diff options
| -rwxr-xr-x | sysconfig/network-scripts/ifup-ipsec | 152 |
1 files changed, 144 insertions, 8 deletions
diff --git a/sysconfig/network-scripts/ifup-ipsec b/sysconfig/network-scripts/ifup-ipsec index 4cdade86..363eac63 100755 --- a/sysconfig/network-scripts/ifup-ipsec +++ b/sysconfig/network-scripts/ifup-ipsec @@ -6,18 +6,36 @@ # # Configuration parameters # -# Manual keying: -# # SRC = source address. Not required. # DST = destination address # SRCNET = source net (for tunneling) # DSTNET = destination network (for tunneling) -# AH_PROTO = protocol to use for AH (defaults to HMAC-MD5) -# ESP_PROTO = protocol to use for ESP (defaults to 3DES) -# KEY_AH = AH key -# KEY_ESP = ESP key +# +# Manual keying: +# +# AH_PROTO{_IN,_OUT} = protocol to use for AH (defaults to HMAC-MD5) +# ESP_PROTO{_IN,_OUT} = protocol to use for ESP (defaults to 3DES) +# KEY_AH{_IN,_OUT} = AH key +# KEY_ESP{_IN,_OUT} = ESP key # SPI[1..4] = SPIs to use # +# _IN and _OUT specifiers are for using different keys or protocols for inccoming +# and outgoing packets. If neither _IN or _OUT variants are set, the same keys +# or protocols will be used for both. +# +# Automatic keying: +# +# IKE_METHOD=PSK|X509|RSA +# PSK = preshared keys (shared secret) +# X509 = X.509 certificates +# RSA = RSA host keys in DNS (not yet implemented) +# GSSAPI = GSSAPI authentication +# IKE_PSK = preshared key for this connection +# IKE_CERTFILE = our certificate file name for X509 IKE +# IKE_PEER_CERTFILE = peer public cert filename for X509 IKE +# IKE_DNSSEC = retrieve peer public certs from DNS +# (otherwise uses certificate information sent over IKE) +# IKE_RSA_KEY = RSA key for RSA IKE # if [ -n "$KEY_AH" -o -n "$KEY_ESP" ]; then @@ -40,17 +58,27 @@ if [ -z "$KEY_ESP_OUT" -a -n "$KEY_ESP" ]; then KEY_ESP_OUT=$KEY_ESP fi - if [ -n "$IKE_PSK" ]; then KEYING=automatic IKE_METHOD=PSK fi -if [ -n "$CERT_NAME" ]; then +if [ -n "$IKE_CERTFILE" ]; then + KEYING=automatic + IKE_METHOD=X509 +fi + +if [ -n "$IKE_PEER_CERTFILE" ]; then + KEYING=automatic + IKE_METHOD=X509 +fi + +if [ -n "$IKE_DNSSEC" ]; then KEYING=automatic IKE_METHOD=X509 fi + if [ -n "$RSA_KEY" ]; then KEYING=automatic IKE_METHOD=RSA @@ -62,6 +90,8 @@ else MODE=host fi +[ -z "$KEYING" ] && KEYING=manual + if [ "$KEYING" = "manual" ]; then # Get source address if [ -n "$SRC" ]; then @@ -131,3 +161,109 @@ spdadd $DSTNET $SRCNET any -P in ipsec EOF fi fi + +if [ "$KEYING" = "automatic" ]; then + if [ "$MODE" = "host" ]; then + /sbin/setkey -c << EOF +spddelete $SRC $DST any -P out; +spddelete $DST $SRC any -P in; + +spdadd $SRC $DST any -P out ipsec + ${KEY_ESP_OUT:+esp/transport//require} + ${KEY_AH_OUT:+ah/transport//require} + ; + +spdadd $DST $SRC any -P in ipsec + ${KEY_ESP_IN:+esp/transport//require} + ${KEY_AH_IN:+ah/transport//require} + ; +EOF + else + [ -n "$SRCNET" ] && SRCNET="$SRC/32" + [ -n "$DSTNET" ] && DSTNET="$DST/32" + + /sbin/setkey -c << EOF +spddelete $SRCNET $DSTNET any -P out; +spddelete $DSTNET $SRCNET any -P in; + +spdadd $SRCNET $DSTNET any -P out ipsec + ${KEY_ESP_OUT:+esp/tunnel/$SRC-$DEST/require} + ${KEY_AH_OUT:+ah/tunnel/$SRC-$DEST/require} + ; + +spdadd $DSTNET $SRCNET any -P in ipsec + ${KEY_ESP_IN:+esp/tunnel/$DEST-$SRC/require} + ${KEY_AH_IN:+ah/tunnel/$DEST-$SRC/require} + ; +EOF + fi + if [ "$IKE_METHOD" = "PSK" ]; then + tmpfile=`mktemp /etc/racoon/psk.XXXXXX` + grep -v "^$DST" /etc/racoon/psk.txt > $tmpfile + echo "$DST $IKE_PSK" >> $tmpfile + mv -f $tmpfile /etc/racoon/psk.txt + fi + if [ ! -f /etc/racoon/$DST.conf -o /etc/racoon/$DST.conf -ot $1 ] ; then + cat > /etc/racoon/$DST.conf << EOF +remote $DST +{ + exchange_mode agressive, main; +EOF + case "$IKE_METHOD" in + PSK) + cat >> /etc/racoon/$DST.conf << EOF + my_identifier address; + proposal { + encryption_algorithm $ESP_PROTO; + hash_alogirtihm $AH_PROTO; + authentication_method pre_shared_key; + dh_group 2 ; + } +} +EOF + ;; + X509) + cat >> /etc/racoon/$DST.conf << EOF + my_identifier asn1dn; + peers_identifier asn1dn; + certificate_type x509 "$IKE_CERTFILE.public" "$IKE_CERTFILE.private"; +EOF + if [ -n "$IKE_DNSSEC" ]; then + echo " peers_certfile dnssec;" >> /etc/racoon/$DST.conf + fi + if [ -n "$IKE_PEER_CERTFILE" ]; then + echo " peers_certfile $IKE_PEER_CERTFILE;" >> /etc/racoon/$DST.conf + fi + cat >> /etc/racoon/$DST.conf << EOF + proposal { + encryption_algorithm $ESP_PROTO; + hash_algorithm $AH_PROTO; + authentication_method rsasig; + dh_group 2; + } +} +EOF + ;; + RSA) + # not supported yet, only in freeswan + ;; + GSSAPI) + cat >> /etc/racoon/$DST.conf << EOF + my_identifier address; + proposal { + encryption_algorithm $ESP_PROTO; + hash_alogirtihm $AH_PROTO; + authentication_method gssapi_krb; + dh_group 2 ; + } +} +EOF + esac + racoontmp=`mktemp /etc/racoon/racoon.XXXXXX` + grep -v "^include $DST.conf" /etc/racoon/racoon.conf >> $racoontmp + echo "include $DST.conf" >> $racoontmp + mv -f $racoontmp /etc/racoon/racoon.conf + pidof -x /usr/sbin/racoon > /dev/null 2>&1 && killall -HUP /usr/sbin/racoon + fi + pidof -x /usr/sbin/racoon || /usr/sbin/racoon +fi |