Merge branch 'libipsec-ip-frag'
This fixes "packet too short" errors when parsing fragmented IPv4 packets and correctly determines the protocol in fragmented IPv6 packets. Protocol headers are only parsed in unfragmented IPv4 and IPv6 packets, or IPv4 first fragments. Closes strongswan/strongswan#80.
This commit is contained in:
Tobias Brunner
@@ -52,7 +52,15 @@ struct ip6_hdr {
|
||||
uint8_t ip6_hlim;
|
||||
struct in6_addr ip6_src, ip6_dst;
|
||||
} __attribute__((packed));
|
||||
#define HAVE_NETINET_IP6_H /* not really, but we only need the struct above */
|
||||
struct ip6_ext {
|
||||
uint8_t ip6e_nxt;
|
||||
uint8_t ip6e_len;
|
||||
} __attribute__((packed));
|
||||
#define HAVE_NETINET_IP6_H /* not really, but we only need the structs above */
|
||||
#endif
|
||||
|
||||
#ifndef IP_OFFMASK
|
||||
#define IP_OFFMASK 0x1fff
|
||||
#endif
|
||||
|
||||
/**
|
||||
@@ -219,6 +227,56 @@ static bool parse_transport_header(chunk_t packet, uint8_t proto,
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
#ifdef HAVE_NETINET_IP6_H
|
||||
/**
|
||||
* Skip to the actual payload and parse the transport header.
|
||||
*/
|
||||
static bool parse_transport_header_v6(struct ip6_hdr *ip, chunk_t packet,
|
||||
chunk_t *payload, uint8_t *proto,
|
||||
uint16_t *sport, uint16_t *dport)
|
||||
{
|
||||
struct ip6_ext *ext;
|
||||
bool fragment = FALSE;
|
||||
|
||||
*proto = ip->ip6_nxt;
|
||||
*payload = chunk_skip(packet, 40);
|
||||
while (payload->len >= sizeof(struct ip6_ext))
|
||||
{
|
||||
switch (*proto)
|
||||
{
|
||||
case 44: /* Fragment Header */
|
||||
fragment = TRUE;
|
||||
/* skip the header */
|
||||
case 0: /* Hop-by-Hop Options Header */
|
||||
case 43: /* Routing Header */
|
||||
case 60: /* Destination Options Header */
|
||||
case 135: /* Mobility Header */
|
||||
case 139: /* HIP */
|
||||
case 140: /* Shim6 */
|
||||
/* simply skip over these headers for now */
|
||||
ext = (struct ip6_ext*)payload->ptr;
|
||||
*proto = ext->ip6e_nxt;
|
||||
*payload = chunk_skip(*payload, 8 * (ext->ip6e_len + 1));
|
||||
continue;
|
||||
default:
|
||||
/* assume anything else is an upper layer protocol but only
|
||||
* attempt to parse the transport header for non-fragmented
|
||||
* packets as there is no guarantee that initial fragments
|
||||
* contain the transport header, depending on the number and
|
||||
* type of extension headers */
|
||||
if (!fragment &&
|
||||
!parse_transport_header(*payload, *proto, sport, dport))
|
||||
{
|
||||
return FALSE;
|
||||
}
|
||||
break;
|
||||
}
|
||||
break;
|
||||
}
|
||||
return TRUE;
|
||||
}
|
||||
#endif /* HAVE_NETINET_IP6_H */
|
||||
|
||||
/**
|
||||
* Described in header.
|
||||
*/
|
||||
@@ -253,7 +311,8 @@ ip_packet_t *ip_packet_create(chunk_t packet)
|
||||
/* remove any RFC 4303 TFC extra padding */
|
||||
packet.len = min(packet.len, untoh16(&ip->ip_len));
|
||||
payload = chunk_skip(packet, ip->ip_hl * 4);
|
||||
if (!parse_transport_header(payload, ip->ip_p, &sport, &dport))
|
||||
if ((ip->ip_off & htons(IP_OFFMASK)) == 0 &&
|
||||
!parse_transport_header(payload, ip->ip_p, &sport, &dport))
|
||||
{
|
||||
goto failed;
|
||||
}
|
||||
@@ -277,10 +336,8 @@ ip_packet_t *ip_packet_create(chunk_t packet)
|
||||
ip = (struct ip6_hdr*)packet.ptr;
|
||||
/* remove any RFC 4303 TFC extra padding */
|
||||
packet.len = min(packet.len, 40 + untoh16(&ip->ip6_plen));
|
||||
/* we only handle packets without extension headers, just skip the
|
||||
* basic IPv6 header */
|
||||
payload = chunk_skip(packet, 40);
|
||||
if (!parse_transport_header(payload, ip->ip6_nxt, &sport, &dport))
|
||||
if (!parse_transport_header_v6(ip, packet, &payload, &next_header,
|
||||
&sport, &dport))
|
||||
{
|
||||
goto failed;
|
||||
}
|
||||
@@ -288,7 +345,6 @@ ip_packet_t *ip_packet_create(chunk_t packet)
|
||||
chunk_from_thing(ip->ip6_src), sport);
|
||||
dst = host_create_from_chunk(AF_INET6,
|
||||
chunk_from_thing(ip->ip6_dst), dport);
|
||||
next_header = ip->ip6_nxt;
|
||||
break;
|
||||
}
|
||||
#endif /* HAVE_NETINET_IP6_H */
|
||||
|
||||
@@ -0,0 +1,14 @@
|
||||
A connection between the subnets behind the gateways <b>moon</b> and <b>sun</b> is set up.
|
||||
The authentication is based on <b>X.509 certificates</b> and the <b>kernel-libipsec</b>
|
||||
plugin is used for userland IPsec ESP encryption.
|
||||
<p/>
|
||||
Upon the successful establishment of the IPsec tunnel, an updown script automatically
|
||||
inserts iptables-based firewall rules that let pass the traffic tunneled via the
|
||||
<b>ipsec0</b> tun interface. In order to test both tunnel and firewall, client <b>alice</b>
|
||||
behind gateway <b>moon</b> pings client <b>bob</b> located behind gateway <b>sun</b>.
|
||||
<p/>
|
||||
This scenario is mainly to test how fragmented IPv6 packets are handled (e.g. determining
|
||||
the protocol via IPv6 extension headers). Three pings are required due to PMTUD, the first
|
||||
is rejected by <b>moon</b>, so <b>alice</b> adjusts the MTU. The second gets through,
|
||||
but the response is rejected by <b>sun</b>, so <b>bob</b> will adjust the MTU. The third
|
||||
finally is successful.
