- import of strongswan-2.7.0
- applied patch for charon
This commit is contained in:
Martin Willi
+150
@@ -0,0 +1,150 @@
|
||||
|
||||
-------------------------------
|
||||
strongSwan UML - Installation
|
||||
-------------------------------
|
||||
|
||||
|
||||
Contents
|
||||
--------
|
||||
|
||||
1. Making the host system UML-capable
|
||||
2. Installing the required files
|
||||
3. Creating the UML testing environment
|
||||
|
||||
|
||||
1. Making the host system UML-capable
|
||||
----------------------------------
|
||||
|
||||
UML instances can be run on both Linux 2.4 and Linux 2.6 kernels.
|
||||
If you are using a vanilla kernel from kernel.org then you must first
|
||||
apply the host SKAS patch available from
|
||||
|
||||
http://www.user-mode-linux.org/~blaisorblade/patches/
|
||||
|
||||
and recompile and reboot your host kernel. Some Linux distributions as e.g.
|
||||
SuSE already include the SKAS patch in their kernels.
|
||||
|
||||
You will also need the UML utilities (uml_mconsole and uml_switch)
|
||||
available from
|
||||
|
||||
http://prdownloads.sourceforge.net/user-mode-linux/uml_utilities_20040406.tar.bz2
|
||||
|
||||
Many Linux distributions offer the UML utilities as a package.
|
||||
|
||||
|
||||
2. Installing the required files
|
||||
-----------------------------
|
||||
|
||||
First create a directory where you want the strongSwan UML testing environment
|
||||
to be located.The default directory is "~/strongswan-testing". If you choose a
|
||||
different location, please adapt the UMLTESTDIR variable in "testing.conf"
|
||||
accordingly.
|
||||
|
||||
mkdir ~/strongswan-testing
|
||||
|
||||
Now copy the "testing" subdirectory coming with the strongSwan distribution to
|
||||
the UML testing environment:
|
||||
|
||||
cp -r testing ~/strongswan-testing
|
||||
|
||||
Next you need to copy several files into the ~/strongswan-testing directory that
|
||||
are required for the strongSwan testing environment:
|
||||
|
||||
* A vanilla Linux kernel on which the UML kernel will be based on.
|
||||
We recommend the use of
|
||||
|
||||
http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.16.9.tar.bz2
|
||||
|
||||
* Starting with Linux kernel 2.6.9 no patch must be applied any more in order
|
||||
to make the vanilla kernel UML-capable. For older kernels you'll find
|
||||
a matching UML patch at
|
||||
|
||||
http://prdownloads.sourceforge.net/user-mode-linux/
|
||||
|
||||
* The matching .config file required to compile the UML kernel:
|
||||
|
||||
http://download.strongswan.org/uml/.config-2.6.16
|
||||
|
||||
* A gentoo-based UML file system (compressed size 130 MBytes) found at
|
||||
|
||||
http://download.strongswan.org/uml/gentoo-fs-20060330.tar.bz2
|
||||
|
||||
* The latest strongSwan distribution
|
||||
|
||||
http://download.strongswan.org/strongswan-2.7.0.tar.gz
|
||||
|
||||
|
||||
3. Creating the environment
|
||||
------------------------
|
||||
|
||||
Now change into the testing subdirectory
|
||||
|
||||
cd ~/strongswan-testing/testing
|
||||
|
||||
and make the UML testing environment:
|
||||
|
||||
./make-testing <hosts>
|
||||
|
||||
The "make-testing" script calls a series of subscripts which can be
|
||||
enabled or disabled individually by setting the corresponding flags
|
||||
in "testing.conf":
|
||||
|
||||
if [ $ENABLE_BUILD_UMLKERNEL = "yes" ]
|
||||
then
|
||||
scripts/build-umlkernel
|
||||
fi
|
||||
|
||||
builds an UML kernel out of the vanilla Linux kernel and the corresponding
|
||||
UML kernel patch.
|
||||
|
||||
if [ $ENABLE_BUILD_HOSTCONFIG = "yes" ]
|
||||
then
|
||||
scripts/build-hostconfig
|
||||
fi
|
||||
|
||||
generates the default configurations for the UML hosts alice, venus, moon,
|
||||
carol, winnetou, dave, sun, and bob by replacing the wildcards PH_IP_ALICE,
|
||||
etc. by the actual IP addresses defined in "testing.conf".
|
||||
|
||||
if [ $ENABLE_BUILD_UMLROOTFS = "yes" ]
|
||||
then
|
||||
scripts/build-umlrootfs
|
||||
fi
|
||||
|
||||
takes the gentoo-based UML file system and compiles the latest strongSwan
|
||||
distribution into it.
|
||||
|
||||
if [ $ENABLE_BUILD_SSHKEYS = "yes" ]
|
||||
then
|
||||
scripts/build-sshkeys
|
||||
fi
|
||||
|
||||
adds the common RSA public key of the UML instances to your ~/.ssh/known_hosts
|
||||
directory so that you can log onto the UML instances using ssh without typing
|
||||
in a password. The "scripts/build-sshkeys" script should only be run once.
|
||||
|
||||
if [ $ENABLE_BUILD_UMLHOSTFS = "yes" ]
|
||||
then
|
||||
scripts/build-umlhostfs <hosts>
|
||||
fi
|
||||
|
||||
creates the customized UML file systems for the instances given as command line
|
||||
arguments by adding the default host configurations to the UML root file system.
|
||||
If the "make-starting" scripts is called without any arguments then by default
|
||||
the UML file systems are created for the hosts alice, venus, moon, carol,
|
||||
winnetou, dave, sun, and bob. Each UML root file system has as size defined by
|
||||
the ROOTFSSIZE in testing.conf which by default is 544 MBytes. Thus all 8 UML
|
||||
hosts plus the master copy will require a total of 5 GBytes of disk space.
|
||||
|
||||
if [ $ENABLE_START_TESTING = "yes" ]
|
||||
then
|
||||
./start-testing <hosts>
|
||||
fi
|
||||
|
||||
starts the automated testing. More details on the tests you'll find in the
|
||||
README document.
|
||||
|
||||
-----------------------------------------------------------------------------
|
||||
|
||||
This file is RCSID $Id: INSTALL,v 1.39 2006/04/24 16:58:03 as Exp $
|
||||
|
||||
+160
@@ -0,0 +1,160 @@
|
||||
|
||||
------------------------------------
|
||||
strongSwan UML - Running the Tests
|
||||
------------------------------------
|
||||
|
||||
|
||||
Contents
|
||||
--------
|
||||
|
||||
1. Starting up the UML testing environment
|
||||
2. Running the automated tests
|
||||
3. Manual testing
|
||||
|
||||
|
||||
1. Starting up the UML testing environment
|
||||
---------------------------------------
|
||||
|
||||
When the strongSwan UML testing environment has been put into place by
|
||||
running the "make-testing" script then you are ready to start up the
|
||||
UML instances by calling
|
||||
|
||||
./start-testing <hosts>
|
||||
|
||||
This main script first calls the subscript
|
||||
|
||||
scripts/start-switches
|
||||
|
||||
that starts the three UML switches umlswitch0, umlswitch1, and umlswitch2
|
||||
which are connecting the UML instances among each other and via tun/tap
|
||||
devices also make them accessible from the host system.
|
||||
|
||||
Then depending on the setting of the UMLSTARTMODE variable defined
|
||||
in "testing.conf", the UML instances given on the command line are started
|
||||
up with different terminals:
|
||||
|
||||
If you are running the KDE graphical environment then by setting
|
||||
|
||||
UMLSTARTMODE=konsole
|
||||
|
||||
the script
|
||||
|
||||
scripts/kstart-umls <hosts>
|
||||
|
||||
is called which starts up each of the UML instances defined by <hosts> in
|
||||
a KDE konsole. If
|
||||
|
||||
UMLSTARTMODE=xterm
|
||||
|
||||
is set then
|
||||
|
||||
scripts/xstart-umls <hosts>
|
||||
|
||||
starts up the UML instances in an xterm each. And with the choice
|
||||
|
||||
UMLSTARTMODE=screen
|
||||
|
||||
the instances are started up by
|
||||
|
||||
scripts/start-umls <hosts>
|
||||
|
||||
in the background but the Linux command "screen -r <host>" can be used to
|
||||
connect a terminal to the UML instance <host> if desired.
|
||||
|
||||
|
||||
if [ $ENABLE_DO_TESTS = "yes" ]
|
||||
then
|
||||
do-tests
|
||||
fi
|
||||
|
||||
either executes all the tests defined in the "testing/tests" directory
|
||||
if the variable SELECTEDTESTSONLY in "testing.conf" is set to "no" or the
|
||||
selected tests defined by the string in SELELECTEDTESTS if SELECTEDTESTSONLY
|
||||
is set to "yes".
|
||||
|
||||
if [ $ENABLE_STOP_TESTING = "yes" ]
|
||||
then
|
||||
stop-testing <hosts>
|
||||
fi
|
||||
|
||||
stops the both the UML switches and the UML instances designated by the
|
||||
<hosts> argument.
|
||||
|
||||
|
||||
2. Running the automated tests
|
||||
---------------------------
|
||||
|
||||
The script
|
||||
|
||||
./do-tests <testnames>
|
||||
|
||||
runs the automated tests. With an empty <testnames> argument the tests
|
||||
as defined in "testing.conf" are executed, otherwise the tests enumerated
|
||||
by the <testnames> argument will be run as shown in the example below.
|
||||
|
||||
./do-tests net2net-psk net2net-cert
|
||||
|
||||
Each test is divided into the following phases:
|
||||
|
||||
* scripts/load-testconfig <testname>
|
||||
loads the UML hosts with test specific settings if such are provided.
|
||||
|
||||
* next the "pretest.dat" script found in each test directory is executed.
|
||||
Among other commands, strongSwan is started on the IPsec hosts.
|
||||
|
||||
* the "evaltest.dat" script evaluates if the test has been successful.
|
||||
|
||||
* the "posttest.dat" script terminates the test e.g. by stopping
|
||||
strongSwan on the IPsec hosts.
|
||||
|
||||
* scripts/restore-defaults <testname>
|
||||
restores the default settings on the UML hosts.
|
||||
|
||||
The test results and configuration settings for all tests settings are stored
|
||||
in a folder labeled with the current date in the directory
|
||||
|
||||
~/strongswan-testing/testresults
|
||||
|
||||
the same results are also automatically transferred to the Apache server
|
||||
running on UML instance "winnetou" and can be accessed via the URL
|
||||
|
||||
http://192.168.0.150/testresults/
|
||||
|
||||
|
||||
3. Manual testing
|
||||
--------------
|
||||
|
||||
The greates flexibility can be achieved with manual testing. Just set
|
||||
|
||||
ENABLE_DO_TESTS="no"
|
||||
ENABLE_STOP_TESTING="no"
|
||||
|
||||
in "testing.conf" and start the UML instances that you want to experiment with
|
||||
by calling
|
||||
|
||||
./start-testing <hosts>
|
||||
|
||||
If you want to preload a test scenario with configurations differing from
|
||||
the default values, e.g. when using Preshared Keys then you can do this
|
||||
with the command
|
||||
|
||||
scripts/load-testconfig net2net-psk
|
||||
|
||||
You can then log onto any UML instance using its konsole, xterm or screen
|
||||
terminal as root with the default password
|
||||
|
||||
tuxmux
|
||||
|
||||
You can then execute any commands the UML instances, including changing
|
||||
and recompiling the strongSwan source code located in the /root directory.
|
||||
|
||||
After you have finished testing, the default configuration settings can
|
||||
restored with the command
|
||||
|
||||
scripts/restore-defaults net2net-psk
|
||||
|
||||
|
||||
-----------------------------------------------------------------------------
|
||||
|
||||
This file is RCSID $Id: README,v 1.2 2004/12/20 16:26:39 as Exp $
|
||||
|
||||
Executable
+458
@@ -0,0 +1,458 @@
|
||||
#!/bin/bash
|
||||
# Automatically execute the strongSwan test cases
|
||||
#
|
||||
# Copyright (C) 2004 Eric Marchionni, Patrik Rayo
|
||||
# Zuercher Hochschule Winterthur
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU General Public License as published by the
|
||||
# Free Software Foundation; either version 2 of the License, or (at your
|
||||
# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
# for more details.
|
||||
#
|
||||
# RCSID $Id: do-tests,v 1.20 2006/02/08 21:27:59 as Exp $
|
||||
|
||||
DIR=`dirname $0`
|
||||
|
||||
source $DIR/scripts/function.sh
|
||||
|
||||
[ -f $DIR/testing.conf ] || die "Configuration file 'testing.conf' not found"
|
||||
[ -d $DIR/hosts ] || die "Directory 'hosts' not found"
|
||||
[ -d $DIR/tests ] || die "Directory 'tests' not found"
|
||||
|
||||
source $DIR/testing.conf
|
||||
|
||||
|
||||
##############################################################################
|
||||
# test if UMLs have been built at all
|
||||
#
|
||||
|
||||
[ -d $BUILDDIR ] || die "Directory '$BUILDDIR' does not exist. Please run 'make-testing'first."
|
||||
|
||||
|
||||
##############################################################################
|
||||
# take care of new path and file variables
|
||||
#
|
||||
|
||||
[ -d $TESTRESULTSDIR ] || mkdir $TESTRESULTSDIR
|
||||
|
||||
TESTDATE=`date +%Y%m%d-%H%M`
|
||||
|
||||
TODAYDIR=$TESTRESULTSDIR/$TESTDATE
|
||||
mkdir $TODAYDIR
|
||||
TESTRESULTSHTML=$TODAYDIR/index.html
|
||||
DEFAULTTESTSDIR=$UMLTESTDIR/testing/tests
|
||||
|
||||
testnumber="0"
|
||||
failed_cnt="0"
|
||||
passed_cnt="0"
|
||||
|
||||
|
||||
##############################################################################
|
||||
# copy default tests to $BUILDDIR
|
||||
#
|
||||
|
||||
TESTSDIR=$BUILDDIR/tests
|
||||
[ -d $TESTSDIR ] || mkdir $TESTSDIR
|
||||
rm -rf $TESTSDIR/*
|
||||
cp -rfp $DEFAULTTESTSDIR/* $TESTSDIR
|
||||
|
||||
|
||||
##############################################################################
|
||||
# assign IP for each host to hostname
|
||||
#
|
||||
|
||||
for host in $STRONGSWANHOSTS
|
||||
do
|
||||
eval ip_${host}="`echo $HOSTNAMEIPS | sed -n -e "s/^.*${host}://gp" | awk -F : '{ print $1 }' | awk '{ print $1 }'`"
|
||||
case $host in
|
||||
moon)
|
||||
eval ip1_${host}="`echo $HOSTNAMEIPS | sed -n -e "s/^.*${host}://gp" | awk -F : '{ print $2 }' | awk '{ print $1 }'`"
|
||||
searchandreplace PH_IP_MOON $ip_moon $TESTSDIR
|
||||
searchandreplace PH_IP1_MOON $ip1_moon $TESTSDIR
|
||||
;;
|
||||
sun)
|
||||
eval ip1_${host}="`echo $HOSTNAMEIPS | sed -n -e "s/^.*${host}://gp" | awk -F : '{ print $2 }' | awk '{ print $1 }'`"
|
||||
searchandreplace PH_IP_SUN $ip_sun $TESTSDIR
|
||||
searchandreplace PH_IP1_SUN $ip1_sun $TESTSDIR
|
||||
;;
|
||||
alice)
|
||||
searchandreplace PH_IP_ALICE $ip_alice $TESTSDIR
|
||||
;;
|
||||
venus)
|
||||
searchandreplace PH_IP_VENUS $ip_venus $TESTSDIR
|
||||
;;
|
||||
bob)
|
||||
searchandreplace PH_IP_BOB $ip_bob $TESTSDIR
|
||||
;;
|
||||
carol)
|
||||
eval ip1_${host}="`echo $HOSTNAMEIPS | sed -n -e "s/^.*${host}://gp" | awk -F : '{ print $2 }' | awk '{ print $1 }'`"
|
||||
searchandreplace PH_IP_CAROL $ip_carol $TESTSDIR
|
||||
searchandreplace PH_IP1_CAROL $ip1_carol $TESTSDIR
|
||||
;;
|
||||
dave)
|
||||
eval ip1_${host}="`echo $HOSTNAMEIPS | sed -n -e "s/^.*${host}://gp" | awk -F : '{ print $2 }' | awk '{ print $1 }'`"
|
||||
searchandreplace PH_IP_DAVE $ip_dave $TESTSDIR
|
||||
searchandreplace PH_IP1_DAVE $ip1_dave $TESTSDIR
|
||||
;;
|
||||
winnetou)
|
||||
searchandreplace PH_IP_WINNETOU $ip_winnetou $TESTSDIR
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
|
||||
##############################################################################
|
||||
# create header for the results html file
|
||||
#
|
||||
|
||||
KERNEL_VERSION=`basename $KERNEL .tar.bz2`
|
||||
IPSEC_VERSION=`basename $STRONGSWAN .tar.bz2`
|
||||
|
||||
cat > $TESTRESULTSHTML <<@EOF
|
||||
<html>
|
||||
<head>
|
||||
<title>strongSwan UML Testing</title>
|
||||
</head>
|
||||
<body>
|
||||
<h2>strongSwan UML Testing</h2>
|
||||
<table border="0" cellspacing="2">
|
||||
<tr><td><b>Host:</b></td><td>`uname -a`</td></tr>
|
||||
<tr><td><b>UML kernel: </b></td><td>$KERNEL_VERSION</td></tr>
|
||||
<tr><td><b>IPsec:</b></td><td>$IPSEC_VERSION</td></tr>
|
||||
<tr><td><b>Date:</b></td><td>$TESTDATE</td></tr>
|
||||
</table>
|
||||
<p>
|
||||
<table border="0" width="500">
|
||||
<thead align="left"><th>Number</th><th>Test</th><th>Result</th></thead>
|
||||
@EOF
|
||||
|
||||
cecho "UML kernel: $KERNEL_VERSION"
|
||||
cecho "IPsec: $IPSEC_VERSION"
|
||||
cecho "Date: $TESTDATE"
|
||||
cecho ""
|
||||
|
||||
|
||||
##############################################################################
|
||||
# enter specific test directory
|
||||
#
|
||||
|
||||
if [ $# -gt 0 ]
|
||||
then
|
||||
TESTS=$*
|
||||
elif [ $SELECTEDTESTSONLY = "yes" ]
|
||||
then
|
||||
# set internal field seperator
|
||||
TESTS=$SELECTEDTESTS
|
||||
else
|
||||
# set internal field seperator
|
||||
TESTS="`ls $TESTSDIR`"
|
||||
fi
|
||||
|
||||
for testname in $TESTS
|
||||
do
|
||||
let "testnumber += 1"
|
||||
cecho-n " $testnumber $testname.."
|
||||
|
||||
if [ ! -d $TESTSDIR/${testname} ]
|
||||
then
|
||||
cecho "is missing..skipped"
|
||||
continue
|
||||
fi
|
||||
|
||||
[ -f $TESTSDIR/${testname}/description.txt ] || die "!! File 'description.txt' is missing"
|
||||
[ -f $TESTSDIR/${testname}/test.conf ] || die "!! File 'test.conf' is missing"
|
||||
[ -f $TESTSDIR/${testname}/pretest.dat ] || die "!! File 'pretest.dat' is missing"
|
||||
[ -f $TESTSDIR/${testname}/posttest.dat ] || die "!! File 'posttest.dat' is missing"
|
||||
[ -f $TESTSDIR/${testname}/evaltest.dat ] || die "!! File 'evaltest.dat' is missing"
|
||||
|
||||
TESTRESULTDIR=$TODAYDIR/$testname
|
||||
mkdir $TESTRESULTDIR
|
||||
CONSOLE_LOG=$TESTRESULTDIR/console.log
|
||||
touch $CONSOLE_LOG
|
||||
|
||||
|
||||
##########################################################################
|
||||
# copy test specific configurations to uml hosts and clear auth.log files
|
||||
#
|
||||
|
||||
$DIR/scripts/load-testconfig $testname
|
||||
source $TESTSDIR/$testname/test.conf
|
||||
|
||||
|
||||
##########################################################################
|
||||
# run tcpdump in the background
|
||||
#
|
||||
|
||||
if [ "$TCPDUMPHOSTS" != "" ]
|
||||
then
|
||||
echo -e "TCPDUMP\n" >> $CONSOLE_LOG 2>&1
|
||||
|
||||
for host_iface in $TCPDUMPHOSTS
|
||||
do
|
||||
host=`echo $host_iface | awk -F ":" '{print $1}'`
|
||||
iface=`echo $host_iface | awk -F ":" '{if ($2 != "") { print $2 } else { printf("eth0") }}'`
|
||||
tcpdump_cmd="tcpdump -i $iface not port ssh and not port domain and not arp > /tmp/tcpdump.log 2>&1 &"
|
||||
echo "${host}# $tcpdump_cmd" >> $CONSOLE_LOG
|
||||
ssh root@`eval echo \\\$ip_$host '$tcpdump_cmd'`
|
||||
eval TDUP_${host}="true"
|
||||
done
|
||||
fi
|
||||
|
||||
##########################################################################
|
||||
# execute pre-test commands
|
||||
#
|
||||
|
||||
cecho-n "pre.."
|
||||
echo -e "\nPRE-TEST\n" >> $CONSOLE_LOG 2>&1
|
||||
|
||||
eval `awk -F "::" '{
|
||||
if ($2 != "")
|
||||
{
|
||||
printf("echo \"%s# %s\"; ", $1, $2)
|
||||
printf("ssh root@\044ip_%s \"%s\"; ", $1, $2)
|
||||
printf("echo;\n")
|
||||
}
|
||||
}' $TESTSDIR/${testname}/pretest.dat` >> $CONSOLE_LOG 2>&1
|
||||
|
||||
|
||||
##########################################################################
|
||||
# stop tcpdump
|
||||
#
|
||||
|
||||
function stop_tcpdump {
|
||||
echo "${1}# killall tcpdump" >> $CONSOLE_LOG
|
||||
eval ssh root@\$ip_${1} killall tcpdump
|
||||
eval TDUP_${1}="false"
|
||||
echo ""
|
||||
}
|
||||
|
||||
|
||||
##########################################################################
|
||||
# get and evaluate test results
|
||||
#
|
||||
|
||||
cecho-n "test.."
|
||||
echo -e "\nTEST\n" >> $CONSOLE_LOG 2>&1
|
||||
|
||||
STATUS="passed"
|
||||
|
||||
eval `awk -F "::" '{
|
||||
host=$1
|
||||
command=$2
|
||||
pattern=$3
|
||||
hit=$4
|
||||
if (command != "")
|
||||
{
|
||||
if (command == "tcpdump")
|
||||
{
|
||||
printf("if [ \044TDUP_%s == \"true\" ]; then stop_tcpdump %s; fi; \n", host, host)
|
||||
printf("echo \"%s# cat /tmp/tcpdump.log | grep \047%s\047 [%s]\"; ", host, pattern, hit)
|
||||
printf("ssh root@\044ip_%s cat /tmp/tcpdump.log | grep \"%s\"; ", host, pattern)
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("echo \"%s# %s | grep \047%s\047 [%s]\"; ", host, command, pattern, hit)
|
||||
printf("ssh root@\044ip_%s %s | grep \"%s\"; ", host, command, pattern)
|
||||
}
|
||||
printf("cmd_exit=\044?; ")
|
||||
printf("echo; ")
|
||||
printf("if [ \044cmd_exit -eq 0 -a \"%s\" = \"NO\" ] ", hit)
|
||||
printf("|| [ \044cmd_exit -ne 0 -a \"%s\" = \"YES\" ] ", hit)
|
||||
printf("; then STATUS=\"failed\"; fi; \n")
|
||||
|
||||
}
|
||||
}' $TESTSDIR/${testname}/evaltest.dat` >> $CONSOLE_LOG 2>&1
|
||||
|
||||
|
||||
##########################################################################
|
||||
# set counters
|
||||
#
|
||||
|
||||
if [ $STATUS = "failed" ]
|
||||
then
|
||||
let "failed_cnt += 1"
|
||||
else
|
||||
let "passed_cnt += 1"
|
||||
fi
|
||||
|
||||
|
||||
##########################################################################
|
||||
# log statusall and listall output
|
||||
# get copies of ipsec.conf, ipsec.secrets
|
||||
# create index.html for the given test case
|
||||
|
||||
cat > $TESTRESULTDIR/index.html <<@EOF
|
||||
<html>
|
||||
<head>
|
||||
<title>Test $testname</title>
|
||||
</head>
|
||||
<body>
|
||||
<table border="0" width="600">
|
||||
<tr><td>
|
||||
<h2>Test $testname</h2>
|
||||
<h3>Description</h3>
|
||||
@EOF
|
||||
|
||||
cat $TESTSDIR/${testname}/description.txt >> $TESTRESULTDIR/index.html
|
||||
|
||||
cat >> $TESTRESULTDIR/index.html <<@EOF
|
||||
<ul>
|
||||
<li><a href="console.log">console.log</a></li>
|
||||
</ul>
|
||||
<img src="../images/$DIAGRAM" alt="$UMLHOSTS">
|
||||
@EOF
|
||||
|
||||
|
||||
for host in $IPSECHOSTS
|
||||
do
|
||||
eval HOSTLOGIN=root@\$ip_${host}
|
||||
|
||||
for command in statusall listall
|
||||
do
|
||||
ssh $HOSTLOGIN ipsec $command \
|
||||
> $TESTRESULTDIR/${host}.$command 2>/dev/null
|
||||
done
|
||||
|
||||
for file in ipsec.conf ipsec.secrets
|
||||
do
|
||||
scp $HOSTLOGIN:/etc/$file \
|
||||
$TESTRESULTDIR/${host}.$file > /dev/null 2>&1
|
||||
done
|
||||
|
||||
cat >> $TESTRESULTDIR/index.html <<@EOF
|
||||
<h3>$host</h3>
|
||||
<ul>
|
||||
<li><a href="$host.ipsec.conf">ipsec.conf</a></li>
|
||||
<li><a href="$host.ipsec.secrets">ipsec.secrets</a></li>
|
||||
<li><a href="$host.statusall">ipsec statusall</a></li>
|
||||
<li><a href="$host.listall">ipsec listall</a></li>
|
||||
<li><a href="$host.auth.log">auth.log</a></li>
|
||||
</ul>
|
||||
@EOF
|
||||
|
||||
done
|
||||
|
||||
cat >> $TESTRESULTDIR/index.html <<@EOF
|
||||
</td></tr>
|
||||
<tr><td align="right">
|
||||
<b><a href="../index.html">Back</a></b>
|
||||
</td></tr>
|
||||
</table>
|
||||
</body>
|
||||
</html>
|
||||
@EOF
|
||||
|
||||
|
||||
##########################################################################
|
||||
# execute post-test commands
|
||||
#
|
||||
|
||||
cecho-n "post.."
|
||||
echo -e "\nPOST-TEST\n" >> $CONSOLE_LOG 2>&1
|
||||
|
||||
eval `awk -F "::" '{
|
||||
if ($2 != "")
|
||||
{
|
||||
printf("echo \"%s# %s\"; ", $1, $2)
|
||||
printf("ssh root@\044ip_%s \"%s\"; ", $1, $2)
|
||||
printf("echo;\n")
|
||||
}
|
||||
}' $TESTSDIR/${testname}/posttest.dat` >> $CONSOLE_LOG 2>&1
|
||||
|
||||
|
||||
##########################################################################
|
||||
# get a copy of /var/log/auth.log
|
||||
#
|
||||
|
||||
for host in $IPSECHOSTS
|
||||
do
|
||||
eval HOSTLOGIN=root@\$ip_${host}
|
||||
ssh $HOSTLOGIN grep pluto /var/log/auth.log \
|
||||
> $TESTRESULTDIR/${host}.auth.log
|
||||
done
|
||||
|
||||
|
||||
##########################################################################
|
||||
# stop tcpdump if necessary
|
||||
#
|
||||
|
||||
for host in $TCPDUMPHOSTS
|
||||
do
|
||||
if [ "`eval echo \\\$TDUP_${host}`" = "true" ]
|
||||
then
|
||||
echo "${host}# killall tcpdump" >> $CONSOLE_LOG
|
||||
eval ssh root@\$ip_$host killall tcpdump
|
||||
eval TDUP_${host}="false"
|
||||
fi
|
||||
done
|
||||
|
||||
|
||||
##########################################################################
|
||||
# copy default host config back if necessary
|
||||
#
|
||||
|
||||
$DIR/scripts/restore-defaults $testname
|
||||
|
||||
|
||||
##########################################################################
|
||||
# write test status to html file
|
||||
#
|
||||
|
||||
cecho "$STATUS"
|
||||
if [ $STATUS = "passed" ]
|
||||
then
|
||||
COLOR="green"
|
||||
else
|
||||
COLOR="red"
|
||||
fi
|
||||
|
||||
cat >> $TESTRESULTSHTML << @EOF
|
||||
<tr>
|
||||
<td>$testnumber</td>
|
||||
<td><a href="$testname/">$testname</a></td>
|
||||
<td><a href="$testname/console.log"><font color="$COLOR">$STATUS</font></a></td>
|
||||
</tr>
|
||||
@EOF
|
||||
|
||||
done
|
||||
|
||||
|
||||
##############################################################################
|
||||
# finish the results html file
|
||||
#
|
||||
|
||||
cat >> $TESTRESULTSHTML << @EOF
|
||||
</table>
|
||||
<p>
|
||||
<b>Passed: $passed_cnt</b><br>
|
||||
<b>Failed: $failed_cnt</b><br>
|
||||
<p>
|
||||
</body>
|
||||
</html>
|
||||
@EOF
|
||||
|
||||
cecho ""
|
||||
cecho "Passed: $passed_cnt"
|
||||
cecho "Failed: $failed_cnt"
|
||||
cecho ""
|
||||
|
||||
|
||||
##############################################################################
|
||||
# copy the test results to the apache server
|
||||
#
|
||||
|
||||
HTDOCS="/var/www/localhost/htdocs"
|
||||
|
||||
cecho-n "Copying test results to winnetou.."
|
||||
ssh root@${ip_winnetou} mkdir -p $HTDOCS/testresults > /dev/null 2>&1
|
||||
scp -r $TODAYDIR root@${ip_winnetou}:$HTDOCS/testresults > /dev/null 2>&1
|
||||
ssh root@${ip_winnetou} ln -s $HTDOCS/images $HTDOCS/testresults/$TESTDATE/images > /dev/null 2>&1
|
||||
cecho "done"
|
||||
cecho ""
|
||||
cecho "The results are available in $TODAYDIR"
|
||||
cecho "or via the link http://$ip_winnetou/testresults/$TESTDATE"
|
||||
@@ -0,0 +1 @@
|
||||
HOSTNAME=alice
|
||||
@@ -0,0 +1,11 @@
|
||||
# /etc/conf.d/net:
|
||||
|
||||
# This is basically the ifconfig argument without the ifconfig $iface
|
||||
#
|
||||
iface_lo="127.0.0.1 netmask 255.0.0.0"
|
||||
iface_eth0="PH_IP_ALICE broadcast 10.1.255.255 netmask 255.255.0.0"
|
||||
|
||||
# For setting the default gateway
|
||||
#
|
||||
gateway="eth0/PH_IP1_MOON"
|
||||
|
||||
Executable
+74
@@ -0,0 +1,74 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Foundation
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
opts="start stop reload"
|
||||
|
||||
depend() {
|
||||
before net
|
||||
need logger
|
||||
}
|
||||
|
||||
start() {
|
||||
ebegin "Starting firewall"
|
||||
|
||||
# default policy is DROP
|
||||
/sbin/iptables -P INPUT DROP
|
||||
/sbin/iptables -P OUTPUT DROP
|
||||
/sbin/iptables -P FORWARD DROP
|
||||
|
||||
# allow IKE
|
||||
iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
|
||||
iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
|
||||
|
||||
# allow NAT-T
|
||||
iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
|
||||
iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
|
||||
|
||||
|
||||
# allow crl fetch from winnetou
|
||||
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
|
||||
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
|
||||
|
||||
# allow ssh
|
||||
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
|
||||
|
||||
eend $?
|
||||
}
|
||||
|
||||
stop() {
|
||||
ebegin "Stopping firewall"
|
||||
for a in `cat /proc/net/ip_tables_names`; do
|
||||
/sbin/iptables -F -t $a
|
||||
/sbin/iptables -X -t $a
|
||||
|
||||
if [ $a == nat ]; then
|
||||
/sbin/iptables -t nat -P PREROUTING ACCEPT
|
||||
/sbin/iptables -t nat -P POSTROUTING ACCEPT
|
||||
/sbin/iptables -t nat -P OUTPUT ACCEPT
|
||||
elif [ $a == mangle ]; then
|
||||
/sbin/iptables -t mangle -P PREROUTING ACCEPT
|
||||
/sbin/iptables -t mangle -P INPUT ACCEPT
|
||||
/sbin/iptables -t mangle -P FORWARD ACCEPT
|
||||
/sbin/iptables -t mangle -P OUTPUT ACCEPT
|
||||
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
|
||||
elif [ $a == filter ]; then
|
||||
/sbin/iptables -t filter -P INPUT ACCEPT
|
||||
/sbin/iptables -t filter -P FORWARD ACCEPT
|
||||
/sbin/iptables -t filter -P OUTPUT ACCEPT
|
||||
fi
|
||||
done
|
||||
eend $?
|
||||
}
|
||||
|
||||
reload() {
|
||||
ebegin "Flushing firewall"
|
||||
for a in `cat /proc/net/ip_tables_names`; do
|
||||
/sbin/iptables -F -t $a
|
||||
/sbin/iptables -X -t $a
|
||||
done;
|
||||
eend $?
|
||||
start
|
||||
}
|
||||
|
||||
Executable
+314
@@ -0,0 +1,314 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Technologies, Inc.
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
#NB: Config is in /etc/conf.d/net
|
||||
|
||||
if [[ -n $NET_DEBUG ]]; then
|
||||
set -x
|
||||
devnull=/dev/stderr
|
||||
else
|
||||
devnull=/dev/null
|
||||
fi
|
||||
|
||||
# For pcmcia users. note that pcmcia must be added to the same
|
||||
# runlevel as the net.* script that needs it.
|
||||
depend() {
|
||||
use hotplug pcmcia
|
||||
}
|
||||
|
||||
checkconfig() {
|
||||
if [[ -z "${ifconfig_IFACE}" ]]; then
|
||||
eerror "Please make sure that /etc/conf.d/net has \$ifconfig_$IFACE set"
|
||||
eerror "(or \$iface_$IFACE for old-style configuration)"
|
||||
return 1
|
||||
fi
|
||||
if [[ -n "${vlans_IFACE}" && ! -x /sbin/vconfig ]]; then
|
||||
eerror "For VLAN (802.1q) support, emerge net-misc/vconfig"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Fix bug 50039 (init.d/net.eth0 localization)
|
||||
# Some other commands in this script might need to be wrapped, but
|
||||
# we'll get them one-by-one. Note that LC_ALL trumps LC_anything_else
|
||||
# according to locale(7)
|
||||
ifconfig() {
|
||||
LC_ALL=C /sbin/ifconfig "$@"
|
||||
}
|
||||
|
||||
# setup_vars: setup variables based on $1 and content of /etc/conf.d/net
|
||||
# The following variables are set, which should be declared local by
|
||||
# the calling routine.
|
||||
# status_IFACE (up or '')
|
||||
# vlans_IFACE (space-separated list)
|
||||
# ifconfig_IFACE (array of ifconfig lines, replaces iface_IFACE)
|
||||
# dhcpcd_IFACE (command-line args for dhcpcd)
|
||||
# routes_IFACE (array of route lines)
|
||||
# inet6_IFACE (array of inet6 lines)
|
||||
# ifconfig_fallback_IFACE (fallback ifconfig if dhcp fails)
|
||||
setup_vars() {
|
||||
local i iface="${1//\./_}"
|
||||
|
||||
status_IFACE="$(ifconfig ${1} 2>${devnull} | gawk '$1 == "UP" {print "up"}')"
|
||||
eval vlans_IFACE=\"\$\{iface_${iface}_vlans\}\"
|
||||
eval ifconfig_IFACE=( \"\$\{ifconfig_$iface\[@\]\}\" )
|
||||
eval dhcpcd_IFACE=\"\$\{dhcpcd_$iface\}\"
|
||||
eval routes_IFACE=( \"\$\{routes_$iface\[@\]\}\" )
|
||||
eval inet6_IFACE=( \"\$\{inet6_$iface\[@\]\}\" )
|
||||
eval ifconfig_fallback_IFACE=( \"\$\{ifconfig_fallback_$iface\[@\]\}\" )
|
||||
|
||||
# BACKWARD COMPATIBILITY: populate the ifconfig_IFACE array
|
||||
# if iface_IFACE is set (fex. iface_eth0 instead of ifconfig_eth0)
|
||||
eval local iface_IFACE=\"\$\{iface_$iface\}\"
|
||||
if [[ -n ${iface_IFACE} && -z ${ifconfig_IFACE} ]]; then
|
||||
# Make sure these get evaluated as arrays
|
||||
local -a aliases broadcasts netmasks
|
||||
|
||||
# Start with the primary interface
|
||||
ifconfig_IFACE=( "${iface_IFACE}" )
|
||||
|
||||
# ..then add aliases
|
||||
eval aliases=( \$\{alias_$iface\} )
|
||||
eval broadcasts=( \$\{broadcast_$iface\} )
|
||||
eval netmasks=( \$\{netmask_$iface\} )
|
||||
for ((i = 0; i < ${#aliases[@]}; i = i + 1)); do
|
||||
ifconfig_IFACE[i+1]="${aliases[i]} ${broadcasts[i]:+broadcast ${broadcasts[i]}} ${netmasks[i]:+netmask ${netmasks[i]}}"
|
||||
done
|
||||
fi
|
||||
|
||||
# BACKWARD COMPATIBILITY: check for space-separated inet6 addresses
|
||||
if [[ ${#inet6_IFACE[@]} == 1 && ${inet6_IFACE} == *' '* ]]; then
|
||||
inet6_IFACE=( ${inet6_IFACE} )
|
||||
fi
|
||||
}
|
||||
|
||||
iface_start() {
|
||||
local IFACE=${1} i x retval
|
||||
checkconfig || return 1
|
||||
|
||||
if [[ ${ifconfig_IFACE} != dhcp ]]; then
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Bringing ${IFACE} up (${i})"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up"
|
||||
fi
|
||||
# ifconfig does not always return failure ..
|
||||
ifconfig ${IFACE} ${ifconfig_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
# Check that eth0 was not brought up by the kernel ...
|
||||
if [[ ${status_IFACE} == up ]]; then
|
||||
einfo "Keeping kernel configuration for ${IFACE}"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up via DHCP"
|
||||
/sbin/dhcpcd ${dhcpcd_IFACE} ${IFACE}
|
||||
retval=$?
|
||||
eend $retval
|
||||
if [[ $retval == 0 ]]; then
|
||||
# DHCP succeeded, show address retrieved
|
||||
i=$(ifconfig ${IFACE} | grep -m1 -o 'inet addr:[^ ]*' |
|
||||
cut -d: -f2)
|
||||
[[ -n ${i} ]] && einfo " ${IFACE} received address ${i}"
|
||||
elif [[ -n "${ifconfig_fallback_IFACE}" ]]; then
|
||||
# DHCP failed, try fallback.
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_fallback_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Using fallback configuration (${i}) for ${IFACE}"
|
||||
else
|
||||
ebegin "Using fallback configuration for ${IFACE}"
|
||||
fi
|
||||
ifconfig ${IFACE} ${ifconfig_fallback_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
return $retval
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ ${#ifconfig_IFACE[@]} -gt 1 ]]; then
|
||||
einfo " Adding aliases"
|
||||
for ((i = 1; i < ${#ifconfig_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE}:${i} (${ifconfig_IFACE[i]%% *})"
|
||||
ifconfig ${IFACE}:${i} ${ifconfig_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
if [[ -n ${inet6_IFACE} ]]; then
|
||||
einfo " Adding inet6 addresses"
|
||||
for ((i = 0; i < ${#inet6_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE} inet6 add ${inet6_IFACE[i]}"
|
||||
ifconfig ${IFACE} inet6 add ${inet6_IFACE[i]} >${devnull}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set static routes
|
||||
if [[ -n ${routes_IFACE} ]]; then
|
||||
einfo " Adding routes"
|
||||
for ((i = 0; i < ${#routes_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${routes_IFACE[i]}"
|
||||
/sbin/route add ${routes_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set default route if applicable to this interface
|
||||
if [[ ${gateway} == ${IFACE}/* ]]; then
|
||||
local ogw=$(/bin/netstat -rn | awk '$1 == "0.0.0.0" {print $2}')
|
||||
local gw=${gateway#*/}
|
||||
if [[ ${ogw} != ${gw} ]]; then
|
||||
ebegin " Setting default gateway ($gw)"
|
||||
|
||||
# First delete any existing route if it was setup by kernel...
|
||||
/sbin/route del default dev ${IFACE} &>${devnull}
|
||||
|
||||
# Second delete old gateway if it was set...
|
||||
/sbin/route del default gw ${ogw} &>${devnull}
|
||||
|
||||
# Third add our new default gateway
|
||||
/sbin/route add default gw ${gw} >${devnull}
|
||||
eend $? || {
|
||||
true # need to have some command in here
|
||||
# Note: This originally called stop, which is obviously
|
||||
# wrong since it's calling with a local version of IFACE.
|
||||
# The below code works correctly to abort configuration of
|
||||
# the interface, but is commented because we're assuming
|
||||
# that default route failure should not cause the interface
|
||||
# to be unconfigured.
|
||||
#local error=$?
|
||||
#ewarn "Aborting configuration of ${IFACE}"
|
||||
#iface_stop ${IFACE}
|
||||
#return ${error}
|
||||
}
|
||||
fi
|
||||
fi
|
||||
|
||||
# Enabling rp_filter causes wacky packets to be auto-dropped by
|
||||
# the kernel. Note that we only do this if it is not set via
|
||||
# /etc/sysctl.conf ...
|
||||
if [[ -e /proc/sys/net/ipv4/conf/${IFACE}/rp_filter && \
|
||||
-z "$(grep -s '^[^#]*rp_filter' /etc/sysctl.conf)" ]]; then
|
||||
echo -n 1 > /proc/sys/net/ipv4/conf/${IFACE}/rp_filter
|
||||
fi
|
||||
}
|
||||
|
||||
# iface_stop: bring down an interface. Don't trust information in
|
||||
# /etc/conf.d/net since the configuration might have changed since
|
||||
# iface_start ran. Instead query for current configuration and bring
|
||||
# down the interface.
|
||||
iface_stop() {
|
||||
local IFACE=${1} i x aliases inet6 count
|
||||
|
||||
# Try to do a simple down (no aliases, no inet6, no dhcp)
|
||||
aliases="$(ifconfig | grep -o "^$IFACE:[0-9]*" | tac)"
|
||||
inet6="$(ifconfig ${IFACE} | awk '$1 == "inet6" {print $2}')"
|
||||
if [[ -z ${aliases} && -z ${inet6} && ! -e /var/run/dhcpcd-${IFACE}.pid ]]; then
|
||||
ebegin "Bringing ${IFACE} down"
|
||||
ifconfig ${IFACE} down &>/dev/null
|
||||
eend 0
|
||||
return 0
|
||||
fi
|
||||
|
||||
einfo "Bringing ${IFACE} down"
|
||||
|
||||
# Stop aliases before primary interface.
|
||||
# Note this must be done in reverse order, since ifconfig eth0:1
|
||||
# will remove eth0:2, etc. It might be sufficient to simply remove
|
||||
# the base interface but we're being safe here.
|
||||
for i in ${aliases} ${IFACE}; do
|
||||
|
||||
# Delete all the inet6 addresses for this interface
|
||||
inet6="$(ifconfig ${i} | awk '$1 == "inet6" {print $3}')"
|
||||
if [[ -n ${inet6} ]]; then
|
||||
einfo " Removing inet6 addresses"
|
||||
for x in ${inet6}; do
|
||||
ebegin " ${IFACE} inet6 del ${x}"
|
||||
ifconfig ${i} inet6 del ${x}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Stop DHCP (should be N/A for aliases)
|
||||
# Don't trust current configuration... investigate ourselves
|
||||
if /sbin/dhcpcd -z ${i} &>${devnull}; then
|
||||
ebegin " Releasing DHCP lease for ${IFACE}"
|
||||
for ((count = 0; count < 9; count = count + 1)); do
|
||||
/sbin/dhcpcd -z ${i} &>${devnull} || break
|
||||
sleep 1
|
||||
done
|
||||
[[ ${count} -lt 9 ]]
|
||||
eend $? "Timed out"
|
||||
fi
|
||||
ebegin " Stopping ${i}"
|
||||
ifconfig ${i} down &>${devnull}
|
||||
eend 0
|
||||
done
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
start() {
|
||||
# These variables are set by setup_vars
|
||||
local status_IFACE vlans_IFACE dhcpcd_IFACE
|
||||
local -a ifconfig_IFACE routes_IFACE inet6_IFACE
|
||||
|
||||
# Call user-defined preup function if it exists
|
||||
if [[ $(type -t preup) == function ]]; then
|
||||
einfo "Running preup function"
|
||||
preup ${IFACE} || {
|
||||
eerror "preup ${IFACE} failed"
|
||||
return 1
|
||||
}
|
||||
fi
|
||||
|
||||
# Start the primary interface and aliases
|
||||
setup_vars ${IFACE}
|
||||
iface_start ${IFACE} || return 1
|
||||
|
||||
# Start vlans
|
||||
local vlan
|
||||
for vlan in ${vlans_IFACE}; do
|
||||
/sbin/vconfig add ${IFACE} ${vlan} >${devnull}
|
||||
setup_vars ${IFACE}.${vlan}
|
||||
iface_start ${IFACE}.${vlan}
|
||||
done
|
||||
|
||||
# Call user-defined postup function if it exists
|
||||
if [[ $(type -t postup) == function ]]; then
|
||||
einfo "Running postup function"
|
||||
postup ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
stop() {
|
||||
# Call user-defined predown function if it exists
|
||||
if [[ $(type -t predown) == function ]]; then
|
||||
einfo "Running predown function"
|
||||
predown ${IFACE}
|
||||
fi
|
||||
|
||||
# Don't depend on setup_vars since configuration might have changed.
|
||||
# Investigate current configuration instead.
|
||||
local vlan
|
||||
for vlan in $(ifconfig | grep -o "^${IFACE}\.[^ ]*"); do
|
||||
iface_stop ${vlan}
|
||||
/sbin/vconfig rem ${vlan} >${devnull}
|
||||
done
|
||||
|
||||
iface_stop ${IFACE} || return 1 # always succeeds, btw
|
||||
|
||||
# Call user-defined postdown function if it exists
|
||||
if [[ $(type -t postdown) == function ]]; then
|
||||
einfo "Running postdown function"
|
||||
postdown ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
# vim:ts=4
|
||||
Executable
+25
@@ -0,0 +1,25 @@
|
||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
version 2.0 # conforms to second version of ipsec.conf specification
|
||||
|
||||
config setup
|
||||
plutodebug=control
|
||||
crlcheckinterval=180
|
||||
strictcrlpolicy=no
|
||||
nat_traversal=yes
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
|
||||
conn nat-t
|
||||
left=%defaultroute
|
||||
leftcert=aliceCert.pem
|
||||
[email protected]
|
||||
leftfirewall=yes
|
||||
right=PH_IP_SUN
|
||||
[email protected]
|
||||
rightsubnet=10.2.0.0/16
|
||||
auto=add
|
||||
@@ -0,0 +1,22 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDtTCCAp2gAwIBAgIBADANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
|
||||
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
|
||||
b290IENBMB4XDTA0MDkxMDExMDE0NVoXDTE0MDkwODExMDE0NVowRTELMAkGA1UE
|
||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0cm9u
|
||||
Z1N3YW4gUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL/y
|
||||
X2LqPVZuWLPIeknK86xhz6ljd3NNhC2z+P1uoCP3sBMuZiZQEjFzhnKcbXxCeo2f
|
||||
FnvhOOjrrisSuVkzuu82oxXD3fIkzuS7m9V4E10EZzgmKWIf+WuNRfbgAuUINmLc
|
||||
4YGAXBQLPyzpP4Ou48hhz/YQo58Bics6PHy5v34qCVROIXDvqhj91P8g+pS+F21/
|
||||
7P+CH2jRcVIEHZtG8M/PweTPQ95dPzpYd2Ov6SZ/U7EWmbMmT8VcUYn1aChxFmy5
|
||||
gweVBWlkH6MP+1DeE0/tL5c87xo5KCeGK8Tdqpe7sBRC4pPEEHDQciTUvkeuJ1Pr
|
||||
K+1LwdqRxo7HgMRiDw8CAwEAAaOBrzCBrDAPBgNVHRMBAf8EBTADAQH/MAsGA1Ud
|
||||
DwQEAwIBBjAdBgNVHQ4EFgQUXafdcAZRMn7ntm2zteXgYOouTe8wbQYDVR0jBGYw
|
||||
ZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJBgNVBAYTAkNIMRkwFwYD
|
||||
VQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJvbmdTd2FuIFJvb3Qg
|
||||
Q0GCAQAwDQYJKoZIhvcNAQEEBQADggEBAJrXTj5gWS37myHHhii9drYwkMFyDHS/
|
||||
lHU8rW/drcnHdus507+qUhNr9SiEAHg4Ywj895UDvT0a1sFaw44QyEa/94iKA8/n
|
||||
+g5kS1IrKvWu3wu8UI3EgzChgHV3cncQlQWbK+FI9Y3Ax1O1np1r+wLptoWpKKKE
|
||||
UxsYcxP9K4Nbyeon0AIHOajUheiL3t6aRc3m0o7VU7Do6S2r+He+1Zq/nRUfFeTy
|
||||
0Atebkn8tmUpPSKWaXkmwpVNrjZ1Qu9umAU+dtJyhzL2zmnyhPC4VqpsKCOp7imy
|
||||
gKZvUIKPm1zyf4T+yjwxwkiX2xVseoM3aKswb1EoZFelHwndU7u0GQ8=
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,25 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEHzCCAwegAwIBAgIBBTANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
|
||||
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
|
||||
b290IENBMB4XDTA0MDkxMDExMjQzOVoXDTA5MDkwOTExMjQzOVowVzELMAkGA1UE
|
||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDjAMBgNVBAsTBVNhbGVz
|
||||
MR0wGwYDVQQDFBRhbGljZUBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcNAQEB
|
||||
BQADggEPADCCAQoCggEBAK7FyvkE18/oujCaTd8GXBNOH+Cvoy0ibJ8j2sNsBrer
|
||||
GS1lgxRs8zaVfK9fosadu0UZeWIHsOKkew5469sPvkKK2SGGH+pu+x+xO/vuaEG4
|
||||
FlkAu8iGFWLQycLt6BJfcqw7FT8rwNuD18XXBXmP7hRavi/TEElbVYHbO7lm8T5W
|
||||
6hTr/sYddiSB7X9/ba7JBy6lxmBcUAx5bjiiHLaW/llefkqyhc6dw5nvPZ2DchvH
|
||||
v/HWvLF9bsvxbBkHU0/z/CEsRuMBI7EPEL4rx3UqmuCUAqiMJTS3IrDaIlfJOLWc
|
||||
KlbsnE6hHpwmt9oDB9iWBY9WeZUSAtJGFw4b7FCZvQ0CAwEAAaOCAQYwggECMAkG
|
||||
A1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBRZmh0JtiNTjBsQsfD7ECNa
|
||||
60iG2jBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTELMAkG
|
||||
A1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0
|
||||
cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRhbGljZUBzdHJvbmdzd2Fu
|
||||
Lm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3Jn
|
||||
L3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQADdQIlJkFtmHEjtuyo
|
||||
2aIcrsUx98FtvVgB7RpQB8JZlly7UEjvX0CIIvW/7Al5/8h9s1rhrRffX7nXQKAQ
|
||||
AmPnvD2Pp47obDnHqm/L109S1fcL5BiPN1AlgsseUBwzdqBpyRncPXZoAuBh/BU5
|
||||
D/1Dip0hXgB/X6+QymSzRJoSKfpeXVICj1kYH1nIkn0YXthYF3BTrCheCzBlKn0S
|
||||
CixbCUYsUjtSqld0nG76jyGb/gnWntNettH+RXWe1gm6qREJwfEFdeYviTqx2Uxi
|
||||
6sBKG/XjNAcMArXb7V6w0YAwCyjwCl49B+mLZaFH+9izzBJ7NyVqhH8ToB1gt0re
|
||||
JGhV
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,27 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEpAIBAAKCAQEArsXK+QTXz+i6MJpN3wZcE04f4K+jLSJsnyPaw2wGt6sZLWWD
|
||||
FGzzNpV8r1+ixp27RRl5Ygew4qR7Dnjr2w++QorZIYYf6m77H7E7++5oQbgWWQC7
|
||||
yIYVYtDJwu3oEl9yrDsVPyvA24PXxdcFeY/uFFq+L9MQSVtVgds7uWbxPlbqFOv+
|
||||
xh12JIHtf39trskHLqXGYFxQDHluOKIctpb+WV5+SrKFzp3Dme89nYNyG8e/8da8
|
||||
sX1uy/FsGQdTT/P8ISxG4wEjsQ8QvivHdSqa4JQCqIwlNLcisNoiV8k4tZwqVuyc
|
||||
TqEenCa32gMH2JYFj1Z5lRIC0kYXDhvsUJm9DQIDAQABAoIBAEsjnnARNPeeBu5+
|
||||
aJxKD6v9Gpdu66ir9Cc3MwZxmzG7zcdGrWRKswX0nvaHF2Rsy+aZXSZYSCQosv81
|
||||
3bEAw7u4FkHjeDVCIZUujatyhEA89N6vAgzkGK2zNgsoXW4IuzRw8mGGXhQCSvIz
|
||||
z5bD2ofFu560D3x6V/jMWJENQQqbfWuD27OI+bZp92K2DGM6MoSbdNnd886F2oWR
|
||||
4pQfrwoxmSm7JFFARoe4t6pZPy4G+5jjnrhB3kblxONaV297nvSby9Ctfke7oOkM
|
||||
A3JpzNzEmrjjb2M8GKkYmbm6P+0ARdYIToD0sFpbRCdjJAKLadwNNnk2kijxPvQh
|
||||
HNHGy8ECgYEA2uD922oiNaIvBR+rJ/zRsJg7Dth+upGePiieOZdS0S/dZUFEXuK7
|
||||
PdLZOcelQP2fIFRdODLEpkkOii292Ej3zixgzu9QYSfCdhcOoeV+RiAC7XEBBMqc
|
||||
gFI1DdL91KGSmMNZ+B8yocA31pwQQsVFDUpvgqpA8fxsZkRI9oVSiOsCgYEAzGna
|
||||
At/Kk9AQfiM7fpjBygYUt1ZErHsPJhLPVXmqx7+FuB2+RQvTMBS4sRdG6yC4Kd1y
|
||||
CNIo83Yzv2IQGyNOCcGr60OPeqzTSQ6AUn7VxMY5EJZ880nfXBud7mj+CbyFi48V
|
||||
Sh2qziF18aUYm7z4eJCTpLlFjPzHcoU1ORM0U+cCgYEAzCWp4Kp/OdMJVBgThXpz
|
||||
AekavGAE43LKS2OLIGAZqG6iaryTToTe62zrms6xPYrQjlDhmXcQn5/oZc0AEukL
|
||||
6ErQCHKBX/y7jXU3+pyYSEO3N0t9DcEEc1M5lKlEgrwohT8/fQNsMB2edxacvApO
|
||||
u3S/yPmPFaTAXio2e2gicP0CgYEAp3PjM02PDu14RUypdTjAL7YxjErwcPdSXpc0
|
||||
H8pOm9mKOlyrPLbGJ3IiJnhyETW5iBovS4iWIXNoStSTaxfN2vI72rt6sz0WzJdD
|
||||
idD7X3oezzboXwjaIANDqkV6LhGwuLXa898/yCLjErRzZ0kzptiRCnT3w9pjrK3w
|
||||
/rN7v2sCgYAEwfgrwjb7+JUaSSaf6TlbM9/ZuTRBVN0OTQz2JVhokeAePeFjHzXt
|
||||
nzJI2ETYlIu6e1VaFzHb6dp84PzWfLV7Kk8hZqJeCQN4RmQ04oNBllWoOZPbN7oa
|
||||
8pAMk/DCsBxcM/GvnDQJlDVLQRyY64zJU8EI0rF1t+zosIyGtXom/A==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
@@ -0,0 +1,9 @@
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
|
||||
: RSA aliceKey.pem
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
+314
@@ -0,0 +1,314 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Technologies, Inc.
