aboutsummaryrefslogtreecommitdiffstats
path: root/sysconfig/network-scripts/ifdown-ipsec
blob: 37785642f40b3c2cfa412e77e8b3c7ebf25e9c5f (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
#!/bin/bash
PATH=/sbin:/usr/sbin/:/bin:/usr/bin

cd /etc/sysconfig/network-scripts
. network-functions

CONFIG=$1
[ -f "${CONFIG}" ] || CONFIG=ifcfg-${1}
source_config

if [ -n "$IKE_PSK" ]; then
  KEYING=automatic
  IKE_METHOD=PSK
fi
 
if [ -n "$IKE_CERTFILE" ]; then
  KEYING=automatic
  IKE_METHOD=X509
fi
 
if [ -n "$IKE_PEER_CERTFILE" ]; then
  KEYING=automatic
  IKE_METHOD=X509
fi

if [ -n "$IKE_DNSSEC" ]; then
  KEYING=automatic
  IKE_METHOD=X509
fi
if [ -n "$RSA_KEY" ]; then
  KEYING=automatic
  IKE_METHOD=RSA
fi

[ -z "$KEYING" ] && KEYING=manual

if [ -n "$SRCNET" -o -n "$DSTNET" ]; then
  MODE=tunnel
else
  MODE=host
fi

if [ -z "$SRC" ]; then
    SRC=`ip -o route get to $DST | sed "s|.*src \([^ ]*\).*|\1|"`
fi

if [ "$KEYING" = "manual" ]; then
    setkey -c << EOF
delete $SRC $DST ah $SPI_AH_OUT;
delete $DST $SRC ah $SPI_AH_IN;
delete $SRC $DST esp $SPI_ESP_OUT;
delete $DST $SRC esp $SPI_ESP_IN;
EOF
fi

if [ "$MODE" = "host" ]; then
	setkey -c << EOF
	spddelete $SRC $DST any -P out;
	spddelete $DST $SRC any -P in;
	spddelete $DST $SRC any -P fwd;
EOF
else
      [ -z "$SRCNET" ] && SRCNET="$SRC/32"
      [ -z "$DSTNET" ] && DSTNET="$DST/32"

      ip route del to $DSTNET via $DST

      /sbin/setkey -c >/dev/null 2>&1 << EOF
	spddelete $SRCNET $DSTNET any -P out;
	spddelete $DSTNET $SRCNET any -P in;
	spddelete $DSTNET $SRCNET any -P fwd;
EOF
fi


if [ "$KEYING" = "automatic" ]; then
   racoontmp=`mktemp /etc/racoon/racoon.XXXXXX`
   grep -v "^include \"/etc/racoon/$DST.conf\";" /etc/racoon/racoon.conf >> $racoontmp
   mv -f $racoontmp /etc/racoon/racoon.conf
   pidof -x /usr/sbin/racoon > /dev/null 2>&1 && killall -HUP /usr/sbin/racoon
fi

/etc/sysconfig/network-scripts/ifdown-post $CONFIG