- import of strongswan-2.7.0
- applied patch for charon
This commit is contained in:
Martin Willi
@@ -0,0 +1 @@
|
||||
_startklips
|
||||
@@ -0,0 +1,43 @@
|
||||
# Makefile for miscelaneous programs
|
||||
# Copyright (C) 2002 Michael Richardson <[email protected]>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU General Public License as published by the
|
||||
# Free Software Foundation; either version 2 of the License, or (at your
|
||||
# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
# for more details.
|
||||
#
|
||||
# RCSID $Id: Makefile,v 1.1 2004/03/15 20:35:27 as Exp $
|
||||
|
||||
FREESWANSRCDIR=../..
|
||||
include ${FREESWANSRCDIR}/Makefile.inc
|
||||
|
||||
PROGRAM=_startklips
|
||||
PROGRAMDIR=${LIBDIR}
|
||||
|
||||
include ../Makefile.program
|
||||
|
||||
#
|
||||
# $Log: Makefile,v $
|
||||
# Revision 1.1 2004/03/15 20:35:27 as
|
||||
# added files from freeswan-2.04-x509-1.5.3
|
||||
#
|
||||
# Revision 1.3 2002/08/02 16:01:42 mcr
|
||||
# moved user visible programs to $PREFIX/libexec, while moving
|
||||
# private files to $PREFIX/lib.
|
||||
#
|
||||
# Revision 1.2 2002/06/02 22:02:14 mcr
|
||||
# changed TOPDIR->FREESWANSRCDIR in all Makefiles.
|
||||
# (note that linux/net/ipsec/Makefile uses TOPDIR because this is the
|
||||
# kernel sense.)
|
||||
#
|
||||
# Revision 1.1 2002/04/24 07:55:32 mcr
|
||||
# #include patches and Makefiles for post-reorg compilation.
|
||||
#
|
||||
#
|
||||
#
|
||||
|
||||
@@ -0,0 +1,33 @@
|
||||
.TH _STARTKLIPS 8 "25 Apr 2002"
|
||||
.\"
|
||||
.\" RCSID $Id: _startklips.8,v 1.1 2004/03/15 20:35:27 as Exp $
|
||||
.\"
|
||||
.SH NAME
|
||||
ipsec _startklips \- internal script to bring up kernel components
|
||||
.SH DESCRIPTION
|
||||
.I _startklips
|
||||
brings up the FreeS/WAN kernel component. This involves loading any
|
||||
required modules, attaching and configuring the ipsecX pseudo-devices and
|
||||
attaching the pseudo-devices to the physical devices.
|
||||
.SH "SEE ALSO"
|
||||
ipsec(8), ipsec_tncfg(8).
|
||||
.SH HISTORY
|
||||
Man page written for the Linux FreeS/WAN project <http://www.freeswan.org/>
|
||||
by Michael Richardson. Original program by Henry Spencer.
|
||||
.\"
|
||||
.\" $Log: _startklips.8,v $
|
||||
.\" Revision 1.1 2004/03/15 20:35:27 as
|
||||
.\" added files from freeswan-2.04-x509-1.5.3
|
||||
.\"
|
||||
.\" Revision 1.2 2002/04/29 22:39:31 mcr
|
||||
.\" added basic man page for all internal commands.
|
||||
.\"
|
||||
.\" Revision 1.1 2002/04/26 01:21:43 mcr
|
||||
.\" while tracking down a missing (not installed) /etc/ipsec.conf,
|
||||
.\" MCR has decided that it is not okay for each program subdir to have
|
||||
.\" some subset (determined with -f) of possible files.
|
||||
.\" Each subdir that defines $PROGRAM, MUST have a PROGRAM.8 file as well as a PROGRAM file.
|
||||
.\" Optional PROGRAM.5 files have been added to the makefiles.