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
#NB: Config is in /etc/conf.d/net
|
||||
|
||||
if [[ -n $NET_DEBUG ]]; then
|
||||
set -x
|
||||
devnull=/dev/stderr
|
||||
else
|
||||
devnull=/dev/null
|
||||
fi
|
||||
|
||||
# For pcmcia users. note that pcmcia must be added to the same
|
||||
# runlevel as the net.* script that needs it.
|
||||
depend() {
|
||||
use hotplug pcmcia
|
||||
}
|
||||
|
||||
checkconfig() {
|
||||
if [[ -z "${ifconfig_IFACE}" ]]; then
|
||||
eerror "Please make sure that /etc/conf.d/net has \$ifconfig_$IFACE set"
|
||||
eerror "(or \$iface_$IFACE for old-style configuration)"
|
||||
return 1
|
||||
fi
|
||||
if [[ -n "${vlans_IFACE}" && ! -x /sbin/vconfig ]]; then
|
||||
eerror "For VLAN (802.1q) support, emerge net-misc/vconfig"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Fix bug 50039 (init.d/net.eth0 localization)
|
||||
# Some other commands in this script might need to be wrapped, but
|
||||
# we'll get them one-by-one. Note that LC_ALL trumps LC_anything_else
|
||||
# according to locale(7)
|
||||
ifconfig() {
|
||||
LC_ALL=C /sbin/ifconfig "$@"
|
||||
}
|
||||
|
||||
# setup_vars: setup variables based on $1 and content of /etc/conf.d/net
|
||||
# The following variables are set, which should be declared local by
|
||||
# the calling routine.
|
||||
# status_IFACE (up or '')
|
||||
# vlans_IFACE (space-separated list)
|
||||
# ifconfig_IFACE (array of ifconfig lines, replaces iface_IFACE)
|
||||
# dhcpcd_IFACE (command-line args for dhcpcd)
|
||||
# routes_IFACE (array of route lines)
|
||||
# inet6_IFACE (array of inet6 lines)
|
||||
# ifconfig_fallback_IFACE (fallback ifconfig if dhcp fails)
|
||||
setup_vars() {
|
||||
local i iface="${1//\./_}"
|
||||
|
||||
status_IFACE="$(ifconfig ${1} 2>${devnull} | gawk '$1 == "UP" {print "up"}')"
|
||||
eval vlans_IFACE=\"\$\{iface_${iface}_vlans\}\"
|
||||
eval ifconfig_IFACE=( \"\$\{ifconfig_$iface\[@\]\}\" )
|
||||
eval dhcpcd_IFACE=\"\$\{dhcpcd_$iface\}\"
|
||||
eval routes_IFACE=( \"\$\{routes_$iface\[@\]\}\" )
|
||||
eval inet6_IFACE=( \"\$\{inet6_$iface\[@\]\}\" )
|
||||
eval ifconfig_fallback_IFACE=( \"\$\{ifconfig_fallback_$iface\[@\]\}\" )
|
||||
|
||||
# BACKWARD COMPATIBILITY: populate the ifconfig_IFACE array
|
||||
# if iface_IFACE is set (fex. iface_eth0 instead of ifconfig_eth0)
|
||||
eval local iface_IFACE=\"\$\{iface_$iface\}\"
|
||||
if [[ -n ${iface_IFACE} && -z ${ifconfig_IFACE} ]]; then
|
||||
# Make sure these get evaluated as arrays
|
||||
local -a aliases broadcasts netmasks
|
||||
|
||||
# Start with the primary interface
|
||||
ifconfig_IFACE=( "${iface_IFACE}" )
|
||||
|
||||
# ..then add aliases
|
||||
eval aliases=( \$\{alias_$iface\} )
|
||||
eval broadcasts=( \$\{broadcast_$iface\} )
|
||||
eval netmasks=( \$\{netmask_$iface\} )
|
||||
for ((i = 0; i < ${#aliases[@]}; i = i + 1)); do
|
||||
ifconfig_IFACE[i+1]="${aliases[i]} ${broadcasts[i]:+broadcast ${broadcasts[i]}} ${netmasks[i]:+netmask ${netmasks[i]}}"
|
||||
done
|
||||
fi
|
||||
|
||||
# BACKWARD COMPATIBILITY: check for space-separated inet6 addresses
|
||||
if [[ ${#inet6_IFACE[@]} == 1 && ${inet6_IFACE} == *' '* ]]; then
|
||||
inet6_IFACE=( ${inet6_IFACE} )
|
||||
fi
|
||||
}
|
||||
|
||||
iface_start() {
|
||||
local IFACE=${1} i x retval
|
||||
checkconfig || return 1
|
||||
|
||||
if [[ ${ifconfig_IFACE} != dhcp ]]; then
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Bringing ${IFACE} up (${i})"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up"
|
||||
fi
|
||||
# ifconfig does not always return failure ..
|
||||
ifconfig ${IFACE} ${ifconfig_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
# Check that eth0 was not brought up by the kernel ...
|
||||
if [[ ${status_IFACE} == up ]]; then
|
||||
einfo "Keeping kernel configuration for ${IFACE}"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up via DHCP"
|
||||
/sbin/dhcpcd ${dhcpcd_IFACE} ${IFACE}
|
||||
retval=$?
|
||||
eend $retval
|
||||
if [[ $retval == 0 ]]; then
|
||||
# DHCP succeeded, show address retrieved
|
||||
i=$(ifconfig ${IFACE} | grep -m1 -o 'inet addr:[^ ]*' |
|
||||
cut -d: -f2)
|
||||
[[ -n ${i} ]] && einfo " ${IFACE} received address ${i}"
|
||||
elif [[ -n "${ifconfig_fallback_IFACE}" ]]; then
|
||||
# DHCP failed, try fallback.
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_fallback_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Using fallback configuration (${i}) for ${IFACE}"
|
||||
else
|
||||
ebegin "Using fallback configuration for ${IFACE}"
|
||||
fi
|
||||
ifconfig ${IFACE} ${ifconfig_fallback_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
return $retval
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ ${#ifconfig_IFACE[@]} -gt 1 ]]; then
|
||||
einfo " Adding aliases"
|
||||
for ((i = 1; i < ${#ifconfig_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE}:${i} (${ifconfig_IFACE[i]%% *})"
|
||||
ifconfig ${IFACE}:${i} ${ifconfig_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
if [[ -n ${inet6_IFACE} ]]; then
|
||||
einfo " Adding inet6 addresses"
|
||||
for ((i = 0; i < ${#inet6_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE} inet6 add ${inet6_IFACE[i]}"
|
||||
ifconfig ${IFACE} inet6 add ${inet6_IFACE[i]} >${devnull}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set static routes
|
||||
if [[ -n ${routes_IFACE} ]]; then
|
||||
einfo " Adding routes"
|
||||
for ((i = 0; i < ${#routes_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${routes_IFACE[i]}"
|
||||
/sbin/route add ${routes_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set default route if applicable to this interface
|
||||
if [[ ${gateway} == ${IFACE}/* ]]; then
|
||||
local ogw=$(/bin/netstat -rn | awk '$1 == "0.0.0.0" {print $2}')
|
||||
local gw=${gateway#*/}
|
||||
if [[ ${ogw} != ${gw} ]]; then
|
||||
ebegin " Setting default gateway ($gw)"
|
||||
|
||||
# First delete any existing route if it was setup by kernel...
|
||||
/sbin/route del default dev ${IFACE} &>${devnull}
|
||||
|
||||
# Second delete old gateway if it was set...
|
||||
/sbin/route del default gw ${ogw} &>${devnull}
|
||||
|
||||
# Third add our new default gateway
|
||||
/sbin/route add default gw ${gw} >${devnull}
|
||||
eend $? || {
|
||||
true # need to have some command in here
|
||||
# Note: This originally called stop, which is obviously
|
||||
# wrong since it's calling with a local version of IFACE.
|
||||
# The below code works correctly to abort configuration of
|
||||
# the interface, but is commented because we're assuming
|
||||
# that default route failure should not cause the interface
|
||||
# to be unconfigured.
|
||||
#local error=$?
|
||||
#ewarn "Aborting configuration of ${IFACE}"
|
||||
#iface_stop ${IFACE}
|
||||
#return ${error}
|
||||
}
|
||||
fi
|
||||
fi
|
||||
|
||||
# Enabling rp_filter causes wacky packets to be auto-dropped by
|
||||
# the kernel. Note that we only do this if it is not set via
|
||||
# /etc/sysctl.conf ...
|
||||
if [[ -e /proc/sys/net/ipv4/conf/${IFACE}/rp_filter && \
|
||||
-z "$(grep -s '^[^#]*rp_filter' /etc/sysctl.conf)" ]]; then
|
||||
echo -n 1 > /proc/sys/net/ipv4/conf/${IFACE}/rp_filter
|
||||
fi
|
||||
}
|
||||
|
||||
# iface_stop: bring down an interface. Don't trust information in
|
||||
# /etc/conf.d/net since the configuration might have changed since
|
||||
# iface_start ran. Instead query for current configuration and bring
|
||||
# down the interface.
|
||||
iface_stop() {
|
||||
local IFACE=${1} i x aliases inet6 count
|
||||
|
||||
# Try to do a simple down (no aliases, no inet6, no dhcp)
|
||||
aliases="$(ifconfig | grep -o "^$IFACE:[0-9]*" | tac)"
|
||||
inet6="$(ifconfig ${IFACE} | awk '$1 == "inet6" {print $2}')"
|
||||
if [[ -z ${aliases} && -z ${inet6} && ! -e /var/run/dhcpcd-${IFACE}.pid ]]; then
|
||||
ebegin "Bringing ${IFACE} down"
|
||||
ifconfig ${IFACE} down &>/dev/null
|
||||
eend 0
|
||||
return 0
|
||||
fi
|
||||
|
||||
einfo "Bringing ${IFACE} down"
|
||||
|
||||
# Stop aliases before primary interface.
|
||||
# Note this must be done in reverse order, since ifconfig eth0:1
|
||||
# will remove eth0:2, etc. It might be sufficient to simply remove
|
||||
# the base interface but we're being safe here.
|
||||
for i in ${aliases} ${IFACE}; do
|
||||
|
||||
# Delete all the inet6 addresses for this interface
|
||||
inet6="$(ifconfig ${i} | awk '$1 == "inet6" {print $3}')"
|
||||
if [[ -n ${inet6} ]]; then
|
||||
einfo " Removing inet6 addresses"
|
||||
for x in ${inet6}; do
|
||||
ebegin " ${IFACE} inet6 del ${x}"
|
||||
ifconfig ${i} inet6 del ${x}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Stop DHCP (should be N/A for aliases)
|
||||
# Don't trust current configuration... investigate ourselves
|
||||
if /sbin/dhcpcd -z ${i} &>${devnull}; then
|
||||
ebegin " Releasing DHCP lease for ${IFACE}"
|
||||
for ((count = 0; count < 9; count = count + 1)); do
|
||||
/sbin/dhcpcd -z ${i} &>${devnull} || break
|
||||
sleep 1
|
||||
done
|
||||
[[ ${count} -lt 9 ]]
|
||||
eend $? "Timed out"
|
||||
fi
|
||||
ebegin " Stopping ${i}"
|
||||
ifconfig ${i} down &>${devnull}
|
||||
eend 0
|
||||
done
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
start() {
|
||||
# These variables are set by setup_vars
|
||||
local status_IFACE vlans_IFACE dhcpcd_IFACE
|
||||
local -a ifconfig_IFACE routes_IFACE inet6_IFACE
|
||||
|
||||
# Call user-defined preup function if it exists
|
||||
if [[ $(type -t preup) == function ]]; then
|
||||
einfo "Running preup function"
|
||||
preup ${IFACE} || {
|
||||
eerror "preup ${IFACE} failed"
|
||||
return 1
|
||||
}
|
||||
fi
|
||||
|
||||
# Start the primary interface and aliases
|
||||
setup_vars ${IFACE}
|
||||
iface_start ${IFACE} || return 1
|
||||
|
||||
# Start vlans
|
||||
local vlan
|
||||
for vlan in ${vlans_IFACE}; do
|
||||
/sbin/vconfig add ${IFACE} ${vlan} >${devnull}
|
||||
setup_vars ${IFACE}.${vlan}
|
||||
iface_start ${IFACE}.${vlan}
|
||||
done
|
||||
|
||||
# Call user-defined postup function if it exists
|
||||
if [[ $(type -t postup) == function ]]; then
|
||||
einfo "Running postup function"
|
||||
postup ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
stop() {
|
||||
# Call user-defined predown function if it exists
|
||||
if [[ $(type -t predown) == function ]]; then
|
||||
einfo "Running predown function"
|
||||
predown ${IFACE}
|
||||
fi
|
||||
|
||||
# Don't depend on setup_vars since configuration might have changed.
|
||||
# Investigate current configuration instead.
|
||||
local vlan
|
||||
for vlan in $(ifconfig | grep -o "^${IFACE}\.[^ ]*"); do
|
||||
iface_stop ${vlan}
|
||||
/sbin/vconfig rem ${vlan} >${devnull}
|
||||
done
|
||||
|
||||
iface_stop ${IFACE} || return 1 # always succeeds, btw
|
||||
|
||||
# Call user-defined postdown function if it exists
|
||||
if [[ $(type -t postdown) == function ]]; then
|
||||
einfo "Running postdown function"
|
||||
postdown ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
# vim:ts=4
|
||||
@@ -0,0 +1 @@
|
||||
HOSTNAME=bob
|
||||
@@ -0,0 +1,10 @@
|
||||
# /etc/conf.d/net:
|
||||
|
||||
# This is basically the ifconfig argument without the ifconfig $iface
|
||||
#
|
||||
iface_lo="127.0.0.1 netmask 255.0.0.0"
|
||||
iface_eth0="PH_IP_BOB broadcast 10.2.255.255 netmask 255.255.0.0"
|
||||
|
||||
# For setting the default gateway
|
||||
#
|
||||
gateway="eth0/PH_IP1_SUN"
|
||||
Executable
+74
@@ -0,0 +1,74 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Foundation
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
opts="start stop reload"
|
||||
|
||||
depend() {
|
||||
before net
|
||||
need logger
|
||||
}
|
||||
|
||||
start() {
|
||||
ebegin "Starting firewall"
|
||||
|
||||
# default policy is DROP
|
||||
/sbin/iptables -P INPUT DROP
|
||||
/sbin/iptables -P OUTPUT DROP
|
||||
/sbin/iptables -P FORWARD DROP
|
||||
|
||||
# allow IKE
|
||||
iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
|
||||
iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
|
||||
|
||||
# allow NAT-T
|
||||
iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
|
||||
iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
|
||||
|
||||
|
||||
# allow crl fetch from winnetou
|
||||
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
|
||||
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
|
||||
|
||||
# allow ssh
|
||||
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
|
||||
|
||||
eend $?
|
||||
}
|
||||
|
||||
stop() {
|
||||
ebegin "Stopping firewall"
|
||||
for a in `cat /proc/net/ip_tables_names`; do
|
||||
/sbin/iptables -F -t $a
|
||||
/sbin/iptables -X -t $a
|
||||
|
||||
if [ $a == nat ]; then
|
||||
/sbin/iptables -t nat -P PREROUTING ACCEPT
|
||||
/sbin/iptables -t nat -P POSTROUTING ACCEPT
|
||||
/sbin/iptables -t nat -P OUTPUT ACCEPT
|
||||
elif [ $a == mangle ]; then
|
||||
/sbin/iptables -t mangle -P PREROUTING ACCEPT
|
||||
/sbin/iptables -t mangle -P INPUT ACCEPT
|
||||
/sbin/iptables -t mangle -P FORWARD ACCEPT
|
||||
/sbin/iptables -t mangle -P OUTPUT ACCEPT
|
||||
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
|
||||
elif [ $a == filter ]; then
|
||||
/sbin/iptables -t filter -P INPUT ACCEPT
|
||||
/sbin/iptables -t filter -P FORWARD ACCEPT
|
||||
/sbin/iptables -t filter -P OUTPUT ACCEPT
|
||||
fi
|
||||
done
|
||||
eend $?
|
||||
}
|
||||
|
||||
reload() {
|
||||
ebegin "Flushing firewall"
|
||||
for a in `cat /proc/net/ip_tables_names`; do
|
||||
/sbin/iptables -F -t $a
|
||||
/sbin/iptables -X -t $a
|
||||
done;
|
||||
eend $?
|
||||
start
|
||||
}
|
||||
|
||||
Executable
+314
@@ -0,0 +1,314 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Technologies, Inc.
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
#NB: Config is in /etc/conf.d/net
|
||||
|
||||
if [[ -n $NET_DEBUG ]]; then
|
||||
set -x
|
||||
devnull=/dev/stderr
|
||||
else
|
||||
devnull=/dev/null
|
||||
fi
|
||||
|
||||
# For pcmcia users. note that pcmcia must be added to the same
|
||||
# runlevel as the net.* script that needs it.
|
||||
depend() {
|
||||
use hotplug pcmcia
|
||||
}
|
||||
|
||||
checkconfig() {
|
||||
if [[ -z "${ifconfig_IFACE}" ]]; then
|
||||
eerror "Please make sure that /etc/conf.d/net has \$ifconfig_$IFACE set"
|
||||
eerror "(or \$iface_$IFACE for old-style configuration)"
|
||||
return 1
|
||||
fi
|
||||
if [[ -n "${vlans_IFACE}" && ! -x /sbin/vconfig ]]; then
|
||||
eerror "For VLAN (802.1q) support, emerge net-misc/vconfig"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Fix bug 50039 (init.d/net.eth0 localization)
|
||||
# Some other commands in this script might need to be wrapped, but
|
||||
# we'll get them one-by-one. Note that LC_ALL trumps LC_anything_else
|
||||
# according to locale(7)
|
||||
ifconfig() {
|
||||
LC_ALL=C /sbin/ifconfig "$@"
|
||||
}
|
||||
|
||||
# setup_vars: setup variables based on $1 and content of /etc/conf.d/net
|
||||
# The following variables are set, which should be declared local by
|
||||
# the calling routine.
|
||||
# status_IFACE (up or '')
|
||||
# vlans_IFACE (space-separated list)
|
||||
# ifconfig_IFACE (array of ifconfig lines, replaces iface_IFACE)
|
||||
# dhcpcd_IFACE (command-line args for dhcpcd)
|
||||
# routes_IFACE (array of route lines)
|
||||
# inet6_IFACE (array of inet6 lines)
|
||||
# ifconfig_fallback_IFACE (fallback ifconfig if dhcp fails)
|
||||
setup_vars() {
|
||||
local i iface="${1//\./_}"
|
||||
|
||||
status_IFACE="$(ifconfig ${1} 2>${devnull} | gawk '$1 == "UP" {print "up"}')"
|
||||
eval vlans_IFACE=\"\$\{iface_${iface}_vlans\}\"
|
||||
eval ifconfig_IFACE=( \"\$\{ifconfig_$iface\[@\]\}\" )
|
||||
eval dhcpcd_IFACE=\"\$\{dhcpcd_$iface\}\"
|
||||
eval routes_IFACE=( \"\$\{routes_$iface\[@\]\}\" )
|
||||
eval inet6_IFACE=( \"\$\{inet6_$iface\[@\]\}\" )
|
||||
eval ifconfig_fallback_IFACE=( \"\$\{ifconfig_fallback_$iface\[@\]\}\" )
|
||||
|
||||
# BACKWARD COMPATIBILITY: populate the ifconfig_IFACE array
|
||||
# if iface_IFACE is set (fex. iface_eth0 instead of ifconfig_eth0)
|
||||
eval local iface_IFACE=\"\$\{iface_$iface\}\"
|
||||
if [[ -n ${iface_IFACE} && -z ${ifconfig_IFACE} ]]; then
|
||||
# Make sure these get evaluated as arrays
|
||||
local -a aliases broadcasts netmasks
|
||||
|
||||
# Start with the primary interface
|
||||
ifconfig_IFACE=( "${iface_IFACE}" )
|
||||
|
||||
# ..then add aliases
|
||||
eval aliases=( \$\{alias_$iface\} )
|
||||
eval broadcasts=( \$\{broadcast_$iface\} )
|
||||
eval netmasks=( \$\{netmask_$iface\} )
|
||||
for ((i = 0; i < ${#aliases[@]}; i = i + 1)); do
|
||||
ifconfig_IFACE[i+1]="${aliases[i]} ${broadcasts[i]:+broadcast ${broadcasts[i]}} ${netmasks[i]:+netmask ${netmasks[i]}}"
|
||||
done
|
||||
fi
|
||||
|
||||
# BACKWARD COMPATIBILITY: check for space-separated inet6 addresses
|
||||
if [[ ${#inet6_IFACE[@]} == 1 && ${inet6_IFACE} == *' '* ]]; then
|
||||
inet6_IFACE=( ${inet6_IFACE} )
|
||||
fi
|
||||
}
|
||||
|
||||
iface_start() {
|
||||
local IFACE=${1} i x retval
|
||||
checkconfig || return 1
|
||||
|
||||
if [[ ${ifconfig_IFACE} != dhcp ]]; then
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Bringing ${IFACE} up (${i})"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up"
|
||||
fi
|
||||
# ifconfig does not always return failure ..
|
||||
ifconfig ${IFACE} ${ifconfig_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
# Check that eth0 was not brought up by the kernel ...
|
||||
if [[ ${status_IFACE} == up ]]; then
|
||||
einfo "Keeping kernel configuration for ${IFACE}"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up via DHCP"
|
||||
/sbin/dhcpcd ${dhcpcd_IFACE} ${IFACE}
|
||||
retval=$?
|
||||
eend $retval
|
||||
if [[ $retval == 0 ]]; then
|
||||
# DHCP succeeded, show address retrieved
|
||||
i=$(ifconfig ${IFACE} | grep -m1 -o 'inet addr:[^ ]*' |
|
||||
cut -d: -f2)
|
||||
[[ -n ${i} ]] && einfo " ${IFACE} received address ${i}"
|
||||
elif [[ -n "${ifconfig_fallback_IFACE}" ]]; then
|
||||
# DHCP failed, try fallback.
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_fallback_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Using fallback configuration (${i}) for ${IFACE}"
|
||||
else
|
||||
ebegin "Using fallback configuration for ${IFACE}"
|
||||
fi
|
||||
ifconfig ${IFACE} ${ifconfig_fallback_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
return $retval
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ ${#ifconfig_IFACE[@]} -gt 1 ]]; then
|
||||
einfo " Adding aliases"
|
||||
for ((i = 1; i < ${#ifconfig_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE}:${i} (${ifconfig_IFACE[i]%% *})"
|
||||
ifconfig ${IFACE}:${i} ${ifconfig_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
if [[ -n ${inet6_IFACE} ]]; then
|
||||
einfo " Adding inet6 addresses"
|
||||
for ((i = 0; i < ${#inet6_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE} inet6 add ${inet6_IFACE[i]}"
|
||||
ifconfig ${IFACE} inet6 add ${inet6_IFACE[i]} >${devnull}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set static routes
|
||||
if [[ -n ${routes_IFACE} ]]; then
|
||||
einfo " Adding routes"
|
||||
for ((i = 0; i < ${#routes_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${routes_IFACE[i]}"
|
||||
/sbin/route add ${routes_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set default route if applicable to this interface
|
||||
if [[ ${gateway} == ${IFACE}/* ]]; then
|
||||
local ogw=$(/bin/netstat -rn | awk '$1 == "0.0.0.0" {print $2}')
|
||||
local gw=${gateway#*/}
|
||||
if [[ ${ogw} != ${gw} ]]; then
|
||||
ebegin " Setting default gateway ($gw)"
|
||||
|
||||
# First delete any existing route if it was setup by kernel...
|
||||
/sbin/route del default dev ${IFACE} &>${devnull}
|
||||
|
||||
# Second delete old gateway if it was set...
|
||||
/sbin/route del default gw ${ogw} &>${devnull}
|
||||
|
||||
# Third add our new default gateway
|
||||
/sbin/route add default gw ${gw} >${devnull}
|
||||
eend $? || {
|
||||
true # need to have some command in here
|
||||
# Note: This originally called stop, which is obviously
|
||||
# wrong since it's calling with a local version of IFACE.
|
||||
# The below code works correctly to abort configuration of
|
||||
# the interface, but is commented because we're assuming
|
||||
# that default route failure should not cause the interface
|
||||
# to be unconfigured.
|
||||
#local error=$?
|
||||
#ewarn "Aborting configuration of ${IFACE}"
|
||||
#iface_stop ${IFACE}
|
||||
#return ${error}
|
||||
}
|
||||
fi
|
||||
fi
|
||||
|
||||
# Enabling rp_filter causes wacky packets to be auto-dropped by
|
||||
# the kernel. Note that we only do this if it is not set via
|
||||
# /etc/sysctl.conf ...
|
||||
if [[ -e /proc/sys/net/ipv4/conf/${IFACE}/rp_filter && \
|
||||
-z "$(grep -s '^[^#]*rp_filter' /etc/sysctl.conf)" ]]; then
|
||||
echo -n 1 > /proc/sys/net/ipv4/conf/${IFACE}/rp_filter
|
||||
fi
|
||||
}
|
||||
|
||||
# iface_stop: bring down an interface. Don't trust information in
|
||||
# /etc/conf.d/net since the configuration might have changed since
|
||||
# iface_start ran. Instead query for current configuration and bring
|
||||
# down the interface.
|
||||
iface_stop() {
|
||||
local IFACE=${1} i x aliases inet6 count
|
||||
|
||||
# Try to do a simple down (no aliases, no inet6, no dhcp)
|
||||
aliases="$(ifconfig | grep -o "^$IFACE:[0-9]*" | tac)"
|
||||
inet6="$(ifconfig ${IFACE} | awk '$1 == "inet6" {print $2}')"
|
||||
if [[ -z ${aliases} && -z ${inet6} && ! -e /var/run/dhcpcd-${IFACE}.pid ]]; then
|
||||
ebegin "Bringing ${IFACE} down"
|
||||
ifconfig ${IFACE} down &>/dev/null
|
||||
eend 0
|
||||
return 0
|
||||
fi
|
||||
|
||||
einfo "Bringing ${IFACE} down"
|
||||
|
||||
# Stop aliases before primary interface.
|
||||
# Note this must be done in reverse order, since ifconfig eth0:1
|
||||
# will remove eth0:2, etc. It might be sufficient to simply remove
|
||||
# the base interface but we're being safe here.
|
||||
for i in ${aliases} ${IFACE}; do
|
||||
|
||||
# Delete all the inet6 addresses for this interface
|
||||
inet6="$(ifconfig ${i} | awk '$1 == "inet6" {print $3}')"
|
||||
if [[ -n ${inet6} ]]; then
|
||||
einfo " Removing inet6 addresses"
|
||||
for x in ${inet6}; do
|
||||
ebegin " ${IFACE} inet6 del ${x}"
|
||||
ifconfig ${i} inet6 del ${x}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Stop DHCP (should be N/A for aliases)
|
||||
# Don't trust current configuration... investigate ourselves
|
||||
if /sbin/dhcpcd -z ${i} &>${devnull}; then
|
||||
ebegin " Releasing DHCP lease for ${IFACE}"
|
||||
for ((count = 0; count < 9; count = count + 1)); do
|
||||
/sbin/dhcpcd -z ${i} &>${devnull} || break
|
||||
sleep 1
|
||||
done
|
||||
[[ ${count} -lt 9 ]]
|
||||
eend $? "Timed out"
|
||||
fi
|
||||
ebegin " Stopping ${i}"
|
||||
ifconfig ${i} down &>${devnull}
|
||||
eend 0
|
||||
done
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
start() {
|
||||
# These variables are set by setup_vars
|
||||
local status_IFACE vlans_IFACE dhcpcd_IFACE
|
||||
local -a ifconfig_IFACE routes_IFACE inet6_IFACE
|
||||
|
||||
# Call user-defined preup function if it exists
|
||||
if [[ $(type -t preup) == function ]]; then
|
||||
einfo "Running preup function"
|
||||
preup ${IFACE} || {
|
||||
eerror "preup ${IFACE} failed"
|
||||
return 1
|
||||
}
|
||||
fi
|
||||
|
||||
# Start the primary interface and aliases
|
||||
setup_vars ${IFACE}
|
||||
iface_start ${IFACE} || return 1
|
||||
|
||||
# Start vlans
|
||||
local vlan
|
||||
for vlan in ${vlans_IFACE}; do
|
||||
/sbin/vconfig add ${IFACE} ${vlan} >${devnull}
|
||||
setup_vars ${IFACE}.${vlan}
|
||||
iface_start ${IFACE}.${vlan}
|
||||
done
|
||||
|
||||
# Call user-defined postup function if it exists
|
||||
if [[ $(type -t postup) == function ]]; then
|
||||
einfo "Running postup function"
|
||||
postup ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
stop() {
|
||||
# Call user-defined predown function if it exists
|
||||
if [[ $(type -t predown) == function ]]; then
|
||||
einfo "Running predown function"
|
||||
predown ${IFACE}
|
||||
fi
|
||||
|
||||
# Don't depend on setup_vars since configuration might have changed.
|
||||
# Investigate current configuration instead.
|
||||
local vlan
|
||||
for vlan in $(ifconfig | grep -o "^${IFACE}\.[^ ]*"); do
|
||||
iface_stop ${vlan}
|
||||
/sbin/vconfig rem ${vlan} >${devnull}
|
||||
done
|
||||
|
||||
iface_stop ${IFACE} || return 1 # always succeeds, btw
|
||||
|
||||
# Call user-defined postdown function if it exists
|
||||
if [[ $(type -t postdown) == function ]]; then
|
||||
einfo "Running postdown function"
|
||||
postdown ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
# vim:ts=4
|
||||
Executable
+24
@@ -0,0 +1,24 @@
|
||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
version 2.0 # conforms to second version of ipsec.conf specification
|
||||
|
||||
config setup
|
||||
plutodebug=control
|
||||
crlcheckinterval=180
|
||||
strictcrlpolicy=no
|
||||
nat_traversal=yes
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
|
||||
conn nat-t
|
||||
left=%defaultroute
|
||||
leftcert=bobCert.pem
|
||||
[email protected]
|
||||
leftfirewall=yes
|
||||
right=%any
|
||||
rightsubnetwithin=10.1.0.0/16
|
||||
auto=add
|
||||
@@ -0,0 +1,22 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDtTCCAp2gAwIBAgIBADANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
|
||||
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
|
||||
b290IENBMB4XDTA0MDkxMDExMDE0NVoXDTE0MDkwODExMDE0NVowRTELMAkGA1UE
|
||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0cm9u
|
||||
Z1N3YW4gUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL/y
|
||||
X2LqPVZuWLPIeknK86xhz6ljd3NNhC2z+P1uoCP3sBMuZiZQEjFzhnKcbXxCeo2f
|
||||
FnvhOOjrrisSuVkzuu82oxXD3fIkzuS7m9V4E10EZzgmKWIf+WuNRfbgAuUINmLc
|
||||
4YGAXBQLPyzpP4Ou48hhz/YQo58Bics6PHy5v34qCVROIXDvqhj91P8g+pS+F21/
|
||||
7P+CH2jRcVIEHZtG8M/PweTPQ95dPzpYd2Ov6SZ/U7EWmbMmT8VcUYn1aChxFmy5
|
||||
gweVBWlkH6MP+1DeE0/tL5c87xo5KCeGK8Tdqpe7sBRC4pPEEHDQciTUvkeuJ1Pr
|
||||
K+1LwdqRxo7HgMRiDw8CAwEAAaOBrzCBrDAPBgNVHRMBAf8EBTADAQH/MAsGA1Ud
|
||||
DwQEAwIBBjAdBgNVHQ4EFgQUXafdcAZRMn7ntm2zteXgYOouTe8wbQYDVR0jBGYw
|
||||
ZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJBgNVBAYTAkNIMRkwFwYD
|
||||
VQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJvbmdTd2FuIFJvb3Qg
|
||||
Q0GCAQAwDQYJKoZIhvcNAQEEBQADggEBAJrXTj5gWS37myHHhii9drYwkMFyDHS/
|
||||
lHU8rW/drcnHdus507+qUhNr9SiEAHg4Ywj895UDvT0a1sFaw44QyEa/94iKA8/n
|
||||
+g5kS1IrKvWu3wu8UI3EgzChgHV3cncQlQWbK+FI9Y3Ax1O1np1r+wLptoWpKKKE
|
||||
UxsYcxP9K4Nbyeon0AIHOajUheiL3t6aRc3m0o7VU7Do6S2r+He+1Zq/nRUfFeTy
|
||||
0Atebkn8tmUpPSKWaXkmwpVNrjZ1Qu9umAU+dtJyhzL2zmnyhPC4VqpsKCOp7imy
|
||||
gKZvUIKPm1zyf4T+yjwxwkiX2xVseoM3aKswb1EoZFelHwndU7u0GQ8=
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,25 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEHjCCAwagAwIBAgIBBjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
|
||||
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
|
||||
b290IENBMB4XDTA0MDkxMDExMjUzNFoXDTA5MDkwOTExMjUzNFowWDELMAkGA1UE
|
||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAPBgNVBAsTCFJlc2Vh
|
||||
cmNoMRswGQYDVQQDFBJib2JAc3Ryb25nc3dhbi5vcmcwggEiMA0GCSqGSIb3DQEB
|
||||
AQUAA4IBDwAwggEKAoIBAQDAJaejS3/lJfQHgw0nzvotgSQS8ey/6tvbx7s5RsWY
|
||||
27x9K5xd44aPrvP2Qpyq34IXRY6uPlIqeUTQN7EKpLrWCxMOT36x5N0Co9J5UWRB
|
||||
fJC141D+8+1RwJ9/baEIecpCvb0GfDOX0GXN5ltcJk82hZjE4y1yHC1FN7V3zdRg
|
||||
xmloupPuon+X3bTmyMQ93NKkg48CQGtqtfwQ0MqPiOWu8MBhdztfOyu6aW3EgviF
|
||||
ithLc02SeNzlpqB3M8GDfX+mr3OVDhhhC2OI+VRlZzz7KxJ13DUR2KkvLZR8Ak4E
|
||||
5lRjkUnTYd/f3OQYxfjC8idUmj5ojR6Fb0x1tsV/glzXAgMBAAGjggEEMIIBADAJ
|
||||
BgNVHRMEAjAAMAsGA1UdDwQEAwIDqDAdBgNVHQ4EFgQUaLN5EPOkOkVU3J1Ud0sl
|
||||
+27OOHswbQYDVR0jBGYwZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJ
|
||||
BgNVBAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJz
|
||||
dHJvbmdTd2FuIFJvb3QgQ0GCAQAwHQYDVR0RBBYwFIESYm9iQHN0cm9uZ3N3YW4u
|
||||
b3JnMDkGA1UdHwQyMDAwLqAsoCqGKGh0dHA6Ly9jcmwuc3Ryb25nc3dhbi5vcmcv
|
||||
c3Ryb25nc3dhbi5jcmwwDQYJKoZIhvcNAQEEBQADggEBAIyQLLxdeO8clplzRW9z
|
||||
TRR3J0zSedvi2XlIZ/XCsv0ZVfoBLLWcDp3QrxNiVZXvXXtzjPsDs+DAveZF9LGq
|
||||
0tIw1uT3JorbgNNrmWvxBvJoQTtSw4LQBuV7vF27jrposx3Hi5qtUXUDS6wVnDUI
|
||||
5iORqsrddnoDuMN+Jt7oRcvKfYSNwTV+m0ZAHdB5a/ARWO5UILOrxEA/N72NcDYN
|
||||
NdAd+bLaB38SbkSbh1xj/AGnrHxdJBF4h4mx4btc9gtBSh+dwBHOsn4TheqJ6bbw
|
||||
7FlXBowQDCJIswKNhWfnIepQlM1KEzmq5YX43uZO2b7amRaIKqy2vNE7+UNFYBpE
|
||||
Mto=
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,27 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEowIBAAKCAQEAwCWno0t/5SX0B4MNJ876LYEkEvHsv+rb28e7OUbFmNu8fSuc
|
||||
XeOGj67z9kKcqt+CF0WOrj5SKnlE0DexCqS61gsTDk9+seTdAqPSeVFkQXyQteNQ
|
||||
/vPtUcCff22hCHnKQr29Bnwzl9BlzeZbXCZPNoWYxOMtchwtRTe1d83UYMZpaLqT
|
||||
7qJ/l9205sjEPdzSpIOPAkBrarX8ENDKj4jlrvDAYXc7XzsrumltxIL4hYrYS3NN
|
||||
knjc5aagdzPBg31/pq9zlQ4YYQtjiPlUZWc8+ysSddw1EdipLy2UfAJOBOZUY5FJ
|
||||
02Hf39zkGMX4wvInVJo+aI0ehW9MdbbFf4Jc1wIDAQABAoIBAGbSP5jUiAYZfzKd
|
||||
4GZTDfFXz/QLXcN9bFV51ihaRNb9jyn0MmLTpGgzGP3Iu4l8vWKyqB154AI2jqpV
|
||||
gvnNGOX9Wx8nTwbnD5WgELs24M1iWRXcJLWp1m8PAsrv4WJlueRpIEPeJsWwkSnT
|
||||
gUQYg/8LEqsZXnJXvanym7sWe/Wkh8i/UyMQJv7zwS+TZ5qeKRfSVo8/9622Ppsh
|
||||
n+zKFKnTUhiICUHFed4qZWyVR6NVyuzIYjeQy+VmBa5AOzmF549Izg6llwNrvJ8g
|
||||
DiIKSdtblMrN5OlmTra8LGn2QmlETipRb+4qx+MasbVI8pM1VMMQtBGAJYjhpC51
|
||||
rX/RLLECgYEA/Qk9PlUfw2aTA7I6a93pcjhUFTnKFVe9RdrwY7mds5t7dOAPcRBj
|
||||
5wnIv+OhVszoEo/uOPrgWmBu3ifkmcpPTe4NREFEVA99NOadiJDI/7oAj/Is4c5t
|
||||
CEb/zHTqKtYMVDrjwhszuPD3m2KNIJ38y4gkkrWT071xQBciztWhvYUCgYEAwmXV
|
||||
DFoNagTrNhf7Ep5sUek0O3nXPXY/cYKnKhlloUP41ftLbNvZ02qBQ6zqxPHtjGlB
|
||||
5sPeRQMFbVbmyb+97oa3Mrui1TPiTa5IBPyD36Gg0nFx+xLeXTsy8O8leoFcq02D
|
||||
1SDSye+fEdj2uYr+f33CIknQHUR4/xkOikgSQasCgYEAzTjOHBzsGw25VLkbmtqr
|
||||
eIDo6SIqnS7BCsPsTeWAWuhSs9L5kyjI7dxIniEffIfJ/SwQ+NO4XHRz1ugiBv1H
|
||||
Xpwg1Gfe5BJ/6QTVZaqP6qBPzm+LKUTDt3/l/Uwhk8Zwz2vHx2lKhMei+rpuXbLl
|
||||
EaoEh5yPHZ87F9Dr4Tbw7AUCgYAjtFpmE2AlWdPtsofdypUwkjmStvUuh7ptWcbk
|
||||
N5fv/7EDdE1NKDAg4Y3uZSMVmy27PVXqUY1QdZaYl356DaqP1dRuEAJ/UDE/fUQj
|
||||
DlIWT/Re0pFRwQxwaUAY+oOStZHUsL8G9SliB43a1FO0jm/h8LIoZBBCX+ItUGfY
|
||||
RBZ+UwKBgCToB2oPwDfrfCkScNozV7GPfcmHTR5bvvpYgRMGyuE1hAwLIWW9V4u9
|
||||
1Bp1vCR/C4kiUSBpYsGXLRqJ1GURueQoEbREE4ZvkmNV+t40uX3Fd8/OchAGi934
|
||||
0jYmd3dvN4MtF7O02YwpBzuH/wAwdxK0iDbdv+KEZb7TLdL37IN1
|
||||
-----END RSA PRIVATE KEY-----
|
||||
@@ -0,0 +1,8 @@
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
|
||||
: RSA bobKey.pem
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
+314
@@ -0,0 +1,314 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Technologies, Inc.