|
||||
@@ -0,0 +1,7 @@
|
||||
moon::ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES
|
||||
sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
|
||||
moon::ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
|
||||
sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
|
||||
alice::ping6 -c 3 -W 1 -i 0.2 -s 8184 -p deadbeef ip6-bob.strongswan.org::8192 bytes from ip6-bob.strongswan.org: icmp_seq=3::YES
|
||||
sun::tcpdump::IP moon.strongswan.org.\(4500\|ipsec-nat-t\) > sun.strongswan.org.\(4500\|ipsec-nat-t\): UDP-encap: ESP::YES
|
||||
sun::tcpdump::IP sun.strongswan.org.\(4500\|ipsec-nat-t\) > moon.strongswan.org.\(4500\|ipsec-nat-t\): UDP-encap: ESP::YES
|
||||
@@ -0,0 +1,22 @@
|
||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
mobike=no
|
||||
|
||||
conn net-net
|
||||
left=PH_IP_MOON
|
||||
leftcert=moonCert.pem
|
||||
[email protected]
|
||||
leftsubnet=fec1::0/16[ipv6-icmp]
|
||||
leftupdown=/etc/updown
|
||||
right=PH_IP_SUN
|
||||
[email protected]
|
||||
rightsubnet=fec2::0/16[ipv6-icmp]
|
||||
auto=add
|
||||
@@ -0,0 +1,6 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-libipsec kernel-netlink socket-default updown
|
||||
multiple_authentication = no
|
||||
}
|
||||
@@ -0,0 +1,597 @@
|
||||
#!/bin/sh
|
||||
# default updown script
|
||||
#
|
||||
# Copyright (C) 2003-2004 Nigel Meteringham
|
||||
# Copyright (C) 2003-2004 Tuomo Soini
|
||||
# Copyright (C) 2002-2004 Michael Richardson
|
||||
# Copyright (C) 2005-2007 Andreas Steffen <[email protected]>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU General Public License as published by the
