         # Inactivity timeout
 178         if isset INACTIVITY_TIMEOUT && [ ${INACTIVITY_TIMEOUT} -gt 0 ]; then
 179                 cli_print_fmt1 2 "Inactivity Timeout" "$(format_time ${INACTIVITY_TIMEOUT})"
 180         fi
 181         cli_space
 182
 183         return ${EXIT_OK}
 184 }
 185
 186 # This function writes all values to a via ${connection} specificated VPN IPsec configuration file
 187 ipsec_connection_write_config() {
 188         assert [ $# -ge 1 ]
 189
 190         local connection="${1}"
 191
 192         if ! ipsec_connection_exists "${connection}"; then
 193                 log ERROR "No such VPN IPsec connection: ${connection}"
 194                 return ${EXIT_ERROR}
 195         fi
 196
 197         local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
 198
 199         if ! settings_write "${path}" ${IPSEC_CONNECTION_CONFIG_SETTINGS}; then
 200                 log ERROR "Could not write configuration settings for VPN IPsec connection ${connection}"
 201                 return ${EXIT_ERROR}
 202         fi
 203
 204         ipsec_reload ${connection}
 205 }
 206
 207 # This funtion writes the value for one key to a via ${connection} specificated VPN IPsec connection configuration file
 208 ipsec_connection_write_config_key() {
 209         assert [ $# -ge 3 ]
 210
 211         local connection=${1}
 212         local key=${2}
 213         shift 2
 214
 215         local value="$@"
 216
 217         if ! ipsec_connection_exists "${connection}"; then
 218                 log ERROR "No such VPN ipsec connection: ${connection}"
 219                 return ${EXIT_ERROR}
 220         fi
 221
 222         log DEBUG "Set '${key}' to new value '${value}' in VPN ipsec connection '${connection}'"
 223
 224         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 225
 226         # Read the config settings
 227         if ! ipsec_connection_read_config "${connection}"; then
 228                 return ${EXIT_ERROR}
 229         fi
 230
 231         # Set the key to a new value
 232         assign "${key}" "${value}"
 233
 234         if ! ipsec_connection_write_config "${connection}"; then
 235                 return ${EXIT_ERROR}
 236         fi
 237
 238         return ${EXIT_TRUE}
 239 }
 240
 241 # Reads one or more keys out of a settings file or all if no key is provided.
 242 ipsec_connection_read_config() {
 243         assert [ $# -ge 1 ]
 244
 245         local connection="${1}"
 246         shift 1
 247
 248         if ! ipsec_connection_exists "${connection}"; then
 249                 log ERROR "No such VPN IPsec connection : ${connection}"
 250                 return ${EXIT_ERROR}
 251         fi
 252
 253
 254         local args
 255         if [ $# -eq 0 ] && [ -n "${IPSEC_CONNECTION_CONFIG_SETTINGS}" ]; then
 256                 list_append args ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 257         else
 258                 list_append args $@
 259         fi
 260
 261         local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}/settings"
 262
 263         if ! settings_read "${path}" ${args}; then
 264                 log ERROR "Could not read settings for VPN IPsec connection ${connection}"
 265                 return ${EXIT_ERROR}
 266         fi
 267 }
 268
 269 # This function checks if a vpn ipsec connection exists
 270 # Returns True when yes and false when not
 271 ipsec_connection_exists() {
 272         assert [ $# -eq 1 ]
 273
 274         local connection=${1}
 275
 276         local path="${NETWORK_IPSEC_CONNS_DIR}/${connection}"
 277
 278         [ -d "${path}" ] && return ${EXIT_TRUE} || return ${EXIT_FALSE}
 279 }
 280
 281 # Reloads the connection after config changes
 282 ipsec_reload() {
 283         return ${EXIT_TRUE}
 284 }
 285
 286 # Handle the cli after authentification
 287 ipsec_connection_authentication() {
 288         if [ ! $# -gt 1 ]; then
 289                 log ERROR "Not enough arguments"
 290                 return ${EXIT_ERROR}
 291         fi
 292
 293         local connection=${1}
 294         local cmd=${2}
 295         shift 2
 296
 297         case ${cmd} in
 298                 mode)
 299                         ipsec_connection_authentication_mode "${connection}" $@
 300                         ;;
 301                 pre-shared-key)
 302                         ipsec_connection_authentication_psk "${connection}" $@
 303                         ;;
 304                 *)
 305                         log ERROR "Unrecognized argument: ${cmd}"
 306                         return ${EXIT_ERROR}
 307                         ;;
 308         esac
 309 }
 310
 311 # Set the authentification mode
 312 ipsec_connection_authentication_mode() {
 313         if [ ! $# -eq 2 ]; then
 314                 log ERROR "Not enough arguments"
 315                 return ${EXIT_ERROR}
 316         fi
 317         local connection=${1}