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
#NB: Config is in /etc/conf.d/net
|
||||
|
||||
if [[ -n $NET_DEBUG ]]; then
|
||||
set -x
|
||||
devnull=/dev/stderr
|
||||
else
|
||||
devnull=/dev/null
|
||||
fi
|
||||
|
||||
# For pcmcia users. note that pcmcia must be added to the same
|
||||
# runlevel as the net.* script that needs it.
|
||||
depend() {
|
||||
use hotplug pcmcia
|
||||
}
|
||||
|
||||
checkconfig() {
|
||||
if [[ -z "${ifconfig_IFACE}" ]]; then
|
||||
eerror "Please make sure that /etc/conf.d/net has \$ifconfig_$IFACE set"
|
||||
eerror "(or \$iface_$IFACE for old-style configuration)"
|
||||
return 1
|
||||
fi
|
||||
if [[ -n "${vlans_IFACE}" && ! -x /sbin/vconfig ]]; then
|
||||
eerror "For VLAN (802.1q) support, emerge net-misc/vconfig"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Fix bug 50039 (init.d/net.eth0 localization)
|
||||
# Some other commands in this script might need to be wrapped, but
|
||||
# we'll get them one-by-one. Note that LC_ALL trumps LC_anything_else
|
||||
# according to locale(7)
|
||||
ifconfig() {
|
||||
LC_ALL=C /sbin/ifconfig "$@"
|
||||
}
|
||||
|
||||
# setup_vars: setup variables based on $1 and content of /etc/conf.d/net
|
||||
# The following variables are set, which should be declared local by
|
||||
# the calling routine.
|
||||
# status_IFACE (up or '')
|
||||
# vlans_IFACE (space-separated list)
|
||||
# ifconfig_IFACE (array of ifconfig lines, replaces iface_IFACE)
|
||||
# dhcpcd_IFACE (command-line args for dhcpcd)
|
||||
# routes_IFACE (array of route lines)
|
||||
# inet6_IFACE (array of inet6 lines)
|
||||
# ifconfig_fallback_IFACE (fallback ifconfig if dhcp fails)
|
||||
setup_vars() {
|
||||
local i iface="${1//\./_}"
|
||||
|
||||
status_IFACE="$(ifconfig ${1} 2>${devnull} | gawk '$1 == "UP" {print "up"}')"
|
||||
eval vlans_IFACE=\"\$\{iface_${iface}_vlans\}\"
|
||||
eval ifconfig_IFACE=( \"\$\{ifconfig_$iface\[@\]\}\" )
|
||||
eval dhcpcd_IFACE=\"\$\{dhcpcd_$iface\}\"
|
||||
eval routes_IFACE=( \"\$\{routes_$iface\[@\]\}\" )
|
||||
eval inet6_IFACE=( \"\$\{inet6_$iface\[@\]\}\" )
|
||||
eval ifconfig_fallback_IFACE=( \"\$\{ifconfig_fallback_$iface\[@\]\}\" )
|
||||
|
||||
# BACKWARD COMPATIBILITY: populate the ifconfig_IFACE array
|
||||
# if iface_IFACE is set (fex. iface_eth0 instead of ifconfig_eth0)
|
||||
eval local iface_IFACE=\"\$\{iface_$iface\}\"
|
||||
if [[ -n ${iface_IFACE} && -z ${ifconfig_IFACE} ]]; then
|
||||
# Make sure these get evaluated as arrays
|
||||
local -a aliases broadcasts netmasks
|
||||
|
||||
# Start with the primary interface
|
||||
ifconfig_IFACE=( "${iface_IFACE}" )
|
||||
|
||||
# ..then add aliases
|
||||
eval aliases=( \$\{alias_$iface\} )
|
||||
eval broadcasts=( \$\{broadcast_$iface\} )
|
||||
eval netmasks=( \$\{netmask_$iface\} )
|
||||
for ((i = 0; i < ${#aliases[@]}; i = i + 1)); do
|
||||
ifconfig_IFACE[i+1]="${aliases[i]} ${broadcasts[i]:+broadcast ${broadcasts[i]}} ${netmasks[i]:+netmask ${netmasks[i]}}"
|
||||
done
|
||||
fi
|
||||
|
||||
# BACKWARD COMPATIBILITY: check for space-separated inet6 addresses
|
||||
if [[ ${#inet6_IFACE[@]} == 1 && ${inet6_IFACE} == *' '* ]]; then
|
||||
inet6_IFACE=( ${inet6_IFACE} )
|
||||
fi
|
||||
}
|
||||
|
||||
iface_start() {
|
||||
local IFACE=${1} i x retval
|
||||
checkconfig || return 1
|
||||
|
||||
if [[ ${ifconfig_IFACE} != dhcp ]]; then
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Bringing ${IFACE} up (${i})"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up"
|
||||
fi
|
||||
# ifconfig does not always return failure ..
|
||||
ifconfig ${IFACE} ${ifconfig_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
# Check that eth0 was not brought up by the kernel ...
|
||||
if [[ ${status_IFACE} == up ]]; then
|
||||
einfo "Keeping kernel configuration for ${IFACE}"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up via DHCP"
|
||||
/sbin/dhcpcd ${dhcpcd_IFACE} ${IFACE}
|
||||
retval=$?
|
||||
eend $retval
|
||||
if [[ $retval == 0 ]]; then
|
||||
# DHCP succeeded, show address retrieved
|
||||
i=$(ifconfig ${IFACE} | grep -m1 -o 'inet addr:[^ ]*' |
|
||||
cut -d: -f2)
|
||||
[[ -n ${i} ]] && einfo " ${IFACE} received address ${i}"
|
||||
elif [[ -n "${ifconfig_fallback_IFACE}" ]]; then
|
||||
# DHCP failed, try fallback.
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_fallback_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Using fallback configuration (${i}) for ${IFACE}"
|
||||
else
|
||||
ebegin "Using fallback configuration for ${IFACE}"
|
||||
fi
|
||||
ifconfig ${IFACE} ${ifconfig_fallback_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
return $retval
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ ${#ifconfig_IFACE[@]} -gt 1 ]]; then
|
||||
einfo " Adding aliases"
|
||||
for ((i = 1; i < ${#ifconfig_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE}:${i} (${ifconfig_IFACE[i]%% *})"
|
||||
ifconfig ${IFACE}:${i} ${ifconfig_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
if [[ -n ${inet6_IFACE} ]]; then
|
||||
einfo " Adding inet6 addresses"
|
||||
for ((i = 0; i < ${#inet6_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE} inet6 add ${inet6_IFACE[i]}"
|
||||
ifconfig ${IFACE} inet6 add ${inet6_IFACE[i]} >${devnull}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set static routes
|
||||
if [[ -n ${routes_IFACE} ]]; then
|
||||
einfo " Adding routes"
|
||||
for ((i = 0; i < ${#routes_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${routes_IFACE[i]}"
|
||||
/sbin/route add ${routes_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set default route if applicable to this interface
|
||||
if [[ ${gateway} == ${IFACE}/* ]]; then
|
||||
local ogw=$(/bin/netstat -rn | awk '$1 == "0.0.0.0" {print $2}')
|
||||
local gw=${gateway#*/}
|
||||
if [[ ${ogw} != ${gw} ]]; then
|
||||
ebegin " Setting default gateway ($gw)"
|
||||
|
||||
# First delete any existing route if it was setup by kernel...
|
||||
/sbin/route del default dev ${IFACE} &>${devnull}
|
||||
|
||||
# Second delete old gateway if it was set...
|
||||
/sbin/route del default gw ${ogw} &>${devnull}
|
||||
|
||||
# Third add our new default gateway
|
||||
/sbin/route add default gw ${gw} >${devnull}
|
||||
eend $? || {
|
||||
true # need to have some command in here
|
||||
# Note: This originally called stop, which is obviously
|
||||
# wrong since it's calling with a local version of IFACE.
|
||||
# The below code works correctly to abort configuration of
|
||||
# the interface, but is commented because we're assuming
|
||||
# that default route failure should not cause the interface
|
||||
# to be unconfigured.
|
||||
#local error=$?
|
||||
#ewarn "Aborting configuration of ${IFACE}"
|
||||
#iface_stop ${IFACE}
|
||||
#return ${error}
|
||||
}
|
||||
fi
|
||||
fi
|
||||
|
||||
# Enabling rp_filter causes wacky packets to be auto-dropped by
|
||||
# the kernel. Note that we only do this if it is not set via
|
||||
# /etc/sysctl.conf ...
|
||||
if [[ -e /proc/sys/net/ipv4/conf/${IFACE}/rp_filter && \
|
||||
-z "$(grep -s '^[^#]*rp_filter' /etc/sysctl.conf)" ]]; then
|
||||
echo -n 1 > /proc/sys/net/ipv4/conf/${IFACE}/rp_filter
|
||||
fi
|
||||
}
|
||||
|
||||
# iface_stop: bring down an interface. Don't trust information in
|
||||
# /etc/conf.d/net since the configuration might have changed since
|
||||
# iface_start ran. Instead query for current configuration and bring
|
||||
# down the interface.
|
||||
iface_stop() {
|
||||
local IFACE=${1} i x aliases inet6 count
|
||||
|
||||
# Try to do a simple down (no aliases, no inet6, no dhcp)
|
||||
aliases="$(ifconfig | grep -o "^$IFACE:[0-9]*" | tac)"
|
||||
inet6="$(ifconfig ${IFACE} | awk '$1 == "inet6" {print $2}')"
|
||||
if [[ -z ${aliases} && -z ${inet6} && ! -e /var/run/dhcpcd-${IFACE}.pid ]]; then
|
||||
ebegin "Bringing ${IFACE} down"
|
||||
ifconfig ${IFACE} down &>/dev/null
|
||||
eend 0
|
||||
return 0
|
||||
fi
|
||||
|
||||
einfo "Bringing ${IFACE} down"
|
||||
|
||||
# Stop aliases before primary interface.
|
||||
# Note this must be done in reverse order, since ifconfig eth0:1
|
||||
# will remove eth0:2, etc. It might be sufficient to simply remove
|
||||
# the base interface but we're being safe here.
|
||||
for i in ${aliases} ${IFACE}; do
|
||||
|
||||
# Delete all the inet6 addresses for this interface
|
||||
inet6="$(ifconfig ${i} | awk '$1 == "inet6" {print $3}')"
|
||||
if [[ -n ${inet6} ]]; then
|
||||
einfo " Removing inet6 addresses"
|
||||
for x in ${inet6}; do
|
||||
ebegin " ${IFACE} inet6 del ${x}"
|
||||
ifconfig ${i} inet6 del ${x}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Stop DHCP (should be N/A for aliases)
|
||||
# Don't trust current configuration... investigate ourselves
|
||||
if /sbin/dhcpcd -z ${i} &>${devnull}; then
|
||||
ebegin " Releasing DHCP lease for ${IFACE}"
|
||||
for ((count = 0; count < 9; count = count + 1)); do
|
||||
/sbin/dhcpcd -z ${i} &>${devnull} || break
|
||||
sleep 1
|
||||
done
|
||||
[[ ${count} -lt 9 ]]
|
||||
eend $? "Timed out"
|
||||
fi
|
||||
ebegin " Stopping ${i}"
|
||||
ifconfig ${i} down &>${devnull}
|
||||
eend 0
|
||||
done
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
start() {
|
||||
# These variables are set by setup_vars
|
||||
local status_IFACE vlans_IFACE dhcpcd_IFACE
|
||||
local -a ifconfig_IFACE routes_IFACE inet6_IFACE
|
||||
|
||||
# Call user-defined preup function if it exists
|
||||
if [[ $(type -t preup) == function ]]; then
|
||||
einfo "Running preup function"
|
||||
preup ${IFACE} || {
|
||||
eerror "preup ${IFACE} failed"
|
||||
return 1
|
||||
}
|
||||
fi
|
||||
|
||||
# Start the primary interface and aliases
|
||||
setup_vars ${IFACE}
|
||||
iface_start ${IFACE} || return 1
|
||||
|
||||
# Start vlans
|
||||
local vlan
|
||||
for vlan in ${vlans_IFACE}; do
|
||||
/sbin/vconfig add ${IFACE} ${vlan} >${devnull}
|
||||
setup_vars ${IFACE}.${vlan}
|
||||
iface_start ${IFACE}.${vlan}
|
||||
done
|
||||
|
||||
# Call user-defined postup function if it exists
|
||||
if [[ $(type -t postup) == function ]]; then
|
||||
einfo "Running postup function"
|
||||
postup ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
stop() {
|
||||
# Call user-defined predown function if it exists
|
||||
if [[ $(type -t predown) == function ]]; then
|
||||
einfo "Running predown function"
|
||||
predown ${IFACE}
|
||||
fi
|
||||
|
||||
# Don't depend on setup_vars since configuration might have changed.
|
||||
# Investigate current configuration instead.
|
||||
local vlan
|
||||
for vlan in $(ifconfig | grep -o "^${IFACE}\.[^ ]*"); do
|
||||
iface_stop ${vlan}
|
||||
/sbin/vconfig rem ${vlan} >${devnull}
|
||||
done
|
||||
|
||||
iface_stop ${IFACE} || return 1 # always succeeds, btw
|
||||
|
||||
# Call user-defined postdown function if it exists
|
||||
if [[ $(type -t postdown) == function ]]; then
|
||||
einfo "Running postdown function"
|
||||
postdown ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
# vim:ts=4
|
||||
@@ -0,0 +1 @@
|
||||
HOSTNAME=carol
|
||||
@@ -0,0 +1,10 @@
|
||||
# /etc/conf.d/net:
|
||||
|
||||
# This is basically the ifconfig argument without the ifconfig $iface
|
||||
#
|
||||
iface_lo="127.0.0.1 netmask 255.0.0.0"
|
||||
iface_eth0="PH_IP_CAROL broadcast 192.168.0.255 netmask 255.255.255.0"
|
||||
|
||||
# For setting the default gateway
|
||||
#
|
||||
gateway="eth0/192.168.0.254"
|
||||
Executable
+73
@@ -0,0 +1,73 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Foundation
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
opts="start stop reload"
|
||||
|
||||
depend() {
|
||||
before net
|
||||
need logger
|
||||
}
|
||||
|
||||
start() {
|
||||
ebegin "Starting firewall"
|
||||
|
||||
# default policy is DROP
|
||||
/sbin/iptables -P INPUT DROP
|
||||
/sbin/iptables -P OUTPUT DROP
|
||||
/sbin/iptables -P FORWARD DROP
|
||||
|
||||
# allow esp
|
||||
iptables -A INPUT -i eth0 -p 50 -j ACCEPT
|
||||
iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
|
||||
|
||||
# allow IKE
|
||||
iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
|
||||
iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
|
||||
|
||||
# allow crl fetch from winnetou
|
||||
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
|
||||
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
|
||||
|
||||
# allow ssh
|
||||
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
|
||||
|
||||
eend $?
|
||||
}
|
||||
|
||||
stop() {
|
||||
ebegin "Stopping firewall"
|
||||
for a in `cat /proc/net/ip_tables_names`; do
|
||||
/sbin/iptables -F -t $a
|
||||
/sbin/iptables -X -t $a
|
||||
|
||||
if [ $a == nat ]; then
|
||||
/sbin/iptables -t nat -P PREROUTING ACCEPT
|
||||
/sbin/iptables -t nat -P POSTROUTING ACCEPT
|
||||
/sbin/iptables -t nat -P OUTPUT ACCEPT
|
||||
elif [ $a == mangle ]; then
|
||||
/sbin/iptables -t mangle -P PREROUTING ACCEPT
|
||||
/sbin/iptables -t mangle -P INPUT ACCEPT
|
||||
/sbin/iptables -t mangle -P FORWARD ACCEPT
|
||||
/sbin/iptables -t mangle -P OUTPUT ACCEPT
|
||||
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
|
||||
elif [ $a == filter ]; then
|
||||
/sbin/iptables -t filter -P INPUT ACCEPT
|
||||
/sbin/iptables -t filter -P FORWARD ACCEPT
|
||||
/sbin/iptables -t filter -P OUTPUT ACCEPT
|
||||
fi
|
||||
done
|
||||
eend $?
|
||||
}
|
||||
|
||||
reload() {
|
||||
ebegin "Flushing firewall"
|
||||
for a in `cat /proc/net/ip_tables_names`; do
|
||||
/sbin/iptables -F -t $a
|
||||
/sbin/iptables -X -t $a
|
||||
done;
|
||||
eend $?
|
||||
start
|
||||
}
|
||||
|
||||
Executable
+314
@@ -0,0 +1,314 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Technologies, Inc.
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
#NB: Config is in /etc/conf.d/net
|
||||
|
||||
if [[ -n $NET_DEBUG ]]; then
|
||||
set -x
|
||||
devnull=/dev/stderr
|
||||
else
|
||||
devnull=/dev/null
|
||||
fi
|
||||
|
||||
# For pcmcia users. note that pcmcia must be added to the same
|
||||
# runlevel as the net.* script that needs it.
|
||||
depend() {
|
||||
use hotplug pcmcia
|
||||
}
|
||||
|
||||
checkconfig() {
|
||||
if [[ -z "${ifconfig_IFACE}" ]]; then
|
||||
eerror "Please make sure that /etc/conf.d/net has \$ifconfig_$IFACE set"
|
||||
eerror "(or \$iface_$IFACE for old-style configuration)"
|
||||
return 1
|
||||
fi
|
||||
if [[ -n "${vlans_IFACE}" && ! -x /sbin/vconfig ]]; then
|
||||
eerror "For VLAN (802.1q) support, emerge net-misc/vconfig"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Fix bug 50039 (init.d/net.eth0 localization)
|
||||
# Some other commands in this script might need to be wrapped, but
|
||||
# we'll get them one-by-one. Note that LC_ALL trumps LC_anything_else
|
||||
# according to locale(7)
|
||||
ifconfig() {
|
||||
LC_ALL=C /sbin/ifconfig "$@"
|
||||
}
|
||||
|
||||
# setup_vars: setup variables based on $1 and content of /etc/conf.d/net
|
||||
# The following variables are set, which should be declared local by
|
||||
# the calling routine.
|
||||
# status_IFACE (up or '')
|
||||
# vlans_IFACE (space-separated list)
|
||||
# ifconfig_IFACE (array of ifconfig lines, replaces iface_IFACE)
|
||||
# dhcpcd_IFACE (command-line args for dhcpcd)
|
||||
# routes_IFACE (array of route lines)
|
||||
# inet6_IFACE (array of inet6 lines)
|
||||
# ifconfig_fallback_IFACE (fallback ifconfig if dhcp fails)
|
||||
setup_vars() {
|
||||
local i iface="${1//\./_}"
|
||||
|
||||
status_IFACE="$(ifconfig ${1} 2>${devnull} | gawk '$1 == "UP" {print "up"}')"
|
||||
eval vlans_IFACE=\"\$\{iface_${iface}_vlans\}\"
|
||||
eval ifconfig_IFACE=( \"\$\{ifconfig_$iface\[@\]\}\" )
|
||||
eval dhcpcd_IFACE=\"\$\{dhcpcd_$iface\}\"
|
||||
eval routes_IFACE=( \"\$\{routes_$iface\[@\]\}\" )
|
||||
eval inet6_IFACE=( \"\$\{inet6_$iface\[@\]\}\" )
|
||||
eval ifconfig_fallback_IFACE=( \"\$\{ifconfig_fallback_$iface\[@\]\}\" )
|
||||
|
||||
# BACKWARD COMPATIBILITY: populate the ifconfig_IFACE array
|
||||
# if iface_IFACE is set (fex. iface_eth0 instead of ifconfig_eth0)
|
||||
eval local iface_IFACE=\"\$\{iface_$iface\}\"
|
||||
if [[ -n ${iface_IFACE} && -z ${ifconfig_IFACE} ]]; then
|
||||
# Make sure these get evaluated as arrays
|
||||
local -a aliases broadcasts netmasks
|
||||
|
||||
# Start with the primary interface
|
||||
ifconfig_IFACE=( "${iface_IFACE}" )
|
||||
|
||||
# ..then add aliases
|
||||
eval aliases=( \$\{alias_$iface\} )
|
||||
eval broadcasts=( \$\{broadcast_$iface\} )
|
||||
eval netmasks=( \$\{netmask_$iface\} )
|
||||
for ((i = 0; i < ${#aliases[@]}; i = i + 1)); do
|
||||
ifconfig_IFACE[i+1]="${aliases[i]} ${broadcasts[i]:+broadcast ${broadcasts[i]}} ${netmasks[i]:+netmask ${netmasks[i]}}"
|
||||
done
|
||||
fi
|
||||
|
||||
# BACKWARD COMPATIBILITY: check for space-separated inet6 addresses
|
||||
if [[ ${#inet6_IFACE[@]} == 1 && ${inet6_IFACE} == *' '* ]]; then
|
||||
inet6_IFACE=( ${inet6_IFACE} )
|
||||
fi
|
||||
}
|
||||
|
||||
iface_start() {
|
||||
local IFACE=${1} i x retval
|
||||
checkconfig || return 1
|
||||
|
||||
if [[ ${ifconfig_IFACE} != dhcp ]]; then
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Bringing ${IFACE} up (${i})"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up"
|
||||
fi
|
||||
# ifconfig does not always return failure ..
|
||||
ifconfig ${IFACE} ${ifconfig_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
# Check that eth0 was not brought up by the kernel ...
|
||||
if [[ ${status_IFACE} == up ]]; then
|
||||
einfo "Keeping kernel configuration for ${IFACE}"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up via DHCP"
|
||||
/sbin/dhcpcd ${dhcpcd_IFACE} ${IFACE}
|
||||
retval=$?
|
||||
eend $retval
|
||||
if [[ $retval == 0 ]]; then
|
||||
# DHCP succeeded, show address retrieved
|
||||
i=$(ifconfig ${IFACE} | grep -m1 -o 'inet addr:[^ ]*' |
|
||||
cut -d: -f2)
|
||||
[[ -n ${i} ]] && einfo " ${IFACE} received address ${i}"
|
||||
elif [[ -n "${ifconfig_fallback_IFACE}" ]]; then
|
||||
# DHCP failed, try fallback.
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_fallback_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Using fallback configuration (${i}) for ${IFACE}"
|
||||
else
|
||||
ebegin "Using fallback configuration for ${IFACE}"
|
||||
fi
|
||||
ifconfig ${IFACE} ${ifconfig_fallback_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
return $retval
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ ${#ifconfig_IFACE[@]} -gt 1 ]]; then
|
||||
einfo " Adding aliases"
|
||||
for ((i = 1; i < ${#ifconfig_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE}:${i} (${ifconfig_IFACE[i]%% *})"
|
||||
ifconfig ${IFACE}:${i} ${ifconfig_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
if [[ -n ${inet6_IFACE} ]]; then
|
||||
einfo " Adding inet6 addresses"
|
||||
for ((i = 0; i < ${#inet6_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE} inet6 add ${inet6_IFACE[i]}"
|
||||
ifconfig ${IFACE} inet6 add ${inet6_IFACE[i]} >${devnull}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set static routes
|
||||
if [[ -n ${routes_IFACE} ]]; then
|
||||
einfo " Adding routes"
|
||||
for ((i = 0; i < ${#routes_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${routes_IFACE[i]}"
|
||||
/sbin/route add ${routes_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set default route if applicable to this interface
|
||||
if [[ ${gateway} == ${IFACE}/* ]]; then
|
||||
local ogw=$(/bin/netstat -rn | awk '$1 == "0.0.0.0" {print $2}')
|
||||
local gw=${gateway#*/}
|
||||
if [[ ${ogw} != ${gw} ]]; then
|
||||
ebegin " Setting default gateway ($gw)"
|
||||
|
||||
# First delete any existing route if it was setup by kernel...
|
||||
/sbin/route del default dev ${IFACE} &>${devnull}
|
||||
|
||||
# Second delete old gateway if it was set...
|
||||
/sbin/route del default gw ${ogw} &>${devnull}
|
||||
|
||||
# Third add our new default gateway
|
||||
/sbin/route add default gw ${gw} >${devnull}
|
||||
eend $? || {
|
||||
true # need to have some command in here
|
||||
# Note: This originally called stop, which is obviously
|
||||
# wrong since it's calling with a local version of IFACE.
|
||||
# The below code works correctly to abort configuration of
|
||||
# the interface, but is commented because we're assuming
|
||||
# that default route failure should not cause the interface
|
||||
# to be unconfigured.
|
||||
#local error=$?
|
||||
#ewarn "Aborting configuration of ${IFACE}"
|
||||
#iface_stop ${IFACE}
|
||||
#return ${error}
|
||||
}
|
||||
fi
|
||||
fi
|
||||
|
||||
# Enabling rp_filter causes wacky packets to be auto-dropped by
|
||||
# the kernel. Note that we only do this if it is not set via
|
||||
# /etc/sysctl.conf ...
|
||||
if [[ -e /proc/sys/net/ipv4/conf/${IFACE}/rp_filter && \
|
||||
-z "$(grep -s '^[^#]*rp_filter' /etc/sysctl.conf)" ]]; then
|
||||
echo -n 1 > /proc/sys/net/ipv4/conf/${IFACE}/rp_filter
|
||||
fi
|
||||
}
|
||||
|
||||
# iface_stop: bring down an interface. Don't trust information in
|
||||
# /etc/conf.d/net since the configuration might have changed since
|
||||
# iface_start ran. Instead query for current configuration and bring
|
||||
# down the interface.
|
||||
iface_stop() {
|
||||
local IFACE=${1} i x aliases inet6 count
|
||||
|
||||
# Try to do a simple down (no aliases, no inet6, no dhcp)
|
||||
aliases="$(ifconfig | grep -o "^$IFACE:[0-9]*" | tac)"
|
||||
inet6="$(ifconfig ${IFACE} | awk '$1 == "inet6" {print $2}')"
|
||||
if [[ -z ${aliases} && -z ${inet6} && ! -e /var/run/dhcpcd-${IFACE}.pid ]]; then
|
||||
ebegin "Bringing ${IFACE} down"
|
||||
ifconfig ${IFACE} down &>/dev/null
|
||||
eend 0
|
||||
return 0
|
||||
fi
|
||||
|
||||
einfo "Bringing ${IFACE} down"
|
||||
|
||||
# Stop aliases before primary interface.
|
||||
# Note this must be done in reverse order, since ifconfig eth0:1
|
||||
# will remove eth0:2, etc. It might be sufficient to simply remove
|
||||
# the base interface but we're being safe here.
|
||||
for i in ${aliases} ${IFACE}; do
|
||||
|
||||
# Delete all the inet6 addresses for this interface
|
||||
inet6="$(ifconfig ${i} | awk '$1 == "inet6" {print $3}')"
|
||||
if [[ -n ${inet6} ]]; then
|
||||
einfo " Removing inet6 addresses"
|
||||
for x in ${inet6}; do
|
||||
ebegin " ${IFACE} inet6 del ${x}"
|
||||
ifconfig ${i} inet6 del ${x}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Stop DHCP (should be N/A for aliases)
|
||||
# Don't trust current configuration... investigate ourselves
|
||||
if /sbin/dhcpcd -z ${i} &>${devnull}; then
|
||||
ebegin " Releasing DHCP lease for ${IFACE}"
|
||||
for ((count = 0; count < 9; count = count + 1)); do
|
||||
/sbin/dhcpcd -z ${i} &>${devnull} || break
|
||||
sleep 1
|
||||
done
|
||||
[[ ${count} -lt 9 ]]
|
||||
eend $? "Timed out"
|
||||
fi
|
||||
ebegin " Stopping ${i}"
|
||||
ifconfig ${i} down &>${devnull}
|
||||
eend 0
|
||||
done
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
start() {
|
||||
# These variables are set by setup_vars
|
||||
local status_IFACE vlans_IFACE dhcpcd_IFACE
|
||||
local -a ifconfig_IFACE routes_IFACE inet6_IFACE
|
||||
|
||||
# Call user-defined preup function if it exists
|
||||
if [[ $(type -t preup) == function ]]; then
|
||||
einfo "Running preup function"
|
||||
preup ${IFACE} || {
|
||||
eerror "preup ${IFACE} failed"
|
||||
return 1
|
||||
}
|
||||
fi
|
||||
|
||||
# Start the primary interface and aliases
|
||||
setup_vars ${IFACE}
|
||||
iface_start ${IFACE} || return 1
|
||||
|
||||
# Start vlans
|
||||
local vlan
|
||||
for vlan in ${vlans_IFACE}; do
|
||||
/sbin/vconfig add ${IFACE} ${vlan} >${devnull}
|
||||
setup_vars ${IFACE}.${vlan}
|
||||
iface_start ${IFACE}.${vlan}
|
||||
done
|
||||
|
||||
# Call user-defined postup function if it exists
|
||||
if [[ $(type -t postup) == function ]]; then
|
||||
einfo "Running postup function"
|
||||
postup ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
stop() {
|
||||
# Call user-defined predown function if it exists
|
||||
if [[ $(type -t predown) == function ]]; then
|
||||
einfo "Running predown function"
|
||||
predown ${IFACE}
|
||||
fi
|
||||
|
||||
# Don't depend on setup_vars since configuration might have changed.
|
||||
# Investigate current configuration instead.
|
||||
local vlan
|
||||
for vlan in $(ifconfig | grep -o "^${IFACE}\.[^ ]*"); do
|
||||
iface_stop ${vlan}
|
||||
/sbin/vconfig rem ${vlan} >${devnull}
|
||||
done
|
||||
|
||||
iface_stop ${IFACE} || return 1 # always succeeds, btw
|
||||
|
||||
# Call user-defined postdown function if it exists
|
||||
if [[ $(type -t postdown) == function ]]; then
|
||||
einfo "Running postdown function"
|
||||
postdown ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
# vim:ts=4
|
||||
Executable
+29
@@ -0,0 +1,29 @@
|
||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
version 2.0 # conforms to second version of ipsec.conf specification
|
||||
|
||||
config setup
|
||||
plutodebug=control
|
||||
crlcheckinterval=180
|
||||
strictcrlpolicy=no
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
|
||||
conn home
|
||||
left=PH_IP_CAROL
|
||||
leftnexthop=%direct
|
||||
leftcert=carolCert.pem
|
||||
[email protected]
|
||||
leftfirewall=yes
|
||||
right=PH_IP_MOON
|
||||
rightsubnet=10.1.0.0/16
|
||||
[email protected]
|
||||
auto=add
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,22 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDtTCCAp2gAwIBAgIBADANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
|
||||
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
|
||||
b290IENBMB4XDTA0MDkxMDExMDE0NVoXDTE0MDkwODExMDE0NVowRTELMAkGA1UE
|
||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0cm9u
|
||||
Z1N3YW4gUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL/y
|
||||
X2LqPVZuWLPIeknK86xhz6ljd3NNhC2z+P1uoCP3sBMuZiZQEjFzhnKcbXxCeo2f
|
||||
FnvhOOjrrisSuVkzuu82oxXD3fIkzuS7m9V4E10EZzgmKWIf+WuNRfbgAuUINmLc
|
||||
4YGAXBQLPyzpP4Ou48hhz/YQo58Bics6PHy5v34qCVROIXDvqhj91P8g+pS+F21/
|
||||
7P+CH2jRcVIEHZtG8M/PweTPQ95dPzpYd2Ov6SZ/U7EWmbMmT8VcUYn1aChxFmy5
|
||||
gweVBWlkH6MP+1DeE0/tL5c87xo5KCeGK8Tdqpe7sBRC4pPEEHDQciTUvkeuJ1Pr
|
||||
K+1LwdqRxo7HgMRiDw8CAwEAAaOBrzCBrDAPBgNVHRMBAf8EBTADAQH/MAsGA1Ud
|
||||
DwQEAwIBBjAdBgNVHQ4EFgQUXafdcAZRMn7ntm2zteXgYOouTe8wbQYDVR0jBGYw
|
||||
ZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJBgNVBAYTAkNIMRkwFwYD
|
||||
VQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJvbmdTd2FuIFJvb3Qg
|
||||
Q0GCAQAwDQYJKoZIhvcNAQEEBQADggEBAJrXTj5gWS37myHHhii9drYwkMFyDHS/
|
||||
lHU8rW/drcnHdus507+qUhNr9SiEAHg4Ywj895UDvT0a1sFaw44QyEa/94iKA8/n
|
||||
+g5kS1IrKvWu3wu8UI3EgzChgHV3cncQlQWbK+FI9Y3Ax1O1np1r+wLptoWpKKKE
|
||||
UxsYcxP9K4Nbyeon0AIHOajUheiL3t6aRc3m0o7VU7Do6S2r+He+1Zq/nRUfFeTy
|
||||
0Atebkn8tmUpPSKWaXkmwpVNrjZ1Qu9umAU+dtJyhzL2zmnyhPC4VqpsKCOp7imy
|
||||
gKZvUIKPm1zyf4T+yjwxwkiX2xVseoM3aKswb1EoZFelHwndU7u0GQ8=
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,25 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEIjCCAwqgAwIBAgIBCjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
|
||||
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
|
||||
b290IENBMB4XDTA1MDEwMTIxNDMxOFoXDTA5MTIzMTIxNDMxOFowWjELMAkGA1UE
|
||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAPBgNVBAsTCFJlc2Vh
|
||||
cmNoMR0wGwYDVQQDFBRjYXJvbEBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcN
|
||||
AQEBBQADggEPADCCAQoCggEBALgbhJIECOCGyNJ4060un/wBuJ6MQjthK5CAEPgX
|
||||
T/lvZynoSxhfuW5geDCCxQes6dZPeb6wJS4F5fH3qJoLM+Z4n13rZlCEyyMBkcFl
|
||||
vK0aNFY+ARs0m7arUX8B7Pfi9N6WHTYgO4XpeBHLJrZQz9AU0V3S0rce/WVuVjii
|
||||
S/cJhrgSi7rl87Qo1jYOA9P06BZQLj0dFNcWWrGpKp/hXvBF1OSP9b15jsgMlCCW
|
||||
LJqXmLVKDtKgDPLJZR19mILhgcHvaxxD7craL9GR4QmWLb0m84oAIIwaw+0npZJM
|
||||
YDMMeYeOtcepCWCmRy+XmsqcWu4rtNCu05W1RsXjYZEKBjcCAwEAAaOCAQYwggEC
|
||||
MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBRVNeym66J5uu+IfxhD
|
||||
j9InsWdG0TBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTEL
|
||||
MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMT
|
||||
EnN0cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRjYXJvbEBzdHJvbmdz
|
||||
d2FuLm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4u
|
||||
b3JnL3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQCxMEp+Zdclc0aI
|
||||
U+jO3TmL81gcwea0BUucjZfDyvCSkDXcXidOez+l/vUueGC7Bqq1ukDF8cpVgGtM
|
||||
2HPxM97ZSLPInMgWIeLq3uX8iTtIo05EYqRasJxBIAkY9o6ja6v6z0CZqjSbi2WE
|
||||
HrHkFrkOTrRi7deGzbAAhWVjOnAfzSxBaujkdUxb6jGBc2F5qpAeVSbE+sAxzmSd
|
||||
hRyF3tUUwl4yabBzmoedJzlQ4anqg0G14QScBxgXkq032gKuzNVVxWRp6OFannKG
|
||||
C1INvsBWYtN62wjXlXXhM/M4sBFhmPpftVb+Amgr1jSspTX2dQsNqhI/WtNvLmfK
|
||||
omBYfxqp
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,27 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEowIBAAKCAQEAuBuEkgQI4IbI0njTrS6f/AG4noxCO2ErkIAQ+BdP+W9nKehL
|
||||
GF+5bmB4MILFB6zp1k95vrAlLgXl8feomgsz5nifXetmUITLIwGRwWW8rRo0Vj4B
|
||||
GzSbtqtRfwHs9+L03pYdNiA7hel4EcsmtlDP0BTRXdLStx79ZW5WOKJL9wmGuBKL
|
||||
uuXztCjWNg4D0/ToFlAuPR0U1xZasakqn+Fe8EXU5I/1vXmOyAyUIJYsmpeYtUoO
|
||||
0qAM8sllHX2YguGBwe9rHEPtytov0ZHhCZYtvSbzigAgjBrD7SelkkxgMwx5h461
|
||||
x6kJYKZHL5eaypxa7iu00K7TlbVGxeNhkQoGNwIDAQABAoIBAQCnhwq8H4XAYYWN
|
||||
17quJPYZR6uqQfDmvYX5yD8osXXpgNC8Fo92z2wZnxje86+8S0DA7bLXrMs4NM/H
|
||||
vVcjTTxd5LcHrHN+o0eBRCVQeXYVgfnL3EH/coCa2Qugaa0q589wV+Ke5Pek5AyJ
|
||||
DHXegmyHaNoW6Qcq8L0dtigpAq3jTLG5w/3QCo8DMDKOGNR3AJrFpDlS/gW3JXuL
|
||||
Tn+PUojoWO9W6joDGYDTi4eeYyfZSajzwZvzecEpez3vwKN0pupvHA6BJCR8Mzkq
|
||||
5EYIH0hvWLtBy8uiWRXTfu/ggoQI9/Z5hBWIQk71m23uMIBbkm+oDn/1fLSBcWfK
|
||||
cr9RyM+RAoGBANpWewy7xCbkRV/90bgBNkTZ9HeFsFsWOgFVyB1XwM2E/nOqdRJc
|
||||
rxFt5Qt63DaXB+2REn231EIrsIz/Xd+R9KDl+yZOCY/m/mL4oquTPurEGJPzZdgW
|
||||
X3kUOFW1pbfcMcmzSp1FPufI17JPiePtUb/q3C4RAjCKlnskHftEyK1pAoGBANfd
|
||||
eEN8UzoV/R3WsGNDNOecMdIVAX9aiGnkLLraP7CRZ1heCH5y+RV1RB98yppkJG31
|
||||
fw5F8a6GoomkMHWGqhzDzQacZQV8w7C6rDY0Bk5TF5vemvJTGlrydwodfMvcJj8Y
|
||||
KZrS7A0iS3GAAmM6VGr3THyscszfJTq0NwE3v4KfAoGAY7L1wVzENxYpb6nRZ/p1
|
||||
s37rGODdJNrDZfSrympVygMexeZiSx4zevv5iQJzKCJTJnIGRY35yLV2iwvY68wU
|
||||
LpyV0Gn2B9Xs93idn0c/hahBqN2N9dxRgFJxXwHxSEGuInJScfo6vVCC3hNf3cpy
|
||||
d/Zg0FBH9a5zBIv7fM9t63ECgYAosrSt5I68cNDcA1IWJOGgmS47cYJqxGLbtA1K
|
||||
3UMMwx08592qGXsktIs3dIuuOBs2MAbYZg9+3Btg3/fS8KS576CEEpBpTHCIrWky
|
||||
fvSBZ+EXngyQi2J4qyYOXijdNpBvbNrLOeEPSNv4di39D05DLITbLJgoUBnwy3Fj
|
||||
ZWNR+QKBgEKn19f5QWs/O1DPWBXfvCSc01cuSUx20a6Z3B6Lxj+7MuXBjVxPkGge
|
||||
kEaZnNzwgm+QQ1C51nIn9gY4LZx7OxMy0idEss76aRq4Lb7I6XakBrCQLQ9IiTkv
|
||||
gNOeJYGsQv7tkIWWRlBIXjSBGwT6HzTEfN5cvdHSDzARGFGjwYfK
|
||||
-----END RSA PRIVATE KEY-----
|
||||
@@ -0,0 +1,7 @@
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
|
||||
: RSA carolKey.pem
|
||||
|
||||
|
||||
|
||||
|
||||
+314
@@ -0,0 +1,314 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Technologies, Inc.
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
#NB: Config is in /etc/conf.d/net
|
||||
|
||||
if [[ -n $NET_DEBUG ]]; then
|
||||
set -x
|
||||
devnull=/dev/stderr
|
||||
else
|
||||
devnull=/dev/null
|
||||
fi
|
||||
|
||||
# For pcmcia users. note that pcmcia must be added to the same
|
||||
# runlevel as the net.* script that needs it.
|
||||
depend() {
|
||||
use hotplug pcmcia
|
||||
}
|
||||
|
||||
checkconfig() {
|
||||
if [[ -z "${ifconfig_IFACE}" ]]; then
|
||||
eerror "Please make sure that /etc/conf.d/net has \$ifconfig_$IFACE set"
|
||||
eerror "(or \$iface_$IFACE for old-style configuration)"
|
||||
return 1
|
||||
fi
|
||||
if [[ -n "${vlans_IFACE}" && ! -x /sbin/vconfig ]]; then
|
||||
eerror "For VLAN (802.1q) support, emerge net-misc/vconfig"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Fix bug 50039 (init.d/net.eth0 localization)
|
||||
# Some other commands in this script might need to be wrapped, but
|
||||
# we'll get them one-by-one. Note that LC_ALL trumps LC_anything_else
|
||||
# according to locale(7)
|
||||
ifconfig() {
|
||||
LC_ALL=C /sbin/ifconfig "$@"
|
||||
}
|
||||
|
||||
# setup_vars: setup variables based on $1 and content of /etc/conf.d/net
|
||||
# The following variables are set, which should be declared local by
|
||||
# the calling routine.
|
||||
# status_IFACE (up or '')
|
||||
# vlans_IFACE (space-separated list)
|
||||
# ifconfig_IFACE (array of ifconfig lines, replaces iface_IFACE)
|
||||
# dhcpcd_IFACE (command-line args for dhcpcd)
|
||||
# routes_IFACE (array of route lines)
|
||||
# inet6_IFACE (array of inet6 lines)
|
||||
# ifconfig_fallback_IFACE (fallback ifconfig if dhcp fails)
|
||||
setup_vars() {
|
||||
local i iface="${1//\./_}"
|
||||
|
||||
status_IFACE="$(ifconfig ${1} 2>${devnull} | gawk '$1 == "UP" {print "up"}')"
|
||||
eval vlans_IFACE=\"\$\{iface_${iface}_vlans\}\"
|
||||
eval ifconfig_IFACE=( \"\$\{ifconfig_$iface\[@\]\}\" )
|
||||
eval dhcpcd_IFACE=\"\$\{dhcpcd_$iface\}\"
|
||||
eval routes_IFACE=( \"\$\{routes_$iface\[@\]\}\" )
|
||||
eval inet6_IFACE=( \"\$\{inet6_$iface\[@\]\}\" )
|
||||
eval ifconfig_fallback_IFACE=( \"\$\{ifconfig_fallback_$iface\[@\]\}\" )
|
||||
|
||||
# BACKWARD COMPATIBILITY: populate the ifconfig_IFACE array
|
||||
# if iface_IFACE is set (fex. iface_eth0 instead of ifconfig_eth0)
|
||||
eval local iface_IFACE=\"\$\{iface_$iface\}\"
|
||||
if [[ -n ${iface_IFACE} && -z ${ifconfig_IFACE} ]]; then
|
||||
# Make sure these get evaluated as arrays
|
||||
local -a aliases broadcasts netmasks
|
||||
|
||||
# Start with the primary interface
|
||||
ifconfig_IFACE=( "${iface_IFACE}" )
|
||||
|
||||
# ..then add aliases
|
||||
eval aliases=( \$\{alias_$iface\} )
|
||||
eval broadcasts=( \$\{broadcast_$iface\} )
|
||||
eval netmasks=( \$\{netmask_$iface\} )
|
||||
for ((i = 0; i < ${#aliases[@]}; i = i + 1)); do
|
||||
ifconfig_IFACE[i+1]="${aliases[i]} ${broadcasts[i]:+broadcast ${broadcasts[i]}} ${netmasks[i]:+netmask ${netmasks[i]}}"
|
||||
done
|
||||
fi
|
||||
|
||||
# BACKWARD COMPATIBILITY: check for space-separated inet6 addresses
|
||||
if [[ ${#inet6_IFACE[@]} == 1 && ${inet6_IFACE} == *' '* ]]; then
|
||||
inet6_IFACE=( ${inet6_IFACE} )
|
||||
fi
|
||||
}
|
||||
|
||||
iface_start() {
|
||||
local IFACE=${1} i x retval
|
||||
checkconfig || return 1
|
||||
|
||||
if [[ ${ifconfig_IFACE} != dhcp ]]; then
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Bringing ${IFACE} up (${i})"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up"
|
||||
fi
|
||||
# ifconfig does not always return failure ..
|
||||
ifconfig ${IFACE} ${ifconfig_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
# Check that eth0 was not brought up by the kernel ...
|
||||
if [[ ${status_IFACE} == up ]]; then
|
||||
einfo "Keeping kernel configuration for ${IFACE}"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up via DHCP"
|
||||
/sbin/dhcpcd ${dhcpcd_IFACE} ${IFACE}
|
||||
retval=$?
|
||||
eend $retval
|
||||
if [[ $retval == 0 ]]; then
|
||||
# DHCP succeeded, show address retrieved
|
||||
i=$(ifconfig ${IFACE} | grep -m1 -o 'inet addr:[^ ]*' |
|
||||
cut -d: -f2)
|
||||
[[ -n ${i} ]] && einfo " ${IFACE} received address ${i}"
|
||||
elif [[ -n "${ifconfig_fallback_IFACE}" ]]; then
|
||||
# DHCP failed, try fallback.
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_fallback_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Using fallback configuration (${i}) for ${IFACE}"
|
||||
else
|
||||
ebegin "Using fallback configuration for ${IFACE}"
|
||||
fi
|
||||
ifconfig ${IFACE} ${ifconfig_fallback_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
return $retval
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ ${#ifconfig_IFACE[@]} -gt 1 ]]; then
|
||||
einfo " Adding aliases"
|
||||
for ((i = 1; i < ${#ifconfig_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE}:${i} (${ifconfig_IFACE[i]%% *})"
|
||||
ifconfig ${IFACE}:${i} ${ifconfig_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
if [[ -n ${inet6_IFACE} ]]; then
|
||||
einfo " Adding inet6 addresses"
|
||||
for ((i = 0; i < ${#inet6_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE} inet6 add ${inet6_IFACE[i]}"
|
||||
ifconfig ${IFACE} inet6 add ${inet6_IFACE[i]} >${devnull}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set static routes
|
||||
if [[ -n ${routes_IFACE} ]]; then
|
||||
einfo " Adding routes"
|
||||
for ((i = 0; i < ${#routes_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${routes_IFACE[i]}"
|
||||
/sbin/route add ${routes_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set default route if applicable to this interface
|
||||
if [[ ${gateway} == ${IFACE}/* ]]; then
|
||||
local ogw=$(/bin/netstat -rn | awk '$1 == "0.0.0.0" {print $2}')
|
||||
local gw=${gateway#*/}
|
||||
if [[ ${ogw} != ${gw} ]]; then
|
||||
ebegin " Setting default gateway ($gw)"
|
||||
|
||||
# First delete any existing route if it was setup by kernel...
|
||||
/sbin/route del default dev ${IFACE} &>${devnull}
|
||||
|
||||
# Second delete old gateway if it was set...
|
||||
/sbin/route del default gw ${ogw} &>${devnull}
|
||||
|
||||
# Third add our new default gateway
|
||||
/sbin/route add default gw ${gw} >${devnull}
|
||||
eend $? || {
|
||||
true # need to have some command in here
|
||||
# Note: This originally called stop, which is obviously
|
||||
# wrong since it's calling with a local version of IFACE.
|
||||
# The below code works correctly to abort configuration of
|
||||
# the interface, but is commented because we're assuming
|
||||
# that default route failure should not cause the interface
|
||||
# to be unconfigured.
|
||||
#local error=$?
|
||||
#ewarn "Aborting configuration of ${IFACE}"
|
||||
#iface_stop ${IFACE}
|
||||
#return ${error}
|
||||
}
|
||||
fi
|
||||
fi
|
||||
|
||||
# Enabling rp_filter causes wacky packets to be auto-dropped by
|
||||
# the kernel. Note that we only do this if it is not set via
|
||||
# /etc/sysctl.conf ...
|
||||
if [[ -e /proc/sys/net/ipv4/conf/${IFACE}/rp_filter && \
|
||||
-z "$(grep -s '^[^#]*rp_filter' /etc/sysctl.conf)" ]]; then
|
||||
echo -n 1 > /proc/sys/net/ipv4/conf/${IFACE}/rp_filter
|
||||
fi
|
||||
}
|
||||
|
||||
# iface_stop: bring down an interface. Don't trust information in
|
||||
# /etc/conf.d/net since the configuration might have changed since
|
||||
# iface_start ran. Instead query for current configuration and bring
|
||||
# down the interface.
|
||||
iface_stop() {
|
||||
local IFACE=${1} i x aliases inet6 count
|
||||
|
||||
# Try to do a simple down (no aliases, no inet6, no dhcp)
|
||||
aliases="$(ifconfig | grep -o "^$IFACE:[0-9]*" | tac)"
|
||||
inet6="$(ifconfig ${IFACE} | awk '$1 == "inet6" {print $2}')"
|
||||
if [[ -z ${aliases} && -z ${inet6} && ! -e /var/run/dhcpcd-${IFACE}.pid ]]; then
|
||||
ebegin "Bringing ${IFACE} down"
|
||||
ifconfig ${IFACE} down &>/dev/null
|
||||
eend 0
|
||||
return 0
|
||||
fi
|
||||
|
||||
einfo "Bringing ${IFACE} down"
|
||||
|
||||
# Stop aliases before primary interface.
|
||||
# Note this must be done in reverse order, since ifconfig eth0:1
|
||||
# will remove eth0:2, etc. It might be sufficient to simply remove
|
||||
# the base interface but we're being safe here.
|
||||
for i in ${aliases} ${IFACE}; do
|
||||
|
||||
# Delete all the inet6 addresses for this interface
|
||||
inet6="$(ifconfig ${i} | awk '$1 == "inet6" {print $3}')"
|
||||
if [[ -n ${inet6} ]]; then
|
||||
einfo " Removing inet6 addresses"
|
||||
for x in ${inet6}; do
|
||||
ebegin " ${IFACE} inet6 del ${x}"
|
||||
ifconfig ${i} inet6 del ${x}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Stop DHCP (should be N/A for aliases)
|
||||
# Don't trust current configuration... investigate ourselves
|
||||
if /sbin/dhcpcd -z ${i} &>${devnull}; then
|
||||
ebegin " Releasing DHCP lease for ${IFACE}"
|
||||
for ((count = 0; count < 9; count = count + 1)); do
|
||||
/sbin/dhcpcd -z ${i} &>${devnull} || break
|
||||
sleep 1
|
||||
done
|
||||
[[ ${count} -lt 9 ]]
|
||||
eend $? "Timed out"
|
||||
fi
|
||||
ebegin " Stopping ${i}"
|
||||
ifconfig ${i} down &>${devnull}
|
||||
eend 0
|
||||
done
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
start() {
|
||||
# These variables are set by setup_vars
|
||||
local status_IFACE vlans_IFACE dhcpcd_IFACE
|
||||
local -a ifconfig_IFACE routes_IFACE inet6_IFACE
|
||||
|
||||
# Call user-defined preup function if it exists
|
||||
if [[ $(type -t preup) == function ]]; then
|
||||
einfo "Running preup function"
|
||||
preup ${IFACE} || {
|
||||
eerror "preup ${IFACE} failed"
|
||||
return 1
|
||||
}
|
||||
fi
|
||||
|
||||
# Start the primary interface and aliases
|
||||
setup_vars ${IFACE}
|
||||
iface_start ${IFACE} || return 1
|
||||
|
||||
# Start vlans
|
||||
local vlan
|
||||
for vlan in ${vlans_IFACE}; do
|
||||
/sbin/vconfig add ${IFACE} ${vlan} >${devnull}
|
||||
setup_vars ${IFACE}.${vlan}
|
||||
iface_start ${IFACE}.${vlan}
|
||||
done
|
||||
|
||||
# Call user-defined postup function if it exists
|
||||
if [[ $(type -t postup) == function ]]; then
|
||||
einfo "Running postup function"
|
||||
postup ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
stop() {
|
||||
# Call user-defined predown function if it exists
|
||||
if [[ $(type -t predown) == function ]]; then
|
||||
einfo "Running predown function"
|
||||
predown ${IFACE}
|
||||
fi
|
||||
|
||||
# Don't depend on setup_vars since configuration might have changed.
|
||||
# Investigate current configuration instead.
|
||||
local vlan
|
||||
for vlan in $(ifconfig | grep -o "^${IFACE}\.[^ ]*"); do
|
||||
iface_stop ${vlan}
|
||||
/sbin/vconfig rem ${vlan} >${devnull}
|
||||
done
|
||||
|
||||
iface_stop ${IFACE} || return 1 # always succeeds, btw
|
||||
|
||||
# Call user-defined postdown function if it exists
|
||||
if [[ $(type -t postdown) == function ]]; then
|
||||
einfo "Running postdown function"
|
||||
postdown ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
# vim:ts=4
|
||||
@@ -0,0 +1 @@
|
||||
HOSTNAME=dave
|
||||
@@ -0,0 +1,10 @@
|
||||
# /etc/conf.d/net:
|
||||
|
||||
# This is basically the ifconfig argument without the ifconfig $iface
|
||||
#
|
||||
iface_lo="127.0.0.1 netmask 255.0.0.0"
|
||||
iface_eth0="PH_IP_DAVE broadcast 192.168.0.255 netmask 255.255.255.0"
|
||||
|
||||
# For setting the default gateway
|
||||
#
|
||||
gateway="eth0/192.168.0.254"
|
||||
Executable
+73
@@ -0,0 +1,73 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Foundation
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
opts="start stop reload"
|
||||
|
||||
depend() {
|
||||
before net
|
||||
need logger
|
||||
}
|
||||
|
||||
start() {
|
||||
ebegin "Starting firewall"
|
||||
|
||||
# default policy is DROP
|
||||
/sbin/iptables -P INPUT DROP
|
||||
/sbin/iptables -P OUTPUT DROP
|
||||
/sbin/iptables -P FORWARD DROP
|
||||
|
||||
# allow esp
|
||||
iptables -A INPUT -i eth0 -p 50 -j ACCEPT
|
||||
iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
|
||||
|
||||
# allow IKE
|
||||
iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
|
||||
iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
|
||||
|
||||
# allow crl fetch from winnetou
|
||||
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
|
||||
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
|
||||
|
||||
# allow ssh
|
||||
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
|
||||
|
||||
eend $?
|
||||
}
|
||||
|
||||
stop() {
|
||||
ebegin "Stopping firewall"
|
||||
for a in `cat /proc/net/ip_tables_names`; do
|
||||
/sbin/iptables -F -t $a
|
||||
/sbin/iptables -X -t $a
|
||||
|
||||
if [ $a == nat ]; then
|
||||
/sbin/iptables -t nat -P PREROUTING ACCEPT
|
||||
/sbin/iptables -t nat -P POSTROUTING ACCEPT
|
||||
/sbin/iptables -t nat -P OUTPUT ACCEPT
|
||||
elif [ $a == mangle ]; then
|
||||
/sbin/iptables -t mangle -P PREROUTING ACCEPT
|
||||
/sbin/iptables -t mangle -P INPUT ACCEPT
|
||||
/sbin/iptables -t mangle -P FORWARD ACCEPT
|
||||
/sbin/iptables -t mangle -P OUTPUT ACCEPT
|
||||
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
|
||||
elif [ $a == filter ]; then
|
||||
/sbin/iptables -t filter -P INPUT ACCEPT
|
||||
/sbin/iptables -t filter -P FORWARD ACCEPT
|
||||
/sbin/iptables -t filter -P OUTPUT ACCEPT
|
||||
fi
|
||||
done
|
||||
eend $?
|
||||
}
|
||||
|
||||
reload() {
|
||||
ebegin "Flushing firewall"
|
||||
for a in `cat /proc/net/ip_tables_names`; do
|
||||
/sbin/iptables -F -t $a
|
||||
/sbin/iptables -X -t $a
|
||||
done;
|
||||
eend $?
|
||||
start
|
||||
}
|
||||
|
||||
Executable
+314
@@ -0,0 +1,314 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Technologies, Inc.