|
||||
# Free Software Foundation; either version 2 of the License, or (at your
|
||||
# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
# for more details.
|
||||
|
||||
# CAUTION: Installing a new version of strongSwan will install a new
|
||||
# copy of this script, wiping out any custom changes you make. If
|
||||
# you need changes, make a copy of this under another name, and customize
|
||||
# that, and use the (left/right)updown parameters in ipsec.conf to make
|
||||
# strongSwan use yours instead of this default one.
|
||||
|
||||
# PLUTO_VERSION
|
||||
# indicates what version of this interface is being
|
||||
# used. This document describes version 1.1. This
|
||||
# is upwardly compatible with version 1.0.
|
||||
#
|
||||
# PLUTO_VERB
|
||||
# specifies the name of the operation to be performed
|
||||
# (prepare-host, prepare-client, up-host, up-client,
|
||||
# down-host, or down-client). If the address family
|
||||
# for security gateway to security gateway communica-
|
||||
# tions is IPv6, then a suffix of -v6 is added to the
|
||||
# verb.
|
||||
#
|
||||
# PLUTO_CONNECTION
|
||||
# is the name of the connection for which we are
|
||||
# routing.
|
||||
#
|
||||
# PLUTO_INTERFACE
|
||||
# is the name of the ipsec interface to be used.
|
||||
#
|
||||
# PLUTO_REQID
|
||||
# is the requid of the AH|ESP policy
|
||||
#
|
||||
# PLUTO_PROTO
|
||||
# is the negotiated IPsec protocol, ah|esp
|
||||
#
|
||||
# PLUTO_IPCOMP
|
||||
# is not empty if IPComp was negotiated
|
||||
#
|
||||
# PLUTO_UNIQUEID
|
||||
# is the unique identifier of the associated IKE_SA
|
||||
#
|
||||
# PLUTO_ME
|
||||
# is the IP address of our host.
|
||||
#
|
||||
# PLUTO_MY_ID
|
||||
# is the ID of our host.
|
||||
#
|
||||
# PLUTO_MY_CLIENT
|
||||
# is the IP address / count of our client subnet. If
|
||||
# the client is just the host, this will be the
|
||||
# host's own IP address / max (where max is 32 for
|
||||
# IPv4 and 128 for IPv6).
|
||||
#
|
||||
# PLUTO_MY_SOURCEIP
|
||||
# PLUTO_MY_SOURCEIP4_$i
|
||||
# PLUTO_MY_SOURCEIP6_$i
|
||||
# contains IPv4/IPv6 virtual IP received from a responder,
|
||||
# $i enumerates from 1 to the number of IP per address family.
|
||||
# PLUTO_MY_SOURCEIP is a legacy variable and equal to the first
|
||||
# virtual IP, IPv4 or IPv6.
|
||||
#
|
||||
# PLUTO_MY_PROTOCOL
|
||||
# is the IP protocol that will be transported.
|
||||
#
|
||||
# PLUTO_MY_PORT
|
||||
# is the UDP/TCP port to which the IPsec SA is
|
||||
# restricted on our side. For ICMP/ICMPv6 this contains the
|
||||
# message type, and PLUTO_PEER_PORT the message code.
|
||||
#
|
||||
# PLUTO_PEER
|
||||
# is the IP address of our peer.
|
||||
#
|
||||
# PLUTO_PEER_ID
|
||||
# is the ID of our peer.
|
||||
#
|
||||
# PLUTO_PEER_CLIENT
|
||||
# is the IP address / count of the peer's client sub-
|
||||
# net. If the client is just the peer, this will be
|
||||
# the peer's own IP address / max (where max is 32
|
||||
# for IPv4 and 128 for IPv6).
|
||||
#
|
||||
# PLUTO_PEER_SOURCEIP
|
||||
# PLUTO_PEER_SOURCEIP4_$i
|
||||
# PLUTO_PEER_SOURCEIP6_$i
|
||||
# contains IPv4/IPv6 virtual IP sent to an initiator,
|
||||
# $i enumerates from 1 to the number of IP per address family.
|
||||
# PLUTO_PEER_SOURCEIP is a legacy variable and equal to the first
|
||||
# virtual IP, IPv4 or IPv6.
|
||||
#
|
||||
# PLUTO_PEER_PROTOCOL
|
||||
# is the IP protocol that will be transported.
|
||||
#
|
||||
# PLUTO_PEER_PORT
|
||||
# is the UDP/TCP port to which the IPsec SA is
|
||||
# restricted on the peer side. For ICMP/ICMPv6 this contains the
|
||||
# message code, and PLUTO_MY_PORT the message type.
|
||||
#
|
||||
# PLUTO_XAUTH_ID
|
||||
# is an optional user ID employed by the XAUTH protocol
|
||||
#
|
||||
# PLUTO_MARK_IN
|
||||
# is an optional XFRM mark set on the inbound IPsec SA
|
||||
#
|
||||
# PLUTO_MARK_OUT
|
||||
# is an optional XFRM mark set on the outbound IPsec SA
|
||||
#
|
||||
# PLUTO_UDP_ENC
|
||||
# contains the remote UDP port in the case of ESP_IN_UDP
|
||||
# encapsulation
|
||||
#
|
||||
# PLUTO_DNS4_$i
|
||||
# PLUTO_DNS6_$i
|
||||
# contains IPv4/IPv6 DNS server attribute received from a
|
||||
# responder, $i enumerates from 1 to the number of servers per
|
||||
# address family.
|
||||
#
|
||||
|
||||
# define a minimum PATH environment in case it is not set
|
||||
PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/sbin"
|
||||
export PATH
|
||||
|
||||
# comment to disable logging VPN connections to syslog
|
||||
VPN_LOGGING=1
|
||||
#
|
||||
# tag put in front of each log entry:
|
||||
TAG=vpn
|
||||
#
|
||||
# syslog facility and priority used:
|
||||
FAC_PRIO=local0.notice
|
||||
#
|
||||
# to create a special vpn logging file, put the following line into
|
||||
# the syslog configuration file /etc/syslog.conf:
|
||||
#
|
||||
# local0.notice -/var/log/vpn
|
||||
|
||||
# check interface version
|
||||
case "$PLUTO_VERSION" in
|
||||
1.[0|1]) # Older release?!? Play it safe, script may be using new features.
|
||||
echo "$0: obsolete interface version \`$PLUTO_VERSION'," >&2
|
||||
echo "$0: called by obsolete release?" >&2
|
||||
exit 2
|
||||
;;
|
||||
1.*) ;;
|
||||
*) echo "$0: unknown interface version \`$PLUTO_VERSION'" >&2
|
||||
exit 2
|
||||
;;
|
||||
esac
|
||||
|
||||
# check parameter(s)
|
||||
case "$1:$*" in
|
||||
':') # no parameters
|
||||
;;
|
||||
iptables:iptables) # due to (left/right)firewall; for default script only
|
||||
;;
|
||||
custom:*) # custom parameters (see above CAUTION comment)
|
||||
;;
|
||||
*) echo "$0: unknown parameters \`$*'" >&2
|
||||
exit 2
|
||||
;;
|
||||
esac
|
||||
|
||||
IPSEC_POLICY="-m policy --pol ipsec --proto $PLUTO_PROTO --reqid $PLUTO_REQID"
|
||||
IPSEC_POLICY_IN="$IPSEC_POLICY --dir in"
|
||||
IPSEC_POLICY_OUT="$IPSEC_POLICY --dir out"
|
||||
|
||||
# use protocol specific options to set ports
|
||||
case "$PLUTO_MY_PROTOCOL" in
|
||||
1) # ICMP
|
||||
ICMP_TYPE_OPTION="--icmp-type"
|
||||
;;
|
||||
58) # ICMPv6
|
||||
ICMP_TYPE_OPTION="--icmpv6-type"
|
||||
;;
|
||||
*)
|
||||
;;
|
||||
esac
|
||||
|
||||
# are there port numbers?
|
||||
if [ "$PLUTO_MY_PORT" != 0 ]
|
||||
then
|
||||
if [ -n "$ICMP_TYPE_OPTION" ]
|
||||
then
|
||||
S_MY_PORT="$ICMP_TYPE_OPTION $PLUTO_MY_PORT"
|
||||
D_MY_PORT="$ICMP_TYPE_OPTION $PLUTO_MY_PORT"
|
||||
else
|
||||
S_MY_PORT="--sport $PLUTO_MY_PORT"
|
||||
D_MY_PORT="--dport $PLUTO_MY_PORT"
|
||||
fi
|
||||
fi
|
||||
if [ "$PLUTO_PEER_PORT" != 0 ]
|
||||
then
|
||||
if [ -n "$ICMP_TYPE_OPTION" ]
|
||||
then
|
||||
# the syntax is --icmp[v6]-type type[/code], so add it to the existing option
|
||||
S_MY_PORT="$S_MY_PORT/$PLUTO_PEER_PORT"
|
||||
D_MY_PORT="$D_MY_PORT/$PLUTO_PEER_PORT"
|
||||
else
|
||||
S_PEER_PORT="--sport $PLUTO_PEER_PORT"
|
||||
D_PEER_PORT="--dport $PLUTO_PEER_PORT"
|
||||
fi
|
||||
fi
|
||||
|
||||
# resolve octal escape sequences
|
||||
PLUTO_MY_ID=`printf "$PLUTO_MY_ID"`
|
||||
PLUTO_PEER_ID=`printf "$PLUTO_PEER_ID"`
|
||||
|
||||
case "$PLUTO_VERB:$1" in
|
||||
up-host:)
|
||||
# connection to me coming up
|
||||
# If you are doing a custom version, firewall commands go here.
|
||||
;;
|
||||
down-host:)
|
||||
# connection to me going down
|
||||
# If you are doing a custom version, firewall commands go here.
|
||||
;;
|
||||
up-client:)
|
||||
# connection to my client subnet coming up
|
||||
# If you are doing a custom version, firewall commands go here.
|
||||
PLUTO_INTERFACE=ipsec0
|
||||
iptables -I FORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_MY_CLIENT $S_MY_PORT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
|
||||
iptables -I FORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_MY_CLIENT $D_MY_PORT -j ACCEPT
|
||||
;;
|
||||
down-client:)
|
||||
# connection to my client subnet going down
|
||||
# If you are doing a custom version, firewall commands go here.
|
||||
PLUTO_INTERFACE=ipsec0
|
||||
iptables -D FORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_MY_CLIENT $S_MY_PORT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
|
||||
iptables -D FORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_MY_CLIENT $D_MY_PORT -j ACCEPT
|
||||
;;
|
||||
up-host:iptables)
|
||||
# connection to me, with (left/right)firewall=yes, coming up
|
||||
# This is used only by the default updown script, not by your custom
|
||||
# ones, so do not mess with it; see CAUTION comment up at top.
|
||||
iptables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
|
||||
iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
|
||||
#
|
||||
# allow IPIP traffic because of the implicit SA created by the kernel if
|
||||
# IPComp is used (for small inbound packets that are not compressed)
|
||||
if [ -n "$PLUTO_IPCOMP" ]
|
||||
then
|
||||
iptables -I INPUT 1 -i $PLUTO_INTERFACE -p 4 \
|
||||
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# log IPsec host connection setup
|
||||
if [ $VPN_LOGGING ]
|
||||
then
|
||||
if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
|
||||
then
|
||||
logger -t $TAG -p $FAC_PRIO \
|
||||
"+ $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME"
|
||||
else
|
||||
logger -t $TAG -p $FAC_PRIO \
|
||||
"+ $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
down-host:iptables)
