- import of strongswan-2.7.0
- applied patch for charon
This commit is contained in:
Martin Willi committed
1 parent
52923c9acb
commit
997358a6c4
2043 files changed
+346842
No files matched your search
@@ -0,0 +1 @@
|
||||
manual
|
||||
@@ -0,0 +1,38 @@
|
||||
# Makefile for miscelaneous programs
|
||||
# Copyright (C) 2002 Michael Richardson <mcr@freeswan.org>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU General Public License as published by the
|
||||
# Free Software Foundation; either version 2 of the License, or (at your
|
||||
# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
# for more details.
|
||||
#
|
||||
# RCSID $Id: Makefile,v 1.1 2004/03/15 20:35:28 as Exp $
|
||||
|
||||
FREESWANSRCDIR=../..
|
||||
include ${FREESWANSRCDIR}/Makefile.inc
|
||||
|
||||
PROGRAM=manual
|
||||
|
||||
include ../Makefile.program
|
||||
|
||||
#
|
||||
# $Log: Makefile,v $
|
||||
# Revision 1.1 2004/03/15 20:35:28 as
|
||||
# added files from freeswan-2.04-x509-1.5.3
|
||||
#
|
||||
# Revision 1.2 2002/06/02 21:51:41 mcr
|
||||
# changed TOPDIR->FREESWANSRCDIR in all Makefiles.
|
||||
# (note that linux/net/ipsec/Makefile uses TOPDIR because this is the
|
||||
# kernel sense.)
|
||||
#
|
||||
# Revision 1.1 2002/04/24 07:55:32 mcr
|
||||
# #include patches and Makefiles for post-reorg compilation.
|
||||
#
|
||||
#
|
||||
#
|
||||
|
||||
@@ -0,0 +1,267 @@
|
||||
.TH IPSEC_MANUAL 8 "17 July 2001"
|
||||
.\" RCSID $Id: manual.8,v 1.1 2004/03/15 20:35:28 as Exp $
|
||||
.SH NAME
|
||||
ipsec manual \- take manually-keyed IPsec connections up and down
|
||||
.SH SYNOPSIS
|
||||
.B ipsec
|
||||
.B manual
|
||||
[
|
||||
.B \-\-show
|
||||
] [
|
||||
.B \-\-showonly
|
||||
] [
|
||||
.B \-\-other
|
||||
]
|
||||
.br
|
||||
\ \ \ [
|
||||
.B \-\-iam
|
||||
.RB address "@" interface
|
||||
] [
|
||||
.B \-\-config
|
||||
configfile
|
||||
]
|
||||
.br
|
||||
\ \ \ operation connection
|
||||
.sp 0.5
|
||||
.B ipsec
|
||||
.B manual
|
||||
[
|
||||
.I options
|
||||
]
|
||||
.B \-\-union
|
||||
operation part ...
|
||||
.SH DESCRIPTION
|
||||
.I Manual
|
||||
manipulates manually-keyed FreeS/WAN IPsec connections,
|
||||
setting them up and shutting them down,
|
||||
based on the information in the IPsec configuration file.
|
||||
In the normal usage,
|
||||
.I connection
|
||||
is the name of a connection specification in the configuration file;
|
||||
.I operation
|
||||
is
|
||||
.BR \-\-up ,
|
||||
.BR \-\-down ,
|
||||
.BR \-\-route ,
|
||||
or
|
||||
.BR \-\-unroute .
|
||||
.I Manual
|
||||
generates setup (\c
|
||||
.BR \-\-route
|
||||
or
|
||||
.BR \-\-up )
|
||||
or
|
||||
teardown (\c
|
||||
.BR \-\-down
|
||||
or
|
||||
.BR \-\-unroute )
|
||||
commands for the connection and feeds them to a shell for execution.
|
||||
.PP
|
||||
The
|
||||
.B \-\-up
|
||||
operation brings the specified connection up, including establishing a
|
||||
suitable route for it if necessary.
|
||||
.PP
|
||||
The
|
||||
.B \-\-route
|
||||
operation just establishes the route for a connection.
|
||||
Unless and until an
|
||||
.B \-\-up
|
||||
operation is done, packets routed by that route will simply be discarded.
|
||||
.PP
|
||||
The
|
||||
.B \-\-down
|
||||
operation tears the specified connection down,
|
||||
.I except
|
||||
that it leaves the route in place.
|
||||
Unless and until an
|
||||
.B \-\-unroute
|
||||
operation is done, packets routed by that route will simply be discarded.
|
||||
This permits establishing another connection to the same destination
|
||||
without any ``window'' in which packets can pass without encryption.
|
||||
.PP
|
||||
The
|
||||
.B \-\-unroute
|
||||
operation (and only the
|
||||
.B \-\-unroute
|
||||
operation) deletes any route established for a connection.