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
#NB: Config is in /etc/conf.d/net
|
||||
|
||||
if [[ -n $NET_DEBUG ]]; then
|
||||
set -x
|
||||
devnull=/dev/stderr
|
||||
else
|
||||
devnull=/dev/null
|
||||
fi
|
||||
|
||||
# For pcmcia users. note that pcmcia must be added to the same
|
||||
# runlevel as the net.* script that needs it.
|
||||
depend() {
|
||||
use hotplug pcmcia
|
||||
}
|
||||
|
||||
checkconfig() {
|
||||
if [[ -z "${ifconfig_IFACE}" ]]; then
|
||||
eerror "Please make sure that /etc/conf.d/net has \$ifconfig_$IFACE set"
|
||||
eerror "(or \$iface_$IFACE for old-style configuration)"
|
||||
return 1
|
||||
fi
|
||||
if [[ -n "${vlans_IFACE}" && ! -x /sbin/vconfig ]]; then
|
||||
eerror "For VLAN (802.1q) support, emerge net-misc/vconfig"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Fix bug 50039 (init.d/net.eth0 localization)
|
||||
# Some other commands in this script might need to be wrapped, but
|
||||
# we'll get them one-by-one. Note that LC_ALL trumps LC_anything_else
|
||||
# according to locale(7)
|
||||
ifconfig() {
|
||||
LC_ALL=C /sbin/ifconfig "$@"
|
||||
}
|
||||
|
||||
# setup_vars: setup variables based on $1 and content of /etc/conf.d/net
|
||||
# The following variables are set, which should be declared local by
|
||||
# the calling routine.
|
||||
# status_IFACE (up or '')
|
||||
# vlans_IFACE (space-separated list)
|
||||
# ifconfig_IFACE (array of ifconfig lines, replaces iface_IFACE)
|
||||
# dhcpcd_IFACE (command-line args for dhcpcd)
|
||||
# routes_IFACE (array of route lines)
|
||||
# inet6_IFACE (array of inet6 lines)
|
||||
# ifconfig_fallback_IFACE (fallback ifconfig if dhcp fails)
|
||||
setup_vars() {
|
||||
local i iface="${1//\./_}"
|
||||
|
||||
status_IFACE="$(ifconfig ${1} 2>${devnull} | gawk '$1 == "UP" {print "up"}')"
|
||||
eval vlans_IFACE=\"\$\{iface_${iface}_vlans\}\"
|
||||
eval ifconfig_IFACE=( \"\$\{ifconfig_$iface\[@\]\}\" )
|
||||
eval dhcpcd_IFACE=\"\$\{dhcpcd_$iface\}\"
|
||||
eval routes_IFACE=( \"\$\{routes_$iface\[@\]\}\" )
|
||||
eval inet6_IFACE=( \"\$\{inet6_$iface\[@\]\}\" )
|
||||
eval ifconfig_fallback_IFACE=( \"\$\{ifconfig_fallback_$iface\[@\]\}\" )
|
||||
|
||||
# BACKWARD COMPATIBILITY: populate the ifconfig_IFACE array
|
||||
# if iface_IFACE is set (fex. iface_eth0 instead of ifconfig_eth0)
|
||||
eval local iface_IFACE=\"\$\{iface_$iface\}\"
|
||||
if [[ -n ${iface_IFACE} && -z ${ifconfig_IFACE} ]]; then
|
||||
# Make sure these get evaluated as arrays
|
||||
local -a aliases broadcasts netmasks
|
||||
|
||||
# Start with the primary interface
|
||||
ifconfig_IFACE=( "${iface_IFACE}" )
|
||||
|
||||
# ..then add aliases
|
||||
eval aliases=( \$\{alias_$iface\} )
|
||||
eval broadcasts=( \$\{broadcast_$iface\} )
|
||||
eval netmasks=( \$\{netmask_$iface\} )
|
||||
for ((i = 0; i < ${#aliases[@]}; i = i + 1)); do
|
||||
ifconfig_IFACE[i+1]="${aliases[i]} ${broadcasts[i]:+broadcast ${broadcasts[i]}} ${netmasks[i]:+netmask ${netmasks[i]}}"
|
||||
done
|
||||
fi
|
||||
|
||||
# BACKWARD COMPATIBILITY: check for space-separated inet6 addresses
|
||||
if [[ ${#inet6_IFACE[@]} == 1 && ${inet6_IFACE} == *' '* ]]; then
|
||||
inet6_IFACE=( ${inet6_IFACE} )
|
||||
fi
|
||||
}
|
||||
|
||||
iface_start() {
|
||||
local IFACE=${1} i x retval
|
||||
checkconfig || return 1
|
||||
|
||||
if [[ ${ifconfig_IFACE} != dhcp ]]; then
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Bringing ${IFACE} up (${i})"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up"
|
||||
fi
|
||||
# ifconfig does not always return failure ..
|
||||
ifconfig ${IFACE} ${ifconfig_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
# Check that eth0 was not brought up by the kernel ...
|
||||
if [[ ${status_IFACE} == up ]]; then
|
||||
einfo "Keeping kernel configuration for ${IFACE}"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up via DHCP"
|
||||
/sbin/dhcpcd ${dhcpcd_IFACE} ${IFACE}
|
||||
retval=$?
|
||||
eend $retval
|
||||
if [[ $retval == 0 ]]; then
|
||||
# DHCP succeeded, show address retrieved
|
||||
i=$(ifconfig ${IFACE} | grep -m1 -o 'inet addr:[^ ]*' |
|
||||
cut -d: -f2)
|
||||
[[ -n ${i} ]] && einfo " ${IFACE} received address ${i}"
|
||||
elif [[ -n "${ifconfig_fallback_IFACE}" ]]; then
|
||||
# DHCP failed, try fallback.
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_fallback_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Using fallback configuration (${i}) for ${IFACE}"
|
||||
else
|
||||
ebegin "Using fallback configuration for ${IFACE}"
|
||||
fi
|
||||
ifconfig ${IFACE} ${ifconfig_fallback_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
return $retval
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ ${#ifconfig_IFACE[@]} -gt 1 ]]; then
|
||||
einfo " Adding aliases"
|
||||
for ((i = 1; i < ${#ifconfig_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE}:${i} (${ifconfig_IFACE[i]%% *})"
|
||||
ifconfig ${IFACE}:${i} ${ifconfig_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
if [[ -n ${inet6_IFACE} ]]; then
|
||||
einfo " Adding inet6 addresses"
|
||||
for ((i = 0; i < ${#inet6_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE} inet6 add ${inet6_IFACE[i]}"
|
||||
ifconfig ${IFACE} inet6 add ${inet6_IFACE[i]} >${devnull}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set static routes
|
||||
if [[ -n ${routes_IFACE} ]]; then
|
||||
einfo " Adding routes"
|
||||
for ((i = 0; i < ${#routes_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${routes_IFACE[i]}"
|
||||
/sbin/route add ${routes_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set default route if applicable to this interface
|
||||
if [[ ${gateway} == ${IFACE}/* ]]; then
|
||||
local ogw=$(/bin/netstat -rn | awk '$1 == "0.0.0.0" {print $2}')
|
||||
local gw=${gateway#*/}
|
||||
if [[ ${ogw} != ${gw} ]]; then
|
||||
ebegin " Setting default gateway ($gw)"
|
||||
|
||||
# First delete any existing route if it was setup by kernel...
|
||||
/sbin/route del default dev ${IFACE} &>${devnull}
|
||||
|
||||
# Second delete old gateway if it was set...
|
||||
/sbin/route del default gw ${ogw} &>${devnull}
|
||||
|
||||
# Third add our new default gateway
|
||||
/sbin/route add default gw ${gw} >${devnull}
|
||||
eend $? || {
|
||||
true # need to have some command in here
|
||||
# Note: This originally called stop, which is obviously
|
||||
# wrong since it's calling with a local version of IFACE.
|
||||
# The below code works correctly to abort configuration of
|
||||
# the interface, but is commented because we're assuming
|
||||
# that default route failure should not cause the interface
|
||||
# to be unconfigured.
|
||||
#local error=$?
|
||||
#ewarn "Aborting configuration of ${IFACE}"
|
||||
#iface_stop ${IFACE}
|
||||
#return ${error}
|
||||
}
|
||||
fi
|
||||
fi
|
||||
|
||||
# Enabling rp_filter causes wacky packets to be auto-dropped by
|
||||
# the kernel. Note that we only do this if it is not set via
|
||||
# /etc/sysctl.conf ...
|
||||
if [[ -e /proc/sys/net/ipv4/conf/${IFACE}/rp_filter && \
|
||||
-z "$(grep -s '^[^#]*rp_filter' /etc/sysctl.conf)" ]]; then
|
||||
echo -n 1 > /proc/sys/net/ipv4/conf/${IFACE}/rp_filter
|
||||
fi
|
||||
}
|
||||
|
||||
# iface_stop: bring down an interface. Don't trust information in
|
||||
# /etc/conf.d/net since the configuration might have changed since
|
||||
# iface_start ran. Instead query for current configuration and bring
|
||||
# down the interface.
|
||||
iface_stop() {
|
||||
local IFACE=${1} i x aliases inet6 count
|
||||
|
||||
# Try to do a simple down (no aliases, no inet6, no dhcp)
|
||||
aliases="$(ifconfig | grep -o "^$IFACE:[0-9]*" | tac)"
|
||||
inet6="$(ifconfig ${IFACE} | awk '$1 == "inet6" {print $2}')"
|
||||
if [[ -z ${aliases} && -z ${inet6} && ! -e /var/run/dhcpcd-${IFACE}.pid ]]; then
|
||||
ebegin "Bringing ${IFACE} down"
|
||||
ifconfig ${IFACE} down &>/dev/null
|
||||
eend 0
|
||||
return 0
|
||||
fi
|
||||
|
||||
einfo "Bringing ${IFACE} down"
|
||||
|
||||
# Stop aliases before primary interface.
|
||||
# Note this must be done in reverse order, since ifconfig eth0:1
|
||||
# will remove eth0:2, etc. It might be sufficient to simply remove
|
||||
# the base interface but we're being safe here.
|
||||
for i in ${aliases} ${IFACE}; do
|
||||
|
||||
# Delete all the inet6 addresses for this interface
|
||||
inet6="$(ifconfig ${i} | awk '$1 == "inet6" {print $3}')"
|
||||
if [[ -n ${inet6} ]]; then
|
||||
einfo " Removing inet6 addresses"
|
||||
for x in ${inet6}; do
|
||||
ebegin " ${IFACE} inet6 del ${x}"
|
||||
ifconfig ${i} inet6 del ${x}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Stop DHCP (should be N/A for aliases)
|
||||
# Don't trust current configuration... investigate ourselves
|
||||
if /sbin/dhcpcd -z ${i} &>${devnull}; then
|
||||
ebegin " Releasing DHCP lease for ${IFACE}"
|
||||
for ((count = 0; count < 9; count = count + 1)); do
|
||||
/sbin/dhcpcd -z ${i} &>${devnull} || break
|
||||
sleep 1
|
||||
done
|
||||
[[ ${count} -lt 9 ]]
|
||||
eend $? "Timed out"
|
||||
fi
|
||||
ebegin " Stopping ${i}"
|
||||
ifconfig ${i} down &>${devnull}
|
||||
eend 0
|
||||
done
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
start() {
|
||||
# These variables are set by setup_vars
|
||||
local status_IFACE vlans_IFACE dhcpcd_IFACE
|
||||
local -a ifconfig_IFACE routes_IFACE inet6_IFACE
|
||||
|
||||
# Call user-defined preup function if it exists
|
||||
if [[ $(type -t preup) == function ]]; then
|
||||
einfo "Running preup function"
|
||||
preup ${IFACE} || {
|
||||
eerror "preup ${IFACE} failed"
|
||||
return 1
|
||||
}
|
||||
fi
|
||||
|
||||
# Start the primary interface and aliases
|
||||
setup_vars ${IFACE}
|
||||
iface_start ${IFACE} || return 1
|
||||
|
||||
# Start vlans
|
||||
local vlan
|
||||
for vlan in ${vlans_IFACE}; do
|
||||
/sbin/vconfig add ${IFACE} ${vlan} >${devnull}
|
||||
setup_vars ${IFACE}.${vlan}
|
||||
iface_start ${IFACE}.${vlan}
|
||||
done
|
||||
|
||||
# Call user-defined postup function if it exists
|
||||
if [[ $(type -t postup) == function ]]; then
|
||||
einfo "Running postup function"
|
||||
postup ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
stop() {
|
||||
# Call user-defined predown function if it exists
|
||||
if [[ $(type -t predown) == function ]]; then
|
||||
einfo "Running predown function"
|
||||
predown ${IFACE}
|
||||
fi
|
||||
|
||||
# Don't depend on setup_vars since configuration might have changed.
|
||||
# Investigate current configuration instead.
|
||||
local vlan
|
||||
for vlan in $(ifconfig | grep -o "^${IFACE}\.[^ ]*"); do
|
||||
iface_stop ${vlan}
|
||||
/sbin/vconfig rem ${vlan} >${devnull}
|
||||
done
|
||||
|
||||
iface_stop ${IFACE} || return 1 # always succeeds, btw
|
||||
|
||||
# Call user-defined postdown function if it exists
|
||||
if [[ $(type -t postdown) == function ]]; then
|
||||
einfo "Running postdown function"
|
||||
postdown ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
# vim:ts=4
|
||||
Executable
+24
@@ -0,0 +1,24 @@
|
||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
version 2.0 # conforms to second version of ipsec.conf specification
|
||||
|
||||
config setup
|
||||
plutodebug=control
|
||||
crlcheckinterval=180
|
||||
strictcrlpolicy=no
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
|
||||
conn home
|
||||
left=PH_IP_DAVE
|
||||
leftcert=daveCert.pem
|
||||
[email protected]
|
||||
leftfirewall=yes
|
||||
right=PH_IP_MOON
|
||||
rightsubnet=10.1.0.0/16
|
||||
[email protected]
|
||||
auto=add
|
||||
@@ -0,0 +1,22 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDtTCCAp2gAwIBAgIBADANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
|
||||
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
|
||||
b290IENBMB4XDTA0MDkxMDExMDE0NVoXDTE0MDkwODExMDE0NVowRTELMAkGA1UE
|
||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0cm9u
|
||||
Z1N3YW4gUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL/y
|
||||
X2LqPVZuWLPIeknK86xhz6ljd3NNhC2z+P1uoCP3sBMuZiZQEjFzhnKcbXxCeo2f
|
||||
FnvhOOjrrisSuVkzuu82oxXD3fIkzuS7m9V4E10EZzgmKWIf+WuNRfbgAuUINmLc
|
||||
4YGAXBQLPyzpP4Ou48hhz/YQo58Bics6PHy5v34qCVROIXDvqhj91P8g+pS+F21/
|
||||
7P+CH2jRcVIEHZtG8M/PweTPQ95dPzpYd2Ov6SZ/U7EWmbMmT8VcUYn1aChxFmy5
|
||||
gweVBWlkH6MP+1DeE0/tL5c87xo5KCeGK8Tdqpe7sBRC4pPEEHDQciTUvkeuJ1Pr
|
||||
K+1LwdqRxo7HgMRiDw8CAwEAAaOBrzCBrDAPBgNVHRMBAf8EBTADAQH/MAsGA1Ud
|
||||
DwQEAwIBBjAdBgNVHQ4EFgQUXafdcAZRMn7ntm2zteXgYOouTe8wbQYDVR0jBGYw
|
||||
ZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJBgNVBAYTAkNIMRkwFwYD
|
||||
VQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJvbmdTd2FuIFJvb3Qg
|
||||
Q0GCAQAwDQYJKoZIhvcNAQEEBQADggEBAJrXTj5gWS37myHHhii9drYwkMFyDHS/
|
||||
lHU8rW/drcnHdus507+qUhNr9SiEAHg4Ywj895UDvT0a1sFaw44QyEa/94iKA8/n
|
||||
+g5kS1IrKvWu3wu8UI3EgzChgHV3cncQlQWbK+FI9Y3Ax1O1np1r+wLptoWpKKKE
|
||||
UxsYcxP9K4Nbyeon0AIHOajUheiL3t6aRc3m0o7VU7Do6S2r+He+1Zq/nRUfFeTy
|
||||
0Atebkn8tmUpPSKWaXkmwpVNrjZ1Qu9umAU+dtJyhzL2zmnyhPC4VqpsKCOp7imy
|
||||
gKZvUIKPm1zyf4T+yjwxwkiX2xVseoM3aKswb1EoZFelHwndU7u0GQ8=
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,25 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEIjCCAwqgAwIBAgIBCDANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
|
||||
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
|
||||
b290IENBMB4XDTA0MDkxMDExMjY1MVoXDTA5MDkwOTExMjY1MVowWzELMAkGA1UE
|
||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xEzARBgNVBAsTCkFjY291
|
||||
bnRpbmcxHDAaBgNVBAMUE2RhdmVAc3Ryb25nc3dhbi5vcmcwggEiMA0GCSqGSIb3
|
||||
DQEBAQUAA4IBDwAwggEKAoIBAQDGbCmUY6inir71/6RWebegcLUTmDSxRqpRONDx
|
||||
2IRUEuES5EKc7qsjRz45XoqjiywCQRjYW33fUEEY6r7fnHk70CyUnWeZyr7v4D/2
|
||||
LjBN3smDE6/ZZrzxPx+xphlUigYOF/vt4gUiW1dOZ5rcnxG9+eNrSL6gWNNg1iuE
|
||||
RflSTbmHV6TVmGU2PGddKGZ6XfqWfdA+6iOi2+oyqw6aH4u4hfXhJyMROEOhLdAF
|
||||
UvzU9UizEXSqsmEOSodS9vypVJRYTbZcx70e9Q7g2MghHvtQY6mVgBzAwakDBCt/
|
||||
98lAlKDeXXOQqPcqAZSc2VjG8gEmkr1dum8wsJw8C2liKGRFAgMBAAGjggEFMIIB
|
||||
ATAJBgNVHRMEAjAAMAsGA1UdDwQEAwIDqDAdBgNVHQ4EFgQU3pC10RxsZDx0UNNq
|
||||
+Ihsoxk4+3IwbQYDVR0jBGYwZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUx
|
||||
CzAJBgNVBAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQD
|
||||
ExJzdHJvbmdTd2FuIFJvb3QgQ0GCAQAwHgYDVR0RBBcwFYETZGF2ZUBzdHJvbmdz
|
||||
d2FuLm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4u
|
||||
b3JnL3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQAnotcnOE0tJDLy
|
||||
8Vh1+naT2zrxx9UxfMIeFljwhDqRiHXSLDAbCOnAWoqj8C9riuZwW7UImIIQ9JT9
|
||||
Gdktt4bbIcG25rGMC3uqP71CfaAz/SwIZZ2vm8Jt2ZzzSMHsE5qbjDIRAZnq6giR
|
||||
P2s6PVsMPSpvH34sRbE0UoWJSdtBZJP5bb+T4hc9gfmbyTewwMnjh09KkGJqVxKV
|
||||
UC/1z1U9zb3X1Gc9y+zI67/D46wM6KdRINaqPdK26aYRFM+/DLoTfFk07dsyz7lt
|
||||
0C+/ityQOvpfjVlZ/OepT92eWno4FuNRJuUP5/gYiHvSsjZbazqG02qGhJ6VgtGT
|
||||
5qILUTmI
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,27 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEpAIBAAKCAQEAxmwplGOop4q+9f+kVnm3oHC1E5g0sUaqUTjQ8diEVBLhEuRC
|
||||
nO6rI0c+OV6Ko4ssAkEY2Ft931BBGOq+35x5O9AslJ1nmcq+7+A/9i4wTd7JgxOv
|
||||
2Wa88T8fsaYZVIoGDhf77eIFIltXTmea3J8Rvfnja0i+oFjTYNYrhEX5Uk25h1ek
|
||||
1ZhlNjxnXShmel36ln3QPuojotvqMqsOmh+LuIX14ScjEThDoS3QBVL81PVIsxF0
|
||||
qrJhDkqHUvb8qVSUWE22XMe9HvUO4NjIIR77UGOplYAcwMGpAwQrf/fJQJSg3l1z
|
||||
kKj3KgGUnNlYxvIBJpK9XbpvMLCcPAtpYihkRQIDAQABAoIBAQCQP7nKotjNVFSX
|
||||
Sg4Sv9H61XUOlaxY5GKVQZTE/P7WkBMIROEYbXoE35og4tYvJtILoX+KapkLa7Cn
|
||||
iKDSt1J7ZU/DitryNy6v/HsDYXjEY55jqEBC8CmTyKwl3fa0OtNEE7OWsKXC4FyM
|
||||
J02x7gJb9fqa1/udXnXtBEYGl0g1x/vDmuhLgKyq6eliTm/orAyjGK2KfRxu06eS
|
||||
YUZObr25wC7yDLHCBsWHGNVC7ZyxQoxcPOu9WNwlWYu92ZJMdf3+rIgZSeXxCn3U
|
||||
3CWAC9tL1HnKC/twbyWEc2Gy0lZaQSgTJzaRtKOlqBTc5Szb4l1ibmyeAA7NanXK
|
||||
wnUYfiZRAoGBAOWW0+4lzZhWOxK/cYwM5+eoI66MhPECFVK2sL8iC34BKGFRCrSd
|
||||
YS/nugWiAu30knIBrw8z9BN0gYEfiE/EZyP5TbjtabKDN28xQa1+bw9Sr+5g5TcR
|
||||
HFvZRkJWSYGoIuVO22eXUh+1hwx3KZP/UX6pwkrc2dxQLxNk0mo/BexPAoGBAN0/
|
||||
geik9GNIjbKwSPLvIIwcmO4TZja2RJy9NCTJOrJZFpCII6HvOiO0eYx3+So+KblG
|
||||
n4AUxrhi4jq1/mAA+VUt4B9ywKH8xzGwhno78dJ1lvydpuzXSTHOEgsWh9Kme05P
|
||||
syt/t1C0ZkWqOKsBGk1f7dU9IOWuOkpVUbbMX10rAoGBALp0S5lUyiu1nDQVljmP
|
||||
IadZPeE77ZttfbO2+sO++mZSumCOWItmZM9q+gApGwf1YBmGlI1cPBSwwZwD58gg
|
||||
UUM97IkLBpQbTKHY9uXXkIp5NLf7qSuXkdhmFFE7kmbiDbT83eK7Wc62tf7Bp9qx
|
||||
t5WOeGQkCCqMVC8D6n6uwDixAoGABV4jErfdzgLWnT01p98xVPTkqPIDitRFOeBF
|
||||
QZc4O1d5+quy4ZziNjeMs2G9w86aSIp0GDFo2NRdVLtRnpande+U/m5UShnN42C7
|
||||
AoAtz8NWlG5mvFxExFaRjX9QcEXlu/KnECkbE3Qs/wewNEXkk3f+VywSfkAJ3f/P
|
||||
6bVvot0CgYBA1B9SXYhclR3KNZJPRuTn9OQ/TqLmcCMN62dIhPW4WZo2ixZH3YdS
|
||||
PE/bYmYfZUPt7MnOSNSnuLKineIf1Dipz0gjuSyFGAs5DE+N+8GWYo00n+0e3TLL
|
||||
pcBj4nOdIVPTZ31IFeVbi06dCYmzLPAGDeLe1M1Z7fakNky1Wv+Sdg==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
@@ -0,0 +1,7 @@
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
|
||||
: RSA daveKey.pem
|
||||
|
||||
|
||||
|
||||
|
||||
+314
@@ -0,0 +1,314 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Technologies, Inc.
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
#NB: Config is in /etc/conf.d/net
|
||||
|
||||
if [[ -n $NET_DEBUG ]]; then
|
||||
set -x
|
||||
devnull=/dev/stderr
|
||||
else
|
||||
devnull=/dev/null
|
||||
fi
|
||||
|
||||
# For pcmcia users. note that pcmcia must be added to the same
|
||||
# runlevel as the net.* script that needs it.
|
||||
depend() {
|
||||
use hotplug pcmcia
|
||||
}
|
||||
|
||||
checkconfig() {
|
||||
if [[ -z "${ifconfig_IFACE}" ]]; then
|
||||
eerror "Please make sure that /etc/conf.d/net has \$ifconfig_$IFACE set"
|
||||
eerror "(or \$iface_$IFACE for old-style configuration)"
|
||||
return 1
|
||||
fi
|
||||
if [[ -n "${vlans_IFACE}" && ! -x /sbin/vconfig ]]; then
|
||||
eerror "For VLAN (802.1q) support, emerge net-misc/vconfig"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Fix bug 50039 (init.d/net.eth0 localization)
|
||||
# Some other commands in this script might need to be wrapped, but
|
||||
# we'll get them one-by-one. Note that LC_ALL trumps LC_anything_else
|
||||
# according to locale(7)
|
||||
ifconfig() {
|
||||
LC_ALL=C /sbin/ifconfig "$@"
|
||||
}
|
||||
|
||||
# setup_vars: setup variables based on $1 and content of /etc/conf.d/net
|
||||
# The following variables are set, which should be declared local by
|
||||
# the calling routine.
|
||||
# status_IFACE (up or '')
|
||||
# vlans_IFACE (space-separated list)
|
||||
# ifconfig_IFACE (array of ifconfig lines, replaces iface_IFACE)
|
||||
# dhcpcd_IFACE (command-line args for dhcpcd)
|
||||
# routes_IFACE (array of route lines)
|
||||
# inet6_IFACE (array of inet6 lines)
|
||||
# ifconfig_fallback_IFACE (fallback ifconfig if dhcp fails)
|
||||
setup_vars() {
|
||||
local i iface="${1//\./_}"
|
||||
|
||||
status_IFACE="$(ifconfig ${1} 2>${devnull} | gawk '$1 == "UP" {print "up"}')"
|
||||
eval vlans_IFACE=\"\$\{iface_${iface}_vlans\}\"
|
||||
eval ifconfig_IFACE=( \"\$\{ifconfig_$iface\[@\]\}\" )
|
||||
eval dhcpcd_IFACE=\"\$\{dhcpcd_$iface\}\"
|
||||
eval routes_IFACE=( \"\$\{routes_$iface\[@\]\}\" )
|
||||
eval inet6_IFACE=( \"\$\{inet6_$iface\[@\]\}\" )
|
||||
eval ifconfig_fallback_IFACE=( \"\$\{ifconfig_fallback_$iface\[@\]\}\" )
|
||||
|
||||
# BACKWARD COMPATIBILITY: populate the ifconfig_IFACE array
|
||||
# if iface_IFACE is set (fex. iface_eth0 instead of ifconfig_eth0)
|
||||
eval local iface_IFACE=\"\$\{iface_$iface\}\"
|
||||
if [[ -n ${iface_IFACE} && -z ${ifconfig_IFACE} ]]; then
|
||||
# Make sure these get evaluated as arrays
|
||||
local -a aliases broadcasts netmasks
|
||||
|
||||
# Start with the primary interface
|
||||
ifconfig_IFACE=( "${iface_IFACE}" )
|
||||
|
||||
# ..then add aliases
|
||||
eval aliases=( \$\{alias_$iface\} )
|
||||
eval broadcasts=( \$\{broadcast_$iface\} )
|
||||
eval netmasks=( \$\{netmask_$iface\} )
|
||||
for ((i = 0; i < ${#aliases[@]}; i = i + 1)); do
|
||||
ifconfig_IFACE[i+1]="${aliases[i]} ${broadcasts[i]:+broadcast ${broadcasts[i]}} ${netmasks[i]:+netmask ${netmasks[i]}}"
|
||||
done
|
||||
fi
|
||||
|
||||
# BACKWARD COMPATIBILITY: check for space-separated inet6 addresses
|
||||
if [[ ${#inet6_IFACE[@]} == 1 && ${inet6_IFACE} == *' '* ]]; then
|
||||
inet6_IFACE=( ${inet6_IFACE} )
|
||||
fi
|
||||
}
|
||||
|
||||
iface_start() {
|
||||
local IFACE=${1} i x retval
|
||||
checkconfig || return 1
|
||||
|
||||
if [[ ${ifconfig_IFACE} != dhcp ]]; then
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Bringing ${IFACE} up (${i})"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up"
|
||||
fi
|
||||
# ifconfig does not always return failure ..
|
||||
ifconfig ${IFACE} ${ifconfig_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
# Check that eth0 was not brought up by the kernel ...
|
||||
if [[ ${status_IFACE} == up ]]; then
|
||||
einfo "Keeping kernel configuration for ${IFACE}"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up via DHCP"
|
||||
/sbin/dhcpcd ${dhcpcd_IFACE} ${IFACE}
|
||||
retval=$?
|
||||
eend $retval
|
||||
if [[ $retval == 0 ]]; then
|
||||
# DHCP succeeded, show address retrieved
|
||||
i=$(ifconfig ${IFACE} | grep -m1 -o 'inet addr:[^ ]*' |
|
||||
cut -d: -f2)
|
||||
[[ -n ${i} ]] && einfo " ${IFACE} received address ${i}"
|
||||
elif [[ -n "${ifconfig_fallback_IFACE}" ]]; then
|
||||
# DHCP failed, try fallback.
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_fallback_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Using fallback configuration (${i}) for ${IFACE}"
|
||||
else
|
||||
ebegin "Using fallback configuration for ${IFACE}"
|
||||
fi
|
||||
ifconfig ${IFACE} ${ifconfig_fallback_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
return $retval
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ ${#ifconfig_IFACE[@]} -gt 1 ]]; then
|
||||
einfo " Adding aliases"
|
||||
for ((i = 1; i < ${#ifconfig_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE}:${i} (${ifconfig_IFACE[i]%% *})"
|
||||
ifconfig ${IFACE}:${i} ${ifconfig_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
if [[ -n ${inet6_IFACE} ]]; then
|
||||
einfo " Adding inet6 addresses"
|
||||
for ((i = 0; i < ${#inet6_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE} inet6 add ${inet6_IFACE[i]}"
|
||||
ifconfig ${IFACE} inet6 add ${inet6_IFACE[i]} >${devnull}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set static routes
|
||||
if [[ -n ${routes_IFACE} ]]; then
|
||||
einfo " Adding routes"
|
||||
for ((i = 0; i < ${#routes_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${routes_IFACE[i]}"
|
||||
/sbin/route add ${routes_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set default route if applicable to this interface
|
||||
if [[ ${gateway} == ${IFACE}/* ]]; then
|
||||
local ogw=$(/bin/netstat -rn | awk '$1 == "0.0.0.0" {print $2}')
|
||||
local gw=${gateway#*/}
|
||||
if [[ ${ogw} != ${gw} ]]; then
|
||||
ebegin " Setting default gateway ($gw)"
|
||||
|
||||
# First delete any existing route if it was setup by kernel...
|
||||
/sbin/route del default dev ${IFACE} &>${devnull}
|
||||
|
||||
# Second delete old gateway if it was set...
|
||||
/sbin/route del default gw ${ogw} &>${devnull}
|
||||
|
||||
# Third add our new default gateway
|
||||
/sbin/route add default gw ${gw} >${devnull}
|
||||
eend $? || {
|
||||
true # need to have some command in here
|
||||
# Note: This originally called stop, which is obviously
|
||||
# wrong since it's calling with a local version of IFACE.
|
||||
# The below code works correctly to abort configuration of
|
||||
# the interface, but is commented because we're assuming
|
||||
# that default route failure should not cause the interface
|
||||
# to be unconfigured.
|
||||
#local error=$?
|
||||
#ewarn "Aborting configuration of ${IFACE}"
|
||||
#iface_stop ${IFACE}
|
||||
#return ${error}
|
||||
}
|
||||
fi
|
||||
fi
|
||||
|
||||
# Enabling rp_filter causes wacky packets to be auto-dropped by
|
||||
# the kernel. Note that we only do this if it is not set via
|
||||
# /etc/sysctl.conf ...
|
||||
if [[ -e /proc/sys/net/ipv4/conf/${IFACE}/rp_filter && \
|
||||
-z "$(grep -s '^[^#]*rp_filter' /etc/sysctl.conf)" ]]; then
|
||||
echo -n 1 > /proc/sys/net/ipv4/conf/${IFACE}/rp_filter
|
||||
fi
|
||||
}
|
||||
|
||||
# iface_stop: bring down an interface. Don't trust information in
|
||||
# /etc/conf.d/net since the configuration might have changed since
|
||||
# iface_start ran. Instead query for current configuration and bring
|
||||
# down the interface.
|
||||
iface_stop() {
|
||||
local IFACE=${1} i x aliases inet6 count
|
||||
|
||||
# Try to do a simple down (no aliases, no inet6, no dhcp)
|
||||
aliases="$(ifconfig | grep -o "^$IFACE:[0-9]*" | tac)"
|
||||
inet6="$(ifconfig ${IFACE} | awk '$1 == "inet6" {print $2}')"
|
||||
if [[ -z ${aliases} && -z ${inet6} && ! -e /var/run/dhcpcd-${IFACE}.pid ]]; then
|
||||
ebegin "Bringing ${IFACE} down"
|
||||
ifconfig ${IFACE} down &>/dev/null
|
||||
eend 0
|
||||
return 0
|
||||
fi
|
||||
|
||||
einfo "Bringing ${IFACE} down"
|
||||
|
||||
# Stop aliases before primary interface.
|
||||
# Note this must be done in reverse order, since ifconfig eth0:1
|
||||
# will remove eth0:2, etc. It might be sufficient to simply remove
|
||||
# the base interface but we're being safe here.
|
||||
for i in ${aliases} ${IFACE}; do
|
||||
|
||||
# Delete all the inet6 addresses for this interface
|
||||
inet6="$(ifconfig ${i} | awk '$1 == "inet6" {print $3}')"
|
||||
if [[ -n ${inet6} ]]; then
|
||||
einfo " Removing inet6 addresses"
|
||||
for x in ${inet6}; do
|
||||
ebegin " ${IFACE} inet6 del ${x}"
|
||||
ifconfig ${i} inet6 del ${x}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Stop DHCP (should be N/A for aliases)
|
||||
# Don't trust current configuration... investigate ourselves
|
||||
if /sbin/dhcpcd -z ${i} &>${devnull}; then
|
||||
ebegin " Releasing DHCP lease for ${IFACE}"
|
||||
for ((count = 0; count < 9; count = count + 1)); do
|
||||
/sbin/dhcpcd -z ${i} &>${devnull} || break
|
||||
sleep 1
|
||||
done
|
||||
[[ ${count} -lt 9 ]]
|
||||
eend $? "Timed out"
|
||||
fi
|
||||
ebegin " Stopping ${i}"
|
||||
ifconfig ${i} down &>${devnull}
|
||||
eend 0
|
||||
done
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
start() {
|
||||
# These variables are set by setup_vars
|
||||
local status_IFACE vlans_IFACE dhcpcd_IFACE
|
||||
local -a ifconfig_IFACE routes_IFACE inet6_IFACE
|
||||
|
||||
# Call user-defined preup function if it exists
|
||||
if [[ $(type -t preup) == function ]]; then
|
||||
einfo "Running preup function"
|
||||
preup ${IFACE} || {
|
||||
eerror "preup ${IFACE} failed"
|
||||
return 1
|
||||
}
|
||||
fi
|
||||
|
||||
# Start the primary interface and aliases
|
||||
setup_vars ${IFACE}
|
||||
iface_start ${IFACE} || return 1
|
||||
|
||||
# Start vlans
|
||||
local vlan
|
||||
for vlan in ${vlans_IFACE}; do
|
||||
/sbin/vconfig add ${IFACE} ${vlan} >${devnull}
|
||||
setup_vars ${IFACE}.${vlan}
|
||||
iface_start ${IFACE}.${vlan}
|
||||
done
|
||||
|
||||
# Call user-defined postup function if it exists
|
||||
if [[ $(type -t postup) == function ]]; then
|
||||
einfo "Running postup function"
|
||||
postup ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
stop() {
|
||||
# Call user-defined predown function if it exists
|
||||
if [[ $(type -t predown) == function ]]; then
|
||||
einfo "Running predown function"
|
||||
predown ${IFACE}
|
||||
fi
|
||||
|
||||
# Don't depend on setup_vars since configuration might have changed.
|
||||
# Investigate current configuration instead.
|
||||
local vlan
|
||||
for vlan in $(ifconfig | grep -o "^${IFACE}\.[^ ]*"); do
|
||||
iface_stop ${vlan}
|
||||
/sbin/vconfig rem ${vlan} >${devnull}
|
||||
done
|
||||
|
||||
iface_stop ${IFACE} || return 1 # always succeeds, btw
|
||||
|
||||
# Call user-defined postdown function if it exists
|
||||
if [[ $(type -t postdown) == function ]]; then
|
||||
einfo "Running postdown function"
|
||||
postdown ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
# vim:ts=4
|
||||
@@ -0,0 +1,34 @@
|
||||
# /etc/hosts: This file describes a number of hostname-to-address
|
||||
# mappings for the TCP/IP subsystem. It is mostly
|
||||
# used at boot time, when no name servers are running.
|
||||
# On small systems, this file can be used instead of a
|
||||
# "named" name server. Just add the names, addresses
|
||||
# and any aliases to this file...
|
||||
#
|
||||
|
||||
127.0.0.1 localhost
|
||||
|
||||
192.168.0.254 uml0.strongswan.org uml0
|
||||
10.1.0.254 uml1.strongswan.org uml1
|
||||
10.2.0.254 uml1.strongswan.org uml2
|
||||
|
||||
PH_IP_ALICE alice.strongswan.org alice
|
||||
PH_IP_VENUS venus.strongswan.org venus
|
||||
PH_IP1_MOON moon1.strongswan.org moon1
|
||||
PH_IP_MOON moon.strongswan.org moon
|
||||
PH_IP_CAROL carol.strongswan.org carol
|
||||
PH_IP1_CAROL carol1.strongswan.org carol1
|
||||
PH_IP_WINNETOU winnetou.strongswan.org winnetou crl.strongswan.org ocsp.strongswan.org ldap.strongswan.org
|
||||
PH_IP_DAVE dave.strongswan.org dave
|
||||
PH_IP1_DAVE dave1.strongswan.org dave1
|
||||
PH_IP_SUN sun.strongswan.org sun
|
||||
PH_IP1_SUN sun1.strongswan.org sun1
|
||||
PH_IP_BOB bob.strongswan.org bob
|
||||
|
||||
# IPV6 versions of localhost and co
|
||||
::1 ip6-localhost ip6-loopback
|
||||
fe00::0 ip6-localnet
|
||||
ff00::0 ip6-mcastprefix
|
||||
ff02::1 ip6-allnodes
|
||||
ff02::2 ip6-allrouters
|
||||
ff02::3 ip6-allhosts
|
||||
@@ -0,0 +1 @@
|
||||
HOSTNAME=moon
|
||||
@@ -0,0 +1,11 @@
|
||||
# /etc/conf.d/net:
|
||||
|
||||
# This is basically the ifconfig argument without the ifconfig $iface
|
||||
#
|
||||
iface_lo="127.0.0.1 netmask 255.0.0.0"
|
||||
iface_eth0="PH_IP_MOON broadcast 192.168.0.255 netmask 255.255.255.0"
|
||||
iface_eth1="PH_IP1_MOON broadcast 10.1.255.255 netmask 255.255.0.0"
|
||||
|
||||
# For setting the default gateway
|
||||
#
|
||||
gateway="eth0/192.168.0.254"
|
||||
Executable
+76
@@ -0,0 +1,76 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Foundation
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
opts="start stop reload"
|
||||
|
||||
depend() {
|
||||
before net
|
||||
need logger
|
||||
}
|
||||
|
||||
start() {
|
||||
ebegin "Starting firewall"
|
||||
|
||||
# enable IP forwarding
|
||||
echo 1 > /proc/sys/net/ipv4/ip_forward
|
||||
|
||||
# default policy is DROP
|
||||
/sbin/iptables -P INPUT DROP
|
||||
/sbin/iptables -P OUTPUT DROP
|
||||
/sbin/iptables -P FORWARD DROP
|
||||
|
||||
# allow esp
|
||||
iptables -A INPUT -i eth0 -p 50 -j ACCEPT
|
||||
iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
|
||||
|
||||
# allow IKE
|
||||
iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
|
||||
iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
|
||||
|
||||
# allow crl fetch from winnetou
|
||||
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
|
||||
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
|
||||
|
||||
# allow ssh
|
||||
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
|
||||
|
||||
eend $?
|
||||
}
|
||||
|
||||
stop() {
|
||||
ebegin "Stopping firewall"
|
||||
for a in `cat /proc/net/ip_tables_names`; do
|
||||
/sbin/iptables -F -t $a
|
||||
/sbin/iptables -X -t $a
|
||||
|
||||
if [ $a == nat ]; then
|
||||
/sbin/iptables -t nat -P PREROUTING ACCEPT
|
||||
/sbin/iptables -t nat -P POSTROUTING ACCEPT
|
||||
/sbin/iptables -t nat -P OUTPUT ACCEPT
|
||||
elif [ $a == mangle ]; then
|
||||
/sbin/iptables -t mangle -P PREROUTING ACCEPT
|
||||
/sbin/iptables -t mangle -P INPUT ACCEPT
|
||||
/sbin/iptables -t mangle -P FORWARD ACCEPT
|
||||
/sbin/iptables -t mangle -P OUTPUT ACCEPT
|
||||
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
|
||||
elif [ $a == filter ]; then
|
||||
/sbin/iptables -t filter -P INPUT ACCEPT
|
||||
/sbin/iptables -t filter -P FORWARD ACCEPT
|
||||
/sbin/iptables -t filter -P OUTPUT ACCEPT
|
||||
fi
|
||||
done
|
||||
eend $?
|
||||
}
|
||||
|
||||
reload() {
|
||||
ebegin "Flushing firewall"
|
||||
for a in `cat /proc/net/ip_tables_names`; do
|
||||
/sbin/iptables -F -t $a
|
||||
/sbin/iptables -X -t $a
|
||||
done;
|
||||
eend $?
|
||||
start
|
||||
}
|
||||
|
||||
Executable
+314
@@ -0,0 +1,314 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Technologies, Inc.
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
#NB: Config is in /etc/conf.d/net
|
||||
|
||||
if [[ -n $NET_DEBUG ]]; then
|
||||
set -x
|
||||
devnull=/dev/stderr
|
||||
else
|
||||
devnull=/dev/null
|
||||
fi
|
||||
|
||||
# For pcmcia users. note that pcmcia must be added to the same
|
||||
# runlevel as the net.* script that needs it.
|
||||
depend() {
|
||||
use hotplug pcmcia
|
||||
}
|
||||
|
||||
checkconfig() {
|
||||
if [[ -z "${ifconfig_IFACE}" ]]; then
|
||||
eerror "Please make sure that /etc/conf.d/net has \$ifconfig_$IFACE set"
|
||||
eerror "(or \$iface_$IFACE for old-style configuration)"
|
||||
return 1
|
||||
fi
|
||||
if [[ -n "${vlans_IFACE}" && ! -x /sbin/vconfig ]]; then
|
||||
eerror "For VLAN (802.1q) support, emerge net-misc/vconfig"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Fix bug 50039 (init.d/net.eth0 localization)
|
||||
# Some other commands in this script might need to be wrapped, but
|
||||
# we'll get them one-by-one. Note that LC_ALL trumps LC_anything_else
|
||||
# according to locale(7)
|
||||
ifconfig() {
|
||||
LC_ALL=C /sbin/ifconfig "$@"
|
||||
}
|
||||
|
||||
# setup_vars: setup variables based on $1 and content of /etc/conf.d/net
|
||||
# The following variables are set, which should be declared local by
|
||||
# the calling routine.
|
||||
# status_IFACE (up or '')
|
||||
# vlans_IFACE (space-separated list)
|
||||
# ifconfig_IFACE (array of ifconfig lines, replaces iface_IFACE)
|
||||
# dhcpcd_IFACE (command-line args for dhcpcd)
|
||||
# routes_IFACE (array of route lines)
|
||||
# inet6_IFACE (array of inet6 lines)
|
||||
# ifconfig_fallback_IFACE (fallback ifconfig if dhcp fails)
|
||||
setup_vars() {
|
||||
local i iface="${1//\./_}"
|
||||
|
||||
status_IFACE="$(ifconfig ${1} 2>${devnull} | gawk '$1 == "UP" {print "up"}')"
|
||||
eval vlans_IFACE=\"\$\{iface_${iface}_vlans\}\"
|
||||
eval ifconfig_IFACE=( \"\$\{ifconfig_$iface\[@\]\}\" )
|
||||
eval dhcpcd_IFACE=\"\$\{dhcpcd_$iface\}\"
|
||||
eval routes_IFACE=( \"\$\{routes_$iface\[@\]\}\" )
|
||||
eval inet6_IFACE=( \"\$\{inet6_$iface\[@\]\}\" )
|
||||
eval ifconfig_fallback_IFACE=( \"\$\{ifconfig_fallback_$iface\[@\]\}\" )
|
||||
|
||||
# BACKWARD COMPATIBILITY: populate the ifconfig_IFACE array
|
||||
# if iface_IFACE is set (fex. iface_eth0 instead of ifconfig_eth0)
|
||||
eval local iface_IFACE=\"\$\{iface_$iface\}\"
|
||||
if [[ -n ${iface_IFACE} && -z ${ifconfig_IFACE} ]]; then
|
||||
# Make sure these get evaluated as arrays
|
||||
local -a aliases broadcasts netmasks
|
||||
|
||||
# Start with the primary interface
|
||||
ifconfig_IFACE=( "${iface_IFACE}" )
|
||||
|
||||
# ..then add aliases
|
||||
eval aliases=( \$\{alias_$iface\} )
|
||||
eval broadcasts=( \$\{broadcast_$iface\} )
|
||||
eval netmasks=( \$\{netmask_$iface\} )
|
||||
for ((i = 0; i < ${#aliases[@]}; i = i + 1)); do
|
||||
ifconfig_IFACE[i+1]="${aliases[i]} ${broadcasts[i]:+broadcast ${broadcasts[i]}} ${netmasks[i]:+netmask ${netmasks[i]}}"
|
||||
done
|
||||
fi
|
||||
|
||||
# BACKWARD COMPATIBILITY: check for space-separated inet6 addresses
|
||||
if [[ ${#inet6_IFACE[@]} == 1 && ${inet6_IFACE} == *' '* ]]; then
|
||||
inet6_IFACE=( ${inet6_IFACE} )
|
||||
fi
|
||||
}
|
||||
|
||||
iface_start() {
|
||||
local IFACE=${1} i x retval
|
||||
checkconfig || return 1
|
||||
|
||||
if [[ ${ifconfig_IFACE} != dhcp ]]; then
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Bringing ${IFACE} up (${i})"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up"
|
||||
fi
|
||||
# ifconfig does not always return failure ..
|
||||
ifconfig ${IFACE} ${ifconfig_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
# Check that eth0 was not brought up by the kernel ...
|
||||
if [[ ${status_IFACE} == up ]]; then
|
||||
einfo "Keeping kernel configuration for ${IFACE}"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up via DHCP"
|
||||
/sbin/dhcpcd ${dhcpcd_IFACE} ${IFACE}
|
||||
retval=$?
|
||||
eend $retval
|
||||
if [[ $retval == 0 ]]; then
|
||||
# DHCP succeeded, show address retrieved
|
||||
i=$(ifconfig ${IFACE} | grep -m1 -o 'inet addr:[^ ]*' |
|
||||
cut -d: -f2)
|
||||
[[ -n ${i} ]] && einfo " ${IFACE} received address ${i}"
|
||||
elif [[ -n "${ifconfig_fallback_IFACE}" ]]; then
|
||||
# DHCP failed, try fallback.
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_fallback_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Using fallback configuration (${i}) for ${IFACE}"
|
||||
else
|
||||
ebegin "Using fallback configuration for ${IFACE}"
|
||||
fi
|
||||
ifconfig ${IFACE} ${ifconfig_fallback_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
return $retval
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ ${#ifconfig_IFACE[@]} -gt 1 ]]; then
|
||||
einfo " Adding aliases"
|
||||
for ((i = 1; i < ${#ifconfig_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE}:${i} (${ifconfig_IFACE[i]%% *})"
|
||||
ifconfig ${IFACE}:${i} ${ifconfig_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
if [[ -n ${inet6_IFACE} ]]; then
|
||||
einfo " Adding inet6 addresses"
|
||||
for ((i = 0; i < ${#inet6_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE} inet6 add ${inet6_IFACE[i]}"
|
||||
ifconfig ${IFACE} inet6 add ${inet6_IFACE[i]} >${devnull}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set static routes
|
||||
if [[ -n ${routes_IFACE} ]]; then
|
||||
einfo " Adding routes"
|
||||
for ((i = 0; i < ${#routes_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${routes_IFACE[i]}"
|
||||
/sbin/route add ${routes_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set default route if applicable to this interface
|
||||
if [[ ${gateway} == ${IFACE}/* ]]; then
|
||||
local ogw=$(/bin/netstat -rn | awk '$1 == "0.0.0.0" {print $2}')
|
||||
local gw=${gateway#*/}
|
||||
if [[ ${ogw} != ${gw} ]]; then
|
||||
ebegin " Setting default gateway ($gw)"
|
||||
|
||||
# First delete any existing route if it was setup by kernel...
|
||||
/sbin/route del default dev ${IFACE} &>${devnull}
|
||||
|
||||
# Second delete old gateway if it was set...
|
||||
/sbin/route del default gw ${ogw} &>${devnull}
|
||||
|
||||
# Third add our new default gateway
|
||||
/sbin/route add default gw ${gw} >${devnull}
|
||||
eend $? || {
|
||||
true # need to have some command in here
|
||||
# Note: This originally called stop, which is obviously
|
||||
# wrong since it's calling with a local version of IFACE.
|
||||
# The below code works correctly to abort configuration of
|
||||
# the interface, but is commented because we're assuming
|
||||
# that default route failure should not cause the interface
|
||||
# to be unconfigured.
|
||||
#local error=$?
|
||||
#ewarn "Aborting configuration of ${IFACE}"
|
||||
#iface_stop ${IFACE}
|
||||
#return ${error}
|
||||
}
|
||||
fi
|
||||
fi
|
||||
|
||||
# Enabling rp_filter causes wacky packets to be auto-dropped by
|
||||
# the kernel. Note that we only do this if it is not set via
|
||||
# /etc/sysctl.conf ...
|
||||
if [[ -e /proc/sys/net/ipv4/conf/${IFACE}/rp_filter && \
|
||||
-z "$(grep -s '^[^#]*rp_filter' /etc/sysctl.conf)" ]]; then
|
||||
echo -n 1 > /proc/sys/net/ipv4/conf/${IFACE}/rp_filter
|
||||
fi
|
||||
}
|
||||
|
||||
# iface_stop: bring down an interface. Don't trust information in
|
||||
# /etc/conf.d/net since the configuration might have changed since
|
||||
# iface_start ran. Instead query for current configuration and bring
|
||||
# down the interface.
|
||||
iface_stop() {
|
||||
local IFACE=${1} i x aliases inet6 count
|
||||
|
||||
# Try to do a simple down (no aliases, no inet6, no dhcp)
|
||||
aliases="$(ifconfig | grep -o "^$IFACE:[0-9]*" | tac)"
|
||||
inet6="$(ifconfig ${IFACE} | awk '$1 == "inet6" {print $2}')"
|
||||
if [[ -z ${aliases} && -z ${inet6} && ! -e /var/run/dhcpcd-${IFACE}.pid ]]; then
|
||||
ebegin "Bringing ${IFACE} down"
|
||||
ifconfig ${IFACE} down &>/dev/null
|
||||
eend 0
|
||||
return 0
|
||||
fi
|
||||
|
||||
einfo "Bringing ${IFACE} down"
|
||||
|
||||
# Stop aliases before primary interface.
|
||||
# Note this must be done in reverse order, since ifconfig eth0:1
|
||||
# will remove eth0:2, etc. It might be sufficient to simply remove
|
||||
# the base interface but we're being safe here.
|
||||
for i in ${aliases} ${IFACE}; do
|
||||
|
||||
# Delete all the inet6 addresses for this interface
|
||||
inet6="$(ifconfig ${i} | awk '$1 == "inet6" {print $3}')"
|
||||
if [[ -n ${inet6} ]]; then
|
||||
einfo " Removing inet6 addresses"
|
||||
for x in ${inet6}; do
|
||||
ebegin " ${IFACE} inet6 del ${x}"
|
||||
ifconfig ${i} inet6 del ${x}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Stop DHCP (should be N/A for aliases)
|
||||
# Don't trust current configuration... investigate ourselves
|
||||
if /sbin/dhcpcd -z ${i} &>${devnull}; then
|
||||
ebegin " Releasing DHCP lease for ${IFACE}"
|
||||
for ((count = 0; count < 9; count = count + 1)); do
|
||||
/sbin/dhcpcd -z ${i} &>${devnull} || break
|
||||
sleep 1
|
||||
done
|
||||
[[ ${count} -lt 9 ]]
|
||||
eend $? "Timed out"
|
||||
fi
|
||||
ebegin " Stopping ${i}"
|
||||
ifconfig ${i} down &>${devnull}
|
||||
eend 0
|
||||
done
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
start() {
|
||||
# These variables are set by setup_vars
|
||||
local status_IFACE vlans_IFACE dhcpcd_IFACE
|
||||
local -a ifconfig_IFACE routes_IFACE inet6_IFACE
|
||||
|
||||
# Call user-defined preup function if it exists
|
||||
if [[ $(type -t preup) == function ]]; then
|
||||
einfo "Running preup function"
|
||||
preup ${IFACE} || {
|
||||
eerror "preup ${IFACE} failed"
|
||||
return 1
|
||||
}
|
||||
fi
|
||||
|
||||
# Start the primary interface and aliases
|
||||
setup_vars ${IFACE}
|
||||
iface_start ${IFACE} || return 1
|
||||
|
||||
# Start vlans
|
||||
local vlan
|
||||
for vlan in ${vlans_IFACE}; do
|
||||
/sbin/vconfig add ${IFACE} ${vlan} >${devnull}
|
||||
setup_vars ${IFACE}.${vlan}
|
||||
iface_start ${IFACE}.${vlan}
|
||||
done
|
||||
|
||||
# Call user-defined postup function if it exists
|
||||
if [[ $(type -t postup) == function ]]; then
|
||||
einfo "Running postup function"
|
||||
postup ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
stop() {
|
||||
# Call user-defined predown function if it exists
|
||||
if [[ $(type -t predown) == function ]]; then
|
||||
einfo "Running predown function"
|
||||
predown ${IFACE}
|
||||
fi
|
||||
|
||||
# Don't depend on setup_vars since configuration might have changed.
|
||||
# Investigate current configuration instead.
|
||||
local vlan
|
||||
for vlan in $(ifconfig | grep -o "^${IFACE}\.[^ ]*"); do
|
||||
iface_stop ${vlan}
|
||||
/sbin/vconfig rem ${vlan} >${devnull}
|
||||
done
|
||||
|
||||
iface_stop ${IFACE} || return 1 # always succeeds, btw
|
||||
|
||||
# Call user-defined postdown function if it exists
|
||||
if [[ $(type -t postdown) == function ]]; then
|
||||
einfo "Running postdown function"
|
||||
postdown ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
# vim:ts=4
|
||||
Executable
+314
@@ -0,0 +1,314 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Technologies, Inc.