|
||||
.\"
|
||||
.\"
|
||||
.\"
|
||||
Executable
+367
@@ -0,0 +1,367 @@
|
||||
#!/bin/sh
|
||||
# KLIPS startup script
|
||||
# Copyright (C) 1998, 1999, 2001, 2002 Henry Spencer.
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU General Public License as published by the
|
||||
# Free Software Foundation; either version 2 of the License, or (at your
|
||||
# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
# for more details.
|
||||
#
|
||||
# RCSID $Id: _startklips.in,v 1.6 2005/05/06 22:11:33 as Exp $
|
||||
|
||||
me='ipsec _startklips' # for messages
|
||||
|
||||
# KLIPS-related paths
|
||||
sysflags=/proc/sys/net/ipsec
|
||||
modules=/proc/modules
|
||||
# full rp_filter path is $rpfilter1/interface/$rpfilter2
|
||||
rpfilter1=/proc/sys/net/ipv4/conf
|
||||
rpfilter2=rp_filter
|
||||
# %unchanged or setting (0, 1, or 2)
|
||||
rpfiltercontrol=0
|
||||
ipsecversion=/proc/net/ipsec_version
|
||||
moduleplace=/lib/modules/`uname -r`/kernel/net/ipsec
|
||||
bareversion=`uname -r | sed -e 's/^\(2\.[0-9]\.[1-9][0-9]*-[1-9][0-9]*\(\.[0-9][0-9]*\)*\(\.x\)*\).*$/\1/'`
|
||||
moduleinstplace=/lib/modules/$bareversion/kernel/net/ipsec
|
||||
modulename=ipsec.o
|
||||
klips=true
|
||||
netkey=/proc/net/pfkey
|
||||
|
||||
info=/dev/null
|
||||
log=daemon.error
|
||||
for dummy
|
||||
do
|
||||
case "$1" in
|
||||
--log) log="$2" ; shift ;;
|
||||
--info) info="$2" ; shift ;;
|
||||
--debug) debug="$2" ; shift ;;
|
||||
--omtu) omtu="$2" ; shift ;;
|
||||
--fragicmp) fragicmp="$2" ; shift ;;
|
||||
--hidetos) hidetos="$2" ; shift ;;
|
||||
--rpfilter) rpfiltercontrol="$2" ; shift ;;
|
||||
--) shift ; break ;;
|
||||
-*) echo "$me: unknown option \`$1'" >&2 ; exit 2 ;;
|
||||
*) break ;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
||||
|
||||
|
||||
# some shell functions, to clarify the actual code
|
||||
|
||||
# set up a system flag based on a variable
|
||||
# sysflag value shortname default flagname
|
||||
sysflag() {
|
||||
case "$1" in
|
||||
'') v="$3" ;;
|
||||
*) v="$1" ;;
|
||||
esac
|
||||
if test ! -f $sysflags/$4
|
||||
then
|
||||
if test " $v" != " $3"
|
||||
then
|
||||
echo "cannot do $2=$v, $sysflags/$4 does not exist"
|
||||
exit 1
|
||||
else
|
||||
return # can't set, but it's the default anyway
|
||||
fi
|
||||
fi
|
||||
case "$v" in
|
||||
yes|no) ;;
|
||||
*) echo "unknown (not yes/no) $2 value \`$1'"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
case "$v" in
|
||||
yes) echo 1 >$sysflags/$4 ;;
|
||||
no) echo 0 >$sysflags/$4 ;;
|
||||
esac
|
||||
}
|
||||
|
||||
# set up a Klips interface
|
||||
klipsinterface() {
|
||||
# pull apart the interface spec
|
||||
virt=`expr $1 : '\([^=]*\)=.*'`
|
||||
phys=`expr $1 : '[^=]*=\(.*\)'`
|
||||
case "$virt" in
|
||||
ipsec[0-9]) ;;
|
||||
*) echo "invalid interface \`$virt' in \`$1'" ; exit 1 ;;
|
||||
esac
|
||||
|
||||
# figure out ifconfig for interface
|
||||
addr=
|
||||
eval `ifconfig $phys |
|
||||
awk '$1 == "inet" && $2 ~ /^addr:/ && $NF ~ /^Mask:/ {
|
||||
gsub(/:/, " ", $0)
|
||||
print "addr=" $3
|
||||
other = $5
|
||||
if ($4 == "Bcast")
|
||||
print "type=broadcast"
|
||||
else if ($4 == "P-t-P")
|
||||
print "type=pointopoint"
|
||||
else if (NF == 5) {
|
||||
print "type="
|
||||
other = ""
|
||||
} else
|
||||
print "type=unknown"
|