 318         local mode=${2}
 319
 320         if ! isoneof mode ${IPSEC_VALID_AUTH_MODES}; then
 321                 log ERROR "Auth mode '${mode}' is invalid"
 322                 return ${EXIT_ERROR}
 323         fi
 324
 325         if ! ipsec_connection_write_config_key "${connection}" "AUTH_MODE" ${mode,,}; then
 326                 log ERROR "Could not write configuration settings"
 327                 return ${EXIT_ERROR}
 328         fi
 329 }
 330
 331 # Set the psk
 332 ipsec_connection_authentication_psk() {
 333         if [ ! $# -eq 2]; then
 334                 log ERROR "Not enough arguments"
 335                 return ${EXIT_ERROR}
 336         fi
 337         local connection=${1}
 338         local psk=${2}
 339
 340         # TODO Check if psk is valid
 341
 342         if ! ipsec_connection_write_config_key "${connection}" "PSK" ${psk}; then
 343                 log ERROR "Could not write configuration settings"
 344                 return ${EXIT_ERROR}
 345         fi
 346
 347         return ${EXIT_OK}
 348 }
 349
 350 # Handle the cli after local
 351 ipsec_connection_local() {
 352         if [ ! $# -ge 2 ]; then
 353                 log ERROR "Not enough arguments"
 354                 return ${EXIT_ERROR}
 355         fi
 356
 357         local connection=${1}
 358         local cmd=${2}
 359         shift 2
 360
 361         case ${cmd} in
 362                 id)
 363                         ipsec_connection_id "${connection}" "LOCAL" $@
 364                         ;;
 365                 prefix)
 366                         ipsec_connection_prefix "${connection}" "LOCAL" $@
 367                         ;;
 368                 *)
 369                         log ERROR "Unrecognized argument: ${cmd}"
 370                         return ${EXIT_ERROR}
 371                         ;;
 372         esac
 373
 374         return ${EXIT_OK}
 375 }
 376
 377 # Set the connection mode
 378 ipsec_connection_mode() {
 379         if [ ! $# -eq 2 ]; then
 380                 log ERROR "Not enough arguments"
 381                 return ${EXIT_ERROR}
 382         fi
 383         local connection=${1}
 384         local mode=${2}
 385
 386         if ! isoneof mode ${IPSEC_VALID_MODES}; then
 387                 log ERROR "Mode '${mode}' is invalid"
 388                 return ${EXIT_ERROR}
 389         fi
 390
 391         if ! ipsec_connection_write_config_key "${connection}" "MODE" ${mode}; then
 392                 log ERROR "Could not write configuration settings"
 393                 return ${EXIT_ERROR}
 394         fi
 395
 396         return ${EXIT_OK}
 397 }
 398
 399 # Set the peer to connect to
 400 ipsec_connection_peer() {
 401         if [ ! $# -eq 2 ]; then
 402                 log ERROR "Not enough arguments"
 403                 return ${EXIT_ERROR}
 404         fi
 405         local connection=${1}
 406         local peer=${2}
 407
 408         if ! ipsec_connection_check_peer ${peer}; then
 409                 log ERROR "Peer '${peer}' is invalid"
 410                 return ${EXIT_ERROR}
 411         fi
 412
 413         if ! ipsec_connection_write_config_key "${connection}" "PEER" ${peer}; then
 414                 log ERROR "Could not write configuration settings"
 415                 return ${EXIT_ERROR}
 416         fi
 417
 418         return ${EXIT_OK}
 419 }
 420
 421 #Set the local or remote id
 422 ipsec_connection_id() {
 423         if [ ! $# -eq 3 ]; then
 424                 log ERROR "Not enough arguments"
 425                 return ${EXIT_ERROR}
 426         fi
 427         local connection=${1}
 428         local type=${2}
 429         local id=${3}
 430
 431         if ! ipsec_connection_check_id ${id}; then
 432                 log ERROR "Id '${id}' is invalid"
 433                 return ${EXIT_ERROR}
 434         fi
 435
 436         if ! ipsec_connection_write_config_key "${connection}" "${type}_ID" ${id}; then
 437                 log ERROR "Could not write configuration settings"
 438                 return ${EXIT_ERROR}
 439         fi
 440
 441         return ${EXIT_OK}
 442 }
 443
 444 # Set the local or remote prefix
 445 ipsec_connection_prefix() {
 446         if [ ! $# -ge 3 ]; then
 447                 log ERROR "Not enough arguments"
 448                 return ${EXIT_ERROR}
 449         fi
 450         local connection=${1}
 451         local type=${2}
 452         shift 2
 453
 454         local _prefix="${type}_PREFIX"
 455         local "${_prefix}"
 456         if ! ipsec_connection_read_config "${connection}" "${_prefix}"; then
 457                 return ${EXIT_ERROR}
 458         fi
 459
 460         # Remove duplicated entries to proceed the list safely
 461         assign "${_prefix}" "$(list_unique ${!_prefix} )"
 462
 463         local prefixes_added
 464         local prefixes_removed
 465         local prefixes_set
 466
 467         while [ $# -gt 0 ]; do