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
#NB: Config is in /etc/conf.d/net
|
||||
|
||||
if [[ -n $NET_DEBUG ]]; then
|
||||
set -x
|
||||
devnull=/dev/stderr
|
||||
else
|
||||
devnull=/dev/null
|
||||
fi
|
||||
|
||||
# For pcmcia users. note that pcmcia must be added to the same
|
||||
# runlevel as the net.* script that needs it.
|
||||
depend() {
|
||||
use hotplug pcmcia
|
||||
}
|
||||
|
||||
checkconfig() {
|
||||
if [[ -z "${ifconfig_IFACE}" ]]; then
|
||||
eerror "Please make sure that /etc/conf.d/net has \$ifconfig_$IFACE set"
|
||||
eerror "(or \$iface_$IFACE for old-style configuration)"
|
||||
return 1
|
||||
fi
|
||||
if [[ -n "${vlans_IFACE}" && ! -x /sbin/vconfig ]]; then
|
||||
eerror "For VLAN (802.1q) support, emerge net-misc/vconfig"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Fix bug 50039 (init.d/net.eth0 localization)
|
||||
# Some other commands in this script might need to be wrapped, but
|
||||
# we'll get them one-by-one. Note that LC_ALL trumps LC_anything_else
|
||||
# according to locale(7)
|
||||
ifconfig() {
|
||||
LC_ALL=C /sbin/ifconfig "$@"
|
||||
}
|
||||
|
||||
# setup_vars: setup variables based on $1 and content of /etc/conf.d/net
|
||||
# The following variables are set, which should be declared local by
|
||||
# the calling routine.
|
||||
# status_IFACE (up or '')
|
||||
# vlans_IFACE (space-separated list)
|
||||
# ifconfig_IFACE (array of ifconfig lines, replaces iface_IFACE)
|
||||
# dhcpcd_IFACE (command-line args for dhcpcd)
|
||||
# routes_IFACE (array of route lines)
|
||||
# inet6_IFACE (array of inet6 lines)
|
||||
# ifconfig_fallback_IFACE (fallback ifconfig if dhcp fails)
|
||||
setup_vars() {
|
||||
local i iface="${1//\./_}"
|
||||
|
||||
status_IFACE="$(ifconfig ${1} 2>${devnull} | gawk '$1 == "UP" {print "up"}')"
|
||||
eval vlans_IFACE=\"\$\{iface_${iface}_vlans\}\"
|
||||
eval ifconfig_IFACE=( \"\$\{ifconfig_$iface\[@\]\}\" )
|
||||
eval dhcpcd_IFACE=\"\$\{dhcpcd_$iface\}\"
|
||||
eval routes_IFACE=( \"\$\{routes_$iface\[@\]\}\" )
|
||||
eval inet6_IFACE=( \"\$\{inet6_$iface\[@\]\}\" )
|
||||
eval ifconfig_fallback_IFACE=( \"\$\{ifconfig_fallback_$iface\[@\]\}\" )
|
||||
|
||||
# BACKWARD COMPATIBILITY: populate the ifconfig_IFACE array
|
||||
# if iface_IFACE is set (fex. iface_eth0 instead of ifconfig_eth0)
|
||||
eval local iface_IFACE=\"\$\{iface_$iface\}\"
|
||||
if [[ -n ${iface_IFACE} && -z ${ifconfig_IFACE} ]]; then
|
||||
# Make sure these get evaluated as arrays
|
||||
local -a aliases broadcasts netmasks
|
||||
|
||||
# Start with the primary interface
|
||||
ifconfig_IFACE=( "${iface_IFACE}" )
|
||||
|
||||
# ..then add aliases
|
||||
eval aliases=( \$\{alias_$iface\} )
|
||||
eval broadcasts=( \$\{broadcast_$iface\} )
|
||||
eval netmasks=( \$\{netmask_$iface\} )
|
||||
for ((i = 0; i < ${#aliases[@]}; i = i + 1)); do
|
||||
ifconfig_IFACE[i+1]="${aliases[i]} ${broadcasts[i]:+broadcast ${broadcasts[i]}} ${netmasks[i]:+netmask ${netmasks[i]}}"
|
||||
done
|
||||
fi
|
||||
|
||||
# BACKWARD COMPATIBILITY: check for space-separated inet6 addresses
|
||||
if [[ ${#inet6_IFACE[@]} == 1 && ${inet6_IFACE} == *' '* ]]; then
|
||||
inet6_IFACE=( ${inet6_IFACE} )
|
||||
fi
|
||||
}
|
||||
|
||||
iface_start() {
|
||||
local IFACE=${1} i x retval
|
||||
checkconfig || return 1
|
||||
|
||||
if [[ ${ifconfig_IFACE} != dhcp ]]; then
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Bringing ${IFACE} up (${i})"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up"
|
||||
fi
|
||||
# ifconfig does not always return failure ..
|
||||
ifconfig ${IFACE} ${ifconfig_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
# Check that eth0 was not brought up by the kernel ...
|
||||
if [[ ${status_IFACE} == up ]]; then
|
||||
einfo "Keeping kernel configuration for ${IFACE}"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up via DHCP"
|
||||
/sbin/dhcpcd ${dhcpcd_IFACE} ${IFACE}
|
||||
retval=$?
|
||||
eend $retval
|
||||
if [[ $retval == 0 ]]; then
|
||||
# DHCP succeeded, show address retrieved
|
||||
i=$(ifconfig ${IFACE} | grep -m1 -o 'inet addr:[^ ]*' |
|
||||
cut -d: -f2)
|
||||
[[ -n ${i} ]] && einfo " ${IFACE} received address ${i}"
|
||||
elif [[ -n "${ifconfig_fallback_IFACE}" ]]; then
|
||||
# DHCP failed, try fallback.
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_fallback_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Using fallback configuration (${i}) for ${IFACE}"
|
||||
else
|
||||
ebegin "Using fallback configuration for ${IFACE}"
|
||||
fi
|
||||
ifconfig ${IFACE} ${ifconfig_fallback_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
return $retval
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ ${#ifconfig_IFACE[@]} -gt 1 ]]; then
|
||||
einfo " Adding aliases"
|
||||
for ((i = 1; i < ${#ifconfig_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE}:${i} (${ifconfig_IFACE[i]%% *})"
|
||||
ifconfig ${IFACE}:${i} ${ifconfig_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
if [[ -n ${inet6_IFACE} ]]; then
|
||||
einfo " Adding inet6 addresses"
|
||||
for ((i = 0; i < ${#inet6_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE} inet6 add ${inet6_IFACE[i]}"
|
||||
ifconfig ${IFACE} inet6 add ${inet6_IFACE[i]} >${devnull}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set static routes
|
||||
if [[ -n ${routes_IFACE} ]]; then
|
||||
einfo " Adding routes"
|
||||
for ((i = 0; i < ${#routes_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${routes_IFACE[i]}"
|
||||
/sbin/route add ${routes_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set default route if applicable to this interface
|
||||
if [[ ${gateway} == ${IFACE}/* ]]; then
|
||||
local ogw=$(/bin/netstat -rn | awk '$1 == "0.0.0.0" {print $2}')
|
||||
local gw=${gateway#*/}
|
||||
if [[ ${ogw} != ${gw} ]]; then
|
||||
ebegin " Setting default gateway ($gw)"
|
||||
|
||||
# First delete any existing route if it was setup by kernel...
|
||||
/sbin/route del default dev ${IFACE} &>${devnull}
|
||||
|
||||
# Second delete old gateway if it was set...
|
||||
/sbin/route del default gw ${ogw} &>${devnull}
|
||||
|
||||
# Third add our new default gateway
|
||||
/sbin/route add default gw ${gw} >${devnull}
|
||||
eend $? || {
|
||||
true # need to have some command in here
|
||||
# Note: This originally called stop, which is obviously
|
||||
# wrong since it's calling with a local version of IFACE.
|
||||
# The below code works correctly to abort configuration of
|
||||
# the interface, but is commented because we're assuming
|
||||
# that default route failure should not cause the interface
|
||||
# to be unconfigured.
|
||||
#local error=$?
|
||||
#ewarn "Aborting configuration of ${IFACE}"
|
||||
#iface_stop ${IFACE}
|
||||
#return ${error}
|
||||
}
|
||||
fi
|
||||
fi
|
||||
|
||||
# Enabling rp_filter causes wacky packets to be auto-dropped by
|
||||
# the kernel. Note that we only do this if it is not set via
|
||||
# /etc/sysctl.conf ...
|
||||
if [[ -e /proc/sys/net/ipv4/conf/${IFACE}/rp_filter && \
|
||||
-z "$(grep -s '^[^#]*rp_filter' /etc/sysctl.conf)" ]]; then
|
||||
echo -n 1 > /proc/sys/net/ipv4/conf/${IFACE}/rp_filter
|
||||
fi
|
||||
}
|
||||
|
||||
# iface_stop: bring down an interface. Don't trust information in
|
||||
# /etc/conf.d/net since the configuration might have changed since
|
||||
# iface_start ran. Instead query for current configuration and bring
|
||||
# down the interface.
|
||||
iface_stop() {
|
||||
local IFACE=${1} i x aliases inet6 count
|
||||
|
||||
# Try to do a simple down (no aliases, no inet6, no dhcp)
|
||||
aliases="$(ifconfig | grep -o "^$IFACE:[0-9]*" | tac)"
|
||||
inet6="$(ifconfig ${IFACE} | awk '$1 == "inet6" {print $2}')"
|
||||
if [[ -z ${aliases} && -z ${inet6} && ! -e /var/run/dhcpcd-${IFACE}.pid ]]; then
|
||||
ebegin "Bringing ${IFACE} down"
|
||||
ifconfig ${IFACE} down &>/dev/null
|
||||
eend 0
|
||||
return 0
|
||||
fi
|
||||
|
||||
einfo "Bringing ${IFACE} down"
|
||||
|
||||
# Stop aliases before primary interface.
|
||||
# Note this must be done in reverse order, since ifconfig eth0:1
|
||||
# will remove eth0:2, etc. It might be sufficient to simply remove
|
||||
# the base interface but we're being safe here.
|
||||
for i in ${aliases} ${IFACE}; do
|
||||
|
||||
# Delete all the inet6 addresses for this interface
|
||||
inet6="$(ifconfig ${i} | awk '$1 == "inet6" {print $3}')"
|
||||
if [[ -n ${inet6} ]]; then
|
||||
einfo " Removing inet6 addresses"
|
||||
for x in ${inet6}; do
|
||||
ebegin " ${IFACE} inet6 del ${x}"
|
||||
ifconfig ${i} inet6 del ${x}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Stop DHCP (should be N/A for aliases)
|
||||
# Don't trust current configuration... investigate ourselves
|
||||
if /sbin/dhcpcd -z ${i} &>${devnull}; then
|
||||
ebegin " Releasing DHCP lease for ${IFACE}"
|
||||
for ((count = 0; count < 9; count = count + 1)); do
|
||||
/sbin/dhcpcd -z ${i} &>${devnull} || break
|
||||
sleep 1
|
||||
done
|
||||
[[ ${count} -lt 9 ]]
|
||||
eend $? "Timed out"
|
||||
fi
|
||||
ebegin " Stopping ${i}"
|
||||
ifconfig ${i} down &>${devnull}
|
||||
eend 0
|
||||
done
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
start() {
|
||||
# These variables are set by setup_vars
|
||||
local status_IFACE vlans_IFACE dhcpcd_IFACE
|
||||
local -a ifconfig_IFACE routes_IFACE inet6_IFACE
|
||||
|
||||
# Call user-defined preup function if it exists
|
||||
if [[ $(type -t preup) == function ]]; then
|
||||
einfo "Running preup function"
|
||||
preup ${IFACE} || {
|
||||
eerror "preup ${IFACE} failed"
|
||||
return 1
|
||||
}
|
||||
fi
|
||||
|
||||
# Start the primary interface and aliases
|
||||
setup_vars ${IFACE}
|
||||
iface_start ${IFACE} || return 1
|
||||
|
||||
# Start vlans
|
||||
local vlan
|
||||
for vlan in ${vlans_IFACE}; do
|
||||
/sbin/vconfig add ${IFACE} ${vlan} >${devnull}
|
||||
setup_vars ${IFACE}.${vlan}
|
||||
iface_start ${IFACE}.${vlan}
|
||||
done
|
||||
|
||||
# Call user-defined postup function if it exists
|
||||
if [[ $(type -t postup) == function ]]; then
|
||||
einfo "Running postup function"
|
||||
postup ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
stop() {
|
||||
# Call user-defined predown function if it exists
|
||||
if [[ $(type -t predown) == function ]]; then
|
||||
einfo "Running predown function"
|
||||
predown ${IFACE}
|
||||
fi
|
||||
|
||||
# Don't depend on setup_vars since configuration might have changed.
|
||||
# Investigate current configuration instead.
|
||||
local vlan
|
||||
for vlan in $(ifconfig | grep -o "^${IFACE}\.[^ ]*"); do
|
||||
iface_stop ${vlan}
|
||||
/sbin/vconfig rem ${vlan} >${devnull}
|
||||
done
|
||||
|
||||
iface_stop ${IFACE} || return 1 # always succeeds, btw
|
||||
|
||||
# Call user-defined postdown function if it exists
|
||||
if [[ $(type -t postdown) == function ]]; then
|
||||
einfo "Running postdown function"
|
||||
postdown ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
# vim:ts=4
|
||||
Executable
+36
@@ -0,0 +1,36 @@
|
||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
version 2.0 # conforms to second version of ipsec.conf specification
|
||||
|
||||
config setup
|
||||
plutodebug=control
|
||||
crlcheckinterval=180
|
||||
strictcrlpolicy=no
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
left=192.168.0.1
|
||||
leftnexthop=%direct
|
||||
leftcert=moonCert.pem
|
||||
[email protected]
|
||||
leftfirewall=yes
|
||||
|
||||
conn net-net
|
||||
leftsubnet=10.1.0.0/16
|
||||
right=192.168.0.2
|
||||
rightsubnet=10.2.0.0/16
|
||||
[email protected]
|
||||
auto=add
|
||||
|
||||
conn host-host
|
||||
right=192.168.0.2
|
||||
[email protected]
|
||||
auto=add
|
||||
|
||||
conn rw
|
||||
leftsubnet=10.1.0.0/16
|
||||
right=%any
|
||||
auto=add
|
||||
@@ -0,0 +1,22 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDtTCCAp2gAwIBAgIBADANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
|
||||
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
|
||||
b290IENBMB4XDTA0MDkxMDExMDE0NVoXDTE0MDkwODExMDE0NVowRTELMAkGA1UE
|
||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0cm9u
|
||||
Z1N3YW4gUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL/y
|
||||
X2LqPVZuWLPIeknK86xhz6ljd3NNhC2z+P1uoCP3sBMuZiZQEjFzhnKcbXxCeo2f
|
||||
FnvhOOjrrisSuVkzuu82oxXD3fIkzuS7m9V4E10EZzgmKWIf+WuNRfbgAuUINmLc
|
||||
4YGAXBQLPyzpP4Ou48hhz/YQo58Bics6PHy5v34qCVROIXDvqhj91P8g+pS+F21/
|
||||
7P+CH2jRcVIEHZtG8M/PweTPQ95dPzpYd2Ov6SZ/U7EWmbMmT8VcUYn1aChxFmy5
|
||||
gweVBWlkH6MP+1DeE0/tL5c87xo5KCeGK8Tdqpe7sBRC4pPEEHDQciTUvkeuJ1Pr
|
||||
K+1LwdqRxo7HgMRiDw8CAwEAAaOBrzCBrDAPBgNVHRMBAf8EBTADAQH/MAsGA1Ud
|
||||
DwQEAwIBBjAdBgNVHQ4EFgQUXafdcAZRMn7ntm2zteXgYOouTe8wbQYDVR0jBGYw
|
||||
ZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJBgNVBAYTAkNIMRkwFwYD
|
||||
VQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJvbmdTd2FuIFJvb3Qg
|
||||
Q0GCAQAwDQYJKoZIhvcNAQEEBQADggEBAJrXTj5gWS37myHHhii9drYwkMFyDHS/
|
||||
lHU8rW/drcnHdus507+qUhNr9SiEAHg4Ywj895UDvT0a1sFaw44QyEa/94iKA8/n
|
||||
+g5kS1IrKvWu3wu8UI3EgzChgHV3cncQlQWbK+FI9Y3Ax1O1np1r+wLptoWpKKKE
|
||||
UxsYcxP9K4Nbyeon0AIHOajUheiL3t6aRc3m0o7VU7Do6S2r+He+1Zq/nRUfFeTy
|
||||
0Atebkn8tmUpPSKWaXkmwpVNrjZ1Qu9umAU+dtJyhzL2zmnyhPC4VqpsKCOp7imy
|
||||
gKZvUIKPm1zyf4T+yjwxwkiX2xVseoM3aKswb1EoZFelHwndU7u0GQ8=
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,24 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEDTCCAvWgAwIBAgIBAzANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
|
||||
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
|
||||
b290IENBMB4XDTA0MDkxMDExMTcyNVoXDTA5MDkwOTExMTcyNVowRjELMAkGA1UE
|
||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xHDAaBgNVBAMTE21vb24u
|
||||
c3Ryb25nc3dhbi5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCv
|
||||
ri4QmsCnG0N7bxqeUZTQhcmZ/iyN4RsmHwFsiOc06xpnZ7Fbx9gzi/OswU6KGL+F
|
||||
f9PfvOY36bDTZU8V2QaL30RQUXz3JlG+jUyP9zjqlhsvVYS/cImvqgo3uUkQ0YCD
|
||||
v2SafTlaQfBOaPFElNEP/H2YSiyB6X80IcHsOMYpskVqPY8785FehjF+pxuyRCK+
|
||||
9HXmd+iWdnC09u4qgKRa3L0IamU3q1/BK/afkHK2IAIN4YgM7GzepHVD0f7Exf9U
|
||||
esJEeh4hDZwSjcMzdybrY9XBxzGqLGPOF128jr+5weUZiBW+RzeBw/gsK1nSPeuX
|
||||
Od2lPJjTGj+6V3YK6qibAgMBAAGjggEFMIIBATAJBgNVHRMEAjAAMAsGA1UdDwQE
|
||||
AwIDqDAdBgNVHQ4EFgQU5eQQh2wqxL6thUlCpt52WDA6n8EwbQYDVR0jBGYwZIAU
|
||||
XafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJBgNVBAYTAkNIMRkwFwYDVQQK
|
||||
ExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJvbmdTd2FuIFJvb3QgQ0GC
|
||||
AQAwHgYDVR0RBBcwFYITbW9vbi5zdHJvbmdzd2FuLm9yZzA5BgNVHR8EMjAwMC6g
|
||||
LKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3JnL3N0cm9uZ3N3YW4uY3JsMA0G
|
||||
CSqGSIb3DQEBBAUAA4IBAQAvLykhZnqldrsMcbYB36WzWKk+hOihr5dU3fv8Z4ec
|
||||
tsa3gzxXSefDCxGoezVJ4QXdpdNxxFn31A+r1gxKyGI5JL6EyWz6Y462zp9lE7nW
|
||||
EIC4ldJwxAXqzDEMcJphO29hApyU9TWsWDa4kL5AKtLFLwH3/Uv/jAzAy+qXIO8h
|
||||
wLtB+wcmhSo8OFY9kX/cyhht7eb7yD/r2e3wVBOCRk7jePe4yWhN8NJAKwfrEd1K
|
||||
iGq15ymdmeomhplHRsLZwA2VsCspUNZ/eXjG21s3nEoxcCOcQUz3Q7q4ZgBTZoCW
|
||||
kAc6FQ5zxoZrmzNWFqzb06jmUVlt7baGtdjT7rEt+dcp
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,27 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEowIBAAKCAQEAr64uEJrApxtDe28anlGU0IXJmf4sjeEbJh8BbIjnNOsaZ2ex
|
||||
W8fYM4vzrMFOihi/hX/T37zmN+mw02VPFdkGi99EUFF89yZRvo1Mj/c46pYbL1WE
|
||||
v3CJr6oKN7lJENGAg79kmn05WkHwTmjxRJTRD/x9mEosgel/NCHB7DjGKbJFaj2P
|
||||
O/ORXoYxfqcbskQivvR15nfolnZwtPbuKoCkWty9CGplN6tfwSv2n5BytiACDeGI
|
||||
DOxs3qR1Q9H+xMX/VHrCRHoeIQ2cEo3DM3cm62PVwccxqixjzhddvI6/ucHlGYgV
|
||||
vkc3gcP4LCtZ0j3rlzndpTyY0xo/uld2CuqomwIDAQABAoIBAECAVQ1npCA2lFo3
|
||||
erByB49f75sIhVc6NPuUGrO8uBbn0vPwUGAASdLzKW5eMvXlDDx5qFLXSjdxJ6kV
|
||||
4ymEWzDzsmNC5/zeJtkti9S30j/fCPAiF/Ep4oOKjOHUt4zjPqoglVFbdLk8yHwh
|
||||
b6Pcd73E2GAXq6uvDTMYydhvJ+KaozAfbXmQ9vf3HbneI6xmgAug209Cu+gpMspW
|
||||
4IunMMY/668neRmM7jh+4JNLMqJhCrmQpLkIlRux2yNFzxkF8RrqptGzaLf4KxNF
|
||||
rRRUThHUfWmB/EvggzJgUMuVA2Pa0bKNvBbbQuwPqXMxLHMGBjvJ8wimsLzJZeXL
|
||||
fgsyPKECgYEA5x//2cmlKL3LbprRpfSzVOPqM3OSeEqseQtPun9Gs7WNVZZVc/ZJ
|
||||
O2hjdc9qDGjak3lDSwVbYl8B1kqfGTTLB1sl2171aDJQOWdNV3WQtexUKEhC4Ewn
|
||||
yXEDoVGAXJtiCj34QYHjoMEHUqfabKyWKUcaK8hbMsOhYPOorfLXg9MCgYEAwpaP
|
||||
W68NJGu5Zxsdz62rOiPNb58cuoxLDZsJ1sMKJO7BdPIqTZ0oGNdgt5phyc3ROBSH
|
||||
cjqZdzpim1gXGm4ocGvwg3APNQN6DLBknJNZmHzPd7RLSz2UxhTHRTfHAltQPcmW
|
||||
cJVBHsrsS0QnvDndXfzLuLq12S6UZasR5eBdcxkCgYEAizBuOI6DdGG4nceG8lbH
|
||||
mRwY8xtq3h66d7skLMBxp9ByaVS76bYsrCZVn6Fl0EtlNuMUb52uRzPIO3F9FwUA
|
||||
MFHoHpC1YibKwYdAwKcAm07T7950x/eVDm+NLB2VHDBHfruLQogiubEF4/VKSaA2
|
||||
Xm1/iVaD9bJzAZw7vWY9/BkCgYB/Xe9uErGmgkB0BaLIuiNWxfKFOn+id4v01uNk
|
||||
yHtOW10TgCNCdDi3sdpjs1CIuAhXDdDuav7itLuwdMOCkFI16+EdF29Mwv7TaW4h
|
||||
sq01i5R9BO03zZIg6Z7ZZr4Dg+OM3fNzs65RSn/KcE0V/kYwa/So8MVw5/VIauYn
|
||||
MmnYmQKBgDEFWQPyPH242olRqtE0yDp8qVHEjJp7mU822YFbyCyAUnttqOS+/5/u
|
||||
Z7H95QZHGaQESL1tcNnaiRASJAKDWjKOdM/TTotWjCn65v+DHvgk/IJeYJVHoGBS
|
||||
pBE+wJ8AZJu3t9GVp3PxFxHIjxUrEKG0rli7bYv8F245+Wx8DeXI
|
||||
-----END RSA PRIVATE KEY-----
|
||||
@@ -0,0 +1,7 @@
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
|
||||
: RSA moonKey.pem
|
||||
|
||||
|
||||
|
||||
|
||||
+314
@@ -0,0 +1,314 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Technologies, Inc.
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
#NB: Config is in /etc/conf.d/net
|
||||
|
||||
if [[ -n $NET_DEBUG ]]; then
|
||||
set -x
|
||||
devnull=/dev/stderr
|
||||
else
|
||||
devnull=/dev/null
|
||||
fi
|
||||
|
||||
# For pcmcia users. note that pcmcia must be added to the same
|
||||
# runlevel as the net.* script that needs it.
|
||||
depend() {
|
||||
use hotplug pcmcia
|
||||
}
|
||||
|
||||
checkconfig() {
|
||||
if [[ -z "${ifconfig_IFACE}" ]]; then
|
||||
eerror "Please make sure that /etc/conf.d/net has \$ifconfig_$IFACE set"
|
||||
eerror "(or \$iface_$IFACE for old-style configuration)"
|
||||
return 1
|
||||
fi
|
||||
if [[ -n "${vlans_IFACE}" && ! -x /sbin/vconfig ]]; then
|
||||
eerror "For VLAN (802.1q) support, emerge net-misc/vconfig"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Fix bug 50039 (init.d/net.eth0 localization)
|
||||
# Some other commands in this script might need to be wrapped, but
|
||||
# we'll get them one-by-one. Note that LC_ALL trumps LC_anything_else
|
||||
# according to locale(7)
|
||||
ifconfig() {
|
||||
LC_ALL=C /sbin/ifconfig "$@"
|
||||
}
|
||||
|
||||
# setup_vars: setup variables based on $1 and content of /etc/conf.d/net
|
||||
# The following variables are set, which should be declared local by
|
||||
# the calling routine.
|
||||
# status_IFACE (up or '')
|
||||
# vlans_IFACE (space-separated list)
|
||||
# ifconfig_IFACE (array of ifconfig lines, replaces iface_IFACE)
|
||||
# dhcpcd_IFACE (command-line args for dhcpcd)
|
||||
# routes_IFACE (array of route lines)
|
||||
# inet6_IFACE (array of inet6 lines)
|
||||
# ifconfig_fallback_IFACE (fallback ifconfig if dhcp fails)
|
||||
setup_vars() {
|
||||
local i iface="${1//\./_}"
|
||||
|
||||
status_IFACE="$(ifconfig ${1} 2>${devnull} | gawk '$1 == "UP" {print "up"}')"
|
||||
eval vlans_IFACE=\"\$\{iface_${iface}_vlans\}\"
|
||||
eval ifconfig_IFACE=( \"\$\{ifconfig_$iface\[@\]\}\" )
|
||||
eval dhcpcd_IFACE=\"\$\{dhcpcd_$iface\}\"
|
||||
eval routes_IFACE=( \"\$\{routes_$iface\[@\]\}\" )
|
||||
eval inet6_IFACE=( \"\$\{inet6_$iface\[@\]\}\" )
|
||||
eval ifconfig_fallback_IFACE=( \"\$\{ifconfig_fallback_$iface\[@\]\}\" )
|
||||
|
||||
# BACKWARD COMPATIBILITY: populate the ifconfig_IFACE array
|
||||
# if iface_IFACE is set (fex. iface_eth0 instead of ifconfig_eth0)
|
||||
eval local iface_IFACE=\"\$\{iface_$iface\}\"
|
||||
if [[ -n ${iface_IFACE} && -z ${ifconfig_IFACE} ]]; then
|
||||
# Make sure these get evaluated as arrays
|
||||
local -a aliases broadcasts netmasks
|
||||
|
||||
# Start with the primary interface
|
||||
ifconfig_IFACE=( "${iface_IFACE}" )
|
||||
|
||||
# ..then add aliases
|
||||
eval aliases=( \$\{alias_$iface\} )
|
||||
eval broadcasts=( \$\{broadcast_$iface\} )
|
||||
eval netmasks=( \$\{netmask_$iface\} )
|
||||
for ((i = 0; i < ${#aliases[@]}; i = i + 1)); do
|
||||
ifconfig_IFACE[i+1]="${aliases[i]} ${broadcasts[i]:+broadcast ${broadcasts[i]}} ${netmasks[i]:+netmask ${netmasks[i]}}"
|
||||
done
|
||||
fi
|
||||
|
||||
# BACKWARD COMPATIBILITY: check for space-separated inet6 addresses
|
||||
if [[ ${#inet6_IFACE[@]} == 1 && ${inet6_IFACE} == *' '* ]]; then
|
||||
inet6_IFACE=( ${inet6_IFACE} )
|
||||
fi
|
||||
}
|
||||
|
||||
iface_start() {
|
||||
local IFACE=${1} i x retval
|
||||
checkconfig || return 1
|
||||
|
||||
if [[ ${ifconfig_IFACE} != dhcp ]]; then
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Bringing ${IFACE} up (${i})"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up"
|
||||
fi
|
||||
# ifconfig does not always return failure ..
|
||||
ifconfig ${IFACE} ${ifconfig_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
# Check that eth0 was not brought up by the kernel ...
|
||||
if [[ ${status_IFACE} == up ]]; then
|
||||
einfo "Keeping kernel configuration for ${IFACE}"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up via DHCP"
|
||||
/sbin/dhcpcd ${dhcpcd_IFACE} ${IFACE}
|
||||
retval=$?
|
||||
eend $retval
|
||||
if [[ $retval == 0 ]]; then
|
||||
# DHCP succeeded, show address retrieved
|
||||
i=$(ifconfig ${IFACE} | grep -m1 -o 'inet addr:[^ ]*' |
|
||||
cut -d: -f2)
|
||||
[[ -n ${i} ]] && einfo " ${IFACE} received address ${i}"
|
||||
elif [[ -n "${ifconfig_fallback_IFACE}" ]]; then
|
||||
# DHCP failed, try fallback.
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_fallback_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Using fallback configuration (${i}) for ${IFACE}"
|
||||
else
|
||||
ebegin "Using fallback configuration for ${IFACE}"
|
||||
fi
|
||||
ifconfig ${IFACE} ${ifconfig_fallback_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
return $retval
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ ${#ifconfig_IFACE[@]} -gt 1 ]]; then
|
||||
einfo " Adding aliases"
|
||||
for ((i = 1; i < ${#ifconfig_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE}:${i} (${ifconfig_IFACE[i]%% *})"
|
||||
ifconfig ${IFACE}:${i} ${ifconfig_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
if [[ -n ${inet6_IFACE} ]]; then
|
||||
einfo " Adding inet6 addresses"
|
||||
for ((i = 0; i < ${#inet6_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE} inet6 add ${inet6_IFACE[i]}"
|
||||
ifconfig ${IFACE} inet6 add ${inet6_IFACE[i]} >${devnull}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set static routes
|
||||
if [[ -n ${routes_IFACE} ]]; then
|
||||
einfo " Adding routes"
|
||||
for ((i = 0; i < ${#routes_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${routes_IFACE[i]}"
|
||||
/sbin/route add ${routes_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set default route if applicable to this interface
|
||||
if [[ ${gateway} == ${IFACE}/* ]]; then
|
||||
local ogw=$(/bin/netstat -rn | awk '$1 == "0.0.0.0" {print $2}')
|
||||
local gw=${gateway#*/}
|
||||
if [[ ${ogw} != ${gw} ]]; then
|
||||
ebegin " Setting default gateway ($gw)"
|
||||
|
||||
# First delete any existing route if it was setup by kernel...
|
||||
/sbin/route del default dev ${IFACE} &>${devnull}
|
||||
|
||||
# Second delete old gateway if it was set...
|
||||
/sbin/route del default gw ${ogw} &>${devnull}
|
||||
|
||||
# Third add our new default gateway
|
||||
/sbin/route add default gw ${gw} >${devnull}
|
||||
eend $? || {
|
||||
true # need to have some command in here
|
||||
# Note: This originally called stop, which is obviously
|
||||
# wrong since it's calling with a local version of IFACE.
|
||||
# The below code works correctly to abort configuration of
|
||||
# the interface, but is commented because we're assuming
|
||||
# that default route failure should not cause the interface
|
||||
# to be unconfigured.
|
||||
#local error=$?
|
||||
#ewarn "Aborting configuration of ${IFACE}"
|
||||
#iface_stop ${IFACE}
|
||||
#return ${error}
|
||||
}
|
||||
fi
|
||||
fi
|
||||
|
||||
# Enabling rp_filter causes wacky packets to be auto-dropped by
|
||||
# the kernel. Note that we only do this if it is not set via
|
||||
# /etc/sysctl.conf ...
|
||||
if [[ -e /proc/sys/net/ipv4/conf/${IFACE}/rp_filter && \
|
||||
-z "$(grep -s '^[^#]*rp_filter' /etc/sysctl.conf)" ]]; then
|
||||
echo -n 1 > /proc/sys/net/ipv4/conf/${IFACE}/rp_filter
|
||||
fi
|
||||
}
|
||||
|
||||
# iface_stop: bring down an interface. Don't trust information in
|
||||
# /etc/conf.d/net since the configuration might have changed since
|
||||
# iface_start ran. Instead query for current configuration and bring
|
||||
# down the interface.
|
||||
iface_stop() {
|
||||
local IFACE=${1} i x aliases inet6 count
|
||||
|
||||
# Try to do a simple down (no aliases, no inet6, no dhcp)
|
||||
aliases="$(ifconfig | grep -o "^$IFACE:[0-9]*" | tac)"
|
||||
inet6="$(ifconfig ${IFACE} | awk '$1 == "inet6" {print $2}')"
|
||||
if [[ -z ${aliases} && -z ${inet6} && ! -e /var/run/dhcpcd-${IFACE}.pid ]]; then
|
||||
ebegin "Bringing ${IFACE} down"
|
||||
ifconfig ${IFACE} down &>/dev/null
|
||||
eend 0
|
||||
return 0
|
||||
fi
|
||||
|
||||
einfo "Bringing ${IFACE} down"
|
||||
|
||||
# Stop aliases before primary interface.
|
||||
# Note this must be done in reverse order, since ifconfig eth0:1
|
||||
# will remove eth0:2, etc. It might be sufficient to simply remove
|
||||
# the base interface but we're being safe here.
|
||||
for i in ${aliases} ${IFACE}; do
|
||||
|
||||
# Delete all the inet6 addresses for this interface
|
||||
inet6="$(ifconfig ${i} | awk '$1 == "inet6" {print $3}')"
|
||||
if [[ -n ${inet6} ]]; then
|
||||
einfo " Removing inet6 addresses"
|
||||
for x in ${inet6}; do
|
||||
ebegin " ${IFACE} inet6 del ${x}"
|
||||
ifconfig ${i} inet6 del ${x}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Stop DHCP (should be N/A for aliases)
|
||||
# Don't trust current configuration... investigate ourselves
|
||||
if /sbin/dhcpcd -z ${i} &>${devnull}; then
|
||||
ebegin " Releasing DHCP lease for ${IFACE}"
|
||||
for ((count = 0; count < 9; count = count + 1)); do
|
||||
/sbin/dhcpcd -z ${i} &>${devnull} || break
|
||||
sleep 1
|
||||
done
|
||||
[[ ${count} -lt 9 ]]
|
||||
eend $? "Timed out"
|
||||
fi
|
||||
ebegin " Stopping ${i}"
|
||||
ifconfig ${i} down &>${devnull}
|
||||
eend 0
|
||||
done
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
start() {
|
||||
# These variables are set by setup_vars
|
||||
local status_IFACE vlans_IFACE dhcpcd_IFACE
|
||||
local -a ifconfig_IFACE routes_IFACE inet6_IFACE
|
||||
|
||||
# Call user-defined preup function if it exists
|
||||
if [[ $(type -t preup) == function ]]; then
|
||||
einfo "Running preup function"
|
||||
preup ${IFACE} || {
|
||||
eerror "preup ${IFACE} failed"
|
||||
return 1
|
||||
}
|
||||
fi
|
||||
|
||||
# Start the primary interface and aliases
|
||||
setup_vars ${IFACE}
|
||||
iface_start ${IFACE} || return 1
|
||||
|
||||
# Start vlans
|
||||
local vlan
|
||||
for vlan in ${vlans_IFACE}; do
|
||||
/sbin/vconfig add ${IFACE} ${vlan} >${devnull}
|
||||
setup_vars ${IFACE}.${vlan}
|
||||
iface_start ${IFACE}.${vlan}
|
||||
done
|
||||
|
||||
# Call user-defined postup function if it exists
|
||||
if [[ $(type -t postup) == function ]]; then
|
||||
einfo "Running postup function"
|
||||
postup ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
stop() {
|
||||
# Call user-defined predown function if it exists
|
||||
if [[ $(type -t predown) == function ]]; then
|
||||
einfo "Running predown function"
|
||||
predown ${IFACE}
|
||||
fi
|
||||
|
||||
# Don't depend on setup_vars since configuration might have changed.
|
||||
# Investigate current configuration instead.
|
||||
local vlan
|
||||
for vlan in $(ifconfig | grep -o "^${IFACE}\.[^ ]*"); do
|
||||
iface_stop ${vlan}
|
||||
/sbin/vconfig rem ${vlan} >${devnull}
|
||||
done
|
||||
|
||||
iface_stop ${IFACE} || return 1 # always succeeds, btw
|
||||
|
||||
# Call user-defined postdown function if it exists
|
||||
if [[ $(type -t postdown) == function ]]; then
|
||||
einfo "Running postdown function"
|
||||
postdown ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
# vim:ts=4
|
||||
+314
@@ -0,0 +1,314 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Technologies, Inc.
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
#NB: Config is in /etc/conf.d/net
|
||||
|
||||
if [[ -n $NET_DEBUG ]]; then
|
||||
set -x
|
||||
devnull=/dev/stderr
|
||||
else
|
||||
devnull=/dev/null
|
||||
fi
|
||||
|
||||
# For pcmcia users. note that pcmcia must be added to the same
|
||||
# runlevel as the net.* script that needs it.
|
||||
depend() {
|
||||
use hotplug pcmcia
|
||||
}
|
||||
|
||||
checkconfig() {
|
||||
if [[ -z "${ifconfig_IFACE}" ]]; then
|
||||
eerror "Please make sure that /etc/conf.d/net has \$ifconfig_$IFACE set"
|
||||
eerror "(or \$iface_$IFACE for old-style configuration)"
|
||||
return 1
|
||||
fi
|
||||
if [[ -n "${vlans_IFACE}" && ! -x /sbin/vconfig ]]; then
|
||||
eerror "For VLAN (802.1q) support, emerge net-misc/vconfig"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Fix bug 50039 (init.d/net.eth0 localization)
|
||||
# Some other commands in this script might need to be wrapped, but
|
||||
# we'll get them one-by-one. Note that LC_ALL trumps LC_anything_else
|
||||
# according to locale(7)
|
||||
ifconfig() {
|
||||
LC_ALL=C /sbin/ifconfig "$@"
|
||||
}
|
||||
|
||||
# setup_vars: setup variables based on $1 and content of /etc/conf.d/net
|
||||
# The following variables are set, which should be declared local by
|
||||
# the calling routine.
|
||||
# status_IFACE (up or '')
|
||||
# vlans_IFACE (space-separated list)
|
||||
# ifconfig_IFACE (array of ifconfig lines, replaces iface_IFACE)
|
||||
# dhcpcd_IFACE (command-line args for dhcpcd)
|
||||
# routes_IFACE (array of route lines)
|
||||
# inet6_IFACE (array of inet6 lines)
|
||||
# ifconfig_fallback_IFACE (fallback ifconfig if dhcp fails)
|
||||
setup_vars() {
|
||||
local i iface="${1//\./_}"
|
||||
|
||||
status_IFACE="$(ifconfig ${1} 2>${devnull} | gawk '$1 == "UP" {print "up"}')"
|
||||
eval vlans_IFACE=\"\$\{iface_${iface}_vlans\}\"
|
||||
eval ifconfig_IFACE=( \"\$\{ifconfig_$iface\[@\]\}\" )
|
||||
eval dhcpcd_IFACE=\"\$\{dhcpcd_$iface\}\"
|
||||
eval routes_IFACE=( \"\$\{routes_$iface\[@\]\}\" )
|
||||
eval inet6_IFACE=( \"\$\{inet6_$iface\[@\]\}\" )
|
||||
eval ifconfig_fallback_IFACE=( \"\$\{ifconfig_fallback_$iface\[@\]\}\" )
|
||||
|
||||
# BACKWARD COMPATIBILITY: populate the ifconfig_IFACE array
|
||||
# if iface_IFACE is set (fex. iface_eth0 instead of ifconfig_eth0)
|
||||
eval local iface_IFACE=\"\$\{iface_$iface\}\"
|
||||
if [[ -n ${iface_IFACE} && -z ${ifconfig_IFACE} ]]; then
|
||||
# Make sure these get evaluated as arrays
|
||||
local -a aliases broadcasts netmasks
|
||||
|
||||
# Start with the primary interface
|
||||
ifconfig_IFACE=( "${iface_IFACE}" )
|
||||
|
||||
# ..then add aliases
|
||||
eval aliases=( \$\{alias_$iface\} )
|
||||
eval broadcasts=( \$\{broadcast_$iface\} )
|
||||
eval netmasks=( \$\{netmask_$iface\} )
|
||||
for ((i = 0; i < ${#aliases[@]}; i = i + 1)); do
|
||||
ifconfig_IFACE[i+1]="${aliases[i]} ${broadcasts[i]:+broadcast ${broadcasts[i]}} ${netmasks[i]:+netmask ${netmasks[i]}}"
|
||||
done
|
||||
fi
|
||||
|
||||
# BACKWARD COMPATIBILITY: check for space-separated inet6 addresses
|
||||
if [[ ${#inet6_IFACE[@]} == 1 && ${inet6_IFACE} == *' '* ]]; then
|
||||
inet6_IFACE=( ${inet6_IFACE} )
|
||||
fi
|
||||
}
|
||||
|
||||
iface_start() {
|
||||
local IFACE=${1} i x retval
|
||||
checkconfig || return 1
|
||||
|
||||
if [[ ${ifconfig_IFACE} != dhcp ]]; then
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Bringing ${IFACE} up (${i})"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up"
|
||||
fi
|
||||
# ifconfig does not always return failure ..
|
||||
ifconfig ${IFACE} ${ifconfig_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
# Check that eth0 was not brought up by the kernel ...
|
||||
if [[ ${status_IFACE} == up ]]; then
|
||||
einfo "Keeping kernel configuration for ${IFACE}"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up via DHCP"
|
||||
/sbin/dhcpcd ${dhcpcd_IFACE} ${IFACE}
|
||||
retval=$?
|
||||
eend $retval
|
||||
if [[ $retval == 0 ]]; then
|
||||
# DHCP succeeded, show address retrieved
|
||||
i=$(ifconfig ${IFACE} | grep -m1 -o 'inet addr:[^ ]*' |
|
||||
cut -d: -f2)
|
||||
[[ -n ${i} ]] && einfo " ${IFACE} received address ${i}"
|
||||
elif [[ -n "${ifconfig_fallback_IFACE}" ]]; then
|
||||
# DHCP failed, try fallback.
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_fallback_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Using fallback configuration (${i}) for ${IFACE}"
|
||||
else
|
||||
ebegin "Using fallback configuration for ${IFACE}"
|
||||
fi
|
||||
ifconfig ${IFACE} ${ifconfig_fallback_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
return $retval
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ ${#ifconfig_IFACE[@]} -gt 1 ]]; then
|
||||
einfo " Adding aliases"
|
||||
for ((i = 1; i < ${#ifconfig_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE}:${i} (${ifconfig_IFACE[i]%% *})"
|
||||
ifconfig ${IFACE}:${i} ${ifconfig_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
if [[ -n ${inet6_IFACE} ]]; then
|
||||
einfo " Adding inet6 addresses"
|
||||
for ((i = 0; i < ${#inet6_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE} inet6 add ${inet6_IFACE[i]}"
|
||||
ifconfig ${IFACE} inet6 add ${inet6_IFACE[i]} >${devnull}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set static routes
|
||||
if [[ -n ${routes_IFACE} ]]; then
|
||||
einfo " Adding routes"
|
||||
for ((i = 0; i < ${#routes_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${routes_IFACE[i]}"
|
||||
/sbin/route add ${routes_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set default route if applicable to this interface
|
||||
if [[ ${gateway} == ${IFACE}/* ]]; then
|
||||
local ogw=$(/bin/netstat -rn | awk '$1 == "0.0.0.0" {print $2}')
|
||||
local gw=${gateway#*/}
|
||||
if [[ ${ogw} != ${gw} ]]; then
|
||||
ebegin " Setting default gateway ($gw)"
|
||||
|
||||
# First delete any existing route if it was setup by kernel...
|
||||
/sbin/route del default dev ${IFACE} &>${devnull}
|
||||
|
||||
# Second delete old gateway if it was set...
|
||||
/sbin/route del default gw ${ogw} &>${devnull}
|
||||
|
||||
# Third add our new default gateway
|
||||
/sbin/route add default gw ${gw} >${devnull}
|
||||
eend $? || {
|
||||
true # need to have some command in here
|
||||
# Note: This originally called stop, which is obviously
|
||||
# wrong since it's calling with a local version of IFACE.
|
||||
# The below code works correctly to abort configuration of
|
||||
# the interface, but is commented because we're assuming
|
||||
# that default route failure should not cause the interface
|
||||
# to be unconfigured.
|
||||
#local error=$?
|
||||
#ewarn "Aborting configuration of ${IFACE}"
|
||||
#iface_stop ${IFACE}
|
||||
#return ${error}
|
||||
}
|
||||
fi
|
||||
fi
|
||||
|
||||
# Enabling rp_filter causes wacky packets to be auto-dropped by
|
||||
# the kernel. Note that we only do this if it is not set via
|
||||
# /etc/sysctl.conf ...
|
||||
if [[ -e /proc/sys/net/ipv4/conf/${IFACE}/rp_filter && \
|
||||
-z "$(grep -s '^[^#]*rp_filter' /etc/sysctl.conf)" ]]; then
|
||||
echo -n 1 > /proc/sys/net/ipv4/conf/${IFACE}/rp_filter
|
||||
fi
|
||||
}
|
||||
|
||||
# iface_stop: bring down an interface. Don't trust information in
|
||||
# /etc/conf.d/net since the configuration might have changed since
|
||||
# iface_start ran. Instead query for current configuration and bring
|
||||
# down the interface.
|
||||
iface_stop() {
|
||||
local IFACE=${1} i x aliases inet6 count
|
||||
|
||||
# Try to do a simple down (no aliases, no inet6, no dhcp)
|
||||
aliases="$(ifconfig | grep -o "^$IFACE:[0-9]*" | tac)"
|
||||
inet6="$(ifconfig ${IFACE} | awk '$1 == "inet6" {print $2}')"
|
||||
if [[ -z ${aliases} && -z ${inet6} && ! -e /var/run/dhcpcd-${IFACE}.pid ]]; then
|
||||
ebegin "Bringing ${IFACE} down"
|
||||
ifconfig ${IFACE} down &>/dev/null
|
||||
eend 0
|
||||
return 0
|
||||
fi
|
||||
|
||||
einfo "Bringing ${IFACE} down"
|
||||
|
||||
# Stop aliases before primary interface.
|
||||
# Note this must be done in reverse order, since ifconfig eth0:1
|
||||
# will remove eth0:2, etc. It might be sufficient to simply remove
|
||||
# the base interface but we're being safe here.
|
||||
for i in ${aliases} ${IFACE}; do
|
||||
|
||||
# Delete all the inet6 addresses for this interface
|
||||
inet6="$(ifconfig ${i} | awk '$1 == "inet6" {print $3}')"
|
||||
if [[ -n ${inet6} ]]; then
|
||||
einfo " Removing inet6 addresses"
|
||||
for x in ${inet6}; do
|
||||
ebegin " ${IFACE} inet6 del ${x}"
|
||||
ifconfig ${i} inet6 del ${x}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Stop DHCP (should be N/A for aliases)
|
||||
# Don't trust current configuration... investigate ourselves
|
||||
if /sbin/dhcpcd -z ${i} &>${devnull}; then
|
||||
ebegin " Releasing DHCP lease for ${IFACE}"
|
||||
for ((count = 0; count < 9; count = count + 1)); do
|
||||
/sbin/dhcpcd -z ${i} &>${devnull} || break
|
||||
sleep 1
|
||||
done
|
||||
[[ ${count} -lt 9 ]]
|
||||
eend $? "Timed out"
|
||||
fi
|
||||
ebegin " Stopping ${i}"
|
||||
ifconfig ${i} down &>${devnull}
|
||||
eend 0
|
||||
done
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
start() {
|
||||
# These variables are set by setup_vars
|
||||
local status_IFACE vlans_IFACE dhcpcd_IFACE
|
||||
local -a ifconfig_IFACE routes_IFACE inet6_IFACE
|
||||
|
||||
# Call user-defined preup function if it exists
|
||||
if [[ $(type -t preup) == function ]]; then
|
||||
einfo "Running preup function"
|
||||
preup ${IFACE} || {
|
||||
eerror "preup ${IFACE} failed"
|
||||
return 1
|
||||
}
|
||||
fi
|
||||
|
||||
# Start the primary interface and aliases
|
||||
setup_vars ${IFACE}
|
||||
iface_start ${IFACE} || return 1
|
||||
|
||||
# Start vlans
|
||||
local vlan
|
||||
for vlan in ${vlans_IFACE}; do
|
||||
/sbin/vconfig add ${IFACE} ${vlan} >${devnull}
|
||||
setup_vars ${IFACE}.${vlan}
|
||||
iface_start ${IFACE}.${vlan}
|
||||
done
|
||||
|
||||
# Call user-defined postup function if it exists
|
||||
if [[ $(type -t postup) == function ]]; then
|
||||
einfo "Running postup function"
|
||||
postup ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
stop() {
|
||||
# Call user-defined predown function if it exists
|
||||
if [[ $(type -t predown) == function ]]; then
|
||||
einfo "Running predown function"
|
||||
predown ${IFACE}
|
||||
fi
|
||||
|
||||
# Don't depend on setup_vars since configuration might have changed.
|
||||
# Investigate current configuration instead.
|
||||
local vlan
|
||||
for vlan in $(ifconfig | grep -o "^${IFACE}\.[^ ]*"); do
|
||||
iface_stop ${vlan}
|
||||
/sbin/vconfig rem ${vlan} >${devnull}
|
||||
done
|
||||
|
||||
iface_stop ${IFACE} || return 1 # always succeeds, btw
|
||||
|
||||
# Call user-defined postdown function if it exists
|
||||
if [[ $(type -t postdown) == function ]]; then
|
||||
einfo "Running postdown function"
|
||||
postdown ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
# vim:ts=4
|
||||
@@ -0,0 +1 @@
|
||||
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAsxKfTm05po6leGD8C+M0eAR5EE4s1pQXc0D/dVlqrmfZ65h5BFQY9lnwpCvapV6OVqKWx8ICmeIH3OhaPxPPNKlU81f3d0xgh8BRJpWh459DYkRVa5f7ax5eeFE1lelj9s1d0seUl/IZolpJ8Wmt9TN1hwJ0mrkwN4670rb3urc=
|
||||
@@ -0,0 +1 @@
|
||||
HOSTNAME=sun
|
||||
@@ -0,0 +1,13 @@
|
||||
# /etc/conf.d/net:
|
||||
|
||||
# This is basically the ifconfig argument without the ifconfig $iface
|
||||
#
|
||||
iface_lo="127.0.0.1 netmask 255.0.0.0"
|
||||
iface_eth0="PH_IP_SUN broadcast 192.168.0.255 netmask 255.255.255.0"
|
||||
iface_eth1="PH_IP1_SUN broadcast 10.2.255.255 netmask 255.255.0.0"
|
||||
|
||||
# For setting the default gateway
|
||||
#
|
||||
gateway="eth0/192.168.0.254"
|
||||
|
||||
|
||||
Executable
+80
@@ -0,0 +1,80 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Foundation
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
opts="start stop reload"
|
||||
|
||||
depend() {
|
||||
before net
|
||||
need logger
|
||||
}
|
||||
|
||||
start() {
|
||||
ebegin "Starting firewall"
|
||||
|
||||
# enable IP forwarding
|
||||
echo 1 > /proc/sys/net/ipv4/ip_forward
|
||||
|
||||
# default policy is DROP
|
||||
/sbin/iptables -P INPUT DROP
|
||||
/sbin/iptables -P OUTPUT DROP
|
||||
/sbin/iptables -P FORWARD DROP
|
||||
|
||||
# allow esp
|
||||
iptables -A INPUT -i eth0 -p 50 -j ACCEPT
|
||||
iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
|
||||
|
||||
# allow IKE
|
||||
iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
|
||||
iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
|
||||
|
||||
# allow NAT-T
|
||||
iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
|
||||
iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
|
||||
|
||||
# allow crl fetch from winnetou
|
||||
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
|
||||
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
|
||||
|
||||
# allow ssh
|
||||
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
|
||||
|
||||
eend $?
|
||||
}
|
||||
|
||||
stop() {
|
||||
ebegin "Stopping firewall"
|
||||
for a in `cat /proc/net/ip_tables_names`; do
|
||||
/sbin/iptables -F -t $a
|
||||
/sbin/iptables -X -t $a
|
||||
|
||||
if [ $a == nat ]; then
|
||||
/sbin/iptables -t nat -P PREROUTING ACCEPT
|
||||
/sbin/iptables -t nat -P POSTROUTING ACCEPT
|
||||
/sbin/iptables -t nat -P OUTPUT ACCEPT
|
||||
elif [ $a == mangle ]; then
|
||||
/sbin/iptables -t mangle -P PREROUTING ACCEPT
|
||||
/sbin/iptables -t mangle -P INPUT ACCEPT
|
||||
/sbin/iptables -t mangle -P FORWARD ACCEPT
|
||||
/sbin/iptables -t mangle -P OUTPUT ACCEPT
|
||||
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
|
||||
elif [ $a == filter ]; then
|
||||
/sbin/iptables -t filter -P INPUT ACCEPT
|
||||
/sbin/iptables -t filter -P FORWARD ACCEPT
|
||||
/sbin/iptables -t filter -P OUTPUT ACCEPT
|
||||
fi
|
||||
done
|
||||
eend $?
|
||||
}
|
||||
|
||||
reload() {
|
||||
ebegin "Flushing firewall"
|
||||
for a in `cat /proc/net/ip_tables_names`; do
|
||||
/sbin/iptables -F -t $a
|
||||
/sbin/iptables -X -t $a
|
||||
done;
|
||||
eend $?
|
||||
start
|
||||
}
|
||||
|
||||
Executable
+314
@@ -0,0 +1,314 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Technologies, Inc.