||||
print "otheraddr=" other
|
||||
print "mask=" $NF
|
||||
}'`
|
||||
if test " $addr" = " "
|
||||
then
|
||||
echo "unable to determine address of \`$phys'"
|
||||
exit 1
|
||||
fi
|
||||
if test " $type" = " unknown"
|
||||
then
|
||||
echo "\`$phys' is of an unknown type"
|
||||
exit 1
|
||||
fi
|
||||
if test " $omtu" != " "
|
||||
then
|
||||
mtu="mtu $omtu"
|
||||
else
|
||||
mtu=
|
||||
fi
|
||||
echo "KLIPS $virt on $phys $addr/$mask $type $otheraddr $mtu" | logonly
|
||||
|
||||
if $klips
|
||||
then
|
||||
# attach the interface and bring it up
|
||||
ipsec tncfg --attach --virtual $virt --physical $phys
|
||||
ifconfig $virt inet $addr $type $otheraddr netmask $mask $mtu
|
||||
fi
|
||||
|
||||
# if %defaultroute, note the facts
|
||||
if test " $2" != " "
|
||||
then
|
||||
(
|
||||
echo "defaultroutephys=$phys"
|
||||
echo "defaultroutevirt=$virt"
|
||||
echo "defaultrouteaddr=$addr"
|
||||
if test " $2" != " 0.0.0.0"
|
||||
then
|
||||
echo "defaultroutenexthop=$2"
|
||||
fi
|
||||
) >>$info
|
||||
else
|
||||
echo '#dr: no default route' >>$info
|
||||
fi
|
||||
|
||||
# check for rp_filter trouble
|
||||
checkif $phys # thought to be a problem only on phys
|
||||
}
|
||||
|
||||
# check an interface for problems
|
||||
checkif() {
|
||||
$klips || return 0
|
||||
rpf=$rpfilter1/$1/$rpfilter2
|
||||
if test -f $rpf
|
||||
then
|
||||
r="`cat $rpf`"
|
||||
if test " $r" != " 0"
|
||||
then
|
||||
case "$r-$rpfiltercontrol" in
|
||||
0-%unchanged|0-0|1-1|2-2)
|
||||
# happy state
|
||||
;;
|
||||
*-%unchanged)
|
||||
echo "WARNING: $1 has route filtering turned on; KLIPS may not work ($rpf is $r)"
|
||||
;;
|
||||
[012]-[012])
|
||||
echo "WARNING: changing route filtering on $1 (changing $rpf from $r to $rpfiltercontrol)"
|
||||
echo "$rpfiltercontrol" >$rpf
|
||||
;;
|
||||
[012]-*)
|
||||
echo "ERROR: unknown rpfilter setting: $rpfiltercontrol"
|
||||
;;
|
||||
*)
|
||||
echo "ERROR: unknown $rpf value $r"
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# interfaces=%defaultroute: put ipsec0 on top of default route's interface
|
||||
defaultinterface() {
|
||||
phys=`netstat -nr |
|
||||
awk '$1 == "0.0.0.0" && $3 == "0.0.0.0" { print $NF }'`
|
||||
if test " $phys" = " "
|
||||
then
|
||||
echo "no default route, %defaultroute cannot cope!!!"
|
||||
exit 1
|
||||
fi
|
||||
if test `echo " $phys" | wc -l` -gt 1
|
||||
then
|
||||
echo "multiple default routes, %defaultroute cannot cope!!!"
|
||||
exit 1
|
||||
fi
|
||||
next=`netstat -nr |
|
||||
awk '$1 == "0.0.0.0" && $3 == "0.0.0.0" { print $2 }'`
|
||||
klipsinterface "ipsec0=$phys" $next
|
||||
}
|
||||
|
||||
# log only to syslog, not to stdout/stderr
|
||||
logonly() {
|
||||
logger -p $log -t ipsec_setup
|
||||
}
|
||||
|
||||
# sort out which module is appropriate, changing it if necessary
|
||||
setmodule() {
|
||||
wantgoo="`ipsec calcgoo /proc/ksyms`"
|
||||
module=$moduleplace/$modulename
|
||||
if test -f $module
|
||||
then
|
||||
goo="`nm -ao $module | ipsec calcgoo`"
|
||||
if test " $wantgoo" = " $goo"
|
||||
then
|
||||
return # looks right
|
||||
fi
|
||||
fi
|
||||
if test -f $moduleinstplace/$wantgoo
|
||||
then
|
||||
echo "insmod failed, but found matching template module $wantgoo."
|
||||
echo "Copying $moduleinstplace/$wantgoo to $module."
