From 37211f2227672cd079548c3eacbebc238646f00f Mon Sep 17 00:00:00 2001 From: Bill Nottingham Date: Mon, 16 Apr 2007 22:43:15 +0000 Subject: allow overriding of my_identifier (#229343, ) --- sysconfig.txt | 5 +++++ sysconfig/network-scripts/ifup-ipsec | 12 ++++++++++-- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/sysconfig.txt b/sysconfig.txt index fbb11535..a9f45f70 100644 --- a/sysconfig.txt +++ b/sysconfig.txt @@ -870,6 +870,11 @@ Files in /etc/sysconfig/network-scripts/ one IPSEC configuration with the same DST), set KEYING=automatic and leave all IKE_* parameters unspecified. + To override the identifier to use with a preshared key: + + MYID_TYPE=address|fqdn|user_fqdn + MYID_VALUE=fqdn or user_fqdn string for this connection + Usage of AH or ESP may be disabled by setting {AH,ESP}_PROTO to "none". Bonding-specific items diff --git a/sysconfig/network-scripts/ifup-ipsec b/sysconfig/network-scripts/ifup-ipsec index 882722fd..fc650daf 100755 --- a/sysconfig/network-scripts/ifup-ipsec +++ b/sysconfig/network-scripts/ifup-ipsec @@ -160,8 +160,16 @@ EOF if [ "$KEYING" = "automatic" -a -n "$IKE_METHOD" ]; then if [ "$IKE_METHOD" = "PSK" ]; then + MYID=address + if [ -n "$MYID_TYPE" ]; then + case "$MYID_TYPE" in + *fqdn*) + MYID="$MYID_TYPE \"$MYID_VALUE\"" + ;; + esac + fi tmpfile=`mktemp /etc/racoon/psk.XXXXXX` - grep -v "^$DST" /etc/racoon/psk.txt > $tmpfile + grep -v "^$DST " /etc/racoon/psk.txt > $tmpfile echo "$DST $IKE_PSK" >> $tmpfile mv -f $tmpfile /etc/racoon/psk.txt fi @@ -174,7 +182,7 @@ EOF case "$IKE_METHOD" in PSK) cat >> /etc/racoon/$DST.conf << EOF - my_identifier address; + my_identifier $MYID; proposal { encryption_algorithm $ESP_PROTO; hash_algorithm $AH_PROTO; -- cgit v1.2.1