|
||||
# connection to me, with (left/right)firewall=yes, going down
|
||||
# This is used only by the default updown script, not by your custom
|
||||
# ones, so do not mess with it; see CAUTION comment up at top.
|
||||
iptables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
|
||||
iptables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
|
||||
#
|
||||
# IPIP exception teardown
|
||||
if [ -n "$PLUTO_IPCOMP" ]
|
||||
then
|
||||
iptables -D INPUT -i $PLUTO_INTERFACE -p 4 \
|
||||
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# log IPsec host connection teardown
|
||||
if [ $VPN_LOGGING ]
|
||||
then
|
||||
if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
|
||||
then
|
||||
logger -t $TAG -p $FAC_PRIO -- \
|
||||
"- $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME"
|
||||
else
|
||||
logger -t $TAG -p $FAC_PRIO -- \
|
||||
"- $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
up-client:iptables)
|
||||
# connection to client subnet, with (left/right)firewall=yes, coming up
|
||||
# This is used only by the default updown script, not by your custom
|
||||
# ones, so do not mess with it; see CAUTION comment up at top.
|
||||
if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/32" ]
|
||||
then
|
||||
iptables -I FORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_MY_CLIENT $S_MY_PORT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
|
||||
iptables -I FORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# a virtual IP requires an INPUT and OUTPUT rule on the host
|
||||
# or sometimes host access via the internal IP is needed
|
||||
if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
|
||||
then
|
||||
iptables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
|
||||
iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_MY_CLIENT $S_MY_PORT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# allow IPIP traffic because of the implicit SA created by the kernel if
|
||||
# IPComp is used (for small inbound packets that are not compressed).
|
||||
# INPUT is correct here even for forwarded traffic.
|
||||
if [ -n "$PLUTO_IPCOMP" ]
|
||||
then
|
||||
iptables -I INPUT 1 -i $PLUTO_INTERFACE -p 4 \
|
||||
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# log IPsec client connection setup
|
||||
if [ $VPN_LOGGING ]
|
||||
then
|
||||
if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
|
||||
then
|
||||
logger -t $TAG -p $FAC_PRIO \
|
||||
"+ $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
|
||||
else
|
||||
logger -t $TAG -p $FAC_PRIO \
|
||||
"+ $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
down-client:iptables)
|
||||
# connection to client subnet, with (left/right)firewall=yes, going down
|
||||
# This is used only by the default updown script, not by your custom
|
||||
# ones, so do not mess with it; see CAUTION comment up at top.
|
||||
if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/32" ]
|
||||
then
|
||||
iptables -D FORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_MY_CLIENT $S_MY_PORT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT \
|
||||
$IPSEC_POLICY_OUT -j ACCEPT
|
||||
iptables -D FORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_MY_CLIENT $D_MY_PORT \
|
||||
$IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# a virtual IP requires an INPUT and OUTPUT rule on the host
|
||||
# or sometimes host access via the internal IP is needed
|
||||
if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
|
||||
then
|
||||
iptables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_MY_CLIENT $D_MY_PORT \
|
||||
$IPSEC_POLICY_IN -j ACCEPT
|
||||
iptables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_MY_CLIENT $S_MY_PORT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT \
|
||||
$IPSEC_POLICY_OUT -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# IPIP exception teardown
|
||||
if [ -n "$PLUTO_IPCOMP" ]
|
||||
then
|
||||
iptables -D INPUT -i $PLUTO_INTERFACE -p 4 \
|
||||
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# log IPsec client connection teardown
|
||||
if [ $VPN_LOGGING ]
|
||||
then
|
||||
if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
|
||||
then
|
||||
logger -t $TAG -p $FAC_PRIO -- \
|
||||
"- $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
|
||||
else
|
||||
logger -t $TAG -p $FAC_PRIO -- \
|
||||
"- $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
#
|
||||
# IPv6
|
||||
#
|
||||
up-host-v6:)
|
||||
# connection to me coming up
|
||||
# If you are doing a custom version, firewall commands go here.
|
||||
;;
|
||||
down-host-v6:)
|
||||
# connection to me going down
|
||||
# If you are doing a custom version, firewall commands go here.
|
||||
;;
|
||||
up-client-v6:)
|
||||
# connection to my client subnet coming up
|
||||
# If you are doing a custom version, firewall commands go here.
|
||||
;;
|
||||
down-client-v6:)
|
||||
# connection to my client subnet going down
|
||||
# If you are doing a custom version, firewall commands go here.
|
||||
;;
|
||||
up-host-v6:iptables)
|
||||
# connection to me, with (left/right)firewall=yes, coming up
|
||||
# This is used only by the default updown script, not by your custom
|
||||
# ones, so do not mess with it; see CAUTION comment up at top.
|
||||
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
|
||||
ip6tables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
|
||||
#
|
||||
# allow IP6IP6 traffic because of the implicit SA created by the kernel if
|
||||
# IPComp is used (for small inbound packets that are not compressed)
|
||||
if [ -n "$PLUTO_IPCOMP" ]
|
||||
then
|
||||
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p 41 \
|
||||
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# log IPsec host connection setup
|
||||
if [ $VPN_LOGGING ]
|
||||
then
|
||||
if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/128" ]
|
||||
then
|
||||
logger -t $TAG -p $FAC_PRIO \
|
||||
"+ $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME"
|
||||
else
|
||||
logger -t $TAG -p $FAC_PRIO \
|
||||
"+ $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
down-host-v6:iptables)
|
||||
# connection to me, with (left/right)firewall=yes, going down
|
||||
# This is used only by the default updown script, not by your custom
|
||||
# ones, so do not mess with it; see CAUTION comment up at top.
|
||||
ip6tables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
|
||||
ip6tables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
|
||||
#
|
||||
# IP6IP6 exception teardown
|
||||
if [ -n "$PLUTO_IPCOMP" ]
|
||||
then
|
||||
ip6tables -D INPUT -i $PLUTO_INTERFACE -p 41 \
|
||||
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# log IPsec host connection teardown
|
||||
if [ $VPN_LOGGING ]
|
||||
then
|
||||
if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/128" ]
|
||||
then
|
||||
logger -t $TAG -p $FAC_PRIO -- \
|
||||
"- $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME"
|
||||
else
|
||||
logger -t $TAG -p $FAC_PRIO -- \
|
||||
"- $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
up-client-v6:iptables)