|
||||
rm -f $module
|
||||
mkdir -p $moduleplace
|
||||
cp -p $moduleinstplace/$wantgoo $module
|
||||
# "depmod -a" gets done by caller
|
||||
fi
|
||||
}
|
||||
|
||||
|
||||
|
||||
# main line
|
||||
|
||||
# load module if possible
|
||||
if test ! -f $ipsecversion && test ! -f $netkey
|
||||
then
|
||||
# statically compiled KLIPS not found; try to load the module
|
||||
insmod ipsec
|
||||
fi
|
||||
|
||||
if test ! -f $ipsecversion && test ! -f $netkey
|
||||
then
|
||||
modprobe -v af_key
|
||||
fi
|
||||
|
||||
if test -f $netkey
|
||||
then
|
||||
klips=false
|
||||
if test -f $modules
|
||||
then
|
||||
modprobe -qv ah4
|
||||
modprobe -qv esp4
|
||||
modprobe -qv ipcomp
|
||||
modprobe -qv xfrm4_tunnel
|
||||
modprobe -qv xfrm_user
|
||||
fi
|
||||
fi
|
||||
|
||||
if test ! -f $ipsecversion && $klips
|
||||
then
|
||||
if test -r $modules # kernel does have modules
|
||||
then
|
||||
setmodule
|
||||
unset MODPATH MODULECONF # no user overrides!
|
||||
depmod -a >/dev/null 2>&1
|
||||
modprobe -v ipsec
|
||||
fi
|
||||
if test ! -f $ipsecversion
|
||||
then
|
||||
echo "kernel appears to lack KLIPS"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# load all compiled algo modules
|
||||
if $klips
|
||||
then
|
||||
for alg in aes serpent twofish blowfish sha2
|
||||
do
|
||||
if test -f $moduleinstplace/alg/ipsec_$alg.o
|
||||
then
|
||||
modprobe ipsec_$alg
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
# figure out debugging flags
|
||||
case "$debug" in
|
||||
'') debug=none ;;
|
||||
esac
|
||||
if test -r /proc/net/ipsec_klipsdebug
|
||||
then
|
||||
echo "KLIPS debug \`$debug'" | logonly
|
||||
case "$debug" in
|
||||
none) ipsec klipsdebug --none ;;
|
||||
all) ipsec klipsdebug --all ;;
|
||||
*) ipsec klipsdebug --none
|
||||
for d in $debug
|
||||
do
|
||||
ipsec klipsdebug --set $d
|
||||
done
|
||||
;;
|
||||
esac
|
||||
elif $klips
|
||||
then
|
||||
if test " $debug" != " none"
|
||||
then
|
||||
echo "klipsdebug=\`$debug' ignored, KLIPS lacks debug facilities"
|
||||
fi
|
||||
fi
|
||||
|
||||
# figure out misc. kernel config
|
||||
if test -d $sysflags
|
||||
then
|
||||
sysflag "$fragicmp" "fragicmp" yes icmp
|
||||
echo 1 >$sysflags/inbound_policy_check # no debate
|
||||
sysflag no "no_eroute_pass" no no_eroute_pass # obsolete parm
|
||||
sysflag no "opportunistic" no opportunistic # obsolete parm
|
||||
sysflag "$hidetos" "hidetos" yes tos
|
||||
elif $klips
|
||||
then
|
||||
echo "WARNING: cannot adjust KLIPS flags, no $sysflags directory!"
|
||||
# carry on
|
||||
fi
|
||||
|
||||
if $klips; then
|
||||
# clear tables out in case dregs have been left over
|
||||
ipsec eroute --clear
|
||||
ipsec spi --clear
|
||||
elif test $netkey
|
||||
then
|
||||
if ip xfrm state > /dev/null 2>&1
|
||||
then
|
||||
ip xfrm state flush
|
||||
ip xfrm policy flush
|
||||
elif type setkey > /dev/null 2>&1
|
||||
then
|
||||
setkey -F
|
||||
setkey -FP
|
||||
else
|
||||
echo "WARNING: cannot flush state/policy database -- \`$1'" |
|
||||
logger -s -p $log -t ipsec_setup
|
||||
fi
|
||||
fi
|
||||
|
||||
# figure out interfaces
|
||||
for i
|
||||
do
|
||||
case "$i" in
|
||||
ipsec*=?*) klipsinterface "$i" ;;
|
||||
%defaultroute) defaultinterface ;;
|
||||
*) echo "interface \`$i' not understood"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
exit 0
|
||||
Reference in New Issue
Block a user