blob: 0d882e74f96cf077b4fe1d8da6a85b1dcf9335bb (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
|
#!/bin/sh
#
# ifup-ipsec
#
# Brings up ipsec interfaces
#
# Configuration parameters
#
# Manual keying:
#
# SRC = source address. Not required.
# DST = destination address
# SRCNET = source net (for tunneling)
# DSTNET = destination network (for tunneling)
# AH_PROTO = protocol to use for AH (defaults to HMAC-MD5)
# ESP_PROTO = protocol to use for ESP (defaults to 3DES)
# KEY_AH = AH key
# KEY_ESP = ESP key
# SPI[1..4] = SPIs to use
#
#
if [ -n "$KEY_AH" -o -n "$KEY_ESP" ]; then
KEYING=manual
fi
if [ -n "$IKE_PSK" ]; then
KEYING=automatic
IKE_METHOD=PSK
fi
if [ -n "$CERT_NAME" ]; then
KEYING=automatic
IKE_METHOD=X509
fi
if [ -n "$RSA_KEY" ]; then
KEYING=automatic
IKE_METHOD=RSA
fi
if [ -n "$SRCNET" -o -n "$DSTNET" ]; then
MODE=tunnel
else
MODE=host
fi
if [ "$KEYING" = "manual" ]; then
# Get source address
if [ -n "$SRC" ]; then
SRC=`ip -o route get to $DST | sed "s|.*src \([^ ]*\).*|\1|"`
fi
[ -z "$AH_PROTO" ] && AH_PROTO=hmac-md5
[ -z "$ESP_PROTO" ] && ESP_PROTO=3des-cbc
if [ "$MODE" = "host" ]; then
/sbin/setkey -c << EOF
deleteall $SRC $DST ah;
deleteall $DST $SRC ah;
deleteall $SRC $DST esp;
deleteall $DST $SRC esp;
spddelete $SRC $DST any -P out;
spddelete $DST $SRC any -P in;
# ESP
add $DST $SRC esp $SPI3 -E $ESP_PROTO $KEY_ESP;
add $SRC $DST esp $SPI4 -E $ESP_PROTO $KEY_ESP;
# AH
add $DST $SRC ah $SPI1 -A $AH_PROTO $KEY_AH;
add $SRC $DST ah $SPI2 -A $AH_PROTO $KEY_AH;
spdadd $SRC $DST any -P out ipsec
esp/transport//require
ah/transport//require;
spdadd $DST $SRC any -P in ipsec
esp/transport//require
ah/transport//require;
EOF
else
[ -n "$SRCNET" ] && SRCNET="$SRC/32"
[ -n "$DSTNET" ] && DSTNET="$DST/32"
/sbin/setkey -c << EOF
deleteall $SRC $DST ah;
deleteall $DST $SRC ah;
deleteall $SRC $DST esp;
deleteall $DST $SRC esp;
spddelete $SRCNET $DSTNET any -P out;
spddelete $DSTNET $SRCNET any -P in;
# ESP
add $DST $SRC esp $SPI3 -m tunnel -E $ESP_PROTO $KEY_ESP;
add $SRC $DST esp $SPI4 -m tunnel -E $ESP_PROTO $KEY_ESP;
# AH
add $DST $SRC ah $SPI1 -m tunnel -A $AH_PROTO $KEY_AH;
add $SRC $DST ah $SPI2 -m tunnel -A $AH_PROTO $KEY_AH;
spdadd $SRCNET $DSTNET any -P out ipsec
esp/tunnel/$SRC-$DEST/require
ah/tunnel/$SRC-$DEST/require;
spdadd $DSTNET $SRCNET any -P in ipsec
esp/tunnel/$DEST-$SRC/require
ah/tunnel/$DEST-$SRC/require;
EOF
fi
fi
|