|
||||
.PP
|
||||
In the
|
||||
.B \-\-union
|
||||
usage, each
|
||||
.I part
|
||||
is the name of a partial connection specification in the configuration file,
|
||||
and the union of all the partial specifications is the
|
||||
connection specification used.
|
||||
The effect is as if the contents of the partial specifications were
|
||||
concatenated together;
|
||||
restrictions on duplicate parameters, etc., do apply to the result.
|
||||
(The same effect can now be had, more gracefully, using the
|
||||
.B also
|
||||
parameter in connection descriptions;
|
||||
see
|
||||
.IR ipsec.conf (5)
|
||||
for details.)
|
||||
.PP
|
||||
The
|
||||
.B \-\-show
|
||||
option turns on the
|
||||
.B \-x
|
||||
option of the shell used to execute the commands,
|
||||
so each command is shown as it is executed.
|
||||
.PP
|
||||
The
|
||||
.B \-\-showonly
|
||||
option causes
|
||||
.I manual
|
||||
to show the commands it would run, on standard output,
|
||||
and not run them.
|
||||
.PP
|
||||
The
|
||||
.B \-\-other
|
||||
option causes
|
||||
.I manual
|
||||
to pretend it is the other end of the connection.
|
||||
This is probably not useful except in combination with
|
||||
.BR \-\-showonly .
|
||||
.PP
|
||||
The
|
||||
.B \-\-iam
|
||||
option causes
|
||||
.I manual
|
||||
to believe it is running on the host with the specified IP
|
||||
.IR address ,
|
||||
and that it should use the specified
|
||||
.I interface
|
||||
(normally it determines all this automatically,
|
||||
based on what IPsec interfaces are up and how they are configured).
|
||||
.PP
|
||||
The
|
||||
.B \-\-config
|
||||
option specifies a non-standard location for the FreeS/WAN IPsec
|
||||
configuration file (default
|
||||
.IR /etc/ipsec.conf ).
|
||||
.PP
|
||||
See
|
||||
.IR ipsec.conf (5)
|
||||
for details of the configuration file.
|
||||
Apart from the basic parameters which specify the endpoints and routing
|
||||
of a connection (\fBleft\fR
|
||||
and
|
||||
.BR right ,
|
||||
plus possibly
|
||||
.BR leftsubnet ,
|
||||
.BR leftnexthop ,
|
||||
.BR leftfirewall ,
|
||||
their
|
||||
.B right
|
||||
equivalents,
|
||||
and perhaps
|
||||
.BR type ),
|
||||
a non-\fBpassthrough\fR
|
||||
.I manual
|
||||
connection needs an
|
||||
.B spi
|
||||
or
|
||||
.B spibase
|
||||
parameter and some parameters specifying encryption, authentication, or
|
||||
both, most simply
|
||||
.BR esp ,
|
||||
.BR espenckey ,
|
||||
and
|
||||
.BR espauthkey .
|
||||
Moderately-secure keys can be obtained from
|
||||
.IR ipsec_ranbits (8).
|
||||
For production use of manually-keyed connections,
|
||||
it is strongly recommended that the keys be kept in a separate file
|
||||
(with permissions
|
||||
.BR rw\-\-\-\-\-\-\- )
|
||||
using the
|
||||
.B include
|
||||
and
|
||||
.B also
|
||||
facilities of the configuration file (see
|
||||
.IR ipsec.conf (5)).
|
||||
.PP
|
||||
If an
|
||||
.B spi
|
||||
parameter is given,
|
||||
.I manual
|
||||
uses that value as the SPI number for all the SAs
|
||||
(which are in separate number spaces anyway).
|
||||
If an
|
||||
.B spibase
|
||||
parameter is given instead,
|
||||
.I manual
|
||||
assigns SPI values by altering the bottom digit
|
||||
of that value;
|
||||
SAs going from left to right get even digits starting at 0,
|
||||
SAs going from right to left get odd digits starting at 1.
|
||||
Either way, it is suggested that manually-keyed connections use
|
||||
three-digit SPIs with the first digit non-zero,
|
||||
i.e. in the range
|
||||
.B 0x100
|
||||
through
|
||||
.BR 0xfff ;
|
||||
FreeS/WAN reserves those for manual keying and will not
|
||||
attempt to use them for automatic keying (unless requested to,
|
||||
presumably by a non-FreeS/WAN other end).
|
||||
.SH FILES
|
||||
.ta \w'/var/run/ipsec.nexthop'u+4n
|
||||
/etc/ipsec.conf default IPsec configuration file
|
||||
.br
|
||||
/var/run/ipsec.info \fB%defaultroute\fR information
|
||||
.SH SEE ALSO
|
||||
ipsec(8), ipsec.conf(5), ipsec_spi(8), ipsec_eroute(8), ipsec_spigrp(8),
|
||||
route(8)
|
||||
.SH HISTORY
|
||||
Written for the FreeS/WAN project
|
||||
<http://www.freeswan.org/>
|
||||
by Henry Spencer.