|
||||
# connection to client subnet, with (left/right)firewall=yes, coming up
|
||||
# This is used only by the default updown script, not by your custom
|
||||
# ones, so do not mess with it; see CAUTION comment up at top.
|
||||
if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/128" ]
|
||||
then
|
||||
ip6tables -I FORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_MY_CLIENT $S_MY_PORT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
|
||||
ip6tables -I FORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# a virtual IP requires an INPUT and OUTPUT rule on the host
|
||||
# or sometimes host access via the internal IP is needed
|
||||
if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
|
||||
then
|
||||
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
|
||||
ip6tables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_MY_CLIENT $S_MY_PORT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# allow IP6IP6 traffic because of the implicit SA created by the kernel if
|
||||
# IPComp is used (for small inbound packets that are not compressed).
|
||||
# INPUT is correct here even for forwarded traffic.
|
||||
if [ -n "$PLUTO_IPCOMP" ]
|
||||
then
|
||||
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p 41 \
|
||||
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# log IPsec client connection setup
|
||||
if [ $VPN_LOGGING ]
|
||||
then
|
||||
if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/128" ]
|
||||
then
|
||||
logger -t $TAG -p $FAC_PRIO \
|
||||
"+ $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
|
||||
else
|
||||
logger -t $TAG -p $FAC_PRIO \
|
||||
"+ $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
down-client-v6:iptables)
|
||||
# connection to client subnet, with (left/right)firewall=yes, going down
|
||||
# This is used only by the default updown script, not by your custom
|
||||
# ones, so do not mess with it; see CAUTION comment up at top.
|
||||
if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/128" ]
|
||||
then
|
||||
ip6tables -D FORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_MY_CLIENT $S_MY_PORT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT \
|
||||
$IPSEC_POLICY_OUT -j ACCEPT
|
||||
ip6tables -D FORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_MY_CLIENT $D_MY_PORT \
|
||||
$IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# a virtual IP requires an INPUT and OUTPUT rule on the host
|
||||
# or sometimes host access via the internal IP is needed
|
||||
if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
|
||||
then
|
||||
ip6tables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_MY_CLIENT $D_MY_PORT \
|
||||
$IPSEC_POLICY_IN -j ACCEPT
|
||||
ip6tables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_MY_CLIENT $S_MY_PORT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT \
|
||||
$IPSEC_POLICY_OUT -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# IP6IP6 exception teardown
|
||||
if [ -n "$PLUTO_IPCOMP" ]
|
||||
then
|
||||
ip6tables -D INPUT -i $PLUTO_INTERFACE -p 41 \
|
||||
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# log IPsec client connection teardown
|
||||
if [ $VPN_LOGGING ]
|
||||
then
|
||||
if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/128" ]
|
||||
then
|
||||
logger -t $TAG -p $FAC_PRIO -- \
|
||||
"- $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
|
||||
else
|
||||
logger -t $TAG -p $FAC_PRIO -- \
|
||||
"- $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
*) echo "$0: unknown verb \`$PLUTO_VERB' or parameter \`$1'" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
@@ -0,0 +1,22 @@
|
||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
mobike=no
|
||||
|
||||
conn net-net
|
||||
left=PH_IP_SUN
|
||||
leftcert=sunCert.pem
|
||||
[email protected]
|
||||
leftsubnet=fec2::0/16[ipv6-icmp]
|
||||
leftupdown=/etc/updown
|
||||
right=PH_IP_MOON
|
||||
[email protected]
|
||||
rightsubnet=fec1::0/16[ipv6-icmp]
|
||||
auto=add
|
||||
@@ -0,0 +1,6 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-libipsec kernel-netlink socket-default updown
|
||||
multiple_authentication = no
|
||||
}
|
||||
@@ -0,0 +1,597 @@
|
||||
#!/bin/sh
|
||||
# default updown script
|
||||
#
|
||||
# Copyright (C) 2003-2004 Nigel Meteringham
|
||||
# Copyright (C) 2003-2004 Tuomo Soini
|
||||
# Copyright (C) 2002-2004 Michael Richardson
|
||||
# Copyright (C) 2005-2007 Andreas Steffen <[email protected]>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU General Public License as published by the
