From mboxrd@z Thu Jan  1 00:00:00 1970
From: Jonatan Schlag <jonatan.schlag@ipfire.org>
To: network@lists.ipfire.org
Subject: [PATCH 1/2] ipsec: only accept valid options for a connection type
Date: Mon, 28 Aug 2017 17:32:52 +0200
Message-ID: <1503934373-8996-1-git-send-email-jonatan.schlag@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============1471485237665742677=="
List-Id: <network.lists.ipfire.org>

--===============1471485237665742677==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

The valid options for a host-to-net ipsec connection and a net-to-net
are different so we nedd to check if we get a valid option for the connection=
 type.

Fixes: #11444

Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org>
---
 src/functions/functions.ipsec | 129 ++++++++++++++++++++++++++++++++++++++++=
++
 1 file changed, 129 insertions(+)

diff --git a/src/functions/functions.ipsec b/src/functions/functions.ipsec
index 6f14c8e..11a1d9a 100644
--- a/src/functions/functions.ipsec
+++ b/src/functions/functions.ipsec
@@ -54,6 +54,46 @@ IPSEC_DEFAULT_TYPE=3D"net-to-net"
 IPSEC_VALID_MODES=3D"gre-transport tunnel vti"
 IPSEC_VALID_AUTH_MODES=3D"PSK"
=20
+# Valid options for all types of connetions
+IPSEC_ALL_VALID_OPTIONS=3D"\
+	authentication \
+	down \
+	disable \
+	dpd \
+	enable \
+	inactivity_timeout \
+	local \
+	mode \
+	remote \
+	security_policy \
+	start_action \
+	up \
+	color \
+	description \
+	show"
+
+# Valid options for net-to-net
+IPSEC_NET_TOT_NET_VALID_OPTIONS=3D"${IPSEC_ALL_VALID_OPTIONS} \
+	peer"
+
+# Valid options for RW
+IPSEC_RW_VALID_OPTIONS=3D"${IPSEC_ALL_VALID_OPTIONS} \
+	pool"
+
+# Valid dpd options for all types of connetions
+IPSEC_DPD_ALL_VALID_OPTIONS=3D"\
+	delay \
+	timeout"
+
+# Valid dpd options for net-to-net
+IPSEC_DPD_NET_TOT_NET_VALID_OPTIONS=3D"${IPSEC_DPD_ALL_VALID_OPTIONS} \
+	action"
+
+# Valid dpd options for RW
+IPSEC_DPD_RW_VALID_OPTIONS=3D"${IPSEC_DPD_ALL_VALID_OPTIONS}"
+
+
+
 cli_ipsec() {
 	local action=3D${1}
 	shift 1
@@ -79,6 +119,10 @@ cli_ipsec_connection() {
 		key=3D${key//-/_}
 		shift 2
=20
+		if ! ipsec_connection_check_option "${connection}" "first" "${key}"; then
+			return ${EXITR_ERROR}
+		fi
+
 		case "${key}" in
 			authentication|down|disable|dpd|enable|inactivity_timeout|local|mode|peer=
|pool|remote|security_policy|start_action|up)
 				ipsec_connection_${key} ${connection} "$@"
@@ -148,6 +192,67 @@ ipsec_connection_get_description_title() {
 	description_title_read $(description_format_filename "ipsec-connection" "${=
name}")
 }
=20
+# This functions returns all options which are valid for this type of connec=
tion
+ipsec_get_valid_options() {
+	assert [ $# -eq 2 ]
+
+	local connection=3D"${1}"
+	local type=3D"${2}"
+
+	local con_type=3D$(ipsec_connection_get_type "${connection}")
+	assert isset con_type
+
+	case ${con_type} in
+		host-to-net)
+			case ${type} in
+				first)
+					echo "${IPSEC_RW_VALID_OPTIONS}"
+					;;
+				dpd)
+					echo "${IPSEC_DPD_RW_VALID_OPTIONS}"
+					;;
+			esac
+			;;
+		net-to-net)
+			case ${type} in
+				first)
+					echo "${IPSEC_NET_TOT_NET_VALID_OPTIONS}"
+					;;
+				dpd)
+					echo "${IPSEC_DPD_NET_TOT_NET_VALID_OPTIONS}"
+					;;
+			esac
+			;;
+	esac
+}
+
+# This Function checks if a option is valid for a given type
+ipsec_connection_check_option() {
+	assert [ $# -eq 3 ]
+
+	local connection=3D"${1}"
+	local type=3D"${2}"
+	local key=3D"${3}"
+
+	local con_type=3D$(ipsec_connection_get_type "${connection}")
+	assert isset con_type
+
+	case ${con_type} in
+		host-to-net)
+			if ! isoneof key $(ipsec_get_valid_options "${connection}" "${type}"); th=
en
+				log ERROR "Invalid Argument: ${key}"
+				return ${EXIT_ERROR}
+			fi
+			;;
+		net-to-net)
+			if ! isoneof key $(ipsec_get_valid_options "${connection}" "${type}"); th=
en
+				log ERROR "Invalid Argument: ${key}"
+				return ${EXIT_ERROR}
+			fi
+		;;
+	esac
+}
+
 cli_ipsec_connection_show() {
 	local connection=3D"${1}"
=20
@@ -443,6 +548,26 @@ ipsec_reload() {
 	ipsec_strongswan_load
 }
=20
+# Returns the type of a connection
+ipsec_connection_get_type() {
+	assert [ $# -eq 1 ]
+
+	local connection=3D${1}
+
+	if ! ipsec_connection_exists "${connection}"; then
+		log ERROR "No such VPN ipsec connection: ${connection}"
+		return ${EXIT_ERROR}
+	fi
+
+	local TYPE
+
+	if ! ipsec_connection_read_config "${connection}" TYPE; then
+		return ${EXIT_ERROR}
+	fi
+
+	echo ${TYPE}
+}
+
 # Handle the cli after authentification
 ipsec_connection_authentication() {
 	if [ ! $# -gt 1 ]; then
@@ -551,6 +676,10 @@ ipsec_connection_dpd() {
 	local cmd=3D${2}
 	shift 2
=20
+	if ! ipsec_connection_check_option "${connection}" "dpd" "${cmd}"; then
+		return ${EXITR_ERROR}
+	fi
+
 	case ${cmd} in
 		action)
 			ipsec_connection_dpd_action "${connection}" "$@"
--=20
2.6.3


--===============1471485237665742677==--