|
||||
.SH BUGS
|
||||
It's not nearly as generous about the syntax of subnets,
|
||||
addresses, etc. as the usual FreeS/WAN user interfaces.
|
||||
Four-component dotted-decimal must be used for all addresses.
|
||||
It
|
||||
.I is
|
||||
smart enough to translate bit-count netmasks to dotted-decimal form.
|
||||
.PP
|
||||
If the connection specification for a connection is changed between an
|
||||
.B \-\-up
|
||||
and the ensuing
|
||||
.BR \-\-down ,
|
||||
chaos may ensue.
|
||||
.PP
|
||||
The
|
||||
.B \-\-up
|
||||
operation is not smart enough to notice whether the connection is already up.
|
||||
.PP
|
||||
.I Manual
|
||||
is not smart enough to reject insecure combinations of algorithms,
|
||||
e.g. encryption with no authentication at all.
|
||||
.PP
|
||||
Any non-IPsec route to the other end which is replaced by the
|
||||
.B \-\-up
|
||||
or
|
||||
.B \-\-route
|
||||
operation will not be re-established by
|
||||
.BR \-\-unroute .
|
||||
Whether this is a feature or a bug depends on your viewpoint.
|
||||
.PP
|
||||
The optional parameters which
|
||||
override the automatic
|
||||
.BR spibase -based
|
||||
SPI assignment are a messy area of the code and bugs are likely.
|
||||
.PP
|
||||
``Road warrior'' handling,
|
||||
and other special forms of setup which
|
||||
require negotiation between the two security gateways,
|
||||
inherently cannot be done with
|
||||
.IR manual .
|
||||
.PP
|
||||
.I Manual
|
||||
generally lags behind
|
||||
.I auto
|
||||
in support of various features,
|
||||
even when implementation \fIwould\fR be possible.
|
||||
For example, currently it does not do IPComp content compression.
|
||||
Executable
+637
@@ -0,0 +1,637 @@
|
||||
#! /bin/sh
|
||||
# user interface to manual keying
|
||||
# Copyright (C) 1998, 1999 Henry Spencer.
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU General Public License as published by the
|
||||
# Free Software Foundation; either version 2 of the License, or (at your
|
||||
# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
# for more details.
|
||||
#
|
||||
# RCSID $Id: manual.in,v 1.1 2004/03/15 20:35:28 as Exp $
|
||||
|
||||
me='ipsec manual'
|
||||
usage="Usage:
|
||||
$me [--showonly] --{up|down|route|unroute} name
|
||||
$me [--showonly] --{up|down|route|unroute} --union partname ...
|
||||
|
||||
other options: [--config ipsecconfigfile] [--other] [--show]
|
||||
[--iam ipaddress@interface]"
|
||||
|
||||
# make sure outputs of (e.g.) ifconfig are in English
|
||||
unset LANG LANGUAGE LC_ALL LC_MESSAGES
|
||||
|
||||
showonly=
|
||||
config=
|
||||
info=/var/run/ipsec.info
|
||||
shopts=
|
||||
other=0
|
||||
union=0
|
||||
noinclude=
|
||||
interfs=
|
||||
op=
|
||||
|
||||
for dummy
|
||||
do
|
||||
case "$1" in
|
||||
--help) echo "$usage" ; exit 0 ;;
|
||||
--version) echo "$me $IPSEC_VERSION" ; exit 0 ;;
|
||||
--show) shopts=-x ;;
|
||||
--showonly) showonly=yes ;;
|
||||
--other) other=1 ;;
|
||||
--union) union=1 ;;
|
||||
--config) config="--config $2" ; shift ;;
|
||||
--noinclude) noinclude=--noinclude ;;
|
||||
--iam) interfs="$2" ; shift ;;
|
||||
--up|--down|--route|--unroute)
|
||||
if test " $op" != " "
|
||||
then
|
||||
echo "$usage" >&2
|
||||
exit 2
|
||||
fi
|
||||
op="$1"
|
||||
;;
|
||||
--) shift ; break ;;
|
||||
-*) echo "$me: unknown option \`$1'" >&2 ; exit 2 ;;
|
||||
*) break ;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