 468                 local arg="${1}"
 469
 470                 case "${arg}" in
 471                         +*)
 472                                 list_append prefixes_added "${arg:1}"
 473                                 ;;
 474                         -*)
 475                                 list_append prefixes_removed "${arg:1}"
 476                                 ;;
 477                         [A-Fa-f0-9]*)
 478                                 list_append prefixes_set "${arg}"
 479                                 ;;
 480                         *)
 481                                 error "Invalid argument: ${arg}"
 482                                 return ${EXIT_ERROR}
 483                                 ;;
 484                 esac
 485                 shift
 486         done
 487
 488         # Check if the user is trying a mixed operation
 489         if ! list_is_empty prefixes_set && (! list_is_empty prefixes_added || ! list_is_empty prefixes_removed); then
 490                 error "You cannot reset the prefix list and add or remove prefixes at the same time"
 491                 return ${EXIT_ERROR}
 492         fi
 493
 494         # Set new prefix list
 495         if ! list_is_empty prefixes_set; then
 496                 # Check if all prefixes are valid
 497                 local prefix
 498                 for prefix in ${prefixes_set}; do
 499                         if ! ip_net_is_valid ${prefix}; then
 500                                 error "Unsupported prefix: ${prefix}"
 501                                 return ${EXIT_ERROR}
 502                         fi
 503                 done
 504
 505                 assign "${_prefix}" "${prefixes_set}"
 506
 507         # Perform incremental updates
 508         else
 509                 local prefix
 510
 511                 # Perform all removals
 512                 for prefix in ${prefixes_removed}; do
 513                         if ! list_remove "${_prefix}" ${prefix}; then
 514                                 warning "${prefix} was not on the list and could not be removed"
 515                         fi
 516                 done
 517
 518
 519                 for prefix in ${prefixes_added}; do
 520                         if ip_net_is_valid ${prefix}; then
 521                                 if ! list_append_unique "${_prefix}" ${prefix}; then
 522                                         warning "${prefix} is already on the prefix list"
 523                                 fi
 524                         else
 525                                 warning "${prefix} is not a valiv IP net and could not be added"
 526                         fi
 527                 done
 528         fi
 529
 530         # Check if the list contain at least one valid prefix
 531         if list_is_empty ${_prefix}; then
 532                 error "Cannot save an empty prefix list"
 533                 return ${EXIT_ERROR}
 534         fi
 535
 536         # Save everything
 537         if ! ipsec_connection_write_config_key "${connection}" "${_prefix}" ${!_prefix}; then
 538                 log ERROR "Could not write configuration settings"
 539         fi
 540
 541         return ${EXIT_OK}
 542 }
 543
 544 # Handle the cli after remote
 545 ipsec_connection_remote() {
 546         if [ ! $# -ge 2 ]; then
 547                 log ERROR "Not enough arguments"
 548                 return ${EXIT_ERROR}
 549         fi
 550
 551         local connection=${1}
 552         local cmd=${2}
 553         shift 2
 554
 555         case ${cmd} in
 556                 id)
 557                         ipsec_connection_id "${connection}" "REMOTE" $@
 558                         ;;
 559
 560                 prefix)
 561                         ipsec_connection_prefix "${connection}" "REMOTE" $@
 562                         ;;
 563                 *)
 564                         log ERROR "Unrecognized argument: ${cmd}"
 565                         return ${EXIT_ERROR}
 566                         ;;
 567         esac
 568
 569         return ${EXIT_OK}
 570 }
 571
 572 # Set the inactivity timeout
 573 ipsec_connection_inactivity_timeout() {
 574         if [ ! $# -ge 2 ]; then
 575                 log ERROR "Not enough arguments"
 576                 return ${EXIT_ERROR}
 577         fi
 578
 579         local connection=${1}
 580         shift 1
 581         local value=$@
 582
 583         if ! isinteger value; then
 584                 value=$(parse_time $@)
 585                 if [ ! $? -eq 0 ]; then
 586                         log ERROR "Parsing the passed time was not sucessful please check the passed values."
 587                         return ${EXIT_ERROR}
 588                 fi
 589         fi
 590
 591         if [ ${value} -le 0 ]; then
 592                 log ERROR "The passed time value must be in the sum greater zero seconds."
