aboutsummaryrefslogtreecommitdiffstats
path: root/sysconfig/network-scripts/ifup-ipsec
diff options
context:
space:
mode:
Diffstat (limited to 'sysconfig/network-scripts/ifup-ipsec')
-rwxr-xr-xsysconfig/network-scripts/ifup-ipsec41
1 files changed, 23 insertions, 18 deletions
diff --git a/sysconfig/network-scripts/ifup-ipsec b/sysconfig/network-scripts/ifup-ipsec
index 2eb38e60..b46d7e2a 100755
--- a/sysconfig/network-scripts/ifup-ipsec
+++ b/sysconfig/network-scripts/ifup-ipsec
@@ -29,7 +29,7 @@
# PSK = preshared keys (shared secret)
# X509 = X.509 certificates
# RSA = RSA host keys in DNS (not yet implemented)
-# GSSAPI = GSSAPI authentication
+# GSSAPI = GSSAPI authentication
# IKE_PSK = preshared key for this connection
# IKE_CERTFILE = our certificate file name for X509 IKE
# IKE_PEER_CERTFILE = peer public cert filename for X509 IKE
@@ -100,11 +100,13 @@ fi
[ -z "$KEYING" ] && KEYING=manual
+# Get source address
+if [ -z "$SRC" ]; then
+ SRC=`ip -o route get to $DST | sed "s|.*src \([^ ]*\).*|\1|"`
+fi
+
+
if [ "$KEYING" = "manual" ]; then
- # Get source address
- if [ -z "$SRC" ]; then
- SRC=`ip -o route get to $DST | sed "s|.*src \([^ ]*\).*|\1|"`
- fi
[ -z "$AH_PROTO" ] && AH_PROTO=hmac-md5
[ -z "$ESP_PROTO" ] && ESP_PROTO=3des-cbc
@@ -171,19 +173,22 @@ EOF
fi
if [ "$KEYING" = "automatic" ]; then
+ [ -z "$AH_PROTO" ] && AH_PROTO=md5
+ [ -z "$ESP_PROTO" ] && ESP_PROTO=3des
+
if [ "$MODE" = "host" ]; then
/sbin/setkey -c << EOF
spddelete $SRC $DST any -P out;
spddelete $DST $SRC any -P in;
spdadd $SRC $DST any -P out ipsec
- ${KEY_ESP_OUT:+esp/transport//require}
- ${KEY_AH_OUT:+ah/transport//require}
+ esp/transport//require
+ ah/transport//require
;
spdadd $DST $SRC any -P in ipsec
- ${KEY_ESP_IN:+esp/transport//require}
- ${KEY_AH_IN:+ah/transport//require}
+ esp/transport//require
+ ah/transport//require
;
EOF
else
@@ -195,13 +200,13 @@ spddelete $SRCNET $DSTNET any -P out;
spddelete $DSTNET $SRCNET any -P in;
spdadd $SRCNET $DSTNET any -P out ipsec
- ${KEY_ESP_OUT:+esp/tunnel/$SRC-$DEST/require}
- ${KEY_AH_OUT:+ah/tunnel/$SRC-$DEST/require}
+ esp/tunnel/$SRC-$DEST/require
+ ah/tunnel/$SRC-$DEST/require
;
spdadd $DSTNET $SRCNET any -P in ipsec
- ${KEY_ESP_IN:+esp/tunnel/$DEST-$SRC/require}
- ${KEY_AH_IN:+ah/tunnel/$DEST-$SRC/require}
+ esp/tunnel/$DEST-$SRC/require
+ ah/tunnel/$DEST-$SRC/require
;
EOF
fi
@@ -215,7 +220,7 @@ EOF
cat > /etc/racoon/$DST.conf << EOF
remote $DST
{
- exchange_mode agressive, main;
+ exchange_mode aggressive, main;
EOF
case "$IKE_METHOD" in
PSK)
@@ -223,7 +228,7 @@ EOF
my_identifier address;
proposal {
encryption_algorithm $ESP_PROTO;
- hash_alogirtihm $AH_PROTO;
+ hash_algorithm $AH_PROTO;
authentication_method pre_shared_key;
dh_group 2 ;
}
@@ -260,7 +265,7 @@ EOF
my_identifier address;
proposal {
encryption_algorithm $ESP_PROTO;
- hash_alogirtihm $AH_PROTO;
+ hash_algorithm $AH_PROTO;
authentication_method gssapi_krb;
dh_group 2 ;
}
@@ -268,8 +273,8 @@ EOF
EOF
esac
racoontmp=`mktemp /etc/racoon/racoon.XXXXXX`
- grep -v "^include $DST.conf" /etc/racoon/racoon.conf >> $racoontmp
- echo "include $DST.conf" >> $racoontmp
+ grep -v "^include /etc/racoon/$DST.conf" /etc/racoon/racoon.conf >> $racoontmp
+ echo "include /etc/racoon/$DST.conf" >> $racoontmp
mv -f $racoontmp /etc/racoon/racoon.conf
pidof -x /usr/sbin/racoon > /dev/null 2>&1 && killall -HUP /usr/sbin/racoon
fi