||||
case "$op$#:$union" in
|
||||
[01]:*) echo "$usage" >&2 ; exit 2 ;;
|
||||
2:0) echo "$me: warning: obsolete command syntax used" >&2
|
||||
op="--$2"
|
||||
names="$1"
|
||||
;;
|
||||
[0-9]*:1) ;;
|
||||
--*) if test $# -eq 0
|
||||
then
|
||||
echo "$usage" >&2
|
||||
exit 2
|
||||
fi
|
||||
names="$*"
|
||||
;;
|
||||
*) echo "$usage" >&2 ; exit 2 ;;
|
||||
esac
|
||||
if test " $op" = " "
|
||||
then
|
||||
# --union obsolete-syntax case, op is last argument
|
||||
echo "$me: warning: obsolete command syntax used" >&2
|
||||
names=
|
||||
prev=
|
||||
for arg
|
||||
do
|
||||
names="$names $prev"
|
||||
prev="$arg"
|
||||
done
|
||||
op="--$prev"
|
||||
fi
|
||||
case "$op" in
|
||||
--up|--down|--route|--unroute) ;;
|
||||
*) echo "$usage" >&2 ; exit 2 ;;
|
||||
esac
|
||||
|
||||
case "$interfs" in
|
||||
'') interfs="`ifconfig |
|
||||
awk ' /^ipsec/ { interf = $1 ; next }
|
||||
/^[^ \t]/ { interf = "" ; next }
|
||||
/^[ \t]*inet addr/ {
|
||||
sub(/:/, " ", $0)
|
||||
if (interf != "")
|
||||
print $3 "@" interf
|
||||
}' | tr '\n' ' '`"
|
||||
;;
|
||||
esac
|
||||
|
||||
if test -s $info
|
||||
then
|
||||
. $info
|
||||
fi
|
||||
|
||||
ipsec _confread $config $noinclude $names |
|
||||
awk ' BEGIN {
|
||||
FS = "\t"
|
||||
myname = "'"$me"'"
|
||||
err = "cat >&2"
|
||||
op = "'"$op"'"
|
||||
other = '"$other"'
|
||||
names = "'"$names"'"
|
||||
interfs = "'"$interfs"'"
|
||||
ni = split(interfs, terfs, " ")
|
||||
if (ni == 0)
|
||||
fail("no IPsec-enabled interfaces found")
|
||||
for (i = 1; i <= ni; i++) {
|
||||
nc = split(terfs[i], cpts, "@")
|
||||
if (nc != 2)
|
||||
fail("internal error on " terfs[i])
|
||||
interface[cpts[1]] = cpts[2]
|
||||
}
|
||||
draddr = "'"$defaultrouteaddr"'"
|
||||
drnexthop = "'"$defaultroutenexthop"'"
|
||||
s[""] = ""
|
||||
nlspi = 0
|
||||
nrspi = 0
|
||||
failed = 0
|
||||
maskbits[0] = "0.0.0.0"
|
||||
maskbits[1] = "128.0.0.0"
|
||||
maskbits[2] = "192.0.0.0"
|
||||
maskbits[3] = "224.0.0.0"
|
||||
maskbits[4] = "240.0.0.0"
|
||||
maskbits[5] = "248.0.0.0"
|
||||
maskbits[6] = "252.0.0.0"
|
||||
maskbits[7] = "254.0.0.0"
|
||||
maskbits[8] = "255.0.0.0"
|
||||
maskbits[9] = "255.128.0.0"
|
||||
maskbits[10] = "255.192.0.0"
|
||||
maskbits[11] = "255.224.0.0"
|
||||
maskbits[12] = "255.240.0.0"
|
||||
maskbits[13] = "255.248.0.0"
|
||||
maskbits[14] = "255.252.0.0"
|
||||
maskbits[15] = "255.254.0.0"
|
||||
maskbits[16] = "255.255.0.0"
|
||||
maskbits[17] = "255.255.128.0"
|
||||
maskbits[18] = "255.255.192.0"
|
||||
maskbits[19] = "255.255.224.0"
|
||||
maskbits[20] = "255.255.240.0"
|
||||
maskbits[21] = "255.255.248.0"
|
||||
maskbits[22] = "255.255.252.0"
|
||||
maskbits[23] = "255.255.254.0"
|
||||
maskbits[24] = "255.255.255.0"
|
||||
maskbits[25] = "255.255.255.128"
|
||||
maskbits[26] = "255.255.255.192"
|
||||
maskbits[27] = "255.255.255.224"
|
||||
maskbits[28] = "255.255.255.240"
|
||||
maskbits[29] = "255.255.255.248"
|
||||
maskbits[30] = "255.255.255.252"
|
||||
maskbits[31] = "255.255.255.254"
|
||||
maskbits[32] = "255.255.255.255"
|
||||
}
|
||||
$1 == "=" {
|
||||
next
|
||||
}
|
||||
$1 == "!" {
|
||||
if ($2 != "")
|
||||
fail($2)
|
||||
next
|
||||
}
|
||||
$1 != ":" {
|
||||
fail("internal error, unknown type code \"" $1 "\"")
|
||||
}
|
||||
{ s[$2] = $3 }
|
||||
function q(s) {
|
||||
return "\"" s "\""
|
||||
}
|
||||
function fail(m) {
|
||||
print myname ": fatal error in " q(names) ": " m |err