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
#NB: Config is in /etc/conf.d/net
|
||||
|
||||
if [[ -n $NET_DEBUG ]]; then
|
||||
set -x
|
||||
devnull=/dev/stderr
|
||||
else
|
||||
devnull=/dev/null
|
||||
fi
|
||||
|
||||
# For pcmcia users. note that pcmcia must be added to the same
|
||||
# runlevel as the net.* script that needs it.
|
||||
depend() {
|
||||
use hotplug pcmcia
|
||||
}
|
||||
|
||||
checkconfig() {
|
||||
if [[ -z "${ifconfig_IFACE}" ]]; then
|
||||
eerror "Please make sure that /etc/conf.d/net has \$ifconfig_$IFACE set"
|
||||
eerror "(or \$iface_$IFACE for old-style configuration)"
|
||||
return 1
|
||||
fi
|
||||
if [[ -n "${vlans_IFACE}" && ! -x /sbin/vconfig ]]; then
|
||||
eerror "For VLAN (802.1q) support, emerge net-misc/vconfig"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Fix bug 50039 (init.d/net.eth0 localization)
|
||||
# Some other commands in this script might need to be wrapped, but
|
||||
# we'll get them one-by-one. Note that LC_ALL trumps LC_anything_else
|
||||
# according to locale(7)
|
||||
ifconfig() {
|
||||
LC_ALL=C /sbin/ifconfig "$@"
|
||||
}
|
||||
|
||||
# setup_vars: setup variables based on $1 and content of /etc/conf.d/net
|
||||
# The following variables are set, which should be declared local by
|
||||
# the calling routine.
|
||||
# status_IFACE (up or '')
|
||||
# vlans_IFACE (space-separated list)
|
||||
# ifconfig_IFACE (array of ifconfig lines, replaces iface_IFACE)
|
||||
# dhcpcd_IFACE (command-line args for dhcpcd)
|
||||
# routes_IFACE (array of route lines)
|
||||
# inet6_IFACE (array of inet6 lines)
|
||||
# ifconfig_fallback_IFACE (fallback ifconfig if dhcp fails)
|
||||
setup_vars() {
|
||||
local i iface="${1//\./_}"
|
||||
|
||||
status_IFACE="$(ifconfig ${1} 2>${devnull} | gawk '$1 == "UP" {print "up"}')"
|
||||
eval vlans_IFACE=\"\$\{iface_${iface}_vlans\}\"
|
||||
eval ifconfig_IFACE=( \"\$\{ifconfig_$iface\[@\]\}\" )
|
||||
eval dhcpcd_IFACE=\"\$\{dhcpcd_$iface\}\"
|
||||
eval routes_IFACE=( \"\$\{routes_$iface\[@\]\}\" )
|
||||
eval inet6_IFACE=( \"\$\{inet6_$iface\[@\]\}\" )
|
||||
eval ifconfig_fallback_IFACE=( \"\$\{ifconfig_fallback_$iface\[@\]\}\" )
|
||||
|
||||
# BACKWARD COMPATIBILITY: populate the ifconfig_IFACE array
|
||||
# if iface_IFACE is set (fex. iface_eth0 instead of ifconfig_eth0)
|
||||
eval local iface_IFACE=\"\$\{iface_$iface\}\"
|
||||
if [[ -n ${iface_IFACE} && -z ${ifconfig_IFACE} ]]; then
|
||||
# Make sure these get evaluated as arrays
|
||||
local -a aliases broadcasts netmasks
|
||||
|
||||
# Start with the primary interface
|
||||
ifconfig_IFACE=( "${iface_IFACE}" )
|
||||
|
||||
# ..then add aliases
|
||||
eval aliases=( \$\{alias_$iface\} )
|
||||
eval broadcasts=( \$\{broadcast_$iface\} )
|
||||
eval netmasks=( \$\{netmask_$iface\} )
|
||||
for ((i = 0; i < ${#aliases[@]}; i = i + 1)); do
|
||||
ifconfig_IFACE[i+1]="${aliases[i]} ${broadcasts[i]:+broadcast ${broadcasts[i]}} ${netmasks[i]:+netmask ${netmasks[i]}}"
|
||||
done
|
||||
fi
|
||||
|
||||
# BACKWARD COMPATIBILITY: check for space-separated inet6 addresses
|
||||
if [[ ${#inet6_IFACE[@]} == 1 && ${inet6_IFACE} == *' '* ]]; then
|
||||
inet6_IFACE=( ${inet6_IFACE} )
|
||||
fi
|
||||
}
|
||||
|
||||
iface_start() {
|
||||
local IFACE=${1} i x retval
|
||||
checkconfig || return 1
|
||||
|
||||
if [[ ${ifconfig_IFACE} != dhcp ]]; then
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Bringing ${IFACE} up (${i})"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up"
|
||||
fi
|
||||
# ifconfig does not always return failure ..
|
||||
ifconfig ${IFACE} ${ifconfig_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
# Check that eth0 was not brought up by the kernel ...
|
||||
if [[ ${status_IFACE} == up ]]; then
|
||||
einfo "Keeping kernel configuration for ${IFACE}"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up via DHCP"
|
||||
/sbin/dhcpcd ${dhcpcd_IFACE} ${IFACE}
|
||||
retval=$?
|
||||
eend $retval
|
||||
if [[ $retval == 0 ]]; then
|
||||
# DHCP succeeded, show address retrieved
|
||||
i=$(ifconfig ${IFACE} | grep -m1 -o 'inet addr:[^ ]*' |
|
||||
cut -d: -f2)
|
||||
[[ -n ${i} ]] && einfo " ${IFACE} received address ${i}"
|
||||
elif [[ -n "${ifconfig_fallback_IFACE}" ]]; then
|
||||
# DHCP failed, try fallback.
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_fallback_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Using fallback configuration (${i}) for ${IFACE}"
|
||||
else
|
||||
ebegin "Using fallback configuration for ${IFACE}"
|
||||
fi
|
||||
ifconfig ${IFACE} ${ifconfig_fallback_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
return $retval
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ ${#ifconfig_IFACE[@]} -gt 1 ]]; then
|
||||
einfo " Adding aliases"
|
||||
for ((i = 1; i < ${#ifconfig_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE}:${i} (${ifconfig_IFACE[i]%% *})"
|
||||
ifconfig ${IFACE}:${i} ${ifconfig_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
if [[ -n ${inet6_IFACE} ]]; then
|
||||
einfo " Adding inet6 addresses"
|
||||
for ((i = 0; i < ${#inet6_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE} inet6 add ${inet6_IFACE[i]}"
|
||||
ifconfig ${IFACE} inet6 add ${inet6_IFACE[i]} >${devnull}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set static routes
|
||||
if [[ -n ${routes_IFACE} ]]; then
|
||||
einfo " Adding routes"
|
||||
for ((i = 0; i < ${#routes_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${routes_IFACE[i]}"
|
||||
/sbin/route add ${routes_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set default route if applicable to this interface
|
||||
if [[ ${gateway} == ${IFACE}/* ]]; then
|
||||
local ogw=$(/bin/netstat -rn | awk '$1 == "0.0.0.0" {print $2}')
|
||||
local gw=${gateway#*/}
|
||||
if [[ ${ogw} != ${gw} ]]; then
|
||||
ebegin " Setting default gateway ($gw)"
|
||||
|
||||
# First delete any existing route if it was setup by kernel...
|
||||
/sbin/route del default dev ${IFACE} &>${devnull}
|
||||
|
||||
# Second delete old gateway if it was set...
|
||||
/sbin/route del default gw ${ogw} &>${devnull}
|
||||
|
||||
# Third add our new default gateway
|
||||
/sbin/route add default gw ${gw} >${devnull}
|
||||
eend $? || {
|
||||
true # need to have some command in here
|
||||
# Note: This originally called stop, which is obviously
|
||||
# wrong since it's calling with a local version of IFACE.
|
||||
# The below code works correctly to abort configuration of
|
||||
# the interface, but is commented because we're assuming
|
||||
# that default route failure should not cause the interface
|
||||
# to be unconfigured.
|
||||
#local error=$?
|
||||
#ewarn "Aborting configuration of ${IFACE}"
|
||||
#iface_stop ${IFACE}
|
||||
#return ${error}
|
||||
}
|
||||
fi
|
||||
fi
|
||||
|
||||
# Enabling rp_filter causes wacky packets to be auto-dropped by
|
||||
# the kernel. Note that we only do this if it is not set via
|
||||
# /etc/sysctl.conf ...
|
||||
if [[ -e /proc/sys/net/ipv4/conf/${IFACE}/rp_filter && \
|
||||
-z "$(grep -s '^[^#]*rp_filter' /etc/sysctl.conf)" ]]; then
|
||||
echo -n 1 > /proc/sys/net/ipv4/conf/${IFACE}/rp_filter
|
||||
fi
|
||||
}
|
||||
|
||||
# iface_stop: bring down an interface. Don't trust information in
|
||||
# /etc/conf.d/net since the configuration might have changed since
|
||||
# iface_start ran. Instead query for current configuration and bring
|
||||
# down the interface.
|
||||
iface_stop() {
|
||||
local IFACE=${1} i x aliases inet6 count
|
||||
|
||||
# Try to do a simple down (no aliases, no inet6, no dhcp)
|
||||
aliases="$(ifconfig | grep -o "^$IFACE:[0-9]*" | tac)"
|
||||
inet6="$(ifconfig ${IFACE} | awk '$1 == "inet6" {print $2}')"
|
||||
if [[ -z ${aliases} && -z ${inet6} && ! -e /var/run/dhcpcd-${IFACE}.pid ]]; then
|
||||
ebegin "Bringing ${IFACE} down"
|
||||
ifconfig ${IFACE} down &>/dev/null
|
||||
eend 0
|
||||
return 0
|
||||
fi
|
||||
|
||||
einfo "Bringing ${IFACE} down"
|
||||
|
||||
# Stop aliases before primary interface.
|
||||
# Note this must be done in reverse order, since ifconfig eth0:1
|
||||
# will remove eth0:2, etc. It might be sufficient to simply remove
|
||||
# the base interface but we're being safe here.
|
||||
for i in ${aliases} ${IFACE}; do
|
||||
|
||||
# Delete all the inet6 addresses for this interface
|
||||
inet6="$(ifconfig ${i} | awk '$1 == "inet6" {print $3}')"
|
||||
if [[ -n ${inet6} ]]; then
|
||||
einfo " Removing inet6 addresses"
|
||||
for x in ${inet6}; do
|
||||
ebegin " ${IFACE} inet6 del ${x}"
|
||||
ifconfig ${i} inet6 del ${x}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Stop DHCP (should be N/A for aliases)
|
||||
# Don't trust current configuration... investigate ourselves
|
||||
if /sbin/dhcpcd -z ${i} &>${devnull}; then
|
||||
ebegin " Releasing DHCP lease for ${IFACE}"
|
||||
for ((count = 0; count < 9; count = count + 1)); do
|
||||
/sbin/dhcpcd -z ${i} &>${devnull} || break
|
||||
sleep 1
|
||||
done
|
||||
[[ ${count} -lt 9 ]]
|
||||
eend $? "Timed out"
|
||||
fi
|
||||
ebegin " Stopping ${i}"
|
||||
ifconfig ${i} down &>${devnull}
|
||||
eend 0
|
||||
done
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
start() {
|
||||
# These variables are set by setup_vars
|
||||
local status_IFACE vlans_IFACE dhcpcd_IFACE
|
||||
local -a ifconfig_IFACE routes_IFACE inet6_IFACE
|
||||
|
||||
# Call user-defined preup function if it exists
|
||||
if [[ $(type -t preup) == function ]]; then
|
||||
einfo "Running preup function"
|
||||
preup ${IFACE} || {
|
||||
eerror "preup ${IFACE} failed"
|
||||
return 1
|
||||
}
|
||||
fi
|
||||
|
||||
# Start the primary interface and aliases
|
||||
setup_vars ${IFACE}
|
||||
iface_start ${IFACE} || return 1
|
||||
|
||||
# Start vlans
|
||||
local vlan
|
||||
for vlan in ${vlans_IFACE}; do
|
||||
/sbin/vconfig add ${IFACE} ${vlan} >${devnull}
|
||||
setup_vars ${IFACE}.${vlan}
|
||||
iface_start ${IFACE}.${vlan}
|
||||
done
|
||||
|
||||
# Call user-defined postup function if it exists
|
||||
if [[ $(type -t postup) == function ]]; then
|
||||
einfo "Running postup function"
|
||||
postup ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
stop() {
|
||||
# Call user-defined predown function if it exists
|
||||
if [[ $(type -t predown) == function ]]; then
|
||||
einfo "Running predown function"
|
||||
predown ${IFACE}
|
||||
fi
|
||||
|
||||
# Don't depend on setup_vars since configuration might have changed.
|
||||
# Investigate current configuration instead.
|
||||
local vlan
|
||||
for vlan in $(ifconfig | grep -o "^${IFACE}\.[^ ]*"); do
|
||||
iface_stop ${vlan}
|
||||
/sbin/vconfig rem ${vlan} >${devnull}
|
||||
done
|
||||
|
||||
iface_stop ${IFACE} || return 1 # always succeeds, btw
|
||||
|
||||
# Call user-defined postdown function if it exists
|
||||
if [[ $(type -t postdown) == function ]]; then
|
||||
einfo "Running postdown function"
|
||||
postdown ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
# vim:ts=4
|
||||
Executable
+314
@@ -0,0 +1,314 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Technologies, Inc.
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
#NB: Config is in /etc/conf.d/net
|
||||
|
||||
if [[ -n $NET_DEBUG ]]; then
|
||||
set -x
|
||||
devnull=/dev/stderr
|
||||
else
|
||||
devnull=/dev/null
|
||||
fi
|
||||
|
||||
# For pcmcia users. note that pcmcia must be added to the same
|
||||
# runlevel as the net.* script that needs it.
|
||||
depend() {
|
||||
use hotplug pcmcia
|
||||
}
|
||||
|
||||
checkconfig() {
|
||||
if [[ -z "${ifconfig_IFACE}" ]]; then
|
||||
eerror "Please make sure that /etc/conf.d/net has \$ifconfig_$IFACE set"
|
||||
eerror "(or \$iface_$IFACE for old-style configuration)"
|
||||
return 1
|
||||
fi
|
||||
if [[ -n "${vlans_IFACE}" && ! -x /sbin/vconfig ]]; then
|
||||
eerror "For VLAN (802.1q) support, emerge net-misc/vconfig"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Fix bug 50039 (init.d/net.eth0 localization)
|
||||
# Some other commands in this script might need to be wrapped, but
|
||||
# we'll get them one-by-one. Note that LC_ALL trumps LC_anything_else
|
||||
# according to locale(7)
|
||||
ifconfig() {
|
||||
LC_ALL=C /sbin/ifconfig "$@"
|
||||
}
|
||||
|
||||
# setup_vars: setup variables based on $1 and content of /etc/conf.d/net
|
||||
# The following variables are set, which should be declared local by
|
||||
# the calling routine.
|
||||
# status_IFACE (up or '')
|
||||
# vlans_IFACE (space-separated list)
|
||||
# ifconfig_IFACE (array of ifconfig lines, replaces iface_IFACE)
|
||||
# dhcpcd_IFACE (command-line args for dhcpcd)
|
||||
# routes_IFACE (array of route lines)
|
||||
# inet6_IFACE (array of inet6 lines)
|
||||
# ifconfig_fallback_IFACE (fallback ifconfig if dhcp fails)
|
||||
setup_vars() {
|
||||
local i iface="${1//\./_}"
|
||||
|
||||
status_IFACE="$(ifconfig ${1} 2>${devnull} | gawk '$1 == "UP" {print "up"}')"
|
||||
eval vlans_IFACE=\"\$\{iface_${iface}_vlans\}\"
|
||||
eval ifconfig_IFACE=( \"\$\{ifconfig_$iface\[@\]\}\" )
|
||||
eval dhcpcd_IFACE=\"\$\{dhcpcd_$iface\}\"
|
||||
eval routes_IFACE=( \"\$\{routes_$iface\[@\]\}\" )
|
||||
eval inet6_IFACE=( \"\$\{inet6_$iface\[@\]\}\" )
|
||||
eval ifconfig_fallback_IFACE=( \"\$\{ifconfig_fallback_$iface\[@\]\}\" )
|
||||
|
||||
# BACKWARD COMPATIBILITY: populate the ifconfig_IFACE array
|
||||
# if iface_IFACE is set (fex. iface_eth0 instead of ifconfig_eth0)
|
||||
eval local iface_IFACE=\"\$\{iface_$iface\}\"
|
||||
if [[ -n ${iface_IFACE} && -z ${ifconfig_IFACE} ]]; then
|
||||
# Make sure these get evaluated as arrays
|
||||
local -a aliases broadcasts netmasks
|
||||
|
||||
# Start with the primary interface
|
||||
ifconfig_IFACE=( "${iface_IFACE}" )
|
||||
|
||||
# ..then add aliases
|
||||
eval aliases=( \$\{alias_$iface\} )
|
||||
eval broadcasts=( \$\{broadcast_$iface\} )
|
||||
eval netmasks=( \$\{netmask_$iface\} )
|
||||
for ((i = 0; i < ${#aliases[@]}; i = i + 1)); do
|
||||
ifconfig_IFACE[i+1]="${aliases[i]} ${broadcasts[i]:+broadcast ${broadcasts[i]}} ${netmasks[i]:+netmask ${netmasks[i]}}"
|
||||
done
|
||||
fi
|
||||
|
||||
# BACKWARD COMPATIBILITY: check for space-separated inet6 addresses
|
||||
if [[ ${#inet6_IFACE[@]} == 1 && ${inet6_IFACE} == *' '* ]]; then
|
||||
inet6_IFACE=( ${inet6_IFACE} )
|
||||
fi
|
||||
}
|
||||
|
||||
iface_start() {
|
||||
local IFACE=${1} i x retval
|
||||
checkconfig || return 1
|
||||
|
||||
if [[ ${ifconfig_IFACE} != dhcp ]]; then
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Bringing ${IFACE} up (${i})"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up"
|
||||
fi
|
||||
# ifconfig does not always return failure ..
|
||||
ifconfig ${IFACE} ${ifconfig_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
# Check that eth0 was not brought up by the kernel ...
|
||||
if [[ ${status_IFACE} == up ]]; then
|
||||
einfo "Keeping kernel configuration for ${IFACE}"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up via DHCP"
|
||||
/sbin/dhcpcd ${dhcpcd_IFACE} ${IFACE}
|
||||
retval=$?
|
||||
eend $retval
|
||||
if [[ $retval == 0 ]]; then
|
||||
# DHCP succeeded, show address retrieved
|
||||
i=$(ifconfig ${IFACE} | grep -m1 -o 'inet addr:[^ ]*' |
|
||||
cut -d: -f2)
|
||||
[[ -n ${i} ]] && einfo " ${IFACE} received address ${i}"
|
||||
elif [[ -n "${ifconfig_fallback_IFACE}" ]]; then
|
||||
# DHCP failed, try fallback.
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_fallback_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Using fallback configuration (${i}) for ${IFACE}"
|
||||
else
|
||||
ebegin "Using fallback configuration for ${IFACE}"
|
||||
fi
|
||||
ifconfig ${IFACE} ${ifconfig_fallback_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
return $retval
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ ${#ifconfig_IFACE[@]} -gt 1 ]]; then
|
||||
einfo " Adding aliases"
|
||||
for ((i = 1; i < ${#ifconfig_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE}:${i} (${ifconfig_IFACE[i]%% *})"
|
||||
ifconfig ${IFACE}:${i} ${ifconfig_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
if [[ -n ${inet6_IFACE} ]]; then
|
||||
einfo " Adding inet6 addresses"
|
||||
for ((i = 0; i < ${#inet6_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE} inet6 add ${inet6_IFACE[i]}"
|
||||
ifconfig ${IFACE} inet6 add ${inet6_IFACE[i]} >${devnull}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set static routes
|
||||
if [[ -n ${routes_IFACE} ]]; then
|
||||
einfo " Adding routes"
|
||||
for ((i = 0; i < ${#routes_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${routes_IFACE[i]}"
|
||||
/sbin/route add ${routes_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set default route if applicable to this interface
|
||||
if [[ ${gateway} == ${IFACE}/* ]]; then
|
||||
local ogw=$(/bin/netstat -rn | awk '$1 == "0.0.0.0" {print $2}')
|
||||
local gw=${gateway#*/}
|
||||
if [[ ${ogw} != ${gw} ]]; then
|
||||
ebegin " Setting default gateway ($gw)"
|
||||
|
||||
# First delete any existing route if it was setup by kernel...
|
||||
/sbin/route del default dev ${IFACE} &>${devnull}
|
||||
|
||||
# Second delete old gateway if it was set...
|
||||
/sbin/route del default gw ${ogw} &>${devnull}
|
||||
|
||||
# Third add our new default gateway
|
||||
/sbin/route add default gw ${gw} >${devnull}
|
||||
eend $? || {
|
||||
true # need to have some command in here
|
||||
# Note: This originally called stop, which is obviously
|
||||
# wrong since it's calling with a local version of IFACE.
|
||||
# The below code works correctly to abort configuration of
|
||||
# the interface, but is commented because we're assuming
|
||||
# that default route failure should not cause the interface
|
||||
# to be unconfigured.
|
||||
#local error=$?
|
||||
#ewarn "Aborting configuration of ${IFACE}"
|
||||
#iface_stop ${IFACE}
|
||||
#return ${error}
|
||||
}
|
||||
fi
|
||||
fi
|
||||
|
||||
# Enabling rp_filter causes wacky packets to be auto-dropped by
|
||||
# the kernel. Note that we only do this if it is not set via
|
||||
# /etc/sysctl.conf ...
|
||||
if [[ -e /proc/sys/net/ipv4/conf/${IFACE}/rp_filter && \
|
||||
-z "$(grep -s '^[^#]*rp_filter' /etc/sysctl.conf)" ]]; then
|
||||
echo -n 1 > /proc/sys/net/ipv4/conf/${IFACE}/rp_filter
|
||||
fi
|
||||
}
|
||||
|
||||
# iface_stop: bring down an interface. Don't trust information in
|
||||
# /etc/conf.d/net since the configuration might have changed since
|
||||
# iface_start ran. Instead query for current configuration and bring
|
||||
# down the interface.
|
||||
iface_stop() {
|
||||
local IFACE=${1} i x aliases inet6 count
|
||||
|
||||
# Try to do a simple down (no aliases, no inet6, no dhcp)
|
||||
aliases="$(ifconfig | grep -o "^$IFACE:[0-9]*" | tac)"
|
||||
inet6="$(ifconfig ${IFACE} | awk '$1 == "inet6" {print $2}')"
|
||||
if [[ -z ${aliases} && -z ${inet6} && ! -e /var/run/dhcpcd-${IFACE}.pid ]]; then
|
||||
ebegin "Bringing ${IFACE} down"
|
||||
ifconfig ${IFACE} down &>/dev/null
|
||||
eend 0
|
||||
return 0
|
||||
fi
|
||||
|
||||
einfo "Bringing ${IFACE} down"
|
||||
|
||||
# Stop aliases before primary interface.
|
||||
# Note this must be done in reverse order, since ifconfig eth0:1
|
||||
# will remove eth0:2, etc. It might be sufficient to simply remove
|
||||
# the base interface but we're being safe here.
|
||||
for i in ${aliases} ${IFACE}; do
|
||||
|
||||
# Delete all the inet6 addresses for this interface
|
||||
inet6="$(ifconfig ${i} | awk '$1 == "inet6" {print $3}')"
|
||||
if [[ -n ${inet6} ]]; then
|
||||
einfo " Removing inet6 addresses"
|
||||
for x in ${inet6}; do
|
||||
ebegin " ${IFACE} inet6 del ${x}"
|
||||
ifconfig ${i} inet6 del ${x}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Stop DHCP (should be N/A for aliases)
|
||||
# Don't trust current configuration... investigate ourselves
|
||||
if /sbin/dhcpcd -z ${i} &>${devnull}; then
|
||||
ebegin " Releasing DHCP lease for ${IFACE}"
|
||||
for ((count = 0; count < 9; count = count + 1)); do
|
||||
/sbin/dhcpcd -z ${i} &>${devnull} || break
|
||||
sleep 1
|
||||
done
|
||||
[[ ${count} -lt 9 ]]
|
||||
eend $? "Timed out"
|
||||
fi
|
||||
ebegin " Stopping ${i}"
|
||||
ifconfig ${i} down &>${devnull}
|
||||
eend 0
|
||||
done
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
start() {
|
||||
# These variables are set by setup_vars
|
||||
local status_IFACE vlans_IFACE dhcpcd_IFACE
|
||||
local -a ifconfig_IFACE routes_IFACE inet6_IFACE
|
||||
|
||||
# Call user-defined preup function if it exists
|
||||
if [[ $(type -t preup) == function ]]; then
|
||||
einfo "Running preup function"
|
||||
preup ${IFACE} || {
|
||||
eerror "preup ${IFACE} failed"
|
||||
return 1
|
||||
}
|
||||
fi
|
||||
|
||||
# Start the primary interface and aliases
|
||||
setup_vars ${IFACE}
|
||||
iface_start ${IFACE} || return 1
|
||||
|
||||
# Start vlans
|
||||
local vlan
|
||||
for vlan in ${vlans_IFACE}; do
|
||||
/sbin/vconfig add ${IFACE} ${vlan} >${devnull}
|
||||
setup_vars ${IFACE}.${vlan}
|
||||
iface_start ${IFACE}.${vlan}
|
||||
done
|
||||
|
||||
# Call user-defined postup function if it exists
|
||||
if [[ $(type -t postup) == function ]]; then
|
||||
einfo "Running postup function"
|
||||
postup ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
stop() {
|
||||
# Call user-defined predown function if it exists
|
||||
if [[ $(type -t predown) == function ]]; then
|
||||
einfo "Running predown function"
|
||||
predown ${IFACE}
|
||||
fi
|
||||
|
||||
# Don't depend on setup_vars since configuration might have changed.
|
||||
# Investigate current configuration instead.
|
||||
local vlan
|
||||
for vlan in $(ifconfig | grep -o "^${IFACE}\.[^ ]*"); do
|
||||
iface_stop ${vlan}
|
||||
/sbin/vconfig rem ${vlan} >${devnull}
|
||||
done
|
||||
|
||||
iface_stop ${IFACE} || return 1 # always succeeds, btw
|
||||
|
||||
# Call user-defined postdown function if it exists
|
||||
if [[ $(type -t postdown) == function ]]; then
|
||||
einfo "Running postdown function"
|
||||
postdown ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
# vim:ts=4
|
||||
Executable
+37
@@ -0,0 +1,37 @@
|
||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
version 2.0 # conforms to second version of ipsec.conf specification
|
||||
|
||||
config setup
|
||||
plutodebug=control
|
||||
crlcheckinterval=180
|
||||
strictcrlpolicy=no
|
||||
nat_traversal=yes
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
left=PH_IP_SUN
|
||||
leftcert=sunCert.pem
|
||||
[email protected]
|
||||
leftfirewall=yes
|
||||
|
||||
conn net-net
|
||||
leftsubnet=10.2.0.0/16
|
||||
right=PH_IP_MOON
|
||||
rightsubnet=10.1.0.0/16
|
||||
[email protected]
|
||||
auto=add
|
||||
|
||||
conn host-host
|
||||
right=PH_IP_MOON
|
||||
[email protected]
|
||||
auto=add
|
||||
|
||||
conn nat-t
|
||||
leftsubnet=10.2.0.0/16
|
||||
right=%any
|
||||
rightsubnetwithin=10.1.0.0/16
|
||||
auto=add
|
||||
@@ -0,0 +1,22 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDtTCCAp2gAwIBAgIBADANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
|
||||
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
|
||||
b290IENBMB4XDTA0MDkxMDExMDE0NVoXDTE0MDkwODExMDE0NVowRTELMAkGA1UE
|
||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0cm9u
|
||||
Z1N3YW4gUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL/y
|
||||
X2LqPVZuWLPIeknK86xhz6ljd3NNhC2z+P1uoCP3sBMuZiZQEjFzhnKcbXxCeo2f
|
||||
FnvhOOjrrisSuVkzuu82oxXD3fIkzuS7m9V4E10EZzgmKWIf+WuNRfbgAuUINmLc
|
||||
4YGAXBQLPyzpP4Ou48hhz/YQo58Bics6PHy5v34qCVROIXDvqhj91P8g+pS+F21/
|
||||
7P+CH2jRcVIEHZtG8M/PweTPQ95dPzpYd2Ov6SZ/U7EWmbMmT8VcUYn1aChxFmy5
|
||||
gweVBWlkH6MP+1DeE0/tL5c87xo5KCeGK8Tdqpe7sBRC4pPEEHDQciTUvkeuJ1Pr
|
||||
K+1LwdqRxo7HgMRiDw8CAwEAAaOBrzCBrDAPBgNVHRMBAf8EBTADAQH/MAsGA1Ud
|
||||
DwQEAwIBBjAdBgNVHQ4EFgQUXafdcAZRMn7ntm2zteXgYOouTe8wbQYDVR0jBGYw
|
||||
ZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJBgNVBAYTAkNIMRkwFwYD
|
||||
VQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJvbmdTd2FuIFJvb3Qg
|
||||
Q0GCAQAwDQYJKoZIhvcNAQEEBQADggEBAJrXTj5gWS37myHHhii9drYwkMFyDHS/
|
||||
lHU8rW/drcnHdus507+qUhNr9SiEAHg4Ywj895UDvT0a1sFaw44QyEa/94iKA8/n
|
||||
+g5kS1IrKvWu3wu8UI3EgzChgHV3cncQlQWbK+FI9Y3Ax1O1np1r+wLptoWpKKKE
|
||||
UxsYcxP9K4Nbyeon0AIHOajUheiL3t6aRc3m0o7VU7Do6S2r+He+1Zq/nRUfFeTy
|
||||
0Atebkn8tmUpPSKWaXkmwpVNrjZ1Qu9umAU+dtJyhzL2zmnyhPC4VqpsKCOp7imy
|
||||
gKZvUIKPm1zyf4T+yjwxwkiX2xVseoM3aKswb1EoZFelHwndU7u0GQ8=
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,24 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIECzCCAvOgAwIBAgIBAjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
|
||||
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
|
||||
b290IENBMB4XDTA0MDkxMDExMTU1M1oXDTA5MDkwOTExMTU1M1owRTELMAkGA1UE
|
||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN1bi5z
|
||||
dHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOQ8
|
||||
foB9h5BZ92gA5JkQTJNuoF6FAzoq91Gh7To27/g74p01+SUnsSaBfPmNfGp4avdS
|
||||
Ewy2dWMA/7uj0Dbe8MEKssNztp0JQubp2s7n8mrrQLGsqB6YAS09l75XDjS3yqTC
|
||||
AtH1kD4zAl/j/AyeQBuLR4CyJEmC/rqD3/a+pr42CaljuFBgBRpCTUpU4mlslZSe
|
||||
zv9wu61PwTFxb8VDlBHUd/lwkXThKgU3uEhWRxLahpSldEGmiTTmx30k/XbOMF2n
|
||||
HObEHt5EY9uWRGGbj81ZRWiNk0dNtbpneUHv/NvdWLc591M8cEGEQdWW2XTVbL2G
|
||||
N67q8hdzGgIvb7QJPMcCAwEAAaOCAQQwggEAMAkGA1UdEwQCMAAwCwYDVR0PBAQD
|
||||
AgOoMB0GA1UdDgQWBBQ9xLkyCBbyQmRet0vvV1Fg6z5q2DBtBgNVHSMEZjBkgBRd
|
||||
p91wBlEyfue2bbO15eBg6i5N76FJpEcwRTELMAkGA1UEBhMCQ0gxGTAXBgNVBAoT
|
||||
EExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0cm9uZ1N3YW4gUm9vdCBDQYIB
|
||||
ADAdBgNVHREEFjAUghJzdW4uc3Ryb25nc3dhbi5vcmcwOQYDVR0fBDIwMDAuoCyg
|
||||
KoYoaHR0cDovL2NybC5zdHJvbmdzd2FuLm9yZy9zdHJvbmdzd2FuLmNybDANBgkq
|
||||
hkiG9w0BAQQFAAOCAQEAGQQroiAa0SwwhJprGd7OM+rfBJAGbsa3DPzFCfHX1R7i
|
||||
ZyDs9aph1DK+IgUa377Ev1U7oB0EldpmOoJJugCjtNLfpW3t1RXBERL/QfpO2+VP
|
||||
Wt3SfZ0Oq48jiqB1MVLMZRPCICZEQjT4sJ3HYs5ZuucuvoxeMx3rQ4HxUtHtMD3S
|
||||
5JNMwFFiOXAjyIyrTlb7YuRJTT5hE+Rms8GUQ5Xnt7zKZ7yfoSLFzy0/cLFPdQvE
|
||||
JA7w8crODCZpDgEKVHVyUWuyt1O46N3ydUfDcnKJoQ9HWHm3xCbDex5MHTnvm1lk
|
||||
Stx71CGM7TE6VPy028UlrSw0JqEwCVwstei2cMzwgA==
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,27 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEowIBAAKCAQEA5Dx+gH2HkFn3aADkmRBMk26gXoUDOir3UaHtOjbv+DvinTX5
|
||||
JSexJoF8+Y18anhq91ITDLZ1YwD/u6PQNt7wwQqyw3O2nQlC5unazufyautAsayo
|
||||
HpgBLT2XvlcONLfKpMIC0fWQPjMCX+P8DJ5AG4tHgLIkSYL+uoPf9r6mvjYJqWO4
|
||||
UGAFGkJNSlTiaWyVlJ7O/3C7rU/BMXFvxUOUEdR3+XCRdOEqBTe4SFZHEtqGlKV0
|
||||
QaaJNObHfST9ds4wXacc5sQe3kRj25ZEYZuPzVlFaI2TR021umd5Qe/8291Ytzn3
|
||||
UzxwQYRB1ZbZdNVsvYY3ruryF3MaAi9vtAk8xwIDAQABAoIBACOnh6OO+KSGSW4H
|
||||
5a47q5rEh2z8nnpxx90KzMJxXp+Ky2X/zoINZ1E6nUlm3u7LDPrB6ZPs1P24ZDrt
|
||||
5lMMFNQzVaXO59I0Zi0ojzQPbAFj6uFWtZTB7j0hCBmGBAQcSh3e6Q3frL7qvQ45
|
||||
0WAvQJiM84iZS63oNt7wRwaG1gmUn/k6j34y4qUkD5FfzGhFkekzDS54bRGwjhTA
|
||||
7XBUPAcsdNoIPcihokgLXwcdA8l6LBGsk48HN7O+CYOdh4xb6oQ4msgPED3pDIMo
|
||||
QRptqcPQ6y1qJaiM/D8SvdX2ZTFm/bh2jlGvcm5sWG8VdSDRqq9r0YCi4KlQzA1g
|
||||
OAyrMeECgYEA9dAVEegvRrFm4V6hC9CAwyS6fiOqx/l0xd354Xv4V6vR6n6rKwDF
|
||||
kv96A4sMH+mdNf6MwzFFCNW9zZV7noEIvAyPAc7jM7t/Hmt5M41DiDe0RJpWKEdQ
|
||||
lEj2qd8FqcY4YVDEH/TdchwIvoWHlD2sykW7eoseCY5mYEoQN4Ciwj8CgYEA7bHv
|
||||
qdaz2SoG9lyj8Mz7XthjYZLeaxKu7cpqP5bqzuRSkVFvib0WKoJfwsewzO5hCHnf
|
||||
8yMD3Wp4Ap2FYoN2XfV/jQyHvlpMlkxv+bU39/HLosdhzKbOJsru9kbBCaARHAVi
|
||||
av3O3JfV2/G+cwR6nPCNjcTsIcqtEpUO7kOfU3kCgYAKYNmy4tm0I2NTmpo0FH6L
|
||||
Pq69CqZ4QPkELaYSNhi7It7/BpAVhbfRyAWPxrwhUMy5beDlkNv4ToXv+yK4A3yp
|
||||
6+HR0rlXAtCQKTt5yLoUMz3iM531n2UwjZAUhf0IOP1CZpWRP9ZlrfdUi/C4eo4k
|
||||
ECOlPeBryN5brGTY4w58IwKBgQC0ukRF2I+qoP/mNg4Yu2KtfM4jlG4072G+P9eF
|
||||
PhSO9p+pCkhKbFD8RWDWUsslJmL09OXIkmkP4zIYmvieLOLFEjLHZi2YGER/SuMg
|
||||
9B74EQsKW5sK5hF9AXOsIaQI04Hu0lFAlHbC11euAiMShOdNiMG4d3ArSVVK+bb+
|
||||
hsAP0QKBgHcJuTJ6dv77evW3MFZPRjFH25pike40PWmSLgCt5PV25DRL2UG0pOut
|
||||
uybN9biQK5v377/3GD7eOL+acxHODjWmmfeEFW0YlJ1oUb/P8NlqsSnHvUoIqa24
|
||||
JmTXS/XzjgxQFFfzo0c1/1JLdG6r5CLTWxHq1EhIOJsowTlrCzX/
|
||||
-----END RSA PRIVATE KEY-----
|
||||
@@ -0,0 +1,8 @@
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
|
||||
: RSA sunKey.pem
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
+314
@@ -0,0 +1,314 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Technologies, Inc.
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
#NB: Config is in /etc/conf.d/net
|
||||
|
||||
if [[ -n $NET_DEBUG ]]; then
|
||||
set -x
|
||||
devnull=/dev/stderr
|
||||
else
|
||||
devnull=/dev/null
|
||||
fi
|
||||
|
||||
# For pcmcia users. note that pcmcia must be added to the same
|
||||
# runlevel as the net.* script that needs it.
|
||||
depend() {
|
||||
use hotplug pcmcia
|
||||
}
|
||||
|
||||
checkconfig() {
|
||||
if [[ -z "${ifconfig_IFACE}" ]]; then
|
||||
eerror "Please make sure that /etc/conf.d/net has \$ifconfig_$IFACE set"
|
||||
eerror "(or \$iface_$IFACE for old-style configuration)"
|
||||
return 1
|
||||
fi
|
||||
if [[ -n "${vlans_IFACE}" && ! -x /sbin/vconfig ]]; then
|
||||
eerror "For VLAN (802.1q) support, emerge net-misc/vconfig"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Fix bug 50039 (init.d/net.eth0 localization)
|
||||
# Some other commands in this script might need to be wrapped, but
|
||||
# we'll get them one-by-one. Note that LC_ALL trumps LC_anything_else
|
||||
# according to locale(7)
|
||||
ifconfig() {
|
||||
LC_ALL=C /sbin/ifconfig "$@"
|
||||
}
|
||||
|
||||
# setup_vars: setup variables based on $1 and content of /etc/conf.d/net
|
||||
# The following variables are set, which should be declared local by
|
||||
# the calling routine.
|
||||
# status_IFACE (up or '')
|
||||
# vlans_IFACE (space-separated list)
|
||||
# ifconfig_IFACE (array of ifconfig lines, replaces iface_IFACE)
|
||||
# dhcpcd_IFACE (command-line args for dhcpcd)
|
||||
# routes_IFACE (array of route lines)
|
||||
# inet6_IFACE (array of inet6 lines)
|
||||
# ifconfig_fallback_IFACE (fallback ifconfig if dhcp fails)
|
||||
setup_vars() {
|
||||
local i iface="${1//\./_}"
|
||||
|
||||
status_IFACE="$(ifconfig ${1} 2>${devnull} | gawk '$1 == "UP" {print "up"}')"
|
||||
eval vlans_IFACE=\"\$\{iface_${iface}_vlans\}\"
|
||||
eval ifconfig_IFACE=( \"\$\{ifconfig_$iface\[@\]\}\" )
|
||||
eval dhcpcd_IFACE=\"\$\{dhcpcd_$iface\}\"
|
||||
eval routes_IFACE=( \"\$\{routes_$iface\[@\]\}\" )
|
||||
eval inet6_IFACE=( \"\$\{inet6_$iface\[@\]\}\" )
|
||||
eval ifconfig_fallback_IFACE=( \"\$\{ifconfig_fallback_$iface\[@\]\}\" )
|
||||
|
||||
# BACKWARD COMPATIBILITY: populate the ifconfig_IFACE array
|
||||
# if iface_IFACE is set (fex. iface_eth0 instead of ifconfig_eth0)
|
||||
eval local iface_IFACE=\"\$\{iface_$iface\}\"
|
||||
if [[ -n ${iface_IFACE} && -z ${ifconfig_IFACE} ]]; then
|
||||
# Make sure these get evaluated as arrays
|
||||
local -a aliases broadcasts netmasks
|
||||
|
||||
# Start with the primary interface
|
||||
ifconfig_IFACE=( "${iface_IFACE}" )
|
||||
|
||||
# ..then add aliases
|
||||
eval aliases=( \$\{alias_$iface\} )
|
||||
eval broadcasts=( \$\{broadcast_$iface\} )
|
||||
eval netmasks=( \$\{netmask_$iface\} )
|
||||
for ((i = 0; i < ${#aliases[@]}; i = i + 1)); do
|
||||
ifconfig_IFACE[i+1]="${aliases[i]} ${broadcasts[i]:+broadcast ${broadcasts[i]}} ${netmasks[i]:+netmask ${netmasks[i]}}"
|
||||
done
|
||||
fi
|
||||
|
||||
# BACKWARD COMPATIBILITY: check for space-separated inet6 addresses
|
||||
if [[ ${#inet6_IFACE[@]} == 1 && ${inet6_IFACE} == *' '* ]]; then
|
||||
inet6_IFACE=( ${inet6_IFACE} )
|
||||
fi
|
||||
}
|
||||
|
||||
iface_start() {
|
||||
local IFACE=${1} i x retval
|
||||
checkconfig || return 1
|
||||
|
||||
if [[ ${ifconfig_IFACE} != dhcp ]]; then
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Bringing ${IFACE} up (${i})"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up"
|
||||
fi
|
||||
# ifconfig does not always return failure ..
|
||||
ifconfig ${IFACE} ${ifconfig_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
# Check that eth0 was not brought up by the kernel ...
|
||||
if [[ ${status_IFACE} == up ]]; then
|
||||
einfo "Keeping kernel configuration for ${IFACE}"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up via DHCP"
|
||||
/sbin/dhcpcd ${dhcpcd_IFACE} ${IFACE}
|
||||
retval=$?
|
||||
eend $retval
|
||||
if [[ $retval == 0 ]]; then
|
||||
# DHCP succeeded, show address retrieved
|
||||
i=$(ifconfig ${IFACE} | grep -m1 -o 'inet addr:[^ ]*' |
|
||||
cut -d: -f2)
|
||||
[[ -n ${i} ]] && einfo " ${IFACE} received address ${i}"
|
||||
elif [[ -n "${ifconfig_fallback_IFACE}" ]]; then
|
||||
# DHCP failed, try fallback.
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_fallback_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Using fallback configuration (${i}) for ${IFACE}"
|
||||
else
|
||||
ebegin "Using fallback configuration for ${IFACE}"
|
||||
fi
|
||||
ifconfig ${IFACE} ${ifconfig_fallback_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
return $retval
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ ${#ifconfig_IFACE[@]} -gt 1 ]]; then
|
||||
einfo " Adding aliases"
|
||||
for ((i = 1; i < ${#ifconfig_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE}:${i} (${ifconfig_IFACE[i]%% *})"
|
||||
ifconfig ${IFACE}:${i} ${ifconfig_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
if [[ -n ${inet6_IFACE} ]]; then
|
||||
einfo " Adding inet6 addresses"
|
||||
for ((i = 0; i < ${#inet6_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE} inet6 add ${inet6_IFACE[i]}"
|
||||
ifconfig ${IFACE} inet6 add ${inet6_IFACE[i]} >${devnull}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set static routes
|
||||
if [[ -n ${routes_IFACE} ]]; then
|
||||
einfo " Adding routes"
|
||||
for ((i = 0; i < ${#routes_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${routes_IFACE[i]}"
|
||||
/sbin/route add ${routes_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set default route if applicable to this interface
|
||||
if [[ ${gateway} == ${IFACE}/* ]]; then
|
||||
local ogw=$(/bin/netstat -rn | awk '$1 == "0.0.0.0" {print $2}')
|
||||
local gw=${gateway#*/}
|
||||
if [[ ${ogw} != ${gw} ]]; then
|
||||
ebegin " Setting default gateway ($gw)"
|
||||
|
||||
# First delete any existing route if it was setup by kernel...
|
||||
/sbin/route del default dev ${IFACE} &>${devnull}
|
||||
|
||||
# Second delete old gateway if it was set...
|
||||
/sbin/route del default gw ${ogw} &>${devnull}
|
||||
|
||||
# Third add our new default gateway
|
||||
/sbin/route add default gw ${gw} >${devnull}
|
||||
eend $? || {
|
||||
true # need to have some command in here
|
||||
# Note: This originally called stop, which is obviously
|
||||
# wrong since it's calling with a local version of IFACE.
|
||||
# The below code works correctly to abort configuration of
|
||||
# the interface, but is commented because we're assuming
|
||||
# that default route failure should not cause the interface
|
||||
# to be unconfigured.
|
||||
#local error=$?
|
||||
#ewarn "Aborting configuration of ${IFACE}"
|
||||
#iface_stop ${IFACE}
|
||||
#return ${error}
|
||||
}
|
||||
fi
|
||||
fi
|
||||
|
||||
# Enabling rp_filter causes wacky packets to be auto-dropped by
|
||||
# the kernel. Note that we only do this if it is not set via
|
||||
# /etc/sysctl.conf ...
|
||||
if [[ -e /proc/sys/net/ipv4/conf/${IFACE}/rp_filter && \
|
||||
-z "$(grep -s '^[^#]*rp_filter' /etc/sysctl.conf)" ]]; then
|
||||
echo -n 1 > /proc/sys/net/ipv4/conf/${IFACE}/rp_filter
|
||||
fi
|
||||
}
|
||||
|
||||
# iface_stop: bring down an interface. Don't trust information in
|
||||
# /etc/conf.d/net since the configuration might have changed since
|
||||
# iface_start ran. Instead query for current configuration and bring
|
||||
# down the interface.
|
||||
iface_stop() {
|
||||
local IFACE=${1} i x aliases inet6 count
|
||||
|
||||
# Try to do a simple down (no aliases, no inet6, no dhcp)
|
||||
aliases="$(ifconfig | grep -o "^$IFACE:[0-9]*" | tac)"
|
||||
inet6="$(ifconfig ${IFACE} | awk '$1 == "inet6" {print $2}')"
|
||||
if [[ -z ${aliases} && -z ${inet6} && ! -e /var/run/dhcpcd-${IFACE}.pid ]]; then
|
||||
ebegin "Bringing ${IFACE} down"
|
||||
ifconfig ${IFACE} down &>/dev/null
|
||||
eend 0
|
||||
return 0
|
||||
fi
|
||||
|
||||
einfo "Bringing ${IFACE} down"
|
||||
|
||||
# Stop aliases before primary interface.
|
||||
# Note this must be done in reverse order, since ifconfig eth0:1
|
||||
# will remove eth0:2, etc. It might be sufficient to simply remove
|
||||
# the base interface but we're being safe here.
|
||||
for i in ${aliases} ${IFACE}; do
|
||||
|
||||
# Delete all the inet6 addresses for this interface
|
||||
inet6="$(ifconfig ${i} | awk '$1 == "inet6" {print $3}')"
|
||||
if [[ -n ${inet6} ]]; then
|
||||
einfo " Removing inet6 addresses"
|
||||
for x in ${inet6}; do
|
||||
ebegin " ${IFACE} inet6 del ${x}"
|
||||
ifconfig ${i} inet6 del ${x}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Stop DHCP (should be N/A for aliases)
|
||||
# Don't trust current configuration... investigate ourselves
|
||||
if /sbin/dhcpcd -z ${i} &>${devnull}; then
|
||||
ebegin " Releasing DHCP lease for ${IFACE}"
|
||||
for ((count = 0; count < 9; count = count + 1)); do
|
||||
/sbin/dhcpcd -z ${i} &>${devnull} || break
|
||||
sleep 1
|
||||
done
|
||||
[[ ${count} -lt 9 ]]
|
||||
eend $? "Timed out"
|
||||
fi
|
||||
ebegin " Stopping ${i}"
|
||||
ifconfig ${i} down &>${devnull}
|
||||
eend 0
|
||||
done
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
start() {
|
||||
# These variables are set by setup_vars
|
||||
local status_IFACE vlans_IFACE dhcpcd_IFACE
|
||||
local -a ifconfig_IFACE routes_IFACE inet6_IFACE
|
||||
|
||||
# Call user-defined preup function if it exists
|
||||
if [[ $(type -t preup) == function ]]; then
|
||||
einfo "Running preup function"
|
||||
preup ${IFACE} || {
|
||||
eerror "preup ${IFACE} failed"
|
||||
return 1
|
||||
}
|
||||
fi
|
||||
|
||||
# Start the primary interface and aliases
|
||||
setup_vars ${IFACE}
|
||||
iface_start ${IFACE} || return 1
|
||||
|
||||
# Start vlans
|
||||
local vlan
|
||||
for vlan in ${vlans_IFACE}; do
|
||||
/sbin/vconfig add ${IFACE} ${vlan} >${devnull}
|
||||
setup_vars ${IFACE}.${vlan}
|
||||
iface_start ${IFACE}.${vlan}
|
||||
done
|
||||
|
||||
# Call user-defined postup function if it exists
|
||||
if [[ $(type -t postup) == function ]]; then
|
||||
einfo "Running postup function"
|
||||
postup ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
stop() {
|
||||
# Call user-defined predown function if it exists
|
||||
if [[ $(type -t predown) == function ]]; then
|
||||
einfo "Running predown function"
|
||||
predown ${IFACE}
|
||||
fi
|
||||
|
||||
# Don't depend on setup_vars since configuration might have changed.
|
||||
# Investigate current configuration instead.
|
||||
local vlan
|
||||
for vlan in $(ifconfig | grep -o "^${IFACE}\.[^ ]*"); do
|
||||
iface_stop ${vlan}
|
||||
/sbin/vconfig rem ${vlan} >${devnull}
|
||||
done
|
||||
|
||||
iface_stop ${IFACE} || return 1 # always succeeds, btw
|
||||
|
||||
# Call user-defined postdown function if it exists
|
||||
if [[ $(type -t postdown) == function ]]; then
|
||||
einfo "Running postdown function"
|
||||
postdown ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
# vim:ts=4
|
||||
+314
@@ -0,0 +1,314 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Technologies, Inc.
