_updown: Remove obsolete stuff from default script
This commit is contained in:
Tobias Brunner
+7
-192
@@ -1,5 +1,5 @@
|
||||
#! /bin/sh
|
||||
# iproute2 version, default updown script
|
||||
#!/bin/sh
|
||||
# default updown script
|
||||
#
|
||||
# Copyright (C) 2003-2004 Nigel Meteringham
|
||||
# Copyright (C) 2003-2004 Tuomo Soini
|
||||
@@ -22,8 +22,6 @@
|
||||
# that, and use the (left/right)updown parameters in ipsec.conf to make
|
||||
# strongSwan use yours instead of this default one.
|
||||
|
||||
# things that this script gets (from ipsec_pluto(8) man page)
|
||||
#
|
||||
# PLUTO_VERSION
|
||||
# indicates what version of this interface is being
|
||||
# used. This document describes version 1.1. This
|
||||
@@ -142,21 +140,11 @@ FAC_PRIO=local0.notice
|
||||
#
|
||||
# local0.notice -/var/log/vpn
|
||||
|
||||
# in order to use source IP routing the Linux kernel options
|
||||
# CONFIG_IP_ADVANCED_ROUTER and CONFIG_IP_MULTIPLE_TABLES
|
||||
# must be enabled
|
||||
#
|
||||
# special routing table for sourceip routes
|
||||
SOURCEIP_ROUTING_TABLE=@routing_table@
|
||||
#
|
||||
# priority of the sourceip routing table
|
||||
SOURCEIP_ROUTING_TABLE_PRIO=@routing_table_prio@
|
||||
|
||||
# check interface version
|
||||
case "$PLUTO_VERSION" in
|
||||
1.[0|1]) # Older Pluto?!? Play it safe, script may be using new features.
|
||||
1.[0|1]) # Older release?!? Play it safe, script may be using new features.
|
||||
echo "$0: obsolete interface version \`$PLUTO_VERSION'," >&2
|
||||
echo "$0: called by obsolete Pluto?" >&2
|
||||
echo "$0: called by obsolete release?" >&2
|
||||
exit 2
|
||||
;;
|
||||
1.*) ;;
|
||||
@@ -178,120 +166,9 @@ custom:*) # custom parameters (see above CAUTION comment)
|
||||
;;
|
||||
esac
|
||||
|
||||
# utility functions for route manipulation
|
||||
# Meddling with this stuff should not be necessary and requires great care.
|
||||
uproute() {
|
||||
doroute add
|
||||
ip route flush cache
|
||||
}
|
||||
downroute() {
|
||||
doroute delete
|
||||
ip route flush cache
|
||||
}
|
||||
|
||||
addsource() {
|
||||
st=0
|
||||
if ! ip -o route get ${PLUTO_MY_SOURCEIP%/*} | grep -q ^local
|
||||
then
|
||||
it="ip addr add ${PLUTO_MY_SOURCEIP%/*}/32 dev $PLUTO_INTERFACE"
|
||||
oops="`eval $it 2>&1`"
|
||||
st=$?
|
||||
if test " $oops" = " " -a " $st" != " 0"
|
||||
then
|
||||
oops="silent error, exit status $st"
|
||||
fi
|
||||
if test " $oops" != " " -o " $st" != " 0"
|
||||
then
|
||||
echo "$0: addsource \`$it' failed ($oops)" >&2
|
||||
fi
|
||||
fi
|
||||
return $st
|
||||
}
|
||||
|
||||
doroute() {
|
||||
st=0
|
||||
|
||||
if [ -z "$PLUTO_MY_SOURCEIP" ]
|
||||
then
|
||||
for dir in /etc/sysconfig /etc/conf.d; do
|
||||
if [ -f "$dir/defaultsource" ]
|
||||
then
|
||||
. "$dir/defaultsource"
|
||||
fi
|
||||
done
|
||||
|
||||
if [ -n "$DEFAULTSOURCE" ]
|
||||
then
|
||||
PLUTO_MY_SOURCEIP=$DEFAULTSOURCE
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -z "$KLIPS" -a -z "$PLUTO_MY_SOURCEIP" ]
|
||||
then
|
||||
# leave because no route entry is required
|
||||
return $st
|
||||
fi
|
||||
|
||||
parms1="$PLUTO_PEER_CLIENT"
|
||||
|
||||
if [ -n "$PLUTO_NEXT_HOP" ]
|
||||
then
|
||||
parms2="via $PLUTO_NEXT_HOP"
|
||||
else
|
||||
parms2="via $PLUTO_PEER"
|
||||
fi
|
||||
parms2="$parms2 dev $PLUTO_INTERFACE"
|
||||
|
||||
parms3=
|
||||
if [ -n "$PLUTO_MY_SOURCEIP" ]
|
||||
then
|
||||
if test "$1" = "add"
|
||||
then
|
||||
addsource
|
||||
if ! ip rule list | grep -q "lookup $SOURCEIP_ROUTING_TABLE"
|
||||
then
|
||||
ip rule add pref $SOURCEIP_ROUTING_TABLE_PRIO table $SOURCEIP_ROUTING_TABLE
|
||||
fi
|
||||
fi
|
||||
parms3="$parms3 src ${PLUTO_MY_SOURCEIP%/*} table $SOURCEIP_ROUTING_TABLE"
|
||||
fi
|
||||
|
||||
case "$PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK" in
|
||||
"0.0.0.0/0.0.0.0")
|
||||
# opportunistic encryption work around
|
||||
# need to provide route that eclipses default, without
|
||||
# replacing it.
|
||||
it="ip route $1 0.0.0.0/1 $parms2 $parms3 &&
|
||||
ip route $1 128.0.0.0/1 $parms2 $parms3"
|
||||
;;
|
||||
*) it="ip route $1 $parms1 $parms2 $parms3"
|
||||
;;
|
||||
esac
|
||||
oops="`eval $it 2>&1`"
|
||||
st=$?
