From 6a285499e3106f2a5be0566a1c37cf4ec9776abe Mon Sep 17 00:00:00 2001
From: hwdsl2 <hwdsl2@users.noreply.github.com>
Date: Mon, 11 May 2020 11:28:37 -0500
Subject: [PATCH] Update upgrade scripts

- Support upgrading to Libreswan 3.32
- Update ikev2 setup helper script
---
 extras/ikev2setup.sh        | 11 ++++++-----
 extras/vpnupgrade.sh        | 16 ++++++++--------
 extras/vpnupgrade_centos.sh | 16 ++++++++--------
 3 files changed, 22 insertions(+), 21 deletions(-)

diff --git a/extras/ikev2setup.sh b/extras/ikev2setup.sh
index 6669998..1ab2415 100644
--- a/extras/ikev2setup.sh
+++ b/extras/ikev2setup.sh
@@ -46,15 +46,16 @@ EOF
 fi
 
 case "$swan_ver" in
-  3.19|3.2[01235679]|3.31)
+  3.19|3.2[01235679]|3.3[12])
     /bin/true
     ;;
   *)
 cat 1>&2 <<EOF
 Error: Libreswan version '$swan_ver' is not supported.
   This script requires one of these versions:
-  3.19-3.23, 3.25-3.27, 3.29 or 3.31
-  Upgrade Libreswan: https://git.io/vpnupgrade
+  3.19-3.23, 3.25-3.27, 3.29, 3.31 or 3.32
+  To upgrade Libreswan, see:
+  https://github.com/hwdsl2/setup-ipsec-vpn#upgrade-libreswan
 EOF
     exit 1
     ;;
@@ -119,7 +120,7 @@ fi
 # Check for MOBIKE support
 mobike_support=0
 case "$swan_ver" in
-  3.2[35679]|3.31)
+  3.2[35679]|3.3[12])
     mobike_support=1
     ;;
 esac
@@ -194,7 +195,7 @@ conn ikev2-cp
 EOF
 
 case "$swan_ver" in
-  3.2[35679]|3.31)
+  3.2[35679]|3.3[12])
 cat >> /etc/ipsec.conf <<'EOF'
   modecfgdns="8.8.8.8 8.8.4.4"
   encapsulation=yes
diff --git a/extras/vpnupgrade.sh b/extras/vpnupgrade.sh
index 8a9a4c3..fda2393 100644
--- a/extras/vpnupgrade.sh
+++ b/extras/vpnupgrade.sh
@@ -11,7 +11,7 @@
 # know how you have improved it!
 
 # Specify which Libreswan version to install. See: https://libreswan.org
-SWAN_VER=3.31
+SWAN_VER=3.32
 
 ### DO NOT edit below this line ###
 
@@ -46,14 +46,14 @@ if [ "$(id -u)" != 0 ]; then
 fi
 
 case "$SWAN_VER" in
-  3.19|3.2[01235679]|3.31)
+  3.19|3.2[01235679]|3.3[12])
     /bin/true
     ;;
   *)
 cat 1>&2 <<EOF
 Error: Libreswan version '$SWAN_VER' is not supported.
   This script can install one of the following versions:
-  3.19-3.23, 3.25-3.27, 3.29 and 3.31
+  3.19-3.23, 3.25-3.27, 3.29, 3.31 and 3.32
 EOF
     exit 1
     ;;
@@ -61,7 +61,7 @@ esac
 
 dns_state=0
 case "$SWAN_VER" in
-  3.2[35679]|3.31)
+  3.2[35679]|3.3[12])
     DNS_SRV1=$(grep "modecfgdns1=" /etc/ipsec.conf | head -n 1 | cut -d '=' -f 2)
     DNS_SRV2=$(grep "modecfgdns2=" /etc/ipsec.conf | head -n 1 | cut -d '=' -f 2)
     [ -n "$DNS_SRV1" ] && dns_state=2
@@ -136,7 +136,7 @@ cat <<'EOF'
 EOF
 fi
 
-if [ "$SWAN_VER" = "3.29" ] || [ "$SWAN_VER" = "3.31" ]; then
+if [ "$SWAN_VER" = "3.29" ] || [ "$SWAN_VER" = "3.31" ] || [ "$SWAN_VER" = "3.32" ]; then
 cat <<'EOF'
     - Move "ikev2=never" to section "conn shared"
 EOF
@@ -149,7 +149,7 @@ cat <<'EOF'
 EOF
 
 case "$SWAN_VER" in
-  3.19|3.2[01235679])
+  3.19|3.2[01235679]|3.31)
 cat <<'EOF'
 WARNING: Older versions of Libreswan could contain known security vulnerabilities.
     See: https://libreswan.org/security/
@@ -225,7 +225,7 @@ USE_NSS_AVA_COPY = true
 USE_NSS_IPSEC_PROFILE = false
 USE_GLIBC_KERN_FLIP_HEADERS = true
 EOF
-if [ "$SWAN_VER" = "3.31" ]; then
+if [ "$SWAN_VER" = "3.31" ] || [ "$SWAN_VER" = "3.32" ]; then
   echo "USE_DH2 = true" >> Makefile.inc.local
   if ! grep -qs IFLA_XFRM_LINK /usr/include/linux/if_link.h; then
     echo "USE_XFRM_INTERFACE_IFLA_HEADER = true" >> Makefile.inc.local
@@ -273,7 +273,7 @@ elif [ "$dns_state" = "4" ]; then
   sed -i "s/modecfgdns=.*/modecfgdns1=$DNS_SRV1/" /etc/ipsec.conf
 fi
 