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
#NB: Config is in /etc/conf.d/net
|
||||
|
||||
if [[ -n $NET_DEBUG ]]; then
|
||||
set -x
|
||||
devnull=/dev/stderr
|
||||
else
|
||||
devnull=/dev/null
|
||||
fi
|
||||
|
||||
# For pcmcia users. note that pcmcia must be added to the same
|
||||
# runlevel as the net.* script that needs it.
|
||||
depend() {
|
||||
use hotplug pcmcia
|
||||
}
|
||||
|
||||
checkconfig() {
|
||||
if [[ -z "${ifconfig_IFACE}" ]]; then
|
||||
eerror "Please make sure that /etc/conf.d/net has \$ifconfig_$IFACE set"
|
||||
eerror "(or \$iface_$IFACE for old-style configuration)"
|
||||
return 1
|
||||
fi
|
||||
if [[ -n "${vlans_IFACE}" && ! -x /sbin/vconfig ]]; then
|
||||
eerror "For VLAN (802.1q) support, emerge net-misc/vconfig"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Fix bug 50039 (init.d/net.eth0 localization)
|
||||
# Some other commands in this script might need to be wrapped, but
|
||||
# we'll get them one-by-one. Note that LC_ALL trumps LC_anything_else
|
||||
# according to locale(7)
|
||||
ifconfig() {
|
||||
LC_ALL=C /sbin/ifconfig "$@"
|
||||
}
|
||||
|
||||
# setup_vars: setup variables based on $1 and content of /etc/conf.d/net
|
||||
# The following variables are set, which should be declared local by
|
||||
# the calling routine.
|
||||
# status_IFACE (up or '')
|
||||
# vlans_IFACE (space-separated list)
|
||||
# ifconfig_IFACE (array of ifconfig lines, replaces iface_IFACE)
|
||||
# dhcpcd_IFACE (command-line args for dhcpcd)
|
||||
# routes_IFACE (array of route lines)
|
||||
# inet6_IFACE (array of inet6 lines)
|
||||
# ifconfig_fallback_IFACE (fallback ifconfig if dhcp fails)
|
||||
setup_vars() {
|
||||
local i iface="${1//\./_}"
|
||||
|
||||
status_IFACE="$(ifconfig ${1} 2>${devnull} | gawk '$1 == "UP" {print "up"}')"
|
||||
eval vlans_IFACE=\"\$\{iface_${iface}_vlans\}\"
|
||||
eval ifconfig_IFACE=( \"\$\{ifconfig_$iface\[@\]\}\" )
|
||||
eval dhcpcd_IFACE=\"\$\{dhcpcd_$iface\}\"
|
||||
eval routes_IFACE=( \"\$\{routes_$iface\[@\]\}\" )
|
||||
eval inet6_IFACE=( \"\$\{inet6_$iface\[@\]\}\" )
|
||||
eval ifconfig_fallback_IFACE=( \"\$\{ifconfig_fallback_$iface\[@\]\}\" )
|
||||
|
||||
# BACKWARD COMPATIBILITY: populate the ifconfig_IFACE array
|
||||
# if iface_IFACE is set (fex. iface_eth0 instead of ifconfig_eth0)
|
||||
eval local iface_IFACE=\"\$\{iface_$iface\}\"
|
||||
if [[ -n ${iface_IFACE} && -z ${ifconfig_IFACE} ]]; then
|
||||
# Make sure these get evaluated as arrays
|
||||
local -a aliases broadcasts netmasks
|
||||
|
||||
# Start with the primary interface
|
||||
ifconfig_IFACE=( "${iface_IFACE}" )
|
||||
|
||||
# ..then add aliases
|
||||
eval aliases=( \$\{alias_$iface\} )
|
||||
eval broadcasts=( \$\{broadcast_$iface\} )
|
||||
eval netmasks=( \$\{netmask_$iface\} )
|
||||
for ((i = 0; i < ${#aliases[@]}; i = i + 1)); do
|
||||
ifconfig_IFACE[i+1]="${aliases[i]} ${broadcasts[i]:+broadcast ${broadcasts[i]}} ${netmasks[i]:+netmask ${netmasks[i]}}"
|
||||
done
|
||||
fi
|
||||
|
||||
# BACKWARD COMPATIBILITY: check for space-separated inet6 addresses
|
||||
if [[ ${#inet6_IFACE[@]} == 1 && ${inet6_IFACE} == *' '* ]]; then
|
||||
inet6_IFACE=( ${inet6_IFACE} )
|
||||
fi
|
||||
}
|
||||
|
||||
iface_start() {
|
||||
local IFACE=${1} i x retval
|
||||
checkconfig || return 1
|
||||
|
||||
if [[ ${ifconfig_IFACE} != dhcp ]]; then
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Bringing ${IFACE} up (${i})"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up"
|
||||
fi
|
||||
# ifconfig does not always return failure ..
|
||||
ifconfig ${IFACE} ${ifconfig_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
# Check that eth0 was not brought up by the kernel ...
|
||||
if [[ ${status_IFACE} == up ]]; then
|
||||
einfo "Keeping kernel configuration for ${IFACE}"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up via DHCP"
|
||||
/sbin/dhcpcd ${dhcpcd_IFACE} ${IFACE}
|
||||
retval=$?
|
||||
eend $retval
|
||||
if [[ $retval == 0 ]]; then
|
||||
# DHCP succeeded, show address retrieved
|
||||
i=$(ifconfig ${IFACE} | grep -m1 -o 'inet addr:[^ ]*' |
|
||||
cut -d: -f2)
|
||||
[[ -n ${i} ]] && einfo " ${IFACE} received address ${i}"
|
||||
elif [[ -n "${ifconfig_fallback_IFACE}" ]]; then
|
||||
# DHCP failed, try fallback.
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_fallback_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Using fallback configuration (${i}) for ${IFACE}"
|
||||
else
|
||||
ebegin "Using fallback configuration for ${IFACE}"
|
||||
fi
|
||||
ifconfig ${IFACE} ${ifconfig_fallback_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
return $retval
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ ${#ifconfig_IFACE[@]} -gt 1 ]]; then
|
||||
einfo " Adding aliases"
|
||||
for ((i = 1; i < ${#ifconfig_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE}:${i} (${ifconfig_IFACE[i]%% *})"
|
||||
ifconfig ${IFACE}:${i} ${ifconfig_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
if [[ -n ${inet6_IFACE} ]]; then
|
||||
einfo " Adding inet6 addresses"
|
||||
for ((i = 0; i < ${#inet6_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE} inet6 add ${inet6_IFACE[i]}"
|
||||
ifconfig ${IFACE} inet6 add ${inet6_IFACE[i]} >${devnull}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set static routes
|
||||
if [[ -n ${routes_IFACE} ]]; then
|
||||
einfo " Adding routes"
|
||||
for ((i = 0; i < ${#routes_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${routes_IFACE[i]}"
|
||||
/sbin/route add ${routes_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set default route if applicable to this interface
|
||||
if [[ ${gateway} == ${IFACE}/* ]]; then
|
||||
local ogw=$(/bin/netstat -rn | awk '$1 == "0.0.0.0" {print $2}')
|
||||
local gw=${gateway#*/}
|
||||
if [[ ${ogw} != ${gw} ]]; then
|
||||
ebegin " Setting default gateway ($gw)"
|
||||
|
||||
# First delete any existing route if it was setup by kernel...
|
||||
/sbin/route del default dev ${IFACE} &>${devnull}
|
||||
|
||||
# Second delete old gateway if it was set...
|
||||
/sbin/route del default gw ${ogw} &>${devnull}
|
||||
|
||||
# Third add our new default gateway
|
||||
/sbin/route add default gw ${gw} >${devnull}
|
||||
eend $? || {
|
||||
true # need to have some command in here
|
||||
# Note: This originally called stop, which is obviously
|
||||
# wrong since it's calling with a local version of IFACE.
|
||||
# The below code works correctly to abort configuration of
|
||||
# the interface, but is commented because we're assuming
|
||||
# that default route failure should not cause the interface
|
||||
# to be unconfigured.
|
||||
#local error=$?
|
||||
#ewarn "Aborting configuration of ${IFACE}"
|
||||
#iface_stop ${IFACE}
|
||||
#return ${error}
|
||||
}
|
||||
fi
|
||||
fi
|
||||
|
||||
# Enabling rp_filter causes wacky packets to be auto-dropped by
|
||||
# the kernel. Note that we only do this if it is not set via
|
||||
# /etc/sysctl.conf ...
|
||||
if [[ -e /proc/sys/net/ipv4/conf/${IFACE}/rp_filter && \
|
||||
-z "$(grep -s '^[^#]*rp_filter' /etc/sysctl.conf)" ]]; then
|
||||
echo -n 1 > /proc/sys/net/ipv4/conf/${IFACE}/rp_filter
|
||||
fi
|
||||
}
|
||||
|
||||
# iface_stop: bring down an interface. Don't trust information in
|
||||
# /etc/conf.d/net since the configuration might have changed since
|
||||
# iface_start ran. Instead query for current configuration and bring
|
||||
# down the interface.
|
||||
iface_stop() {
|
||||
local IFACE=${1} i x aliases inet6 count
|
||||
|
||||
# Try to do a simple down (no aliases, no inet6, no dhcp)
|
||||
aliases="$(ifconfig | grep -o "^$IFACE:[0-9]*" | tac)"
|
||||
inet6="$(ifconfig ${IFACE} | awk '$1 == "inet6" {print $2}')"
|
||||
if [[ -z ${aliases} && -z ${inet6} && ! -e /var/run/dhcpcd-${IFACE}.pid ]]; then
|
||||
ebegin "Bringing ${IFACE} down"
|
||||
ifconfig ${IFACE} down &>/dev/null
|
||||
eend 0
|
||||
return 0
|
||||
fi
|
||||
|
||||
einfo "Bringing ${IFACE} down"
|
||||
|
||||
# Stop aliases before primary interface.
|
||||
# Note this must be done in reverse order, since ifconfig eth0:1
|
||||
# will remove eth0:2, etc. It might be sufficient to simply remove
|
||||
# the base interface but we're being safe here.
|
||||
for i in ${aliases} ${IFACE}; do
|
||||
|
||||
# Delete all the inet6 addresses for this interface
|
||||
inet6="$(ifconfig ${i} | awk '$1 == "inet6" {print $3}')"
|
||||
if [[ -n ${inet6} ]]; then
|
||||
einfo " Removing inet6 addresses"
|
||||
for x in ${inet6}; do
|
||||
ebegin " ${IFACE} inet6 del ${x}"
|
||||
ifconfig ${i} inet6 del ${x}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Stop DHCP (should be N/A for aliases)
|
||||
# Don't trust current configuration... investigate ourselves
|
||||
if /sbin/dhcpcd -z ${i} &>${devnull}; then
|
||||
ebegin " Releasing DHCP lease for ${IFACE}"
|
||||
for ((count = 0; count < 9; count = count + 1)); do
|
||||
/sbin/dhcpcd -z ${i} &>${devnull} || break
|
||||
sleep 1
|
||||
done
|
||||
[[ ${count} -lt 9 ]]
|
||||
eend $? "Timed out"
|
||||
fi
|
||||
ebegin " Stopping ${i}"
|
||||
ifconfig ${i} down &>${devnull}
|
||||
eend 0
|
||||
done
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
start() {
|
||||
# These variables are set by setup_vars
|
||||
local status_IFACE vlans_IFACE dhcpcd_IFACE
|
||||
local -a ifconfig_IFACE routes_IFACE inet6_IFACE
|
||||
|
||||
# Call user-defined preup function if it exists
|
||||
if [[ $(type -t preup) == function ]]; then
|
||||
einfo "Running preup function"
|
||||
preup ${IFACE} || {
|
||||
eerror "preup ${IFACE} failed"
|
||||
return 1
|
||||
}
|
||||
fi
|
||||
|
||||
# Start the primary interface and aliases
|
||||
setup_vars ${IFACE}
|
||||
iface_start ${IFACE} || return 1
|
||||
|
||||
# Start vlans
|
||||
local vlan
|
||||
for vlan in ${vlans_IFACE}; do
|
||||
/sbin/vconfig add ${IFACE} ${vlan} >${devnull}
|
||||
setup_vars ${IFACE}.${vlan}
|
||||
iface_start ${IFACE}.${vlan}
|
||||
done
|
||||
|
||||
# Call user-defined postup function if it exists
|
||||
if [[ $(type -t postup) == function ]]; then
|
||||
einfo "Running postup function"
|
||||
postup ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
stop() {
|
||||
# Call user-defined predown function if it exists
|
||||
if [[ $(type -t predown) == function ]]; then
|
||||
einfo "Running predown function"
|
||||
predown ${IFACE}
|
||||
fi
|
||||
|
||||
# Don't depend on setup_vars since configuration might have changed.
|
||||
# Investigate current configuration instead.
|
||||
local vlan
|
||||
for vlan in $(ifconfig | grep -o "^${IFACE}\.[^ ]*"); do
|
||||
iface_stop ${vlan}
|
||||
/sbin/vconfig rem ${vlan} >${devnull}
|
||||
done
|
||||
|
||||
iface_stop ${IFACE} || return 1 # always succeeds, btw
|
||||
|
||||
# Call user-defined postdown function if it exists
|
||||
if [[ $(type -t postdown) == function ]]; then
|
||||
einfo "Running postdown function"
|
||||
postdown ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
# vim:ts=4
|
||||
@@ -0,0 +1 @@
|
||||
HOSTNAME=venus
|
||||
@@ -0,0 +1,11 @@
|
||||
# /etc/conf.d/net:
|
||||
|
||||
# This is basically the ifconfig argument without the ifconfig $iface
|
||||
#
|
||||
iface_lo="127.0.0.1 netmask 255.0.0.0"
|
||||
iface_eth0="PH_IP_VENUS broadcast 10.1.255.255 netmask 255.255.0.0"
|
||||
|
||||
# For setting the default gateway
|
||||
#
|
||||
gateway="eth0/PH_IP1_MOON"
|
||||
|
||||
Executable
+74
@@ -0,0 +1,74 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Foundation
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
opts="start stop reload"
|
||||
|
||||
depend() {
|
||||
before net
|
||||
need logger
|
||||
}
|
||||
|
||||
start() {
|
||||
ebegin "Starting firewall"
|
||||
|
||||
# default policy is DROP
|
||||
/sbin/iptables -P INPUT DROP
|
||||
/sbin/iptables -P OUTPUT DROP
|
||||
/sbin/iptables -P FORWARD DROP
|
||||
|
||||
# allow IKE
|
||||
iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
|
||||
iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
|
||||
|
||||
# allow NAT-T
|
||||
iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
|
||||
iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
|
||||
|
||||
|
||||
# allow crl fetch from winnetou
|
||||
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
|
||||
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
|
||||
|
||||
# allow ssh
|
||||
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
|
||||
|
||||
eend $?
|
||||
}
|
||||
|
||||
stop() {
|
||||
ebegin "Stopping firewall"
|
||||
for a in `cat /proc/net/ip_tables_names`; do
|
||||
/sbin/iptables -F -t $a
|
||||
/sbin/iptables -X -t $a
|
||||
|
||||
if [ $a == nat ]; then
|
||||
/sbin/iptables -t nat -P PREROUTING ACCEPT
|
||||
/sbin/iptables -t nat -P POSTROUTING ACCEPT
|
||||
/sbin/iptables -t nat -P OUTPUT ACCEPT
|
||||
elif [ $a == mangle ]; then
|
||||
/sbin/iptables -t mangle -P PREROUTING ACCEPT
|
||||
/sbin/iptables -t mangle -P INPUT ACCEPT
|
||||
/sbin/iptables -t mangle -P FORWARD ACCEPT
|
||||
/sbin/iptables -t mangle -P OUTPUT ACCEPT
|
||||
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
|
||||
elif [ $a == filter ]; then
|
||||
/sbin/iptables -t filter -P INPUT ACCEPT
|
||||
/sbin/iptables -t filter -P FORWARD ACCEPT
|
||||
/sbin/iptables -t filter -P OUTPUT ACCEPT
|
||||
fi
|
||||
done
|
||||
eend $?
|
||||
}
|
||||
|
||||
reload() {
|
||||
ebegin "Flushing firewall"
|
||||
for a in `cat /proc/net/ip_tables_names`; do
|
||||
/sbin/iptables -F -t $a
|
||||
/sbin/iptables -X -t $a
|
||||
done;
|
||||
eend $?
|
||||
start
|
||||
}
|
||||
|
||||
Executable
+314
@@ -0,0 +1,314 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Technologies, Inc.
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
#NB: Config is in /etc/conf.d/net
|
||||
|
||||
if [[ -n $NET_DEBUG ]]; then
|
||||
set -x
|
||||
devnull=/dev/stderr
|
||||
else
|
||||
devnull=/dev/null
|
||||
fi
|
||||
|
||||
# For pcmcia users. note that pcmcia must be added to the same
|
||||
# runlevel as the net.* script that needs it.
|
||||
depend() {
|
||||
use hotplug pcmcia
|
||||
}
|
||||
|
||||
checkconfig() {
|
||||
if [[ -z "${ifconfig_IFACE}" ]]; then
|
||||
eerror "Please make sure that /etc/conf.d/net has \$ifconfig_$IFACE set"
|
||||
eerror "(or \$iface_$IFACE for old-style configuration)"
|
||||
return 1
|
||||
fi
|
||||
if [[ -n "${vlans_IFACE}" && ! -x /sbin/vconfig ]]; then
|
||||
eerror "For VLAN (802.1q) support, emerge net-misc/vconfig"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Fix bug 50039 (init.d/net.eth0 localization)
|
||||
# Some other commands in this script might need to be wrapped, but
|
||||
# we'll get them one-by-one. Note that LC_ALL trumps LC_anything_else
|
||||
# according to locale(7)
|
||||
ifconfig() {
|
||||
LC_ALL=C /sbin/ifconfig "$@"
|
||||
}
|
||||
|
||||
# setup_vars: setup variables based on $1 and content of /etc/conf.d/net
|
||||
# The following variables are set, which should be declared local by
|
||||
# the calling routine.
|
||||
# status_IFACE (up or '')
|
||||
# vlans_IFACE (space-separated list)
|
||||
# ifconfig_IFACE (array of ifconfig lines, replaces iface_IFACE)
|
||||
# dhcpcd_IFACE (command-line args for dhcpcd)
|
||||
# routes_IFACE (array of route lines)
|
||||
# inet6_IFACE (array of inet6 lines)
|
||||
# ifconfig_fallback_IFACE (fallback ifconfig if dhcp fails)
|
||||
setup_vars() {
|
||||
local i iface="${1//\./_}"
|
||||
|
||||
status_IFACE="$(ifconfig ${1} 2>${devnull} | gawk '$1 == "UP" {print "up"}')"
|
||||
eval vlans_IFACE=\"\$\{iface_${iface}_vlans\}\"
|
||||
eval ifconfig_IFACE=( \"\$\{ifconfig_$iface\[@\]\}\" )
|
||||
eval dhcpcd_IFACE=\"\$\{dhcpcd_$iface\}\"
|
||||
eval routes_IFACE=( \"\$\{routes_$iface\[@\]\}\" )
|
||||
eval inet6_IFACE=( \"\$\{inet6_$iface\[@\]\}\" )
|
||||
eval ifconfig_fallback_IFACE=( \"\$\{ifconfig_fallback_$iface\[@\]\}\" )
|
||||
|
||||
# BACKWARD COMPATIBILITY: populate the ifconfig_IFACE array
|
||||
# if iface_IFACE is set (fex. iface_eth0 instead of ifconfig_eth0)
|
||||
eval local iface_IFACE=\"\$\{iface_$iface\}\"
|
||||
if [[ -n ${iface_IFACE} && -z ${ifconfig_IFACE} ]]; then
|
||||
# Make sure these get evaluated as arrays
|
||||
local -a aliases broadcasts netmasks
|
||||
|
||||
# Start with the primary interface
|
||||
ifconfig_IFACE=( "${iface_IFACE}" )
|
||||
|
||||
# ..then add aliases
|
||||
eval aliases=( \$\{alias_$iface\} )
|
||||
eval broadcasts=( \$\{broadcast_$iface\} )
|
||||
eval netmasks=( \$\{netmask_$iface\} )
|
||||
for ((i = 0; i < ${#aliases[@]}; i = i + 1)); do
|
||||
ifconfig_IFACE[i+1]="${aliases[i]} ${broadcasts[i]:+broadcast ${broadcasts[i]}} ${netmasks[i]:+netmask ${netmasks[i]}}"
|
||||
done
|
||||
fi
|
||||
|
||||
# BACKWARD COMPATIBILITY: check for space-separated inet6 addresses
|
||||
if [[ ${#inet6_IFACE[@]} == 1 && ${inet6_IFACE} == *' '* ]]; then
|
||||
inet6_IFACE=( ${inet6_IFACE} )
|
||||
fi
|
||||
}
|
||||
|
||||
iface_start() {
|
||||
local IFACE=${1} i x retval
|
||||
checkconfig || return 1
|
||||
|
||||
if [[ ${ifconfig_IFACE} != dhcp ]]; then
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Bringing ${IFACE} up (${i})"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up"
|
||||
fi
|
||||
# ifconfig does not always return failure ..
|
||||
ifconfig ${IFACE} ${ifconfig_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
# Check that eth0 was not brought up by the kernel ...
|
||||
if [[ ${status_IFACE} == up ]]; then
|
||||
einfo "Keeping kernel configuration for ${IFACE}"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up via DHCP"
|
||||
/sbin/dhcpcd ${dhcpcd_IFACE} ${IFACE}
|
||||
retval=$?
|
||||
eend $retval
|
||||
if [[ $retval == 0 ]]; then
|
||||
# DHCP succeeded, show address retrieved
|
||||
i=$(ifconfig ${IFACE} | grep -m1 -o 'inet addr:[^ ]*' |
|
||||
cut -d: -f2)
|
||||
[[ -n ${i} ]] && einfo " ${IFACE} received address ${i}"
|
||||
elif [[ -n "${ifconfig_fallback_IFACE}" ]]; then
|
||||
# DHCP failed, try fallback.
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_fallback_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Using fallback configuration (${i}) for ${IFACE}"
|
||||
else
|
||||
ebegin "Using fallback configuration for ${IFACE}"
|
||||
fi
|
||||
ifconfig ${IFACE} ${ifconfig_fallback_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
return $retval
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ ${#ifconfig_IFACE[@]} -gt 1 ]]; then
|
||||
einfo " Adding aliases"
|
||||
for ((i = 1; i < ${#ifconfig_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE}:${i} (${ifconfig_IFACE[i]%% *})"
|
||||
ifconfig ${IFACE}:${i} ${ifconfig_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
if [[ -n ${inet6_IFACE} ]]; then
|
||||
einfo " Adding inet6 addresses"
|
||||
for ((i = 0; i < ${#inet6_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE} inet6 add ${inet6_IFACE[i]}"
|
||||
ifconfig ${IFACE} inet6 add ${inet6_IFACE[i]} >${devnull}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set static routes
|
||||
if [[ -n ${routes_IFACE} ]]; then
|
||||
einfo " Adding routes"
|
||||
for ((i = 0; i < ${#routes_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${routes_IFACE[i]}"
|
||||
/sbin/route add ${routes_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set default route if applicable to this interface
|
||||
if [[ ${gateway} == ${IFACE}/* ]]; then
|
||||
local ogw=$(/bin/netstat -rn | awk '$1 == "0.0.0.0" {print $2}')
|
||||
local gw=${gateway#*/}
|
||||
if [[ ${ogw} != ${gw} ]]; then
|
||||
ebegin " Setting default gateway ($gw)"
|
||||
|
||||
# First delete any existing route if it was setup by kernel...
|
||||
/sbin/route del default dev ${IFACE} &>${devnull}
|
||||
|
||||
# Second delete old gateway if it was set...
|
||||
/sbin/route del default gw ${ogw} &>${devnull}
|
||||
|
||||
# Third add our new default gateway
|
||||
/sbin/route add default gw ${gw} >${devnull}
|
||||
eend $? || {
|
||||
true # need to have some command in here
|
||||
# Note: This originally called stop, which is obviously
|
||||
# wrong since it's calling with a local version of IFACE.
|
||||
# The below code works correctly to abort configuration of
|
||||
# the interface, but is commented because we're assuming
|
||||
# that default route failure should not cause the interface
|
||||
# to be unconfigured.
|
||||
#local error=$?
|
||||
#ewarn "Aborting configuration of ${IFACE}"
|
||||
#iface_stop ${IFACE}
|
||||
#return ${error}
|
||||
}
|
||||
fi
|
||||
fi
|
||||
|
||||
# Enabling rp_filter causes wacky packets to be auto-dropped by
|
||||
# the kernel. Note that we only do this if it is not set via
|
||||
# /etc/sysctl.conf ...
|
||||
if [[ -e /proc/sys/net/ipv4/conf/${IFACE}/rp_filter && \
|
||||
-z "$(grep -s '^[^#]*rp_filter' /etc/sysctl.conf)" ]]; then
|
||||
echo -n 1 > /proc/sys/net/ipv4/conf/${IFACE}/rp_filter
|
||||
fi
|
||||
}
|
||||
|
||||
# iface_stop: bring down an interface. Don't trust information in
|
||||
# /etc/conf.d/net since the configuration might have changed since
|
||||
# iface_start ran. Instead query for current configuration and bring
|
||||
# down the interface.
|
||||
iface_stop() {
|
||||
local IFACE=${1} i x aliases inet6 count
|
||||
|
||||
# Try to do a simple down (no aliases, no inet6, no dhcp)
|
||||
aliases="$(ifconfig | grep -o "^$IFACE:[0-9]*" | tac)"
|
||||
inet6="$(ifconfig ${IFACE} | awk '$1 == "inet6" {print $2}')"
|
||||
if [[ -z ${aliases} && -z ${inet6} && ! -e /var/run/dhcpcd-${IFACE}.pid ]]; then
|
||||
ebegin "Bringing ${IFACE} down"
|
||||
ifconfig ${IFACE} down &>/dev/null
|
||||
eend 0
|
||||
return 0
|
||||
fi
|
||||
|
||||
einfo "Bringing ${IFACE} down"
|
||||
|
||||
# Stop aliases before primary interface.
|
||||
# Note this must be done in reverse order, since ifconfig eth0:1
|
||||
# will remove eth0:2, etc. It might be sufficient to simply remove
|
||||
# the base interface but we're being safe here.
|
||||
for i in ${aliases} ${IFACE}; do
|
||||
|
||||
# Delete all the inet6 addresses for this interface
|
||||
inet6="$(ifconfig ${i} | awk '$1 == "inet6" {print $3}')"
|
||||
if [[ -n ${inet6} ]]; then
|
||||
einfo " Removing inet6 addresses"
|
||||
for x in ${inet6}; do
|
||||
ebegin " ${IFACE} inet6 del ${x}"
|
||||
ifconfig ${i} inet6 del ${x}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Stop DHCP (should be N/A for aliases)
|
||||
# Don't trust current configuration... investigate ourselves
|
||||
if /sbin/dhcpcd -z ${i} &>${devnull}; then
|
||||
ebegin " Releasing DHCP lease for ${IFACE}"
|
||||
for ((count = 0; count < 9; count = count + 1)); do
|
||||
/sbin/dhcpcd -z ${i} &>${devnull} || break
|
||||
sleep 1
|
||||
done
|
||||
[[ ${count} -lt 9 ]]
|
||||
eend $? "Timed out"
|
||||
fi
|
||||
ebegin " Stopping ${i}"
|
||||
ifconfig ${i} down &>${devnull}
|
||||
eend 0
|
||||
done
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
start() {
|
||||
# These variables are set by setup_vars
|
||||
local status_IFACE vlans_IFACE dhcpcd_IFACE
|
||||
local -a ifconfig_IFACE routes_IFACE inet6_IFACE
|
||||
|
||||
# Call user-defined preup function if it exists
|
||||
if [[ $(type -t preup) == function ]]; then
|
||||
einfo "Running preup function"
|
||||
preup ${IFACE} || {
|
||||
eerror "preup ${IFACE} failed"
|
||||
return 1
|
||||
}
|
||||
fi
|
||||
|
||||
# Start the primary interface and aliases
|
||||
setup_vars ${IFACE}
|
||||
iface_start ${IFACE} || return 1
|
||||
|
||||
# Start vlans
|
||||
local vlan
|
||||
for vlan in ${vlans_IFACE}; do
|
||||
/sbin/vconfig add ${IFACE} ${vlan} >${devnull}
|
||||
setup_vars ${IFACE}.${vlan}
|
||||
iface_start ${IFACE}.${vlan}
|
||||
done
|
||||
|
||||
# Call user-defined postup function if it exists
|
||||
if [[ $(type -t postup) == function ]]; then
|
||||
einfo "Running postup function"
|
||||
postup ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
stop() {
|
||||
# Call user-defined predown function if it exists
|
||||
if [[ $(type -t predown) == function ]]; then
|
||||
einfo "Running predown function"
|
||||
predown ${IFACE}
|
||||
fi
|
||||
|
||||
# Don't depend on setup_vars since configuration might have changed.
|
||||
# Investigate current configuration instead.
|
||||
local vlan
|
||||
for vlan in $(ifconfig | grep -o "^${IFACE}\.[^ ]*"); do
|
||||
iface_stop ${vlan}
|
||||
/sbin/vconfig rem ${vlan} >${devnull}
|
||||
done
|
||||
|
||||
iface_stop ${IFACE} || return 1 # always succeeds, btw
|
||||
|
||||
# Call user-defined postdown function if it exists
|
||||
if [[ $(type -t postdown) == function ]]; then
|
||||
einfo "Running postdown function"
|
||||
postdown ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
# vim:ts=4
|
||||
Executable
+25
@@ -0,0 +1,25 @@
|
||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
version 2.0 # conforms to second version of ipsec.conf specification
|
||||
|
||||
config setup
|
||||
plutodebug=control
|
||||
crlcheckinterval=180
|
||||
strictcrlpolicy=no
|
||||
nat_traversal=yes
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
|
||||
conn nat-t
|
||||
left=%defaultroute
|
||||
leftcert=venusCert.pem
|
||||
[email protected]
|
||||
leftfirewall=yes
|
||||
right=PH_IP_SUN
|
||||
[email protected]
|
||||
rightsubnet=10.2.0.0/16
|
||||
auto=add
|
||||
@@ -0,0 +1,22 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDtTCCAp2gAwIBAgIBADANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
|
||||
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
|
||||
b290IENBMB4XDTA0MDkxMDExMDE0NVoXDTE0MDkwODExMDE0NVowRTELMAkGA1UE
|
||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0cm9u
|
||||
Z1N3YW4gUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL/y
|
||||
X2LqPVZuWLPIeknK86xhz6ljd3NNhC2z+P1uoCP3sBMuZiZQEjFzhnKcbXxCeo2f
|
||||
FnvhOOjrrisSuVkzuu82oxXD3fIkzuS7m9V4E10EZzgmKWIf+WuNRfbgAuUINmLc
|
||||
4YGAXBQLPyzpP4Ou48hhz/YQo58Bics6PHy5v34qCVROIXDvqhj91P8g+pS+F21/
|
||||
7P+CH2jRcVIEHZtG8M/PweTPQ95dPzpYd2Ov6SZ/U7EWmbMmT8VcUYn1aChxFmy5
|
||||
gweVBWlkH6MP+1DeE0/tL5c87xo5KCeGK8Tdqpe7sBRC4pPEEHDQciTUvkeuJ1Pr
|
||||
K+1LwdqRxo7HgMRiDw8CAwEAAaOBrzCBrDAPBgNVHRMBAf8EBTADAQH/MAsGA1Ud
|
||||
DwQEAwIBBjAdBgNVHQ4EFgQUXafdcAZRMn7ntm2zteXgYOouTe8wbQYDVR0jBGYw
|
||||
ZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJBgNVBAYTAkNIMRkwFwYD
|
||||
VQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJvbmdTd2FuIFJvb3Qg
|
||||
Q0GCAQAwDQYJKoZIhvcNAQEEBQADggEBAJrXTj5gWS37myHHhii9drYwkMFyDHS/
|
||||
lHU8rW/drcnHdus507+qUhNr9SiEAHg4Ywj895UDvT0a1sFaw44QyEa/94iKA8/n
|
||||
+g5kS1IrKvWu3wu8UI3EgzChgHV3cncQlQWbK+FI9Y3Ax1O1np1r+wLptoWpKKKE
|
||||
UxsYcxP9K4Nbyeon0AIHOajUheiL3t6aRc3m0o7VU7Do6S2r+He+1Zq/nRUfFeTy
|
||||
0Atebkn8tmUpPSKWaXkmwpVNrjZ1Qu9umAU+dtJyhzL2zmnyhPC4VqpsKCOp7imy
|
||||
gKZvUIKPm1zyf4T+yjwxwkiX2xVseoM3aKswb1EoZFelHwndU7u0GQ8=
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,24 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEDzCCAvegAwIBAgIBBDANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
|
||||
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
|
||||
b290IENBMB4XDTA0MDkxMDExMTgyNloXDTA5MDkwOTExMTgyNlowRzELMAkGA1UE
|
||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xHTAbBgNVBAMTFHZlbnVz
|
||||
LnN0cm9uZ3N3YW4ub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
|
||||
mlQ2s9J7bw73onkw0ZwwcM2JDJuU3KmmuzETlmLdtg7m8yFCdhoDg6cxrsIvPAWy
|
||||
Gs++1e+1qzy7LTnNHckaHHFwJQf0JoIGE1bbUrJidX8B1T3sDdvZFbyfmQTWSEyJ
|
||||
thrdqdPS92VJW/9XQOPeEhudIHr+NtWQfCm3OQFKDXGCEkHOjpVNHn3BPUiL99ON
|
||||
FiLZX3gZy6vTERpEE8ga66fHtpM3RJfIxYoUQUdRw8iIa8iOvRGtJa/MfOWX6L/H
|
||||
wquRv3SuCl4iMSph7e/VE+z5xx3OyKSAki914DgRFnQITKjyGxw1lORlDQlZy2w/
|
||||
nu0BAbXS1pb/2AiF8jDpbQIDAQABo4IBBjCCAQIwCQYDVR0TBAIwADALBgNVHQ8E
|
||||
BAMCA6gwHQYDVR0OBBYEFEqPlXBYJh1knX0Q61HMcn9LOZ6sMG0GA1UdIwRmMGSA
|
||||
FF2n3XAGUTJ+57Zts7Xl4GDqLk3voUmkRzBFMQswCQYDVQQGEwJDSDEZMBcGA1UE
|
||||
ChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBSb290IENB
|
||||
ggEAMB8GA1UdEQQYMBaCFHZlbnVzLnN0cm9uZ3N3YW4ub3JnMDkGA1UdHwQyMDAw
|
||||
LqAsoCqGKGh0dHA6Ly9jcmwuc3Ryb25nc3dhbi5vcmcvc3Ryb25nc3dhbi5jcmww
|
||||
DQYJKoZIhvcNAQEEBQADggEBAEx3kXh2Z5CMH+tX6cJPyi6gSeOgXy7NBiNsEdXN
|
||||
rwGp4DwN6uiSog4EYZJA203oqE3eaoYdBXKiOGvjW4vyigvpDr8H+MeW2HsNuMKX
|
||||
PFpY4NucV0fJlzFhtkp31zTLHNESCgTqNIwGj+CbN0rxhHGE6502krnu+C12nJ7B
|
||||
fdMzml1RmVp4JlZC5yfiTy0F2s/aH+8xQ2x509UoD+boNM9GR+IlWS2dDypISGid
|
||||
hbM4rpiMLBj2riWD8HiuljkKQ6LemBXeZQXuIPlusl7cH/synNkHk8iiALM8xfGh
|
||||
wTEmdo5Tp5sDI3cj3LVvhcsTxjiOA81her1F0itlxpEA/gA=
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,27 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEogIBAAKCAQEAmlQ2s9J7bw73onkw0ZwwcM2JDJuU3KmmuzETlmLdtg7m8yFC
|
||||
dhoDg6cxrsIvPAWyGs++1e+1qzy7LTnNHckaHHFwJQf0JoIGE1bbUrJidX8B1T3s
|
||||
DdvZFbyfmQTWSEyJthrdqdPS92VJW/9XQOPeEhudIHr+NtWQfCm3OQFKDXGCEkHO
|
||||
jpVNHn3BPUiL99ONFiLZX3gZy6vTERpEE8ga66fHtpM3RJfIxYoUQUdRw8iIa8iO
|
||||
vRGtJa/MfOWX6L/HwquRv3SuCl4iMSph7e/VE+z5xx3OyKSAki914DgRFnQITKjy
|
||||
Gxw1lORlDQlZy2w/nu0BAbXS1pb/2AiF8jDpbQIDAQABAoIBAFyVMMvn9YzGmeCq
|
||||
e5MD9Dt30kPyAffu/stFwc5yOTfC8OHijhBzwq/0WWXRsKx9bj+PaZjGWWIE6PVU
|
||||
u6ymvDdcBj7w6pM/ZY2siZ6uzUpXiy32G+qkfTMBGW2e7T4qTGMm8tuy69jmtn+u
|
||||
SxXunYaXckfOATu8GxWhoP1dvKMbCrlQxxmduP04au8HhpLTQgDZ28PrvyqUR6AW
|
||||
D+PDGACLbCFzmaMLgv6yv2+GNQpBEDr/VUjOOBvzZhUm9ku81dSdYNhHx8vbT/DG
|
||||
GkERG9tE2PA51sWB5cUh13ZItWmbW/NoWiykxJb7J7VkjXAn57jw4suSbNEQnA/E
|
||||
bg/5WwECgYEAyqEWS7cUCLheHuyWHOxkL7ACoko4wS8QO3Q4ohPlqZb7pca7FIqU
|
||||
WzXEUcyYZPkKTAKx/Vd0Xv6raGImi1QluuwLULACvZ7Ei5uLsMxUCJKyLX7wunTb
|
||||
64aH8jONNMAXX4K9eVj7EghBGjdnVc4HRAzm/QyH8F6hmXGT7Ulw3JECgYEAwvpU
|
||||
AkrUGb5UgVG/tNtlOlCqVGyvWOITDEsxLPCTlC6Ls6EIYKvc/21oRNL7n/ssfvS/
|
||||
DbyVTatiCXaF/MDbx0msbxJbq3sGTY16/XMb1PeTRdQm4xsUEQB1Fi3MnhLmPzV1
|
||||
jdKSKvKoxTfZKUg9eP/aVs4abRyHsIXc7BRznR0CgYBB86qBHGa969xerlyxr1Nw
|
||||
nhZNYmEUp8/duhdQ0a8XwtfHfmaX6f8drONoSHJ1swVh9iKetd9fp/58bC3lfY8G
|
||||
RxvruE48D7gjRI50Dh1v6OdrnXyXA8As6c3HzHWybK9u2+v12jtmBB/Ee7H7oKKG
|
||||
yLhKNtDsMLDic7BVNGkysQKBgHjzr0+oucCqiGOcoc8A1uABEFjE/1WlEOnsbzoQ
|
||||
l4wx/6nT+I13r+WoKimftEZ/GxA6pZZQ6VHAQlXad63eubf75QMWIVXUQIm1fZli
|
||||
Yd6QIoUL4X+62YzeesPib2+UC88kS6NKADCyTa3iQk3QqYm5Nenpew06yJXhxLWS
|
||||
zlGlAoGACEbPUlQB+ouInOFyVcFf1kHsMBcmg54MVi2J6x95149rq5FlY5kbmZcs
|
||||
6wlSBkAzzKb7WbPNgbGLMAYP+EXKODe+f1nzP+oojmJlCdTLfrudREFA2ZGGOKDX
|
||||
0o2EhnGL7VB4Upuw5ddMs7s1v6pqUKQXrZQUb24AX8w/1n+0PEM=
|
||||
-----END RSA PRIVATE KEY-----
|
||||
@@ -0,0 +1,8 @@
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
|
||||
: RSA venusKey.pem
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
+314
@@ -0,0 +1,314 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Technologies, Inc.
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
#NB: Config is in /etc/conf.d/net
|
||||
|
||||
if [[ -n $NET_DEBUG ]]; then
|
||||
set -x
|
||||
devnull=/dev/stderr
|
||||
else
|
||||
devnull=/dev/null
|
||||
fi
|
||||
|
||||
# For pcmcia users. note that pcmcia must be added to the same
|
||||
# runlevel as the net.* script that needs it.
|
||||
depend() {
|
||||
use hotplug pcmcia
|
||||
}
|
||||
|
||||
checkconfig() {
|
||||
if [[ -z "${ifconfig_IFACE}" ]]; then
|
||||
eerror "Please make sure that /etc/conf.d/net has \$ifconfig_$IFACE set"
|
||||
eerror "(or \$iface_$IFACE for old-style configuration)"
|
||||
return 1
|
||||
fi
|
||||
if [[ -n "${vlans_IFACE}" && ! -x /sbin/vconfig ]]; then
|
||||
eerror "For VLAN (802.1q) support, emerge net-misc/vconfig"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Fix bug 50039 (init.d/net.eth0 localization)
|
||||
# Some other commands in this script might need to be wrapped, but
|
||||
# we'll get them one-by-one. Note that LC_ALL trumps LC_anything_else
|
||||
# according to locale(7)
|
||||
ifconfig() {
|
||||
LC_ALL=C /sbin/ifconfig "$@"
|
||||
}
|
||||
|
||||
# setup_vars: setup variables based on $1 and content of /etc/conf.d/net
|
||||
# The following variables are set, which should be declared local by
|
||||
# the calling routine.
|
||||
# status_IFACE (up or '')
|
||||
# vlans_IFACE (space-separated list)
|
||||
# ifconfig_IFACE (array of ifconfig lines, replaces iface_IFACE)
|
||||
# dhcpcd_IFACE (command-line args for dhcpcd)
|
||||
# routes_IFACE (array of route lines)
|
||||
# inet6_IFACE (array of inet6 lines)
|
||||
# ifconfig_fallback_IFACE (fallback ifconfig if dhcp fails)
|
||||
setup_vars() {
|
||||
local i iface="${1//\./_}"
|
||||
|
||||
status_IFACE="$(ifconfig ${1} 2>${devnull} | gawk '$1 == "UP" {print "up"}')"
|
||||
eval vlans_IFACE=\"\$\{iface_${iface}_vlans\}\"
|
||||
eval ifconfig_IFACE=( \"\$\{ifconfig_$iface\[@\]\}\" )
|
||||
eval dhcpcd_IFACE=\"\$\{dhcpcd_$iface\}\"
|
||||
eval routes_IFACE=( \"\$\{routes_$iface\[@\]\}\" )
|
||||
eval inet6_IFACE=( \"\$\{inet6_$iface\[@\]\}\" )
|
||||
eval ifconfig_fallback_IFACE=( \"\$\{ifconfig_fallback_$iface\[@\]\}\" )
|
||||
|
||||
# BACKWARD COMPATIBILITY: populate the ifconfig_IFACE array
|
||||
# if iface_IFACE is set (fex. iface_eth0 instead of ifconfig_eth0)
|
||||
eval local iface_IFACE=\"\$\{iface_$iface\}\"
|
||||
if [[ -n ${iface_IFACE} && -z ${ifconfig_IFACE} ]]; then
|
||||
# Make sure these get evaluated as arrays
|
||||
local -a aliases broadcasts netmasks
|
||||
|
||||
# Start with the primary interface
|
||||
ifconfig_IFACE=( "${iface_IFACE}" )
|
||||
|
||||
# ..then add aliases
|
||||
eval aliases=( \$\{alias_$iface\} )
|
||||
eval broadcasts=( \$\{broadcast_$iface\} )
|
||||
eval netmasks=( \$\{netmask_$iface\} )
|
||||
for ((i = 0; i < ${#aliases[@]}; i = i + 1)); do
|
||||
ifconfig_IFACE[i+1]="${aliases[i]} ${broadcasts[i]:+broadcast ${broadcasts[i]}} ${netmasks[i]:+netmask ${netmasks[i]}}"
|
||||
done
|
||||
fi
|
||||
|
||||
# BACKWARD COMPATIBILITY: check for space-separated inet6 addresses
|
||||
if [[ ${#inet6_IFACE[@]} == 1 && ${inet6_IFACE} == *' '* ]]; then
|
||||
inet6_IFACE=( ${inet6_IFACE} )
|
||||
fi
|
||||
}
|
||||
|
||||
iface_start() {
|
||||
local IFACE=${1} i x retval
|
||||
checkconfig || return 1
|
||||
|
||||
if [[ ${ifconfig_IFACE} != dhcp ]]; then
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Bringing ${IFACE} up (${i})"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up"
|
||||
fi
|
||||
# ifconfig does not always return failure ..
|
||||
ifconfig ${IFACE} ${ifconfig_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
# Check that eth0 was not brought up by the kernel ...
|
||||
if [[ ${status_IFACE} == up ]]; then
|
||||
einfo "Keeping kernel configuration for ${IFACE}"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up via DHCP"
|
||||
/sbin/dhcpcd ${dhcpcd_IFACE} ${IFACE}
|
||||
retval=$?
|
||||
eend $retval
|
||||
if [[ $retval == 0 ]]; then
|
||||
# DHCP succeeded, show address retrieved
|
||||
i=$(ifconfig ${IFACE} | grep -m1 -o 'inet addr:[^ ]*' |
|
||||
cut -d: -f2)
|
||||
[[ -n ${i} ]] && einfo " ${IFACE} received address ${i}"
|
||||
elif [[ -n "${ifconfig_fallback_IFACE}" ]]; then
|
||||
# DHCP failed, try fallback.
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_fallback_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Using fallback configuration (${i}) for ${IFACE}"
|
||||
else
|
||||
ebegin "Using fallback configuration for ${IFACE}"
|
||||
fi
|
||||
ifconfig ${IFACE} ${ifconfig_fallback_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
return $retval
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ ${#ifconfig_IFACE[@]} -gt 1 ]]; then
|
||||
einfo " Adding aliases"
|
||||
for ((i = 1; i < ${#ifconfig_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE}:${i} (${ifconfig_IFACE[i]%% *})"
|
||||
ifconfig ${IFACE}:${i} ${ifconfig_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
if [[ -n ${inet6_IFACE} ]]; then
|
||||
einfo " Adding inet6 addresses"
|
||||
for ((i = 0; i < ${#inet6_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE} inet6 add ${inet6_IFACE[i]}"
|
||||
ifconfig ${IFACE} inet6 add ${inet6_IFACE[i]} >${devnull}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set static routes
|
||||
if [[ -n ${routes_IFACE} ]]; then
|
||||
einfo " Adding routes"
|
||||
for ((i = 0; i < ${#routes_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${routes_IFACE[i]}"
|
||||
/sbin/route add ${routes_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set default route if applicable to this interface
|
||||
if [[ ${gateway} == ${IFACE}/* ]]; then
|
||||
local ogw=$(/bin/netstat -rn | awk '$1 == "0.0.0.0" {print $2}')
|
||||
local gw=${gateway#*/}
|
||||
if [[ ${ogw} != ${gw} ]]; then
|
||||
ebegin " Setting default gateway ($gw)"
|
||||
|
||||
# First delete any existing route if it was setup by kernel...
|
||||
/sbin/route del default dev ${IFACE} &>${devnull}
|
||||
|
||||
# Second delete old gateway if it was set...
|
||||
/sbin/route del default gw ${ogw} &>${devnull}
|
||||
|
||||
# Third add our new default gateway
|
||||
/sbin/route add default gw ${gw} >${devnull}
|
||||
eend $? || {
|
||||
true # need to have some command in here
|
||||
# Note: This originally called stop, which is obviously
|
||||
# wrong since it's calling with a local version of IFACE.
|
||||
# The below code works correctly to abort configuration of
|
||||
# the interface, but is commented because we're assuming
|
||||
# that default route failure should not cause the interface
|
||||
# to be unconfigured.
|
||||
#local error=$?