|
||||
failed = 1
|
||||
exit
|
||||
}
|
||||
function swap(k, t, l, r) {
|
||||
l = "left" k
|
||||
r = "right" k
|
||||
if ((l in s) && (r in s)) {
|
||||
t = s[l]
|
||||
s[l] = s[r]
|
||||
s[r] = t
|
||||
} else if (l in s) { # but not r
|
||||
s[r] = s[l]
|
||||
delete s[l]
|
||||
} else if (r in s) { # but not l
|
||||
s[l] = s[r]
|
||||
delete s[r]
|
||||
}
|
||||
}
|
||||
function yesno(k) {
|
||||
if ((k in s) && s[k] != "yes" && s[k] != "no")
|
||||
fail("parameter \"" k "\" must be \"yes\" or \"no\"")
|
||||
}
|
||||
function default(k, v) {
|
||||
if (!(k in s))
|
||||
s[k] = v
|
||||
}
|
||||
function need(k) {
|
||||
if (!(k in s))
|
||||
fail("connection has no \"" k "\" parameter specified")
|
||||
if (s[k] == "")
|
||||
fail("parameter \"" k "\" value must be non-empty")
|
||||
}
|
||||
function integer(k) {
|
||||
if (!(k in s))
|
||||
return
|
||||
if (s[k] !~ /^[0-9]+$/)
|
||||
fail("parameter \"" k "\" value must be integer")
|
||||
}
|
||||
function nexthopset(dir, val, k) {
|
||||
k = dir "nexthop"
|
||||
if (k in s)
|
||||
fail("non-default value of " k " is being overridden")
|
||||
if (val != "")
|
||||
s[k] = val
|
||||
else if (k in s)
|
||||
delete s[k]
|
||||
}
|
||||
function leftward( t) {
|
||||
nlspi++
|
||||
if ("spi" in s)
|
||||
return s["spi"]
|
||||
t = spibase spil
|
||||
spil += 2
|
||||
return t
|
||||
}
|
||||
function rightward( t) {
|
||||
nrspi++
|
||||
if ("spi" in s)
|
||||
return s["spi"]
|
||||
t = spibase spir
|
||||
spir += 2
|
||||
return t
|
||||
}
|
||||
function netfix(dir, n, t) {
|
||||
n = s[dir "subnet"]
|
||||
if (n == "%default")
|
||||
n = "0.0.0.0/0"
|
||||
if (n !~ /\//)
|
||||
fail(dir "subnet=" n " has no mask specified")
|
||||
t = split(n, netfixarray, "/")
|
||||
if (t != 2)
|
||||
fail("bad syntax in " dir "subnet=" n)
|
||||
s[dir "net"] = netfixarray[1]
|
||||
s[dir "mask"] = mask(netfixarray[2])
|
||||
}
|
||||
function mask(m) {
|
||||
if (m ~ /\./)
|
||||
return m
|
||||
if (!(m in maskbits))
|
||||
fail("unknown mask syntax \"" m "\"")
|
||||
return maskbits[m]
|
||||
}
|
||||
function bidir(name, l, r) {
|
||||
l = "left" name
|
||||
r = "right" name
|
||||
if (!(l in s) && (name in s))
|
||||
s[l] = s[name]
|
||||
if (!(r in s) && (name in s))
|
||||
s[r] = s[name]
|
||||
if ((l in s) != (r in s))
|
||||
fail("must give both or neither \"" l "\" and \"" \
|
||||
r "\"")
|
||||
}
|
||||
function espspi(src, dest, spi, dir) {
|
||||
if (!("esp" in s))
|
||||
return
|
||||
dir = (dest == me) ? "left" : "right"
|
||||
print "ipsec spi --label", q(names), "--af inet",
|
||||
"--said", ("esp" spi "@" dest), "\\"
|
||||
print "\t--esp", s["esp"], "--src", src, "\\"
|
||||
if ((dir "espauthkey") in s)
|
||||
print "\t--authkey", s[dir "espauthkey"], "\\"
|
||||
if ("espreplay_window" in s)
|
||||
print "\t--replay_window", s["espreplay_window"], "\\"
|
||||
if ((dir "espenckey") in s)
|
||||
print "\t--enckey", s[dir "espenckey"], "&&"
|
||||
else
|
||||
print "\t&&"
|
||||
}
|
||||
function ahspi(src, dest, spi, dir) {
|
||||
if (!("ah" in s))
|
||||
return
|
||||
dir = (dest == me) ? "left" : "right"
|
||||
if (!((dir "ahkey") in s))
|
||||
fail("AH specified but no ahkey= given")
|
||||
print "ipsec spi --label", q(names), "--af inet",
|
||||
"--said", ("ah" spi "@" dest), "\\"
|
||||
print "\t--ah", s["ah"], "--src", src, "\\"
|
||||
if ("ahreplay_window" in s)
|