|
||||
# Free Software Foundation; either version 2 of the License, or (at your
|
||||
# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
# for more details.
|
||||
|
||||
# CAUTION: Installing a new version of strongSwan will install a new
|
||||
# copy of this script, wiping out any custom changes you make. If
|
||||
# you need changes, make a copy of this under another name, and customize
|
||||
# that, and use the (left/right)updown parameters in ipsec.conf to make
|
||||
# strongSwan use yours instead of this default one.
|
||||
|
||||
# PLUTO_VERSION
|
||||
# indicates what version of this interface is being
|
||||
# used. This document describes version 1.1. This
|
||||
# is upwardly compatible with version 1.0.
|
||||
#
|
||||
# PLUTO_VERB
|
||||
# specifies the name of the operation to be performed
|
||||
# (prepare-host, prepare-client, up-host, up-client,
|
||||
# down-host, or down-client). If the address family
|
||||
# for security gateway to security gateway communica-
|
||||
# tions is IPv6, then a suffix of -v6 is added to the
|
||||
# verb.
|
||||
#
|
||||
# PLUTO_CONNECTION
|
||||
# is the name of the connection for which we are
|
||||
# routing.
|
||||
#
|
||||
# PLUTO_INTERFACE
|
||||
# is the name of the ipsec interface to be used.
|
||||
#
|
||||
# PLUTO_REQID
|
||||
# is the requid of the AH|ESP policy
|
||||
#
|
||||
# PLUTO_PROTO
|
||||
# is the negotiated IPsec protocol, ah|esp
|
||||
#
|
||||
# PLUTO_IPCOMP
|
||||
# is not empty if IPComp was negotiated
|
||||
#
|
||||
# PLUTO_UNIQUEID
|
||||
# is the unique identifier of the associated IKE_SA
|
||||
#
|
||||
# PLUTO_ME
|
||||
# is the IP address of our host.
|
||||
#
|
||||
# PLUTO_MY_ID
|
||||
# is the ID of our host.
|
||||
#
|
||||
# PLUTO_MY_CLIENT
|
||||
# is the IP address / count of our client subnet. If
|
||||
# the client is just the host, this will be the
|
||||
# host's own IP address / max (where max is 32 for
|
||||
# IPv4 and 128 for IPv6).
|
||||
#
|
||||
# PLUTO_MY_SOURCEIP
|
||||
# PLUTO_MY_SOURCEIP4_$i
|
||||
# PLUTO_MY_SOURCEIP6_$i
|
||||
# contains IPv4/IPv6 virtual IP received from a responder,
|
||||
# $i enumerates from 1 to the number of IP per address family.
|
||||
# PLUTO_MY_SOURCEIP is a legacy variable and equal to the first
|
||||
# virtual IP, IPv4 or IPv6.
|
||||
#
|
||||
# PLUTO_MY_PROTOCOL
|
||||
# is the IP protocol that will be transported.
|
||||
#
|
||||
# PLUTO_MY_PORT
|
||||
# is the UDP/TCP port to which the IPsec SA is
|
||||
# restricted on our side. For ICMP/ICMPv6 this contains the
|
||||
# message type, and PLUTO_PEER_PORT the message code.
|
||||
#
|
||||
# PLUTO_PEER
|
||||
# is the IP address of our peer.
|
||||
#
|
||||
# PLUTO_PEER_ID
|
||||
# is the ID of our peer.
|
||||
#
|
||||
# PLUTO_PEER_CLIENT
|
||||
# is the IP address / count of the peer's client sub-
|
||||
# net. If the client is just the peer, this will be
|
||||
# the peer's own IP address / max (where max is 32
|
||||
# for IPv4 and 128 for IPv6).
|
||||
#
|
||||
# PLUTO_PEER_SOURCEIP
|
||||
# PLUTO_PEER_SOURCEIP4_$i
|
||||
# PLUTO_PEER_SOURCEIP6_$i
|
||||
# contains IPv4/IPv6 virtual IP sent to an initiator,
|
||||
# $i enumerates from 1 to the number of IP per address family.
|
||||
# PLUTO_PEER_SOURCEIP is a legacy variable and equal to the first
|
||||
# virtual IP, IPv4 or IPv6.
|
||||
#
|
||||
# PLUTO_PEER_PROTOCOL
|
||||
# is the IP protocol that will be transported.
|
||||
#
|
||||
# PLUTO_PEER_PORT
|
||||
# is the UDP/TCP port to which the IPsec SA is
|
||||
# restricted on the peer side. For ICMP/ICMPv6 this contains the
|
||||
# message code, and PLUTO_MY_PORT the message type.
|
||||
#
|
||||
# PLUTO_XAUTH_ID
|
||||
# is an optional user ID employed by the XAUTH protocol
|
||||
#
|
||||
# PLUTO_MARK_IN
|
||||
# is an optional XFRM mark set on the inbound IPsec SA
|
||||
#
|
||||
# PLUTO_MARK_OUT
|
||||
# is an optional XFRM mark set on the outbound IPsec SA
|
||||
#
|
||||
# PLUTO_UDP_ENC
|
||||
# contains the remote UDP port in the case of ESP_IN_UDP
|
||||
# encapsulation
|
||||
#
|
||||
# PLUTO_DNS4_$i
|
||||
# PLUTO_DNS6_$i
|
||||
# contains IPv4/IPv6 DNS server attribute received from a
|
||||
# responder, $i enumerates from 1 to the number of servers per
|
||||
# address family.
|
||||
#
|
||||
|
||||
# define a minimum PATH environment in case it is not set
|
||||
PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/sbin"
|
||||
export PATH
|
||||
|
||||
# comment to disable logging VPN connections to syslog
|
||||
VPN_LOGGING=1
|
||||
#
|
||||
# tag put in front of each log entry:
|
||||
TAG=vpn
|
||||
#
|
||||
# syslog facility and priority used:
|
||||
FAC_PRIO=local0.notice
|
||||
#
|
||||
# to create a special vpn logging file, put the following line into
|
||||
# the syslog configuration file /etc/syslog.conf:
|
||||
#
|
||||
# local0.notice -/var/log/vpn
|
||||
|
||||
# check interface version
|
||||
case "$PLUTO_VERSION" in
|
||||
1.[0|1]) # Older release?!? Play it safe, script may be using new features.
|
||||
echo "$0: obsolete interface version \`$PLUTO_VERSION'," >&2
|
||||
echo "$0: called by obsolete release?" >&2
|
||||
exit 2
|
||||
;;
|
||||
1.*) ;;
|
||||
*) echo "$0: unknown interface version \`$PLUTO_VERSION'" >&2
|
||||
exit 2
|
||||
;;
|
||||
esac
|
||||
|
||||
# check parameter(s)
|
||||
case "$1:$*" in
|
||||
':') # no parameters
|
||||
;;
|
||||
iptables:iptables) # due to (left/right)firewall; for default script only
|
||||
;;
|
||||
custom:*) # custom parameters (see above CAUTION comment)
|
||||
;;
|
||||
*) echo "$0: unknown parameters \`$*'" >&2
|
||||
exit 2
|
||||
;;
|
||||
esac
|
||||
|
||||
IPSEC_POLICY="-m policy --pol ipsec --proto $PLUTO_PROTO --reqid $PLUTO_REQID"
|
||||
IPSEC_POLICY_IN="$IPSEC_POLICY --dir in"
|
||||
IPSEC_POLICY_OUT="$IPSEC_POLICY --dir out"
|
||||
|
||||
# use protocol specific options to set ports
|
||||
case "$PLUTO_MY_PROTOCOL" in
|
||||
1) # ICMP
|
||||
ICMP_TYPE_OPTION="--icmp-type"
|
||||
;;
|
||||
58) # ICMPv6
|
||||
ICMP_TYPE_OPTION="--icmpv6-type"
|
||||
;;
|
||||
*)
|
||||
;;
|
||||
esac
|
||||
|
||||
# are there port numbers?
|
||||
if [ "$PLUTO_MY_PORT" != 0 ]
|
||||
then
|
||||
if [ -n "$ICMP_TYPE_OPTION" ]
|
||||
then
|
||||
S_MY_PORT="$ICMP_TYPE_OPTION $PLUTO_MY_PORT"
|
||||
D_MY_PORT="$ICMP_TYPE_OPTION $PLUTO_MY_PORT"
|
||||
else
|
||||
S_MY_PORT="--sport $PLUTO_MY_PORT"
|
||||
D_MY_PORT="--dport $PLUTO_MY_PORT"
|
||||
fi
|
||||
fi
|
||||
if [ "$PLUTO_PEER_PORT" != 0 ]
|
||||
then
|
||||
if [ -n "$ICMP_TYPE_OPTION" ]
|
||||
then
|
||||
# the syntax is --icmp[v6]-type type[/code], so add it to the existing option
|
||||
S_MY_PORT="$S_MY_PORT/$PLUTO_PEER_PORT"
|
||||
D_MY_PORT="$D_MY_PORT/$PLUTO_PEER_PORT"
|
||||
else
|
||||
S_PEER_PORT="--sport $PLUTO_PEER_PORT"
|
||||
D_PEER_PORT="--dport $PLUTO_PEER_PORT"
|
||||
fi
|
||||
fi
|
||||
|
||||
# resolve octal escape sequences
|
||||
PLUTO_MY_ID=`printf "$PLUTO_MY_ID"`
|
||||
PLUTO_PEER_ID=`printf "$PLUTO_PEER_ID"`
|
||||
|
||||
case "$PLUTO_VERB:$1" in
|
||||
up-host:)