-if [ "$SWAN_VER" = "3.29" ] || [ "$SWAN_VER" = "3.31" ]; then
+if [ "$SWAN_VER" = "3.29" ] || [ "$SWAN_VER" = "3.31" ] || [ "$SWAN_VER" = "3.32" ]; then
   sed -i "/ikev2=never/d" /etc/ipsec.conf
   sed -i "/conn shared/a \  ikev2=never" /etc/ipsec.conf
 fi
diff --git a/extras/vpnupgrade_centos.sh b/extras/vpnupgrade_centos.sh
index 4ffd9eb..7f15434 100644
--- a/extras/vpnupgrade_centos.sh
+++ b/extras/vpnupgrade_centos.sh
@@ -11,7 +11,7 @@
 # know how you have improved it!
 
 # Specify which Libreswan version to install. See: https://libreswan.org
-SWAN_VER=3.31
+SWAN_VER=3.32
 
 ### DO NOT edit below this line ###
 
@@ -37,14 +37,14 @@ if [ "$(id -u)" != 0 ]; then
 fi
 
 case "$SWAN_VER" in
-  3.19|3.2[01235679]|3.31)
+  3.19|3.2[01235679]|3.3[12])
     /bin/true
     ;;
   *)
 cat 1>&2 <<EOF
 Error: Libreswan version '$SWAN_VER' is not supported.
   This script can install one of the following versions:
-  3.19-3.23, 3.25-3.27, 3.29 and 3.31
+  3.19-3.23, 3.25-3.27, 3.29, 3.31 and 3.32
 EOF
     exit 1
     ;;
@@ -52,7 +52,7 @@ esac
 
 dns_state=0
 case "$SWAN_VER" in
-  3.2[35679]|3.31)
+  3.2[35679]|3.3[12])
     DNS_SRV1=$(grep "modecfgdns1=" /etc/ipsec.conf | head -n 1 | cut -d '=' -f 2)
     DNS_SRV2=$(grep "modecfgdns2=" /etc/ipsec.conf | head -n 1 | cut -d '=' -f 2)
     [ -n "$DNS_SRV1" ] && dns_state=2
@@ -127,7 +127,7 @@ cat <<'EOF'
 EOF
 fi
 
-if [ "$SWAN_VER" = "3.29" ] || [ "$SWAN_VER" = "3.31" ]; then
+if [ "$SWAN_VER" = "3.29" ] || [ "$SWAN_VER" = "3.31" ] || [ "$SWAN_VER" = "3.32" ]; then
 cat <<'EOF'
     - Move "ikev2=never" to section "conn shared"
 EOF
@@ -140,7 +140,7 @@ cat <<'EOF'
 EOF
 
 case "$SWAN_VER" in
-  3.19|3.2[01235679])
+  3.19|3.2[01235679]|3.31)
 cat <<'EOF'
 WARNING: Older versions of Libreswan could contain known security vulnerabilities.
     See: https://libreswan.org/security/
@@ -234,7 +234,7 @@ USE_NSS_AVA_COPY = true
 USE_NSS_IPSEC_PROFILE = false
 USE_GLIBC_KERN_FLIP_HEADERS = true
 EOF
-if [ "$SWAN_VER" = "3.31" ]; then
+if [ "$SWAN_VER" = "3.31" ] || [ "$SWAN_VER" = "3.32" ]; then
   echo "USE_DH2 = true" >> Makefile.inc.local
   if ! grep -qs IFLA_XFRM_LINK /usr/include/linux/if_link.h; then
     echo "USE_XFRM_INTERFACE_IFLA_HEADER = true" >> Makefile.inc.local
@@ -278,7 +278,7 @@ elif [ "$dns_state" = "4" ]; then
   sed -i "s/modecfgdns=.*/modecfgdns1=$DNS_SRV1/" /etc/ipsec.conf
 fi
 
-if [ "$SWAN_VER" = "3.29" ] || [ "$SWAN_VER" = "3.31" ]; then
+if [ "$SWAN_VER" = "3.29" ] || [ "$SWAN_VER" = "3.31" ] || [ "$SWAN_VER" = "3.32" ]; then
   sed -i "/ikev2=never/d" /etc/ipsec.conf
   sed -i "/conn shared/a \  ikev2=never" /etc/ipsec.conf
 fi