blob: 631d2bc9ac3a7926d3b3a6ce3d759a777d2fcfb1 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
|
#compdef ipsec strongswan
# Completion for the ipsec script (aka strongswan on some systems) provided by
# FreeS/WAN, Openswan, Libreswan, and strongSwan. See also strongSwan's swanctl.
#
# As with swanctl, elevated privileges are usually required to complete SA names
# and the like; consider setting the gain-privileges style as follows:
# zstyle ':completion:*:(ipsec|strongswan)/*' gain-privileges yes
#
# @todo We don't complete pool names or virtual IPs
# Complete connection (IKE SA) names and optionally SA/instance names
# --instances => also complete SA/instance names
(( $+functions[_ipsec_connections] )) ||
_ipsec_connections() {
local -a instances tmp ipsec_conns ipsec_insts
zparseopts -D -E -a instances - -instances
tmp=( ${(f)${"$(
_call_program -p ipsec-status ${_ipsec_cmd:-$words[1]} statusall
)"#*$'\n'[[:space:]]#[Cc]onnections:[[:space:]]#$'\n'}} )
tmp=( ${(@M)tmp:#[[:space:]]#[^[:space:]]##:[[:space:]]##?*} )
tmp=( ${(@)${(@)tmp##[[:space:]]##}%%:*} )
ipsec_conns=( ${(@)tmp%%['[{']<->['}]']} )
ipsec_insts=( ${(@M)tmp:#*['[{']<->['}]']} )
(( $#ipsec_conns )) || {
_message -e connections 'connection name'
return
}
tmp=( 'connections:connection name:compadd -a - ipsec_conns' )
(( $#instances && $#ipsec_insts )) &&
tmp+=( 'instances:connection SA/instance name:compadd -a - ipsec_insts' )
_alternative $tmp
}
# Complete arguments to /usr/lib/ipsec/starter. This is rarely invoked directly,
# and there is almost no documentation on it, but the start/restart commands
# pass options to it
(( $+functions[_ipsec_starter] )) ||
_ipsec_starter() {
_arguments : \
'(--nofork)--attach-gdb[start daemon under gdb (implies --nofork)]' \
'--auto-update[specify select time-out]:select time-out (seconds)' \
'--conf[specify path to ipsec.conf]:ipsec.conf file:_files' \
'--daemon[specify daemon name]:daemon name' \
'--nofork[do not fork daemon]' \
+ '(d)' \
'--debug[set log level 2]' \
'--debug-more[set log level 3]' \
'--debug-all[set log level 4]' \
'--nolog[set log level 0]'
}
_ipsec() {
local ret=1 variant _ipsec_cmd=$words[1]
local -a context line state state_descr tmp
local -A opt_args
_pick_variant -r variant \
freeswan='(#i)frees/#wan' \
libreswan='(#i)libreswan' \
openswan='(#i)openswan' \
strongswan='(#i)strongswan' \
unix \
--version
# Provide only basic completion for non-strongSwan implementations
if [[ $variant == unix ]]; then
_default
return
elif [[ $variant == (free|libre|open)* ]]; then
tmp=( ${(f)"$( _call_program ipsec-help $words[1] --help )"} )
tmp=( ${(@M)tmp:#($' '|$'\t')*} )
tmp=( ${(@)tmp:#*[':/<>()[]']*} )
tmp=( ${(f)${(F)tmp//[[:space:]]##/$'\n'}} )
_arguments -S -A '-*' : \
'(: * -)--help[display help information]' \
'(: * -)--version[display version information]' \
"(-)1:command:(${(j< >)${(@q-)tmp}})" \
'(-)2: :_default'
return
fi
_arguments -A '-*' \
'(: * -)--confdir[display path to configuration directory (IPSEC_CONFDIR)]' \
'(: * -)--copyright[display copyright information]' \
'(: * -)--directory[display path to libexec/utility directory (IPSEC_DIR)]' \
'(: * -)--help[display help information]' \
'(: * -)--piddir[display path to PID directory (IPSEC_PIDDIR)]' \
'(: * -)--version[display version information]' \
'(: * -)--versioncode[display brief version information]' \
'1:command:((
down\:"terminate IPsec connection/SA"
down-srcip\:"terminate IKE SAs by client virtual IP"
leases\:"display IP address/pool status"
listaacerts\:"display X.509 authorization authority certificates"
listacerts\:"display X.509 attribute certificates"
listalgs\:"display loaded algorithms"
listall\:"execute all list commands"
listcacerts\:"display X.509 certificate authority certificates"
listcainfos\:"display certificate authority information"
listcerts\:"display X.509/OpenPGP certificates"
listcounters\:"display IKE counter information"
listcrls\:"display certificate revocation lists"
listgroups\:"display groups for user authorization profiles"
listocsp\:"display OCSP revocation information"
listocspcerts\:"display X.509 OCSP signer certificates"
listplugins\:"display loaded plug-in features"
listpubkeys\:"display RSA public keys"
purgecerts\:"purge cached certificates"
purgecrl\:"purge cached certificate revocation lists"
purgeike\:"purge IKE SAs without a quick mode or CHILD_SA"
purgeocsp\:"purge cached OCSP information"
reload\:"reload entire configuration (send SIGUSR1)"
rereadacerts\:"re-read attribute certificates"
rereadaacerts\:"flush and re-read authorization authority certificates"
rereadall\:"execute all re-read commands"
rereadcacerts\:"flush and re-read certificate authority certificates"
rereadcrls\:"re-read certificate revocation lists"
rereadocspcerts\:"re-read OCSP certificates"
rereadsecrets\:"flush and re-read secrets"
resetcounters\:"reset IKE counter information"
restart\:"equivalent to stop + start"
route\:"insert kernel IPsec policy for connection"
start\:"start IKE daemon"
status\:"display concise connection status"
statusall\:"display detailed connection status"
stop\:"terminate all IPsec connections and stop IKE daemon"
stroke\:"issue stroke command"
unroute\:"remove kernel IPsec policy for connection"
up\:"bring up IPsec connection"
update\:"reload changes in configuration (send SIGHUP)"
))' \
'*:: :->next' \
&& ret=0
[[ $state == next ]] &&
case $words[1] in
down)
_arguments : '1: :_ipsec_connections --instances' && ret=0
;;
listcounters|resetcounters|route|status|statusall|unroute|up)
_arguments : '1: :_ipsec_connections' && ret=0
;;
down-srcip)
_arguments : \
'1:virtual IP address (start)' \
'2::virtual IP address (end)' \
&& ret=0
;;
leases)
_arguments : '1:pool name' '2::virtual IP address' && ret=0
;;
list*~list(counters|plugins))
_arguments : '--utc[use UTC for time fields]' && ret=0
;;
start|restart)
_ipsec_starter && ret=0
;;
stroke)
_arguments -s -S -A '-*' \
'(: * -)'{-h,--help}'[display help information]' \
'(-d --daemon)'{-d+,--daemon=}'[specify daemon name]:daemon name' \
'1: :_guard "^-*" "stroke command"' \
'*:stroke command argument:_default' \
&& ret=0
;;
esac
return ret
}
_ipsec "$@"
|