|
||||
# connection to me coming up
|
||||
# If you are doing a custom version, firewall commands go here.
|
||||
;;
|
||||
down-host:)
|
||||
# connection to me going down
|
||||
# If you are doing a custom version, firewall commands go here.
|
||||
;;
|
||||
up-client:)
|
||||
# connection to my client subnet coming up
|
||||
# If you are doing a custom version, firewall commands go here.
|
||||
PLUTO_INTERFACE=ipsec0
|
||||
iptables -I FORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_MY_CLIENT $S_MY_PORT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
|
||||
iptables -I FORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_MY_CLIENT $D_MY_PORT -j ACCEPT
|
||||
;;
|
||||
down-client:)
|
||||
# connection to my client subnet going down
|
||||
# If you are doing a custom version, firewall commands go here.
|
||||
PLUTO_INTERFACE=ipsec0
|
||||
iptables -D FORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_MY_CLIENT $S_MY_PORT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
|
||||
iptables -D FORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_MY_CLIENT $D_MY_PORT -j ACCEPT
|
||||
;;
|
||||
up-host:iptables)
|
||||
# connection to me, with (left/right)firewall=yes, coming up
|
||||
# This is used only by the default updown script, not by your custom
|
||||
# ones, so do not mess with it; see CAUTION comment up at top.
|
||||
iptables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
|
||||
iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
|
||||
#
|
||||
# allow IPIP traffic because of the implicit SA created by the kernel if
|
||||
# IPComp is used (for small inbound packets that are not compressed)
|
||||
if [ -n "$PLUTO_IPCOMP" ]
|
||||
then
|
||||
iptables -I INPUT 1 -i $PLUTO_INTERFACE -p 4 \
|
||||
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# log IPsec host connection setup
|
||||
if [ $VPN_LOGGING ]
|
||||
then
|
||||
if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
|
||||
then
|
||||
logger -t $TAG -p $FAC_PRIO \
|
||||
"+ $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME"
|
||||
else
|
||||
logger -t $TAG -p $FAC_PRIO \
|
||||
"+ $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
down-host:iptables)
|
||||
# connection to me, with (left/right)firewall=yes, going down
|
||||
# This is used only by the default updown script, not by your custom
|
||||
# ones, so do not mess with it; see CAUTION comment up at top.
|
||||
iptables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
|
||||
iptables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
|
||||
#
|
||||
# IPIP exception teardown
|
||||
if [ -n "$PLUTO_IPCOMP" ]
|
||||
then
|
||||
iptables -D INPUT -i $PLUTO_INTERFACE -p 4 \
|
||||
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# log IPsec host connection teardown
|
||||
if [ $VPN_LOGGING ]
|
||||
then
|
||||
if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
|
||||
then
|
||||
logger -t $TAG -p $FAC_PRIO -- \
|
||||
"- $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME"
|
||||
else
|
||||
logger -t $TAG -p $FAC_PRIO -- \
|
||||
"- $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
up-client:iptables)
|
||||
# connection to client subnet, with (left/right)firewall=yes, coming up
|
||||
# This is used only by the default updown script, not by your custom
|
||||
# ones, so do not mess with it; see CAUTION comment up at top.
|
||||
if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/32" ]
|
||||
then
|
||||
iptables -I FORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_MY_CLIENT $S_MY_PORT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
|
||||
iptables -I FORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# a virtual IP requires an INPUT and OUTPUT rule on the host
|
||||
# or sometimes host access via the internal IP is needed
|
||||
if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
|
||||
then
|
||||
iptables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
|
||||
iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_MY_CLIENT $S_MY_PORT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# allow IPIP traffic because of the implicit SA created by the kernel if
|
||||
# IPComp is used (for small inbound packets that are not compressed).
|
||||
# INPUT is correct here even for forwarded traffic.
|
||||
if [ -n "$PLUTO_IPCOMP" ]
|
||||
then
|
||||
iptables -I INPUT 1 -i $PLUTO_INTERFACE -p 4 \
|
||||
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# log IPsec client connection setup
|
||||
if [ $VPN_LOGGING ]
|
||||
then
|
||||
if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
|
||||
then
|
||||
logger -t $TAG -p $FAC_PRIO \
|
||||
"+ $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
|
||||
else
|
||||
logger -t $TAG -p $FAC_PRIO \
|
||||
"+ $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
down-client:iptables)
|
||||
# connection to client subnet, with (left/right)firewall=yes, going down
|
||||
# This is used only by the default updown script, not by your custom
|
||||
# ones, so do not mess with it; see CAUTION comment up at top.
|
||||
if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/32" ]
|
||||
then
|
||||
iptables -D FORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_MY_CLIENT $S_MY_PORT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT \
|
||||
$IPSEC_POLICY_OUT -j ACCEPT
|
||||
iptables -D FORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_MY_CLIENT $D_MY_PORT \
|
||||
$IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# a virtual IP requires an INPUT and OUTPUT rule on the host
|
||||
# or sometimes host access via the internal IP is needed
|
||||
if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
|
||||
then
|
||||
iptables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_MY_CLIENT $D_MY_PORT \
|
||||
$IPSEC_POLICY_IN -j ACCEPT
|
||||
iptables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_MY_CLIENT $S_MY_PORT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT \
|
||||
$IPSEC_POLICY_OUT -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# IPIP exception teardown
|
||||
if [ -n "$PLUTO_IPCOMP" ]
|
||||
then
|
||||
iptables -D INPUT -i $PLUTO_INTERFACE -p 4 \
|
||||
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# log IPsec client connection teardown
|
||||
if [ $VPN_LOGGING ]
|
||||
then
|
||||
if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
|
||||
then
|
||||
logger -t $TAG -p $FAC_PRIO -- \
|
||||
"- $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
|
||||
else
|
||||
logger -t $TAG -p $FAC_PRIO -- \
|
||||
"- $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
#
|
||||
# IPv6
|
||||
#
|
||||
up-host-v6:)
|
||||
# connection to me coming up
|
||||
# If you are doing a custom version, firewall commands go here.
|
||||
;;
|
||||
down-host-v6:)
|
||||
# connection to me going down
|
||||
# If you are doing a custom version, firewall commands go here.
|
||||
;;
|
||||
up-client-v6:)
|
||||
# connection to my client subnet coming up
|
||||
# If you are doing a custom version, firewall commands go here.
|
||||
;;
|
||||
down-client-v6:)
|
||||
# connection to my client subnet going down
|
||||
# If you are doing a custom version, firewall commands go here.
|
||||
;;
|
||||
up-host-v6:iptables)
