_confread.in

This a good VPN source

			return 1
		}
	}
	return 0
}

# start of rules

{
	lineno++
	# lineno is now the number of this line

	# we must remember indentation because comment stripping loses it
	exdented = $0 !~ /^[ \t]/
	sub(/^[ \t]+/, "")		# get rid of leading white space
	sub(/[ \t]+$/, "")		# get rid of trailing white space
}
including && $0 ~ /^#[<>:]/ {
	# _include control line
	if ($1 ~ /^#[<>]$/) {
		filename = $2
		lineno = $3 - 1
	} else if ($0 ~ /^#:/) {
		msg = substr($0, 3)
		gsub(/"/, "\\\"", msg)
		fail(msg)
	}
	next
}
exdented {
	# any non-leading-white-space line is a section end
	### but not the end of relevant stuff, might be also= sections later
	###if (insection && !indefault && !searching && outputting)
	###	output(o_end)
	insection = 0
	indefault = 0
	outputting = 0
}
/[ \t]#/ {
	# strip trailing comments including the leading whitespace
	# tricky because we must respect quotes
	q = 0
	for (i = 1; i <= NF; i++) {
		if ($i ~ /^#/ && q % 2 == 0) {
			NF = i - 1;
			break
		}
		# using $i in gsub loses whitespace?!?
		junk = $i
		q += gsub(/"/, "&", junk)
	}
}
$0 == "" || $0 ~ /^#/ {
	# empty lines and comments are ignored
	next
}
exdented && NF != 2 {
	# bad section header
	fail("section header " bq $0 eq " has wrong number of fields (" NF ")")
}
exdented && $1 == "version" {
	version = $2 + 0
	if (version < 2.0 || 2.0 < version)
		fail("we only support version 2.0 ipsec.conf files, not " bq version eq)
	next
}
version == "" {
	fail("we only support version 2 ipsec.conf files")
}
exdented && !($1 in goodtypes) {
	# unknown section type
	fail("section type " bq $1 eq " not recognized")
}
exdented && $1 != type {
	# section header, but not one we want
	insection = 1
	next
}
exdented && $1 == "config" && $2 != "setup" {
	fail("unknown config section " bq $2 eq)
}
exdented && $2 != "%default" {
	# non-default section header of our type
	sawnondefault = 1
}
exdented && searching && $2 != "%default" {
	# section header, during search
	insection = 1
	sectionname = $2
	usesdefault[sectionname] = 1		# tentatively
	next
}
exdented && !searching && $2 in wanted {
	# one of our wanted section headers
	if (!($2 in pending))
		fail("duplicate " type " section " bq $2 eq)
	delete pending[$2]
	tag = bq type " " $2 eq
	outputting = 1
	insection = 1
	orientation = wanted[$2]
	output(o_section, $2)
	next
}
exdented && $2 == "%default" {
	# relevant default section header
	if (sawnondefault)
		fail(bq $1 " %default" eq " sections must precede non-default ones")
	tag = bq type " " $2 eq
	indefault = 1
	next
}
exdented {
	# section header, but not one we want
	insection = 1
	next
}
!insection && !indefault {
	# starts with white space but not in a section... oops
	fail("parameter is not within a section")
}
searching && $0 ~ searchpat {
	# search found the right parameter name
	match($0, searchpat)
	rest = substr($0, RLENGTH+1)
	if (rest ~ /^".*"$/)
		rest = substr(rest, 2, length(rest)-2)
	if (!indefault) {
		if (!usesdefault[sectionname])
			fail("duplicated parameter " bq search eq)
		usesdefault[sectionname] = 0
	} else if (search in default)
		fail("duplicated parameter " bq search eq)
	if (rest in wanted) {	# a hit
		if (indefault)
			default[search] = rest
		else
			searchfound(sectionname)
	} else {
		# rather a kludge, but must check this somewhere
		if (search == "auto" && rest !~ /^(add|route|start|ignore|manual)$/)
			fail("illegal auto value " bq rest eq)
	}
	next
}
!searching && !outputting && !indefault {
	# uninteresting line
	next
}
$0 ~ /"/ && $0 !~ /^[^=]+=[ \t]*"[^"]*"$/ {
	if (!searching)
		fail("mismatched quotes in parameter value")
	else
		gsub(/"/, "", $0)
}
$0 !~ /^[a-zA-Z_][a-zA-Z0-9_-]*[ \t]*=/ {
	if (searching)
		next			# just ignore it
	fail("syntax error or illegal parameter name")
}
{
	sub(/[ \t]*=[ \t]*/, "=")	# get rid of white space around =
}
$0 ~ /^(also|alsoflip)=/ {
	v = orientation
	if ($0 ~ /^alsoflip/)
		v = -v;
	if (indefault)
		fail("%default section may not contain " bq "also" eq " or " bq "alsoflip" eq " parameter")
	sub(/^(also|alsoflip)=/, "")
	if ($0 !~ /^[a-zA-Z][a-zA-Z0-9._-]*$/)
		fail("invalid section name " bq $0 eq)
	if (!searching) {
		if ($0 in wanted)
			fail("section " bq $0 eq " requested more than once")
		wanted[$0] = v
		pending[$0] = 1
	} else
		chainref(sectionname, $0)
	next
}
!outputting && !indefault {
	# uninteresting line even for a search
	next
}
{
	equal = match($0, /[=]/)
	name = substr($0, 1, equal-1)
	if (badname(name))
		fail("unknown parameter name " bq name eq)
	value = substr($0, equal+1)
	if (value ~ /^"/)
		value = substr(value, 2, length(value)-2)
	else if (value ~ /[ \t]/)
		fail("white space within non-quoted parameter " bq name eq)
}
indefault {
	if (name in default)
		fail("duplicated default parameter " bq name eq)
	default[name] = value
	next
}
{
	name = orient(name)
	if (name in seen)
		fail("duplicated parameter " bq name eq)
	seen[name] = 1
	output(o_parm, name, value)
}
END {
	if (failed)
		exit 1