 593                 return ${EXIT_ERROR}
 594         fi
 595
 596         if ! ipsec_connection_write_config_key "${connection}" "INACTIVITY_TIMEOUT" ${value}; then
 597                 log ERROR "Could not write configuration settings"
 598                 return ${EXIT_ERROR}
 599         fi
 600
 601         return ${EXIT_OK}
 602 }
 603
 604
 605 # Set the security policy to use
 606 ipsec_connection_security_policy() {
 607         if [ ! $# -eq 2 ]; then
 608                 log ERROR "Not enough arguments"
 609                 return ${EXIT_ERROR}
 610         fi
 611         local connection=${1}
 612         local security_policy=${2}
 613
 614         if ! vpn_security_policy_exists ${security_policy}; then
 615                 log ERROR "No such vpn security policy '${security_policy}'"
 616                 return ${EXIT_ERROR}
 617         fi
 618
 619         if ! ipsec_connection_write_config_key "${connection}" "SECURITY_POLICY" ${security_policy}; then
 620                 log ERROR "Could not write configuration settings"
 621                 return ${EXIT_ERROR}
 622         fi
 623 }
 624
 625 # Check if a id is valid
 626 ipsec_connection_check_id() {
 627         assert [ $# -eq 1 ]
 628         local id=${1}
 629
 630         if [[ ${id} =~ ^@[[:alnum:]]+$ ]] || ip_is_valid ${id}; then
 631                 return ${EXIT_TRUE}
 632         else
 633                 return ${EXIT_FALSE}
 634         fi
 635 }
 636
 637 # Checks if a peer is valid
 638 ipsec_connection_check_peer() {
 639         assert [ $# -eq 1 ]
 640         local peer=${1}
 641
 642         # TODO Accept also FQDNs
 643         if ip_is_valid ${peer}; then
 644                 return ${EXIT_TRUE}
 645         else
 646                 return ${EXIT_FALSE}
 647         fi
 648 }
 649
 650 # This function checks if a VPN IPsec connection name is valid
 651 # Allowed are only A-Za-z0-9
 652 ipsec_connection_check_name() {
 653         assert [ $# -eq 1 ]
 654
 655         local connection=${1}
 656
 657         [[ "${connection}" =~ [^[:alnum:]$] ]]
 658 }
 659
 660 # Function that creates one VPN IPsec connection
 661 ipsec_connection_new() {
 662         if [ $# -gt 1 ]; then
 663                 error "Too many arguments"
 664                 return ${EXIT_ERROR}
 665         fi
 666
 667         local connection="${1}"
 668         if ! isset connection; then
 669                 error "Please provide a connection name"
 670                 return ${EXIT_ERROR}
 671         fi
 672
 673         # Check for duplicates
 674         if ipsec_connection_exists "${connection}"; then
 675                 error "The VPN IPsec connection ${connection} already exists"
 676                 return ${EXIT_ERROR}
 677         fi
 678
 679         # Check if the name of the connection is valid
 680         if  ipsec_connection_check_name "${connection}"; then
 681                 error "'${connection}' contains illegal characters"
 682                 return ${EXIT_ERROR}
 683         fi
 684
 685         log DEBUG "Creating VPN IPsec connection ${connection}"
 686
 687         if ! mkdir -p "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
 688                 log ERROR "Could not create config directory for ${connection}"
 689                 return ${EXIT_ERROR}
 690         fi
 691
 692         local ${IPSEC_CONNECTION_CONFIG_SETTINGS}
 693
 694         MODE=${IPSEC_DEFAULT_MODE}
 695         AUTH_MODE=${IPSEC_DEFAULT_AUTH_MODE}
 696         INACTIVITY_TIMEOUT=${IPSEC_DEFAULT_INACTIVITY_TIMEOUT}
 697         SECURITY_POLICY=${IPSEC_DEFAULT_SECURITY_POLICY}
 698
 699         if ! ipsec_connection_write_config "${connection}"; then
 700                 log ERROR "Could not write new config file"
 701                 return ${EXIT_ERROR}
 702         fi
 703 }
 704
 705 # Function that deletes based on the passed parameters one ore more vpn security policies
 706 ipsec_connection_destroy() {
 707         local connection
 708         for connection in $@; do
 709                 if ! ipsec_connection_exists "${connection}"; then
 710                         log ERROR "The VPN IPsec connection ${connection} does not exist."
 711                         continue
 712                 fi
 713
 714                 log DEBUG "Deleting VPN IPsec connection ${connection}"
 715                 if ! rm -rf "${NETWORK_IPSEC_CONNS_DIR}/${connection}"; then
 716                         log ERROR "Deleting the VPN IPsec connection ${connection} was not sucessful"
 717                         return ${EXIT_ERROR}
 718                 fi
 719         done
 720 }