|
||||
#ewarn "Aborting configuration of ${IFACE}"
|
||||
#iface_stop ${IFACE}
|
||||
#return ${error}
|
||||
}
|
||||
fi
|
||||
fi
|
||||
|
||||
# Enabling rp_filter causes wacky packets to be auto-dropped by
|
||||
# the kernel. Note that we only do this if it is not set via
|
||||
# /etc/sysctl.conf ...
|
||||
if [[ -e /proc/sys/net/ipv4/conf/${IFACE}/rp_filter && \
|
||||
-z "$(grep -s '^[^#]*rp_filter' /etc/sysctl.conf)" ]]; then
|
||||
echo -n 1 > /proc/sys/net/ipv4/conf/${IFACE}/rp_filter
|
||||
fi
|
||||
}
|
||||
|
||||
# iface_stop: bring down an interface. Don't trust information in
|
||||
# /etc/conf.d/net since the configuration might have changed since
|
||||
# iface_start ran. Instead query for current configuration and bring
|
||||
# down the interface.
|
||||
iface_stop() {
|
||||
local IFACE=${1} i x aliases inet6 count
|
||||
|
||||
# Try to do a simple down (no aliases, no inet6, no dhcp)
|
||||
aliases="$(ifconfig | grep -o "^$IFACE:[0-9]*" | tac)"
|
||||
inet6="$(ifconfig ${IFACE} | awk '$1 == "inet6" {print $2}')"
|
||||
if [[ -z ${aliases} && -z ${inet6} && ! -e /var/run/dhcpcd-${IFACE}.pid ]]; then
|
||||
ebegin "Bringing ${IFACE} down"
|
||||
ifconfig ${IFACE} down &>/dev/null
|
||||
eend 0
|
||||
return 0
|
||||
fi
|
||||
|
||||
einfo "Bringing ${IFACE} down"
|
||||
|
||||
# Stop aliases before primary interface.
|
||||
# Note this must be done in reverse order, since ifconfig eth0:1
|
||||
# will remove eth0:2, etc. It might be sufficient to simply remove
|
||||
# the base interface but we're being safe here.
|
||||
for i in ${aliases} ${IFACE}; do
|
||||
|
||||
# Delete all the inet6 addresses for this interface
|
||||
inet6="$(ifconfig ${i} | awk '$1 == "inet6" {print $3}')"
|
||||
if [[ -n ${inet6} ]]; then
|
||||
einfo " Removing inet6 addresses"
|
||||
for x in ${inet6}; do
|
||||
ebegin " ${IFACE} inet6 del ${x}"
|
||||
ifconfig ${i} inet6 del ${x}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Stop DHCP (should be N/A for aliases)
|
||||
# Don't trust current configuration... investigate ourselves
|
||||
if /sbin/dhcpcd -z ${i} &>${devnull}; then
|
||||
ebegin " Releasing DHCP lease for ${IFACE}"
|
||||
for ((count = 0; count < 9; count = count + 1)); do
|
||||
/sbin/dhcpcd -z ${i} &>${devnull} || break
|
||||
sleep 1
|
||||
done
|
||||
[[ ${count} -lt 9 ]]
|
||||
eend $? "Timed out"
|
||||
fi
|
||||
ebegin " Stopping ${i}"
|
||||
ifconfig ${i} down &>${devnull}
|
||||
eend 0
|
||||
done
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
start() {
|
||||
# These variables are set by setup_vars
|
||||
local status_IFACE vlans_IFACE dhcpcd_IFACE
|
||||
local -a ifconfig_IFACE routes_IFACE inet6_IFACE
|
||||
|
||||
# Call user-defined preup function if it exists
|
||||
if [[ $(type -t preup) == function ]]; then
|
||||
einfo "Running preup function"
|
||||
preup ${IFACE} || {
|
||||
eerror "preup ${IFACE} failed"
|
||||
return 1
|
||||
}
|
||||
fi
|
||||
|
||||
# Start the primary interface and aliases
|
||||
setup_vars ${IFACE}
|
||||
iface_start ${IFACE} || return 1
|
||||
|
||||
# Start vlans
|
||||
local vlan
|
||||
for vlan in ${vlans_IFACE}; do
|
||||
/sbin/vconfig add ${IFACE} ${vlan} >${devnull}
|
||||
setup_vars ${IFACE}.${vlan}
|
||||
iface_start ${IFACE}.${vlan}
|
||||
done
|
||||
|
||||
# Call user-defined postup function if it exists
|
||||
if [[ $(type -t postup) == function ]]; then
|
||||
einfo "Running postup function"
|
||||
postup ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
stop() {
|
||||
# Call user-defined predown function if it exists
|
||||
if [[ $(type -t predown) == function ]]; then
|
||||
einfo "Running predown function"
|
||||
predown ${IFACE}
|
||||
fi
|
||||
|
||||
# Don't depend on setup_vars since configuration might have changed.
|
||||
# Investigate current configuration instead.
|
||||
local vlan
|
||||
for vlan in $(ifconfig | grep -o "^${IFACE}\.[^ ]*"); do
|
||||
iface_stop ${vlan}
|
||||
/sbin/vconfig rem ${vlan} >${devnull}
|
||||
done
|
||||
|
||||
iface_stop ${IFACE} || return 1 # always succeeds, btw
|
||||
|
||||
# Call user-defined postdown function if it exists
|
||||
if [[ $(type -t postdown) == function ]]; then
|
||||
einfo "Running postdown function"
|
||||
postdown ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
# vim:ts=4
|
||||
@@ -0,0 +1,22 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDtTCCAp2gAwIBAgIBADANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
|
||||
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
|
||||
b290IENBMB4XDTA0MDkxMDExMDE0NVoXDTE0MDkwODExMDE0NVowRTELMAkGA1UE
|
||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0cm9u
|
||||
Z1N3YW4gUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL/y
|
||||
X2LqPVZuWLPIeknK86xhz6ljd3NNhC2z+P1uoCP3sBMuZiZQEjFzhnKcbXxCeo2f
|
||||
FnvhOOjrrisSuVkzuu82oxXD3fIkzuS7m9V4E10EZzgmKWIf+WuNRfbgAuUINmLc
|
||||
4YGAXBQLPyzpP4Ou48hhz/YQo58Bics6PHy5v34qCVROIXDvqhj91P8g+pS+F21/
|
||||
7P+CH2jRcVIEHZtG8M/PweTPQ95dPzpYd2Ov6SZ/U7EWmbMmT8VcUYn1aChxFmy5
|
||||
gweVBWlkH6MP+1DeE0/tL5c87xo5KCeGK8Tdqpe7sBRC4pPEEHDQciTUvkeuJ1Pr
|
||||
K+1LwdqRxo7HgMRiDw8CAwEAAaOBrzCBrDAPBgNVHRMBAf8EBTADAQH/MAsGA1Ud
|
||||
DwQEAwIBBjAdBgNVHQ4EFgQUXafdcAZRMn7ntm2zteXgYOouTe8wbQYDVR0jBGYw
|
||||
ZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJBgNVBAYTAkNIMRkwFwYD
|
||||
VQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJvbmdTd2FuIFJvb3Qg
|
||||
Q0GCAQAwDQYJKoZIhvcNAQEEBQADggEBAJrXTj5gWS37myHHhii9drYwkMFyDHS/
|
||||
lHU8rW/drcnHdus507+qUhNr9SiEAHg4Ywj895UDvT0a1sFaw44QyEa/94iKA8/n
|
||||
+g5kS1IrKvWu3wu8UI3EgzChgHV3cncQlQWbK+FI9Y3Ax1O1np1r+wLptoWpKKKE
|
||||
UxsYcxP9K4Nbyeon0AIHOajUheiL3t6aRc3m0o7VU7Do6S2r+He+1Zq/nRUfFeTy
|
||||
0Atebkn8tmUpPSKWaXkmwpVNrjZ1Qu9umAU+dtJyhzL2zmnyhPC4VqpsKCOp7imy
|
||||
gKZvUIKPm1zyf4T+yjwxwkiX2xVseoM3aKswb1EoZFelHwndU7u0GQ8=
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,24 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEFTCCAv2gAwIBAgIBDjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
|
||||
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
|
||||
b290IENBMB4XDTA1MDYwODE5MTcxNFoXDTEwMDYwNzE5MTcxNFowSjELMAkGA1UE
|
||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xIDAeBgNVBAMTF3dpbm5l
|
||||
dG91LnN0cm9uZ3N3YW4ub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
|
||||
AQEAwBkz95BmByWVZaEW8cDbeuGr4C1caGAj4QPmuwaIriK+7XqXuh16Ahe3S5vZ
|
||||
F56WhUSvMDOIyULckKH84oSa3Jx/SCz0g7X42x8vZuq92tpsjcP/u7BlyqpBUtLa
|
||||
r14qm5wYw/1nQqMcSG3k9MQOQ+e9KgaGqpidxWM/8T4M/41AaFRBK2gQGBUULo26
|
||||
sjoq3af7Z2jYmWkP/kzj1CHLy9Mgt+UvhKeA+ag5cZnyOG596cqVjlKyqG7vdggk
|
||||
wW2n+/KDpHNOndYfT7GMFeGXUNzJPkCImWlttic7ssi0mjP3q3MuOP3FNHIRMd2H
|
||||
AcNcqT0bgdJHqnNzGv8C0Ei9XQIDAQABo4IBCTCCAQUwCQYDVR0TBAIwADALBgNV
|
||||
HQ8EBAMCA6gwHQYDVR0OBBYEFEMS0mbhrA4zDvmfKf4MntUNxkH4MG0GA1UdIwRm
|
||||
MGSAFF2n3XAGUTJ+57Zts7Xl4GDqLk3voUmkRzBFMQswCQYDVQQGEwJDSDEZMBcG
|
||||
A1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBSb290
|
||||
IENBggEAMCIGA1UdEQQbMBmCF3dpbm5ldG91LnN0cm9uZ3N3YW4ub3JnMDkGA1Ud
|
||||
HwQyMDAwLqAsoCqGKGh0dHA6Ly9jcmwuc3Ryb25nc3dhbi5vcmcvc3Ryb25nc3dh
|
||||
bi5jcmwwDQYJKoZIhvcNAQEEBQADggEBACO4+j1Mwt/lbkopeSJst46uFh7OtegG
|
||||
6IWNE30i3l3FIn9slSwAOMtmZR0hAF8sExvk61EPlzCR/d9trSJ5+gyjPkeF/enw
|
||||
p61rxPMT13Grzomi9gYlk6Q/0zLmE9uYWEY69Q0bEIUcfdZfwB+F7kesa946JNMc
|
||||
yHfVEhKtvzmns9ueG0S/8E+6MPDeJv+JHQ++SdWSvOVg6JNxXDGusnim2fjM2Aln
|
||||
JmqA6iU4IaPl9DUCuXlLOVv/YhwhviNEbF94upyHq8xjOZdzPbKroHXg/2yvalAw
|
||||
4aXc/ZsnFxqsq3i6a2Fj1Y4J7gYsNO/HwA0xvKz3loOTqHaJqO/qeow=
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,27 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEpAIBAAKCAQEAwBkz95BmByWVZaEW8cDbeuGr4C1caGAj4QPmuwaIriK+7XqX
|
||||
uh16Ahe3S5vZF56WhUSvMDOIyULckKH84oSa3Jx/SCz0g7X42x8vZuq92tpsjcP/
|
||||
u7BlyqpBUtLar14qm5wYw/1nQqMcSG3k9MQOQ+e9KgaGqpidxWM/8T4M/41AaFRB
|
||||
K2gQGBUULo26sjoq3af7Z2jYmWkP/kzj1CHLy9Mgt+UvhKeA+ag5cZnyOG596cqV
|
||||
jlKyqG7vdggkwW2n+/KDpHNOndYfT7GMFeGXUNzJPkCImWlttic7ssi0mjP3q3Mu
|
||||
OP3FNHIRMd2HAcNcqT0bgdJHqnNzGv8C0Ei9XQIDAQABAoIBACYiWrCgl8B/c4Lz
|
||||
Uay4Tlm8hvQ/zQJjY3v93EXwbB21hBV8qrYlt9zGfHqj+5q2vsbB9c0pzdO2VDba
|
||||
EWueS2fUIWhglEG5VCebrztNCldx2O7jo9bMk8iBt+oLNaJunSK7ACeYHHGcE7dF
|
||||
KZh1eyd7z4+SMBWZqmhO5ZisasQoHCusVGepcyyMGQNkc3XKJ6resGAsOqrOoq7Q
|
||||
C4vO5Kkbnk8nnEGmQ/ldD8LwIyq1hzVLDiiqWXZgh6S5l4BEo7Dy3KYrZoZfVcZK
|
||||
GMVhAI2+uA1ZqY9twpwryT6VZ3eK4DXF/COQntiBW5pLOpaqTOnKqiVmZFwfbo3u
|
||||
cq8n5jkCgYEA5zgzRLifbM0q34c2HX8pTegh+BH7MGCxtcoU2uRPaXiGkqQObHI9
|
||||
aItrgUQp+pAmKSBnEWJKgKsOh2Uf5ogjIeNuruGG/AXw/Pw2ORHNueenhDuhu69T
|
||||
E2I4yxT3PPYbdzJ4ylBElfgm9WTrv7Wi7wSSfgQ6rEFdWukXa5vvsqMCgYEA1K+q
|
||||
m1Jv9MGVIVc6MxhuOOj2Ym+qcWt/Pjvg78rR8SRsKwHlGTuv1rdWUSXYDr3f2Nf7
|
||||
6DdbJtaSx5f8gY/UG34yGZx5FFbYV03vcCYBaLXsi/b6H7vb/VW74Y5g6bXqnprv
|
||||
4mcdVU7xfyNFgdbLPAP9sYVLijPYDwm0Qq3cz/8CgYBKSJz4BBR8AQI4JBl3qoXb
|
||||
mKtpJmW76iTN0amXlWgJ64XYkMptftpJvxj/w6V08WDBL77NL/XdlpcpWozAJJac
|
||||
6ZOCrcQPLd15eZH2Dck5Y7pG2l2gjbgz7wdt/0NbG3pBdj6mSNlwEPR7PDwdMD6z
|
||||
aZWi1LsA4lMaxO4YTVXZ3wKBgQCoFhTNH/+e/YawjNFQJFSn4WUnMn0Pmhc7xfLl
|
||||
T/NPkqtx6dN3d7ZmCQrMow33yJOqOje5tFXzgc0KtNE4S8Uj3T4XA5SlQGVFyjAa
|
||||
/85JRM2naA8RGVSpCCKuBeoNilnb8zL2SOvjyboN8oAyNuDzk2vh6ihjFsoASHkP
|
||||
4XwLXQKBgQC0k6rzt/plIwEiP56XXOqwOxJj6kuE/hx1zGIiGT6lWiOsih20Ym2T
|
||||
kYegVFvuDIWmSIAxGONWyee1lfnJbEuaHRixWQTnHUpqrU0FSnZTubnR3q/faZat
|
||||
hrvLDdpa0ydAKoMEn3qUPSrh3CdBfi3KTQAQn2Mlk7bGHh9ICWi3vA==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
@@ -0,0 +1,52 @@
|
||||
# Copyright 1999-2004 Gentoo Foundation
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
# $Header: /var/cvsroot/strongswan/testing/hosts/winnetou/etc/conf.d/apache2,v 1.2 2006/01/06 12:21:21 as Exp $
|
||||
|
||||
# Config file for /etc/init.d/apache2
|
||||
|
||||
# An example from /etc/apache2/conf/modules.d/40_mod_ssl.conf:
|
||||
#
|
||||
# <IfDefine SSL>
|
||||
# <IfModule !mod_ssl.c>
|
||||
# LoadModule ssl_module extramodules/mod_ssl.so
|
||||
# </IfModule>
|
||||
# </IfDefine>
|
||||
#
|
||||
# This means that the mod_ssl.so DSO module is only loaded
|
||||
# into the server when you pass "-D SSL" at startup. To
|
||||
# enable WebDAV, add "-D DAV -D DAV_FS". If you installed
|
||||
# mod_php then add "-D PHP4". For more options, please
|
||||
# read the files in the /etc/apache2/conf/modules.d directory.
|
||||
|
||||
APACHE2_OPTS="-D SSL -D DEFAULT_VHOST"
|
||||
|
||||
# Extended options for advanced uses of Apache ONLY
|
||||
# You don't need to edit these unless you are doing crazy Apache stuff
|
||||
# As not having them set correctly, or feeding in an incorrect configuration
|
||||
# via them will result in Apache failing to start
|
||||
# YOU HAVE BEEN WARNED.
|
||||
|
||||
# ServerRoot setting
|
||||
#SERVERROOT=/etc/apache2
|
||||
|
||||
# Configuration file location
|
||||
# - If this does NOT start with a '/', then it is treated relative to
|
||||
# $SERVERROOT by Apache
|
||||
#CONFIGFILE=conf/apache2.conf
|
||||
|
||||
# Location to log startup errors to
|
||||
# They are normally dumped to your terminal.
|
||||
#STARTUPERRORLOG="/var/log/apache2/startuperror.log"
|
||||
|
||||
# PID file location
|
||||
# Note that this MUST match the setting in your configuration file!
|
||||
PIDFILE=/var/run/apache2.pid
|
||||
|
||||
# Restart style
|
||||
# see http://httpd.apache.org/docs-2.0/stopping.html for more details
|
||||
# the default is 'graceful', the other possible value is 'restart'
|
||||
# If you use 'graceful', completion of the command does NOT imply that the system
|
||||
# has finished restarting. Restart is finished only when all child processes
|
||||
# have finished serving their current request sets. Read the URL for details.
|
||||
#RESTARTSTYLE="restart"
|
||||
RESTARTSTYLE="graceful"
|
||||
@@ -0,0 +1 @@
|
||||
HOSTNAME=winnetou
|
||||
@@ -0,0 +1,10 @@
|
||||
# /etc/conf.d/net:
|
||||
|
||||
# This is basically the ifconfig argument without the ifconfig $iface
|
||||
#
|
||||
iface_lo="127.0.0.1 netmask 255.0.0.0"
|
||||
iface_eth0="PH_IP_WINNETOU broadcast 192.168.0.255 netmask 255.255.255.0"
|
||||
|
||||
# For setting the default gateway
|
||||
#
|
||||
gateway="eth0/192.168.0.254"
|
||||
@@ -0,0 +1,8 @@
|
||||
# conf.d file for the openldap-2.1 series
|
||||
#
|
||||
# To enable both the standard unciphered server and the ssl encrypted
|
||||
# one uncomment this line or set any other server starting options
|
||||
# you may desire.
|
||||
#
|
||||
# OPTS="-h 'ldaps:// ldap:// ldapi://%2fvar%2frun%2fopenldap%2fslapd.sock'"
|
||||
OPTS="-4"
|
||||
@@ -0,0 +1 @@
|
||||
winnetou
|
||||
Executable
+78
@@ -0,0 +1,78 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Foundation
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
opts="${opts} reload"
|
||||
|
||||
[ "x${SERVERROOT}" != "x" ] && APACHE2_OPTS="${APACHE2_OPTS} -d ${SERVERROOT}"
|
||||
[ "x${CONFIGFILE}" != "x" ] && APACHE2_OPTS="${APACHE2_OPTS} -f ${CONFIGFILE}"
|
||||
[ "x${STARTUPERRORLOG}" != "x" ] && APACHE2_OPTS="${APACHE2_OPTS} -E ${STARTUPERRORLOG}"
|
||||
# set a default for PIDFILE/RESTARTSTYLE for those that FAILED to follow
|
||||
# instructiosn and update the conf.d/apache2 file.
|
||||
# (bug #38787)
|
||||
[ -z "${PIDFILE}" ] && PIDFILE=/var/run/apache2.pid
|
||||
[ -z "${RESTARTSTYLE}" ] && RESTARTSTYLE="graceful"
|
||||
|
||||
checkconfig() {
|
||||
local myconf="/etc/apache2/conf/apache2.conf"
|
||||
if [ "x${CONFIGFILE}" != "x" ]; then
|
||||
if [ ${CONFIGFILE:0:1} = "/" ]; then
|
||||
myconf="${CONFIGFILE}"
|
||||
else
|
||||
myconf="${SERVERROOT:-/usr/lib/apache2}/${CONFIGFILE}"
|
||||
fi
|
||||
fi
|
||||
if [ ! -r "${myconf}" ]; then
|
||||
eerror "Unable to read configuration file: ${myconf}"
|
||||
return 1
|
||||
fi
|
||||
if [ -z "${PIDFILE}" ]; then
|
||||
eerror "\$PIDFILE is not set!"
|
||||
eerror "Did you etc-update /etc/conf.d/apache2?"
|
||||
return 1
|
||||
fi
|
||||
if [ -z "${RESTARTSTYLE}" ]; then
|
||||
eerror "\$RESTARTSTYLE is not set!"
|
||||
eerror "Did you etc-update /etc/conf.d/apache2?"
|
||||
return 1
|
||||
fi
|
||||
/usr/sbin/apache2 -t ${APACHE2_OPTS} 1>/dev/null 2>&1
|
||||
ret=$?
|
||||
if [ $ret -ne 0 ]; then
|
||||
eerror "Apache2 has detected a syntax error in your configuration files:"
|
||||
/usr/sbin/apache2 -t ${APACHE2_OPTS}
|
||||
fi
|
||||
return $ret
|
||||
}
|
||||
|
||||
depend() {
|
||||
need net
|
||||
use mysql dns logger netmount postgres
|
||||
after sshd
|
||||
}
|
||||
|
||||
start() {
|
||||
checkconfig || return 1
|
||||
ebegin "Starting apache2"
|
||||
[ -f /var/log/apache2/ssl_scache ] && rm /var/log/apache2/ssl_scache
|
||||
[ -f /usr/lib/apache2/build/envvars ] && . /usr/lib/apache2/build/envvars
|
||||
env -i PATH=$PATH /sbin/start-stop-daemon --quiet \
|
||||
--start --startas /usr/sbin/apache2 \
|
||||
--pidfile ${PIDFILE} -- -k start ${APACHE2_OPTS}
|
||||
eend $?
|
||||
}
|
||||
|
||||
stop() {
|
||||
ebegin "Stopping apache2"
|
||||
/usr/sbin/apache2ctl stop >/dev/null
|
||||
start-stop-daemon -o --quiet --stop --pidfile ${PIDFILE}
|
||||
eend $?
|
||||
}
|
||||
|
||||
reload() {
|
||||
# restarting apache2 is much easier than apache1. The server handles most of the work for us.
|
||||
# see http://httpd.apache.org/docs-2.0/stopping.html for more details
|
||||
ebegin "Restarting apache2"
|
||||
/usr/sbin/apache2 ${APACHE2_OPTS} -k ${RESTARTSTYLE}
|
||||
eend $?
|
||||
}
|
||||
Executable
+314
@@ -0,0 +1,314 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Technologies, Inc.
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
#NB: Config is in /etc/conf.d/net
|
||||
|
||||
if [[ -n $NET_DEBUG ]]; then
|
||||
set -x
|
||||
devnull=/dev/stderr
|
||||
else
|
||||
devnull=/dev/null
|
||||
fi
|
||||
|
||||
# For pcmcia users. note that pcmcia must be added to the same
|
||||
# runlevel as the net.* script that needs it.
|
||||
depend() {
|
||||
use hotplug pcmcia
|
||||
}
|
||||
|
||||
checkconfig() {
|
||||
if [[ -z "${ifconfig_IFACE}" ]]; then
|
||||
eerror "Please make sure that /etc/conf.d/net has \$ifconfig_$IFACE set"
|
||||
eerror "(or \$iface_$IFACE for old-style configuration)"
|
||||
return 1
|
||||
fi
|
||||
if [[ -n "${vlans_IFACE}" && ! -x /sbin/vconfig ]]; then
|
||||
eerror "For VLAN (802.1q) support, emerge net-misc/vconfig"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Fix bug 50039 (init.d/net.eth0 localization)
|
||||
# Some other commands in this script might need to be wrapped, but
|
||||
# we'll get them one-by-one. Note that LC_ALL trumps LC_anything_else
|
||||
# according to locale(7)
|
||||
ifconfig() {
|
||||
LC_ALL=C /sbin/ifconfig "$@"
|
||||
}
|
||||
|
||||
# setup_vars: setup variables based on $1 and content of /etc/conf.d/net
|
||||
# The following variables are set, which should be declared local by
|
||||
# the calling routine.
|
||||
# status_IFACE (up or '')
|
||||
# vlans_IFACE (space-separated list)
|
||||
# ifconfig_IFACE (array of ifconfig lines, replaces iface_IFACE)
|
||||
# dhcpcd_IFACE (command-line args for dhcpcd)
|
||||
# routes_IFACE (array of route lines)
|
||||
# inet6_IFACE (array of inet6 lines)
|
||||
# ifconfig_fallback_IFACE (fallback ifconfig if dhcp fails)
|
||||
setup_vars() {
|
||||
local i iface="${1//\./_}"
|
||||
|
||||
status_IFACE="$(ifconfig ${1} 2>${devnull} | gawk '$1 == "UP" {print "up"}')"
|
||||
eval vlans_IFACE=\"\$\{iface_${iface}_vlans\}\"
|
||||
eval ifconfig_IFACE=( \"\$\{ifconfig_$iface\[@\]\}\" )
|
||||
eval dhcpcd_IFACE=\"\$\{dhcpcd_$iface\}\"
|
||||
eval routes_IFACE=( \"\$\{routes_$iface\[@\]\}\" )
|
||||
eval inet6_IFACE=( \"\$\{inet6_$iface\[@\]\}\" )
|
||||
eval ifconfig_fallback_IFACE=( \"\$\{ifconfig_fallback_$iface\[@\]\}\" )
|
||||
|
||||
# BACKWARD COMPATIBILITY: populate the ifconfig_IFACE array
|
||||
# if iface_IFACE is set (fex. iface_eth0 instead of ifconfig_eth0)
|
||||
eval local iface_IFACE=\"\$\{iface_$iface\}\"
|
||||
if [[ -n ${iface_IFACE} && -z ${ifconfig_IFACE} ]]; then
|
||||
# Make sure these get evaluated as arrays
|
||||
local -a aliases broadcasts netmasks
|
||||
|
||||
# Start with the primary interface
|
||||
ifconfig_IFACE=( "${iface_IFACE}" )
|
||||
|
||||
# ..then add aliases
|
||||
eval aliases=( \$\{alias_$iface\} )
|
||||
eval broadcasts=( \$\{broadcast_$iface\} )
|
||||
eval netmasks=( \$\{netmask_$iface\} )
|
||||
for ((i = 0; i < ${#aliases[@]}; i = i + 1)); do
|
||||
ifconfig_IFACE[i+1]="${aliases[i]} ${broadcasts[i]:+broadcast ${broadcasts[i]}} ${netmasks[i]:+netmask ${netmasks[i]}}"
|
||||
done
|
||||
fi
|
||||
|
||||
# BACKWARD COMPATIBILITY: check for space-separated inet6 addresses
|
||||
if [[ ${#inet6_IFACE[@]} == 1 && ${inet6_IFACE} == *' '* ]]; then
|
||||
inet6_IFACE=( ${inet6_IFACE} )
|
||||
fi
|
||||
}
|
||||
|
||||
iface_start() {
|
||||
local IFACE=${1} i x retval
|
||||
checkconfig || return 1
|
||||
|
||||
if [[ ${ifconfig_IFACE} != dhcp ]]; then
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Bringing ${IFACE} up (${i})"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up"
|
||||
fi
|
||||
# ifconfig does not always return failure ..
|
||||
ifconfig ${IFACE} ${ifconfig_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
# Check that eth0 was not brought up by the kernel ...
|
||||
if [[ ${status_IFACE} == up ]]; then
|
||||
einfo "Keeping kernel configuration for ${IFACE}"
|
||||
else
|
||||
ebegin "Bringing ${IFACE} up via DHCP"
|
||||
/sbin/dhcpcd ${dhcpcd_IFACE} ${IFACE}
|
||||
retval=$?
|
||||
eend $retval
|
||||
if [[ $retval == 0 ]]; then
|
||||
# DHCP succeeded, show address retrieved
|
||||
i=$(ifconfig ${IFACE} | grep -m1 -o 'inet addr:[^ ]*' |
|
||||
cut -d: -f2)
|
||||
[[ -n ${i} ]] && einfo " ${IFACE} received address ${i}"
|
||||
elif [[ -n "${ifconfig_fallback_IFACE}" ]]; then
|
||||
# DHCP failed, try fallback.
|
||||
# Show the address, but catch if this interface will be inet6 only
|
||||
i=${ifconfig_fallback_IFACE%% *}
|
||||
if [[ ${i} == *.*.*.* ]]; then
|
||||
ebegin "Using fallback configuration (${i}) for ${IFACE}"
|
||||
else
|
||||
ebegin "Using fallback configuration for ${IFACE}"
|
||||
fi
|
||||
ifconfig ${IFACE} ${ifconfig_fallback_IFACE} >${devnull} && \
|
||||
ifconfig ${IFACE} up &>${devnull}
|
||||
eend $? || return $?
|
||||
else
|
||||
return $retval
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ ${#ifconfig_IFACE[@]} -gt 1 ]]; then
|
||||
einfo " Adding aliases"
|
||||
for ((i = 1; i < ${#ifconfig_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE}:${i} (${ifconfig_IFACE[i]%% *})"
|
||||
ifconfig ${IFACE}:${i} ${ifconfig_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
if [[ -n ${inet6_IFACE} ]]; then
|
||||
einfo " Adding inet6 addresses"
|
||||
for ((i = 0; i < ${#inet6_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${IFACE} inet6 add ${inet6_IFACE[i]}"
|
||||
ifconfig ${IFACE} inet6 add ${inet6_IFACE[i]} >${devnull}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set static routes
|
||||
if [[ -n ${routes_IFACE} ]]; then
|
||||
einfo " Adding routes"
|
||||
for ((i = 0; i < ${#routes_IFACE[@]}; i = i + 1)); do
|
||||
ebegin " ${routes_IFACE[i]}"
|
||||
/sbin/route add ${routes_IFACE[i]}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Set default route if applicable to this interface
|
||||
if [[ ${gateway} == ${IFACE}/* ]]; then
|
||||
local ogw=$(/bin/netstat -rn | awk '$1 == "0.0.0.0" {print $2}')
|
||||
local gw=${gateway#*/}
|
||||
if [[ ${ogw} != ${gw} ]]; then
|
||||
ebegin " Setting default gateway ($gw)"
|
||||
|
||||
# First delete any existing route if it was setup by kernel...
|
||||
/sbin/route del default dev ${IFACE} &>${devnull}
|
||||
|
||||
# Second delete old gateway if it was set...
|
||||
/sbin/route del default gw ${ogw} &>${devnull}
|
||||
|
||||
# Third add our new default gateway
|
||||
/sbin/route add default gw ${gw} >${devnull}
|
||||
eend $? || {
|
||||
true # need to have some command in here
|
||||
# Note: This originally called stop, which is obviously
|
||||
# wrong since it's calling with a local version of IFACE.
|
||||
# The below code works correctly to abort configuration of
|
||||
# the interface, but is commented because we're assuming
|
||||
# that default route failure should not cause the interface
|
||||
# to be unconfigured.
|
||||
#local error=$?
|
||||
#ewarn "Aborting configuration of ${IFACE}"
|
||||
#iface_stop ${IFACE}
|
||||
#return ${error}
|
||||
}
|
||||
fi
|
||||
fi
|
||||
|
||||
# Enabling rp_filter causes wacky packets to be auto-dropped by
|
||||
# the kernel. Note that we only do this if it is not set via
|
||||
# /etc/sysctl.conf ...
|
||||
if [[ -e /proc/sys/net/ipv4/conf/${IFACE}/rp_filter && \
|
||||
-z "$(grep -s '^[^#]*rp_filter' /etc/sysctl.conf)" ]]; then
|
||||
echo -n 1 > /proc/sys/net/ipv4/conf/${IFACE}/rp_filter
|
||||
fi
|
||||
}
|
||||
|
||||
# iface_stop: bring down an interface. Don't trust information in
|
||||
# /etc/conf.d/net since the configuration might have changed since
|
||||
# iface_start ran. Instead query for current configuration and bring
|
||||
# down the interface.
|
||||
iface_stop() {
|
||||
local IFACE=${1} i x aliases inet6 count
|
||||
|
||||
# Try to do a simple down (no aliases, no inet6, no dhcp)
|
||||
aliases="$(ifconfig | grep -o "^$IFACE:[0-9]*" | tac)"
|
||||
inet6="$(ifconfig ${IFACE} | awk '$1 == "inet6" {print $2}')"
|
||||
if [[ -z ${aliases} && -z ${inet6} && ! -e /var/run/dhcpcd-${IFACE}.pid ]]; then
|
||||
ebegin "Bringing ${IFACE} down"
|
||||
ifconfig ${IFACE} down &>/dev/null
|
||||
eend 0
|
||||
return 0
|
||||
fi
|
||||
|
||||
einfo "Bringing ${IFACE} down"
|
||||
|
||||
# Stop aliases before primary interface.
|
||||
# Note this must be done in reverse order, since ifconfig eth0:1
|
||||
# will remove eth0:2, etc. It might be sufficient to simply remove
|
||||
# the base interface but we're being safe here.
|
||||
for i in ${aliases} ${IFACE}; do
|
||||
|
||||
# Delete all the inet6 addresses for this interface
|
||||
inet6="$(ifconfig ${i} | awk '$1 == "inet6" {print $3}')"
|
||||
if [[ -n ${inet6} ]]; then
|
||||
einfo " Removing inet6 addresses"
|
||||
for x in ${inet6}; do
|
||||
ebegin " ${IFACE} inet6 del ${x}"
|
||||
ifconfig ${i} inet6 del ${x}
|
||||
eend $?
|
||||
done
|
||||
fi
|
||||
|
||||
# Stop DHCP (should be N/A for aliases)
|
||||
# Don't trust current configuration... investigate ourselves
|
||||
if /sbin/dhcpcd -z ${i} &>${devnull}; then
|
||||
ebegin " Releasing DHCP lease for ${IFACE}"
|
||||
for ((count = 0; count < 9; count = count + 1)); do
|
||||
/sbin/dhcpcd -z ${i} &>${devnull} || break
|
||||
sleep 1
|
||||
done
|
||||
[[ ${count} -lt 9 ]]
|
||||
eend $? "Timed out"
|
||||
fi
|
||||
ebegin " Stopping ${i}"
|
||||
ifconfig ${i} down &>${devnull}
|
||||
eend 0
|
||||
done
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
start() {
|
||||
# These variables are set by setup_vars
|
||||
local status_IFACE vlans_IFACE dhcpcd_IFACE
|
||||
local -a ifconfig_IFACE routes_IFACE inet6_IFACE
|
||||
|
||||
# Call user-defined preup function if it exists
|
||||
if [[ $(type -t preup) == function ]]; then
|
||||
einfo "Running preup function"
|
||||
preup ${IFACE} || {
|
||||
eerror "preup ${IFACE} failed"
|
||||
return 1
|
||||
}
|
||||
fi
|
||||
|
||||
# Start the primary interface and aliases
|
||||
setup_vars ${IFACE}
|
||||
iface_start ${IFACE} || return 1
|
||||
|
||||
# Start vlans
|
||||
local vlan
|
||||
for vlan in ${vlans_IFACE}; do
|
||||
/sbin/vconfig add ${IFACE} ${vlan} >${devnull}
|
||||
setup_vars ${IFACE}.${vlan}
|
||||
iface_start ${IFACE}.${vlan}
|
||||
done
|
||||
|
||||
# Call user-defined postup function if it exists
|
||||
if [[ $(type -t postup) == function ]]; then
|
||||
einfo "Running postup function"
|
||||
postup ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
stop() {
|
||||
# Call user-defined predown function if it exists
|
||||
if [[ $(type -t predown) == function ]]; then
|
||||
einfo "Running predown function"
|
||||
predown ${IFACE}
|
||||
fi
|
||||
|
||||
# Don't depend on setup_vars since configuration might have changed.
|
||||
# Investigate current configuration instead.
|
||||
local vlan
|
||||
for vlan in $(ifconfig | grep -o "^${IFACE}\.[^ ]*"); do
|
||||
iface_stop ${vlan}
|
||||
/sbin/vconfig rem ${vlan} >${devnull}
|
||||
done
|
||||
|
||||
iface_stop ${IFACE} || return 1 # always succeeds, btw
|
||||
|
||||
# Call user-defined postdown function if it exists
|
||||
if [[ $(type -t postdown) == function ]]; then
|
||||
einfo "Running postdown function"
|
||||
postdown ${IFACE}
|
||||
fi
|
||||
}
|
||||
|
||||
# vim:ts=4
|
||||
Executable
+25
@@ -0,0 +1,25 @@
|
||||
#!/sbin/runscript
|
||||
# Copyright 1999-2004 Gentoo Foundation
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
# $Header: /var/cvsroot/strongswan/testing/hosts/winnetou/etc/init.d/slapd,v 1.2 2005/05/31 14:04:43 as Exp $
|
||||
|
||||
depend() {
|
||||
need net
|
||||
}
|
||||
|
||||
start() {
|
||||
ebegin "Starting ldap-server"
|
||||
eval start-stop-daemon --start --quiet --pidfile /var/run/openldap/slapd.pid --exec /usr/lib/openldap/slapd -- -u ldap -g ldap "${OPTS}"
|
||||
eend $?
|
||||
if [ ! -e /var/lib/openldap-data/objectClass.bdb ]
|
||||
then
|
||||
sleep 5
|
||||
ldapadd -x -D "cn=Manager, o=Linux strongSwan, c=CH" -w tuxmux -f /etc/openldap/ldif.txt
|
||||
fi
|
||||
}
|
||||
|
||||
stop() {
|
||||
ebegin "Stopping ldap-server"
|
||||
start-stop-daemon --stop --signal 2 --quiet --pidfile /var/run/openldap/slapd.pid
|
||||
eend $?
|
||||
}
|
||||
@@ -0,0 +1,40 @@
|
||||
dn: o=Linux strongSwan, c=CH
|
||||
objectclass: organization
|
||||
o: Linux strongSwan
|
||||
|
||||
dn: cn=Manager,o=Linux strongSwan, c=CH
|
||||
objectclass: organizationalRole
|
||||
cn: Manager
|
||||
|
||||
dn: cn=strongSwan Root CA, o=Linux strongSwan, c=CH
|
||||
objectClass: organizationalRole
|
||||
cn: strongSwan Root CA
|
||||
objectClass: certificationAuthority
|
||||
authorityRevocationList;binary:< file:///etc/openssl/strongswan.crl
|
||||
certificateRevocationList;binary:< file:///etc/openssl/strongswan.crl
|
||||
cACertificate;binary:< file:///etc/openssl/strongswanCert.der
|
||||
|
||||
dn: ou=Research, o=Linux strongSwan, c=CH
|
||||
objectclass: organizationalUnit
|
||||
ou: Research
|
||||
|
||||
dn: cn=Research CA, ou=Research, o=Linux strongSwan, c=CH
|
||||
objectClass: organizationalRole
|
||||
cn: Research CA
|
||||
objectClass: certificationAuthority
|
||||
authorityRevocationList;binary:< file:///etc/openssl/research/research.crl
|
||||
certificateRevocationList;binary:< file:///etc/openssl/research/research.crl
|
||||
cACertificate;binary:< file:///etc/openssl/research/researchCert.der
|
||||
|
||||
dn: ou=Sales, o=Linux strongSwan, c=CH
|
||||
objectclass: organizationalUnit
|
||||
ou: Sales
|
||||
|
||||
dn: cn=Sales CA, ou=Sales, o=Linux strongSwan, c=CH
|
||||
objectClass: organizationalRole
|
||||
cn: Sales CA
|
||||
objectClass: certificationAuthority
|
||||
authorityRevocationList;binary:< file:///etc/openssl/sales/sales.crl
|
||||
certificateRevocationList;binary:< file:///etc/openssl/sales/sales.crl
|
||||
cACertificate;binary:< file:///etc/openssl/sales/salesCert.der
|
||||
|
||||
@@ -0,0 +1,68 @@
|
||||
#
|
||||
# See slapd.conf(5) for details on configuration options.
|
||||
# This file should NOT be world readable.
|
||||
#
|
||||
include /etc/openldap/schema/core.schema
|
||||
|
||||
# Define global ACLs to disable default read access.
|
||||
|
||||
# Do not enable referrals until AFTER you have a working directory
|
||||
# service AND an understanding of referrals.
|
||||
#referral ldap://root.openldap.org
|
||||
|
||||
pidfile /var/run/openldap/slapd.pid
|
||||
argsfile /var/run/openldap/slapd.args
|
||||
|
||||
# Load dynamic backend modules:
|
||||
# modulepath /usr/lib/openldap/openldap
|
||||
# moduleload back_bdb.la
|
||||
# moduleload back_ldap.la
|
||||
# moduleload back_ldbm.la
|
||||
# moduleload back_passwd.la
|
||||
# moduleload back_shell.la
|
||||
|
||||
# Sample security restrictions
|
||||
# Require integrity protection (prevent hijacking)
|
||||
# Require 112-bit (3DES or better) encryption for updates
|
||||
# Require 63-bit encryption for simple bind
|
||||
# security ssf=1 update_ssf=112 simple_bind=64
|
||||
|
||||
# Sample access control policy:
|
||||
# Root DSE: allow anyone to read it
|
||||
# Subschema (sub)entry DSE: allow anyone to read it
|
||||
# Other DSEs:
|
||||
# Allow self write access
|
||||
# Allow authenticated users read access
|
||||
# Allow anonymous users to authenticate
|
||||
# Directives needed to implement policy:
|
||||
# access to dn.base="" by * read
|
||||
# access to dn.base="cn=Subschema" by * read
|
||||
# access to *
|
||||
# by self write
|
||||
# by users read
|
||||
# by anonymous auth
|
||||
#
|
||||
# if no access controls are present, the default policy
|
||||
# allows anyone and everyone to read anything but restricts
|
||||
# updates to rootdn. (e.g., "access to * by * read")
|
||||
#
|
||||
# rootdn can always read and write EVERYTHING!
|
||||
|
||||
#######################################################################
|
||||
# BDB database definitions
|
||||
#######################################################################
|
||||
|
||||
database bdb
|
||||
checkpoint 32 30 # <kbyte> <min>
|
||||
suffix "o=Linux strongSwan,c=CH"
|
||||
rootdn "cn=Manager,o=Linux strongSwan,c=CH"
|
||||
# Cleartext passwords, especially for the rootdn, should
|
||||
# be avoid. See slappasswd(8) and slapd.conf(5) for details.
|
||||
# Use of strong authentication encouraged.
|
||||
rootpw tuxmux
|
||||
# The database directory MUST exist prior to running slapd AND
|
||||
# should only be accessible by the slapd and slap tools.
|
||||
# Mode 700 recommended.
|
||||
directory /var/lib/openldap-data
|
||||
# Indices to maintain
|
||||
index objectClass eq
|
||||
+35
@@ -0,0 +1,35 @@
|
||||
#! /bin/sh
|
||||
# generate a certificate revocation list (CRL) for the strongswan CA.
|
||||
#
|
||||
# Copyright (C) 2004 Andreas Steffen
|
||||
# Zuercher Hochschule Winterthur
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU General Public License as published by the
|
||||
# Free Software Foundation; either version 2 of the License, or (at your
|
||||
# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
# for more details.
|
||||
#
|
||||
# RCSID $Id: generate-crl,v 1.2 2005/03/24 11:19:38 as Exp $
|
||||
|
||||
export COMMON_NAME=strongSwan
|
||||
|
||||
cd /etc/openssl
|
||||
openssl ca -config /etc/openssl/openssl.cnf -gencrl -out crl.pem
|
||||
openssl crl -in crl.pem -outform der -out strongswan.crl
|
||||
cp strongswan.crl /var/www/localhost/htdocs/
|
||||
cp strongswanCert.pem /var/www/localhost/htdocs/
|
||||
cp index.html /var/www/localhost/htdocs/
|
||||
cd /etc/openssl/research
|
||||
openssl ca -config /etc/openssl/research/openssl.cnf -gencrl -out crl.pem
|
||||
openssl crl -in crl.pem -outform der -out research.crl
|
||||
cp research.crl /var/www/localhost/htdocs/
|
||||
cd /etc/openssl/sales
|
||||
openssl ca -config /etc/openssl/sales/openssl.cnf -gencrl -out crl.pem
|
||||
openssl crl -in crl.pem -outform der -out sales.crl
|
||||
cp sales.crl /var/www/localhost/htdocs/
|
||||
|
||||
@@ -0,0 +1,36 @@
|
||||
<html>
|
||||
<head>
|
||||
<title>strongSwan Web Services</title>
|
||||
<base target="_self">
|
||||
</head>
|
||||
|
||||
<body bgcolor="#FFFFFF">
|
||||
<table border=0 cellpadding=0 cellspacing=0 width=600>
|
||||
|
||||
<tr><td>
|
||||
<h2>strongSwan Certification Authority</h2>
|
||||
<ul>
|
||||
<li>
|
||||
<a href="strongswanCert.pem">Root CA Certificate</a>
|
||||
</li>
|
||||
</ul>
|
||||
<ul>
|
||||
<li>
|
||||
<a href="strongswan.crl">Certificate Revocation List (CRL)</a>
|
||||
</li>
|
||||
</ul>
|
||||
|
||||
<h2>strongSwan UML Testing Environment</h2>
|
||||
<ul>
|
||||
<li>
|
||||
<a href="testresults/">UML Test Results</a>
|
||||
</li>
|
||||
</ul>
|
||||
<a href="images/umlArchitecture_large.png" target="_blank">
|
||||
<img src="images/umlArchitecture_small.png" border="0">
|
||||
</a>
|
||||
<hr>
|
||||
<address>Linux strongSwan (<a href="http://www.strongswan.org">www.strongswan.org</a>)</address>
|
||||
</td></tr>
|
||||
</table>
|
||||
</body>
|
||||
@@ -0,0 +1,15 @@
|
||||
V 090909111334Z 01 unknown /C=CH/O=Linux strongSwan/CN=mars.strongswan.org
|
||||
V 090909111553Z 02 unknown /C=CH/O=Linux strongSwan/CN=sun.strongswan.org
|
||||
V 090909111725Z 03 unknown /C=CH/O=Linux strongSwan/CN=moon.strongswan.org
|
||||
V 090909111826Z 04 unknown /C=CH/O=Linux strongSwan/CN=venus.strongswan.org
|
||||
V 090909112439Z 05 unknown /C=CH/O=Linux strongSwan/OU=Sales/[email protected]
|
||||
V 090909112534Z 06 unknown /C=CH/O=Linux strongSwan/OU=Research/[email protected]
|
||||
R 090909112548Z 041226135423Z 07 unknown /C=CH/O=Linux strongSwan/OU=Research/[email protected]
|
||||
V 090909112651Z 08 unknown /C=CH/O=Linux strongSwan/OU=Accounting/[email protected]
|
||||
V 091118162928Z 09 unknown /C=CH/O=Linux strongSwan/OU=OCSP Signing Authority/CN=ocsp.strongswan.org
|
||||
V 091231214318Z 0A unknown /C=CH/O=Linux strongSwan/OU=Research/[email protected]
|
||||
V 100216084430Z 0B unknown /C=CH/O=Linux strongSwan/OU=Authorization Authority/[email protected]
|
||||
R 140321062536Z 050621195214Z 0C unknown /C=CH/O=Linux strongSwan/OU=Research/CN=Research CA
|
||||
V 140321062916Z 0D unknown /C=CH/O=Linux strongSwan/OU=Sales/CN=Sales CA
|
||||
V 100607191714Z 0E unknown /C=CH/O=Linux strongSwan/CN=winnetou.strongswan.org
|
||||
V 100620195806Z 0F unknown /C=CH/O=Linux strongSwan/OU=Research/CN=Research CA
|
||||
@@ -0,0 +1 @@
|
||||
unique_subject = yes
|
||||
@@ -0,0 +1 @@
|
||||
unique_subject = yes
|
||||
@@ -0,0 +1,14 @@
|
||||
V 090909111334Z 01 unknown /C=CH/O=Linux strongSwan/CN=mars.strongswan.org
|
||||
V 090909111553Z 02 unknown /C=CH/O=Linux strongSwan/CN=sun.strongswan.org
|
||||
V 090909111725Z 03 unknown /C=CH/O=Linux strongSwan/CN=moon.strongswan.org
|
||||
V 090909111826Z 04 unknown /C=CH/O=Linux strongSwan/CN=venus.strongswan.org
|
||||
V 090909112439Z 05 unknown /C=CH/O=Linux strongSwan/OU=Sales/[email protected]
|
||||
V 090909112534Z 06 unknown /C=CH/O=Linux strongSwan/OU=Research/[email protected]
|
||||
R 090909112548Z 041226135423Z 07 unknown /C=CH/O=Linux strongSwan/OU=Research/[email protected]
|
||||
V 090909112651Z 08 unknown /C=CH/O=Linux strongSwan/OU=Accounting/[email protected]
|
||||
V 091118162928Z 09 unknown /C=CH/O=Linux strongSwan/OU=OCSP Signing Authority/CN=ocsp.strongswan.org
|
||||
V 091231214318Z 0A unknown /C=CH/O=Linux strongSwan/OU=Research/[email protected]
|
||||
V 100216084430Z 0B unknown /C=CH/O=Linux strongSwan/OU=Authorization Authority/[email protected]
|
||||
R 140321062536Z 050621195214Z 0C unknown /C=CH/O=Linux strongSwan/OU=Research/CN=Research CA
|
||||
V 140321062916Z 0D unknown /C=CH/O=Linux strongSwan/OU=Sales/CN=Sales CA
|
||||
V 100607191714Z 0E unknown /C=CH/O=Linux strongSwan/CN=winnetou.strongswan.org
|
||||
@@ -0,0 +1,24 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEDTCCAvWgAwIBAgIBATANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
|
||||
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
|
||||
b290IENBMB4XDTA0MDkxMDExMTMzNFoXDTA5MDkwOTExMTMzNFowRjELMAkGA1UE
|
||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xHDAaBgNVBAMTE21hcnMu
|
||||
c3Ryb25nc3dhbi5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDA
|
||||
zRlshdPlLggS7bpAlovamLpk9pxYUv3c8J4W0kV4knMPbSJywfctpce95iPZfU6V
|
||||
ICV0fVOn/0utJG+0lMTYwcf5zvyIDPDccfsTT3WI+/PcaUpU6E5aaPAZxDG4na6w
|
||||
UVUKiRcOyiuyXanulnu+b48nM7MgoMVZNDWY5q15enEZh1oO2Fy0DlKwweDKEuAi
|
||||
8xSnu2RcZBFSZMDBCRCt3QgHGZygrzjP3vN6IgbvHL+YWIycMi5yiJR5EoCE6D17
|
||||
AT1dh0C8R9m1a0LUK8cKiN+akZQlK/AHYOCu77fg1vz84dMDRIs2PCUs6Ww/fvqy
|
||||
N4r1BXg8XKTVH0zmqfQLAgMBAAGjggEFMIIBATAJBgNVHRMEAjAAMAsGA1UdDwQE
|
||||
AwIDqDAdBgNVHQ4EFgQUbUWd4UeHwbTxn0Kr9io4nUGz6eAwbQYDVR0jBGYwZIAU
|
||||
XafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJBgNVBAYTAkNIMRkwFwYDVQQK
|
||||
ExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJvbmdTd2FuIFJvb3QgQ0GC
|
||||
AQAwHgYDVR0RBBcwFYITbWFycy5zdHJvbmdzd2FuLm9yZzA5BgNVHR8EMjAwMC6g
|
||||
LKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3JnL3N0cm9uZ3N3YW4uY3JsMA0G
|
||||
CSqGSIb3DQEBBAUAA4IBAQBY0ab/r6K40Gni/db8apZGJqoO3XFPE4K7wi46LNZq
|
||||
gB3mQgazLkf48luj06rcfux+vC/2W3DyqAtKD5JRccL0A5yxY55p3rrCNvz76Y9H
|
||||
0AkVledhZTjd7SxdtsfxlRuok4nACwQii9GXcfs8qBc5QE8ZQRAtPwRxVx8hE19n
|
||||
D3AllTSukJSC6nPJHf+4FXz1Dxt3aFZOnkJM4qERBjFREYE4jGLaz71HNNKshsYy
|
||||
2UuwLAqsQk6zYogrJgpWLIuMVE2GHoth/rjpkzK/ErAwcV4OgMNdA1bHGl94soDy
|
||||
zryvlFj1zaqlvdKayWATnrAQQTQeeYz3i0wF95CNR22b
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,24 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIECzCCAvOgAwIBAgIBAjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
|
||||
MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
|
||||
b290IENBMB4XDTA0MDkxMDExMTU1M1oXDTA5MDkwOTExMTU1M1owRTELMAkGA1UE
|
||||
BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN1bi5z
|
||||
dHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOQ8
|
||||
foB9h5BZ92gA5JkQTJNuoF6FAzoq91Gh7To27/g74p01+SUnsSaBfPmNfGp4avdS
|
||||
Ewy2dWMA/7uj0Dbe8MEKssNztp0JQubp2s7n8mrrQLGsqB6YAS09l75XDjS3yqTC
|
||||
AtH1kD4zAl/j/AyeQBuLR4CyJEmC/rqD3/a+pr42CaljuFBgBRpCTUpU4mlslZSe
|
||||
zv9wu61PwTFxb8VDlBHUd/lwkXThKgU3uEhWRxLahpSldEGmiTTmx30k/XbOMF2n
|
||||
HObEHt5EY9uWRGGbj81ZRWiNk0dNtbpneUHv/NvdWLc591M8cEGEQdWW2XTVbL2G
|
||||
N67q8hdzGgIvb7QJPMcCAwEAAaOCAQQwggEAMAkGA1UdEwQCMAAwCwYDVR0PBAQD
|
||||
AgOoMB0GA1UdDgQWBBQ9xLkyCBbyQmRet0vvV1Fg6z5q2DBtBgNVHSMEZjBkgBRd
|
||||
p91wBlEyfue2bbO15eBg6i5N76FJpEcwRTELMAkGA1UEBhMCQ0gxGTAXBgNVBAoT
|
||||
EExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0cm9uZ1N3YW4gUm9vdCBDQYIB
|
||||
ADAdBgNVHREEFjAUghJzdW4uc3Ryb25nc3dhbi5vcmcwOQYDVR0fBDIwMDAuoCyg
|
||||
KoYoaHR0cDovL2NybC5zdHJvbmdzd2FuLm9yZy9zdHJvbmdzd2FuLmNybDANBgkq
|
||||
hkiG9w0BAQQFAAOCAQEAGQQroiAa0SwwhJprGd7OM+rfBJAGbsa3DPzFCfHX1R7i
|
||||
ZyDs9aph1DK+IgUa377Ev1U7oB0EldpmOoJJugCjtNLfpW3t1RXBERL/QfpO2+VP
|
||||
Wt3SfZ0Oq48jiqB1MVLMZRPCICZEQjT4sJ3HYs5ZuucuvoxeMx3rQ4HxUtHtMD3S
|
||||
5JNMwFFiOXAjyIyrTlb7YuRJTT5hE+Rms8GUQ5Xnt7zKZ7yfoSLFzy0/cLFPdQvE
|
||||
JA7w8crODCZpDgEKVHVyUWuyt1O46N3ydUfDcnKJoQ9HWHm3xCbDex5MHTnvm1lk
|
||||
Stx71CGM7TE6VPy028UlrSw0JqEwCVwstei2cMzwgA==
|
||||
-----END CERTIFICATE-----
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user