Improve upgrade scripts

- Add note for users downgrading to 3.22
- Add check for Libreswan 3.25 (not yet supported)
- Print Libreswan versions and improve message
- Cleanup

extras/vpnupgrade.sh

@@ -47,11 +47,16 @@ if [ -z "$SWAN_VER" ]; then
   exiterr "Libreswan version 'SWAN_VER' not specified."
 fi
 
-if ! /usr/local/sbin/ipsec --version 2>/dev/null | grep -q "Libreswan"; then
+if [ "$SWAN_VER" = "3.25" ]; then
+  exiterr "Libreswan 3.25 is not yet supported."
+fi
+
+ipsec_ver="$(/usr/local/sbin/ipsec --version 2>/dev/null)"
+if ! printf '%s' "$ipsec_ver" | grep -q "Libreswan"; then
   exiterr "This script requires Libreswan already installed."
 fi
 
-if /usr/local/sbin/ipsec --version 2>/dev/null | grep -qF "$SWAN_VER"; then
+if printf '%s' "$ipsec_ver" | grep -qF "$SWAN_VER"; then
   echo "You already have Libreswan version $SWAN_VER installed! "
   echo "If you continue, the same version will be re-installed."
   echo
@@ -68,13 +73,23 @@ if /usr/local/sbin/ipsec --version 2>/dev/null | grep -qF "$SWAN_VER"; then
   esac
 fi
 
+is_downgrade_to_322=0
+if [ "$SWAN_VER" = "3.22" ]; then
+  if printf '%s' "$ipsec_ver" | grep -qF -e "3.23" -e "3.25"; then
+    is_downgrade_to_322=1
+  fi
+fi
+
 clear
 
 cat <<EOF
 Welcome! This script will build and install Libreswan $SWAN_VER on your server.
-Additional packages required for Libreswan compilation will also be installed.
+Additional packages required for compilation will also be installed.
 
-This is intended for use on servers running an older version of Libreswan.
+It is intended for upgrading servers to a newer Libreswan version.
+
+Current version: $ipsec_ver
+Version to be installed: Libreswan $SWAN_VER
 
 EOF
 
@@ -88,9 +103,7 @@ EOF
 fi
 
 cat <<'EOF'
-IMPORTANT NOTES:
-
-Libreswan versions 3.19 and newer require some configuration changes.
+NOTE: Libreswan versions 3.19 and newer require some configuration changes.
       This script will make the following changes to your /etc/ipsec.conf:
 
       Replace this line:
@@ -205,6 +218,19 @@ EOF
     ;;
 esac
 
+if [ "$is_downgrade_to_322" = "1" ]; then
+cat <<'EOF'
+NOTE: Users downgrading to Libreswan 3.22 should edit
+      "/etc/ipsec.conf" and replace this line:
+        modecfgdns="DNS_SERVER_1, DNS_SERVER_2"
+      with two lines like this:
+        modecfgdns1=DNS_SERVER_1
+        modecfgdns2=DNS_SERVER_2
+      Then run "service ipsec restart".
+
+EOF
+fi
+
 }
 
 ## Defer setup until we have the complete script

extras/vpnupgrade_centos.sh

@@ -38,11 +38,16 @@ if [ -z "$SWAN_VER" ]; then
   exiterr "Libreswan version 'SWAN_VER' not specified."
 fi
 
-if ! /usr/local/sbin/ipsec --version 2>/dev/null | grep -q "Libreswan"; then
+if [ "$SWAN_VER" = "3.25" ]; then
+  exiterr "Libreswan 3.25 is not yet supported."
+fi
+
+ipsec_ver="$(/usr/local/sbin/ipsec --version 2>/dev/null)"
+if ! printf '%s' "$ipsec_ver" | grep -q "Libreswan"; then
   exiterr "This script requires Libreswan already installed."
 fi
 
-if /usr/local/sbin/ipsec --version 2>/dev/null | grep -qF "$SWAN_VER"; then
+if printf '%s' "$ipsec_ver" | grep -qF "$SWAN_VER"; then
   echo "You already have Libreswan version $SWAN_VER installed! "
   echo "If you continue, the same version will be re-installed."
   echo
@@ -59,13 +64,23 @@ if /usr/local/sbin/ipsec --version 2>/dev/null | grep -qF "$SWAN_VER"; then
   esac
 fi
 
+is_downgrade_to_322=0
+if [ "$SWAN_VER" = "3.22" ]; then
+  if printf '%s' "$ipsec_ver" | grep -qF -e "3.23" -e "3.25"; then
+    is_downgrade_to_322=1
+  fi
+fi
+
 clear
 
 cat <<EOF
 Welcome! This script will build and install Libreswan $SWAN_VER on your server.
-Additional packages required for Libreswan compilation will also be installed.
+Additional packages required for compilation will also be installed.
 
-This is intended for use on servers running an older version of Libreswan.
+It is intended for upgrading servers to a newer Libreswan version.
+
+Current version: $ipsec_ver
+Version to be installed: Libreswan $SWAN_VER
 
 EOF
 
@@ -79,9 +94,7 @@ EOF
 fi
 
 cat <<'EOF'
-IMPORTANT NOTES:
-
-Libreswan versions 3.19 and newer require some configuration changes.
+NOTE: Libreswan versions 3.19 and newer require some configuration changes.
       This script will make the following changes to your /etc/ipsec.conf:
 
       Replace this line:
@@ -206,6 +219,19 @@ EOF
     ;;
 esac
 
+if [ "$is_downgrade_to_322" = "1" ]; then
+cat <<'EOF'
+NOTE: Users downgrading to Libreswan 3.22 should edit
+      "/etc/ipsec.conf" and replace this line:
+        modecfgdns="DNS_SERVER_1, DNS_SERVER_2"
+      with two lines like this:
+        modecfgdns1=DNS_SERVER_1
+        modecfgdns2=DNS_SERVER_2
+      Then run "service ipsec restart".
+
+EOF
+fi
+
 }
 
 ## Defer setup until we have the complete script