||||
print "\t--replay_window", s["ahreplay_window"], "\\"
|
||||
print "\t--authkey", s[dir "ahkey"], "&&"
|
||||
}
|
||||
# issue a suitable invocation of updown command
|
||||
function updown(verb, suffix, cmd) {
|
||||
if ("leftupdown" in s) {
|
||||
cmd = s["leftupdown"]
|
||||
if (s["leftfirewall"] == "yes")
|
||||
fail("cannot specify both updown and firewall")
|
||||
} else {
|
||||
cmd = "ipsec _updown"
|
||||
if (s["leftfirewall"] == "yes")
|
||||
cmd = cmd " ipfwadm"
|
||||
}
|
||||
print "PLUTO_VERB=" verb verbsuf " " cmd " " suffix
|
||||
}
|
||||
END {
|
||||
#########
|
||||
if (failed)
|
||||
exit 1
|
||||
default("type", "tunnel")
|
||||
type = s["type"]
|
||||
shunt = 0
|
||||
if (type == "transport") {
|
||||
if ("leftsubnet" in s)
|
||||
fail("type=transport incompatible with leftsubnet")
|
||||
if ("rightsubnet" in s)
|
||||
fail("type=transport incompatible with rightsubnet")
|
||||
} else if (type == "passthrough") {
|
||||
shunt = 1;
|
||||
p = "%pass"
|
||||
} else if (type == "drop" || type == "reject") {
|
||||
shunt = 1;
|
||||
p = "%" type
|
||||
} else if (type != "tunnel")
|
||||
fail("only know how to do types tunnel/transport/passthrough")
|
||||
if (shunt) {
|
||||
if (("ah" in s) || ("esp" in s))
|
||||
fail(type " connection may not specify AH or ESP")
|
||||
} else {
|
||||
if (!("ah" in s) && !("esp" in s))
|
||||
fail("neither AH nor ESP specified for connection")
|
||||
}
|
||||
|
||||
need("left")
|
||||
need("right")
|
||||
if (s["left"] == "%defaultroute") {
|
||||
if (s["right"] == "%defaultroute")
|
||||
fail("left and right cannot both be %defaultroute")
|
||||
if (draddr == "")
|
||||
fail("%defaultroute requested but not known")
|
||||
s["left"] = draddr
|
||||
nexthopset("left", drnexthop)
|
||||
} else if (s["right"] == "%defaultroute") {
|
||||
if (draddr == "")
|
||||
fail("%defaultroute requested but not known")
|
||||
s["right"] = draddr
|
||||
nexthopset("right", drnexthop)
|
||||
}
|
||||
|
||||
leftsub = ("leftsubnet" in s) ? 1 : 0
|
||||
default("leftsubnet", s["left"] "/32")
|
||||
rightsub = ("rightsubnet" in s) ? 1 : 0
|
||||
default("rightsubnet", s["right"] "/32")
|
||||
default("leftfirewall", "no")
|
||||
default("rightfirewall", "no")
|
||||
yesno("leftfirewall")
|
||||
yesno("rightfirewall")
|
||||
integer("espreplay_window")
|
||||
if (("espreplay_window" in s) && s["espreplay_window"] == 0)
|
||||
delete s["espreplay_window"]
|
||||
integer("ahreplay_window")
|
||||
if (("ahreplay_window" in s) && s["ahreplay_window"] == 0)
|
||||
delete s["ahreplay_window"]
|
||||
netfix("left")
|
||||
netfix("right")
|
||||
|
||||
default("leftnexthop", s["right"])
|
||||
default("rightnexthop", s["left"])
|
||||
if (s["leftnexthop"] == s["left"])
|
||||
fail("left and leftnexthop must not be the same")
|
||||
if (s["rightnexthop"] == s["right"])
|
||||
fail("right and rightnexthop must not be the same")
|
||||
|
||||
bidir("espenckey")
|
||||
bidir("espauthkey")
|
||||
bidir("ahkey")
|
||||
if ("spi" in s && "spibase" in s)
|
||||
fail("cannot specify both spi and spibase")
|
||||
if (!shunt) {
|
||||
if ("spibase" in s) {
|
||||
b = s["spibase"]
|
||||
if (b !~ /^0x[0-9a-fA-F]+0$/)
|
||||
fail("bad syntax in spibase -- must be 0x...0")
|
||||
spibase = substr(b, 1, length(b)-1)
|
||||
} else {
|
||||
need("spi")
|
||||
if (s["spi"] !~ /^0x[0-9a-fA-F]+$/)
|
||||
fail("bad syntax in spi -- must be 0x...")