|
||||
if test " $oops" = " " -a " $st" != " 0"
|
||||
then
|
||||
oops="silent error, exit status $st"
|
||||
fi
|
||||
if test " $oops" != " " -o " $st" != " 0"
|
||||
then
|
||||
echo "$0: doroute \`$it' failed ($oops)" >&2
|
||||
fi
|
||||
return $st
|
||||
}
|
||||
|
||||
# in the presence of KLIPS and ipsecN interfaces do not use IPSEC_POLICY
|
||||
if [ `echo "$PLUTO_INTERFACE" | grep "ipsec"` ]
|
||||
then
|
||||
KLIPS=1
|
||||
IPSEC_POLICY_IN=""
|
||||
IPSEC_POLICY_OUT=""
|
||||
else
|
||||
KLIPS=
|
||||
IPSEC_POLICY="-m policy --pol ipsec --proto $PLUTO_PROTO --reqid $PLUTO_REQID"
|
||||
IPSEC_POLICY_IN="$IPSEC_POLICY --dir in"
|
||||
IPSEC_POLICY_OUT="$IPSEC_POLICY --dir out"
|
||||
fi
|
||||
IPSEC_POLICY="-m policy --pol ipsec --proto $PLUTO_PROTO --reqid $PLUTO_REQID"
|
||||
IPSEC_POLICY_IN="$IPSEC_POLICY --dir in"
|
||||
IPSEC_POLICY_OUT="$IPSEC_POLICY --dir out"
|
||||
|
||||
# use protocol specific options to set ports
|
||||
case "$PLUTO_MY_PROTOCOL" in
|
||||
@@ -334,59 +211,7 @@ fi
|
||||
PLUTO_MY_ID=`printf "$PLUTO_MY_ID"`
|
||||
PLUTO_PEER_ID=`printf "$PLUTO_PEER_ID"`
|
||||
|
||||
# the big choice
|
||||
case "$PLUTO_VERB:$1" in
|
||||
prepare-host:*|prepare-client:*)
|
||||
if [ -z "$KLIPS" -a -z "$PLUTO_MY_SOURCEIP" ]
|
||||
then
|
||||
# exit because no route will be added,
|
||||
# so that existing routes can stay
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# delete possibly-existing route (preliminary to adding a route)
|
||||
case "$PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK" in
|
||||
"0.0.0.0/0.0.0.0")
|
||||
# need to provide route that eclipses default, without
|
||||
# replacing it.
|
||||
parms1="0.0.0.0/1"
|
||||
parms2="128.0.0.0/1"
|
||||
it="ip route delete $parms1 2>&1 ; ip route delete $parms2 2>&1"
|
||||
oops="`ip route delete $parms1 2>&1 ; ip route delete $parms2 2>&1`"
|
||||
;;
|
||||
*)
|
||||
parms="$PLUTO_PEER_CLIENT"
|
||||
it="ip route delete $parms 2>&1"
|
||||
oops="`ip route delete $parms 2>&1`"
|
||||
;;
|
||||
esac
|
||||
status="$?"
|
||||
if test " $oops" = " " -a " $status" != " 0"
|
||||
then
|
||||
oops="silent error, exit status $status"
|
||||
fi
|
||||
case "$oops" in
|
||||
*'RTNETLINK answers: No such process'*)
|
||||
# This is what route (currently -- not documented!) gives
|
||||
# for "could not find such a route".
|
||||
oops=
|
||||
status=0
|
||||
;;
|
||||
esac
|
||||
if test " $oops" != " " -o " $status" != " 0"
|
||||
then
|
||||
echo "$0: \`$it' failed ($oops)" >&2
|
||||
fi
|
||||
exit $status
|
||||
;;
|
||||
route-host:*|route-client:*)
|
||||
# connection to me or my client subnet being routed
|
||||
uproute
|
||||
;;
|
||||
unroute-host:*|unroute-client:*)
|
||||
# connection to me or my client subnet being unrouted
|
||||
downroute
|
||||
;;
|
||||
up-host:)
|
||||
# connection to me coming up
|
||||
# If you are doing a custom version, firewall commands go here.
|
||||
@@ -567,16 +392,6 @@ down-client:iptables)
|
||||
#
|
||||
# IPv6
|
||||
#
|
||||
prepare-host-v6:*|prepare-client-v6:*)
|
||||
;;
|
||||
route-host-v6:*|route-client-v6:*)
|
||||
# connection to me or my client subnet being routed
|
||||
#uproute_v6
|
||||
;;
|
||||
unroute-host-v6:*|unroute-client-v6:*)
|
||||
# connection to me or my client subnet being unrouted
|
||||
#downroute_v6
|
||||
;;
|
||||
up-host-v6:)
|
||||
# connection to me coming up
|
||||
# If you are doing a custom version, firewall commands go here.
|
||||
|
||||
Reference in New Issue
Block a user