	# supply default conns if relevant and not found
	if (type == "conn") {
		if (jam("packetdefault", "route")) {
			output(o_parm, "type", "tunnel")
			output(o_parm, "leftsubnet", "0.0.0.0/0")
			output(o_parm, "right", "%opportunistic")
			output(o_parm, "failureshunt", "passthrough")
			output(o_parm, "keyingtries", "3")
			output(o_parm, "ikelifetime", "1h")
			output(o_parm, "keylife", "1h")
			output(o_parm, "rekey", "no")
		}
		if (jam("clear", "route")) {
			output(o_parm, "type", "passthrough")
			output(o_parm, "authby", "never")
			output(o_parm, "right", "%group")
		}
		if (jam("clear-or-private", "route")) {
			output(o_parm, "type", "passthrough")
			output(o_parm, "right", "%opportunisticgroup")
			output(o_parm, "failureshunt", "passthrough")
			output(o_parm, "keyingtries", "3")
			output(o_parm, "ikelifetime", "1h")
			output(o_parm, "keylife", "1h")
			output(o_parm, "rekey", "no")
		}
		if (jam("private-or-clear", "route")) {
			output(o_parm, "type", "tunnel")
			output(o_parm, "right", "%opportunisticgroup")
			output(o_parm, "failureshunt", "passthrough")
			output(o_parm, "keyingtries", "3")
			output(o_parm, "ikelifetime", "1h")
			output(o_parm, "keylife", "1h")
			output(o_parm, "rekey", "no")
		}
		if (jam("private", "route")) {
			output(o_parm, "type", "tunnel")
			output(o_parm, "right", "%opportunisticgroup")
			output(o_parm, "failureshunt", "drop")
			output(o_parm, "keyingtries", "3")
			output(o_parm, "ikelifetime", "1h")
			output(o_parm, "keylife", "1h")
			output(o_parm, "rekey", "no")
		}
		if (jam("block", "route")) {
			output(o_parm, "type", "reject")
			output(o_parm, "authby", "never")
			output(o_parm, "right", "%group")
		}
	}

	filename = originalfilename
	unseen = ""
	for (i in pending)
		unseen = unseen " " i
	if (!optional && !searching && unseen != "")
		fail("did not find " type " section(s) " bq substr(unseen, 2) eq)
	if (!searching) {
		for (name in default)
			if (!(name in seen))
				output(o_parm, name, default[name])
	} else {
		if (default[search] in wanted)
			for (name in usesdefault)
				if (usesdefault[name])
					seen[name] = 1
		delete seen[""]
		if (fieldfmt)
			for (name in seen)
				output(o_section, name)
		else {
			outlist = ""
			for (name in seen)
				if (outlist == "")
					outlist = name
				else
					outlist = outlist " " name
			output(o_names, outlist)
		}
	}
	output(o_status, "")
}'