|
||||
}
|
||||
}
|
||||
spir = 0
|
||||
spil = 1
|
||||
|
||||
# who am I?
|
||||
me = ""
|
||||
for (addr in interface) {
|
||||
if (addr == s["left"] || addr == s["right"]) {
|
||||
if (me != "")
|
||||
fail("ambiguous: could be on \"" iface \
|
||||
"\" or \"" interface[addr] "\"")
|
||||
me = addr
|
||||
iface = interface[addr]
|
||||
}
|
||||
}
|
||||
if (me == "")
|
||||
fail("cannot find interface for " s["left"] " or " s["right"])
|
||||
if (other) {
|
||||
if (s["left"] == me)
|
||||
me = s["right"]
|
||||
else if (s["right"] == me)
|
||||
me = s["left"]
|
||||
}
|
||||
havesubnet = leftsubnet
|
||||
if (s["right"] == me) {
|
||||
swap("") # swaps "left" and "right"
|
||||
swap("subnet")
|
||||
swap("nexthop")
|
||||
swap("net")
|
||||
swap("mask")
|
||||
swap("firewall")
|
||||
swap("espspi")
|
||||
swap("ahspi")
|
||||
swap("espenckey")
|
||||
swap("espauthkey")
|
||||
swap("ahkey")
|
||||
swap("updown")
|
||||
t = spil
|
||||
spil = spir
|
||||
spir = t
|
||||
havesubnet = rightsubnet
|
||||
}
|
||||
him = s["right"]
|
||||
|
||||
if (s["leftnexthop"] == "%defaultroute") {
|
||||
if (drnexthop == "")
|
||||
fail("%defaultroute requested but not known")
|
||||
s["leftnexthop"] = drnexthop
|
||||
}
|
||||
|
||||
tspi = rightward()
|
||||
if (type == "tunnel") {
|
||||
espi = rightward()
|
||||
intspi = leftward()
|
||||
} else
|
||||
espi = tspi
|
||||
if (s["rightespspi"] != "")
|
||||
espi = s["rightespspi"]
|
||||
respi = leftward()
|
||||
if (s["leftespspi"] != "")
|
||||
respi = s["leftespspi"]
|
||||
if ("ah" in s) {
|
||||
if ("esp" in s) {
|
||||
aspi = rightward()
|
||||
raspi = leftward()
|
||||
} else {
|
||||
aspi = espi
|
||||
raspi = respi
|
||||
}
|
||||
if (s["rightahspi"] != "")
|
||||
aspi = s["rightahspi"]
|
||||
if (s["leftahspi"] != "")
|
||||
raspi = s["leftahspi"]
|
||||
}
|
||||
routeid = "-net " s["rightnet"] " netmask " s["rightmask"]
|
||||
if (s["rightmask"] == "255.255.255.255")
|
||||
routeid = "-host " s["rightnet"]
|
||||
|
||||
print "PATH=\"'"$PATH"'\""
|
||||
print "export PATH"
|
||||
print "PLUTO_VERSION=1.1"
|
||||
verbsuf = (havesubnet) ? "-client" : "-host"
|
||||
print "PLUTO_CONNECTION=" q(names)
|
||||
print "PLUTO_NEXT_HOP=" s["leftnexthop"]
|
||||
print "PLUTO_INTERFACE=" iface
|
||||
print "PLUTO_ME=" me
|
||||
print "PLUTO_MY_CLIENT=" s["leftsubnet"]
|
||||
print "PLUTO_MY_CLIENT_NET=" s["leftnet"]
|
||||
print "PLUTO_MY_CLIENT_MASK=" s["leftmask"]
|
||||
print "PLUTO_PEER=" him
|
||||
print "PLUTO_PEER_CLIENT=" s["rightsubnet"]
|
||||
print "PLUTO_PEER_CLIENT_NET=" s["rightnet"]
|
||||
print "PLUTO_PEER_CLIENT_MASK=" s["rightmask"]
|
||||
print "export PLUTO_VERSION PLUTO_CONNECTION PLUTO_NEXT_HOP"
|
||||
print "export PLUTO_INTERFACE PLUTO_ME PLUTO_MY_CLIENT"
|
||||
print "export PLUTO_MY_CLIENT_NET PLUTO_MY_CLIENT_MASK PLUTO_PEER"
|
||||
print "export PLUTO_PEER_CLIENT PLUTO_PEER_CLIENT_NET"
|
||||
print "export PLUTO_PEER_CLIENT_MASK"
|
||||
|
||||
if (op == "--up") {
|
||||
print "{"
|
||||
# first, the outbound SAs
|
||||
if (type == "tunnel") {
|
||||
print "ipsec spi --label", q(names), "--af inet",
|
||||
"--said", ("tun" tspi "@" him), "\\"
|
||||
print "\t--ip4", "--src", me, "--dst", him, "&&"
|
||||
}
|
||||
espspi(me, him, espi)
|
||||
ahspi(me, him, aspi)
|
||||
if (nrspi > 1) {
|
||||
# group them
|
||||
printf "ipsec spigrp --label %s --said ", q(names)
|
||||
if (type == "tunnel")
|
||||
printf "tun%s@%s ", tspi, him
|
||||
if (("esp" in s))
|
||||
printf "esp%s@%s ", espi, him
|
||||
if ("ah" in s)
|
||||