|
||||
# connection to me, with (left/right)firewall=yes, coming up
|
||||
# This is used only by the default updown script, not by your custom
|
||||
# ones, so do not mess with it; see CAUTION comment up at top.
|
||||
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
|
||||
ip6tables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
|
||||
#
|
||||
# allow IP6IP6 traffic because of the implicit SA created by the kernel if
|
||||
# IPComp is used (for small inbound packets that are not compressed)
|
||||
if [ -n "$PLUTO_IPCOMP" ]
|
||||
then
|
||||
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p 41 \
|
||||
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# log IPsec host connection setup
|
||||
if [ $VPN_LOGGING ]
|
||||
then
|
||||
if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/128" ]
|
||||
then
|
||||
logger -t $TAG -p $FAC_PRIO \
|
||||
"+ $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME"
|
||||
else
|
||||
logger -t $TAG -p $FAC_PRIO \
|
||||
"+ $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
down-host-v6:iptables)
|
||||
# connection to me, with (left/right)firewall=yes, going down
|
||||
# This is used only by the default updown script, not by your custom
|
||||
# ones, so do not mess with it; see CAUTION comment up at top.
|
||||
ip6tables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
|
||||
ip6tables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
|
||||
#
|
||||
# IP6IP6 exception teardown
|
||||
if [ -n "$PLUTO_IPCOMP" ]
|
||||
then
|
||||
ip6tables -D INPUT -i $PLUTO_INTERFACE -p 41 \
|
||||
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# log IPsec host connection teardown
|
||||
if [ $VPN_LOGGING ]
|
||||
then
|
||||
if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/128" ]
|
||||
then
|
||||
logger -t $TAG -p $FAC_PRIO -- \
|
||||
"- $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME"
|
||||
else
|
||||
logger -t $TAG -p $FAC_PRIO -- \
|
||||
"- $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
up-client-v6:iptables)
|
||||
# connection to client subnet, with (left/right)firewall=yes, coming up
|
||||
# This is used only by the default updown script, not by your custom
|
||||
# ones, so do not mess with it; see CAUTION comment up at top.
|
||||
if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/128" ]
|
||||
then
|
||||
ip6tables -I FORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_MY_CLIENT $S_MY_PORT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
|
||||
ip6tables -I FORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# a virtual IP requires an INPUT and OUTPUT rule on the host
|
||||
# or sometimes host access via the internal IP is needed
|
||||
if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
|
||||
then
|
||||
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
|
||||
ip6tables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_MY_CLIENT $S_MY_PORT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# allow IP6IP6 traffic because of the implicit SA created by the kernel if
|
||||
# IPComp is used (for small inbound packets that are not compressed).
|
||||
# INPUT is correct here even for forwarded traffic.
|
||||
if [ -n "$PLUTO_IPCOMP" ]
|
||||
then
|
||||
ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p 41 \
|
||||
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# log IPsec client connection setup
|
||||
if [ $VPN_LOGGING ]
|
||||
then
|
||||
if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/128" ]
|
||||
then
|
||||
logger -t $TAG -p $FAC_PRIO \
|
||||
"+ $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
|
||||
else
|
||||
logger -t $TAG -p $FAC_PRIO \
|
||||
"+ $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
down-client-v6:iptables)
|
||||
# connection to client subnet, with (left/right)firewall=yes, going down
|
||||
# This is used only by the default updown script, not by your custom
|
||||
# ones, so do not mess with it; see CAUTION comment up at top.
|
||||
if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/128" ]
|
||||
then
|
||||
ip6tables -D FORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_MY_CLIENT $S_MY_PORT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT \
|
||||
$IPSEC_POLICY_OUT -j ACCEPT
|
||||
ip6tables -D FORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_MY_CLIENT $D_MY_PORT \
|
||||
$IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# a virtual IP requires an INPUT and OUTPUT rule on the host
|
||||
# or sometimes host access via the internal IP is needed
|
||||
if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
|
||||
then
|
||||
ip6tables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
|
||||
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
|
||||
-d $PLUTO_MY_CLIENT $D_MY_PORT \
|
||||
$IPSEC_POLICY_IN -j ACCEPT
|
||||
ip6tables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
|
||||
-s $PLUTO_MY_CLIENT $S_MY_PORT \
|
||||
-d $PLUTO_PEER_CLIENT $D_PEER_PORT \
|
||||
$IPSEC_POLICY_OUT -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# IP6IP6 exception teardown
|
||||
if [ -n "$PLUTO_IPCOMP" ]
|
||||
then
|
||||
ip6tables -D INPUT -i $PLUTO_INTERFACE -p 41 \
|
||||
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
|
||||
fi
|
||||
#
|
||||
# log IPsec client connection teardown
|
||||
if [ $VPN_LOGGING ]
|
||||
then
|
||||
if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/128" ]
|
||||
then
|
||||
logger -t $TAG -p $FAC_PRIO -- \
|
||||
"- $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
|
||||
else
|
||||
logger -t $TAG -p $FAC_PRIO -- \
|
||||
"- $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
*) echo "$0: unknown verb \`$PLUTO_VERB' or parameter \`$1'" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
@@ -0,0 +1,8 @@
|
||||
moon::ipsec stop
|
||||
sun::ipsec stop
|
||||
alice::"ip route del fec2:\:/16 via fec1:\:1"
|
||||
moon::"ip route del fec2:\:/16 via fec0:\:2"
|
||||
sun::"ip route del fec1:\:/16 via fec0:\:1"
|
||||
bob::"ip route del fec1:\:/16 via fec2:\:1"
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
sun::iptables-restore < /etc/iptables.flush
|
||||
@@ -0,0 +1,11 @@
|
||||
moon::iptables-restore < /etc/iptables.rules
|
||||
sun::iptables-restore < /etc/iptables.rules
|
||||
alice::"ip route add fec2:\:/16 via fec1:\:1"
|
||||
moon::"ip route add fec2:\:/16 via fec0:\:2"
|
||||
sun::"ip route add fec1:\:/16 via fec0:\:1"
|
||||
bob::"ip route add fec1:\:/16 via fec2:\:1"
|
||||
sun::ipsec start
|
||||
moon::ipsec start
|
||||
sun::expect-connection net-net
|
||||
moon::expect-connection net-net
|
||||
moon::ipsec up net-net
|
||||
@@ -0,0 +1,21 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# This configuration file provides information on the
|
||||
# guest instances used for this test
|
||||
|
||||
# All guest instances that are required for this test
|
||||
#
|
||||
VIRTHOSTS="alice moon winnetou sun bob"
|
||||
|
||||
# Corresponding block diagram
|
||||
#
|
||||
DIAGRAM="a-m-w-s-b.png"
|
||||
|
||||
# Guest instances on which tcpdump is to be started
|
||||
#
|
||||
TCPDUMPHOSTS="sun"
|
||||
|
||||
# Guest instances on which IPsec is started
|
||||
# Used for IPsec logging purposes
|
||||
#
|
||||
IPSECHOSTS="moon sun"
|
||||
Reference in New Issue
Block a user