printf "ah%s@%s ", aspi, him
|
||||
printf " &&\n"
|
||||
}
|
||||
# inbound SAs
|
||||
if (type == "tunnel") {
|
||||
print "ipsec spi --label", q(names), "--af inet",
|
||||
"--said", ("tun" intspi "@" me), "\\"
|
||||
print "\t--ip4", "--src", him, "--dst", me, "&&"
|
||||
}
|
||||
espspi(him, me, respi)
|
||||
ahspi(him, me, raspi)
|
||||
if (nlspi > 1) {
|
||||
# group them
|
||||
printf "ipsec spigrp --label %s --said ", q(names)
|
||||
if (type == "tunnel")
|
||||
printf "tun%s@%s ", intspi, me
|
||||
if (("esp" in s))
|
||||
printf "esp%s@%s ", respi, me
|
||||
if ("ah" in s)
|
||||
printf "ah%s@%s ", raspi, me
|
||||
printf " &&\n"
|
||||
}
|
||||
# with the SAs in place, eroute to them
|
||||
print "ipsec eroute --label", q(names),
|
||||
"--eraf inet --replace", "\\"
|
||||
if (!shunt) {
|
||||
if (type == "tunnel")
|
||||
p = "tun"
|
||||
else if (("esp" in s))
|
||||
p = "esp"
|
||||
else
|
||||
p = "ah"
|
||||
p = p tspi "@" him
|
||||
}
|
||||
print "\t--src", s["leftsubnet"], "--dst", s["rightsubnet"],
|
||||
"--said", p, "&&"
|
||||
# with the eroute in place, NOW we can route to it
|
||||
#print "{ route del", routeid, "2>/dev/null ; true ; } &&"
|
||||
updown("prepare", "&&")
|
||||
#print "route add", routeid, "dev", iface, "gw",
|
||||
# s["leftnexthop"], "&&"
|
||||
updown("route", "&&")
|
||||
# and with all processing in place, we can penetrate firewall
|
||||
#if (s["leftfirewall"] == "yes") {
|
||||
# print "ipfwadm -F -i accept -b -S", s["leftsubnet"],
|
||||
# "-D", s["rightsubnet"], "&&"
|
||||
#}
|
||||
updown("up", "&&")
|
||||
print "true"
|
||||
print "} || {"
|
||||
} else if (op == "--route") {
|
||||
#print "{ route del", routeid, "2>/dev/null ; true ; } &&"
|
||||
updown("prepare", "&&")
|
||||
#print "route add", routeid, "dev", iface, "gw",
|
||||
# s["leftnexthop"]
|
||||
updown("route")
|
||||
exit 0
|
||||
} else if (op == "--unroute") {
|
||||
#print "route del", routeid, "dev", iface, "gw",
|
||||
# s["leftnexthop"]
|
||||
updown("unroute")
|
||||
exit 0
|
||||
} else # down
|
||||
print "{"
|
||||
|
||||
# now do "down", unconditionally, since the desired output for "up"
|
||||
# is { up && up && up && true } || { down ; down ; down }
|
||||
# tear things down in fairly strict reverse order
|
||||
#if (s["leftfirewall"] == "yes")
|
||||
# print "ipfwadm -F -d accept -b -S", s["leftsubnet"],
|
||||
# "-D", s["rightsubnet"]
|
||||
updown("down")
|
||||
#print "route del", routeid, "dev", iface, "gw", s["leftnexthop"]
|
||||
print "# do not delete route"
|
||||
print "ipsec eroute --label", q(names), "--eraf inet --del", "\\"
|
||||
print "\t--src", s["leftsubnet"], "--dst", s["rightsubnet"]
|
||||
#if ("ah" in s) {
|
||||
# print "ipsec spi --label", q(names), "--af inet", "--del",
|
||||
# "--said", ("ah" raspi "@" me)
|
||||
#}
|
||||
#if ("esp" in s) {
|
||||
# print "ipsec spi --label", q(names), "--af inet", "--del",
|
||||
# "--said", ("esp" respi "@" me)
|
||||
#}
|
||||
if (!shunt) {
|
||||
if (type == "tunnel")
|
||||
p = "tun"
|
||||
else if (("esp" in s))
|
||||
p = "esp"
|
||||
else
|
||||
p = "ah"
|
||||
print "ipsec spi --label", q(names), "--af inet", "--del",
|
||||
"--said", (p tspi "@" him),
|
||||
" # outbound"
|
||||
print "ipsec spi --label", q(names), "--af inet", "--del",
|
||||
"--said", (p intspi "@" me),
|
||||
" # inbound"
|
||||
}
|
||||
|
||||
if (op == "--up")
|
||||
print "} 2>/dev/null"
|
||||
else
|
||||
print "}"
|
||||
#########
|
||||
}' |
|
||||
if test $showonly
|
||||
then
|
||||
cat
|
||||
else
|
||||
sh $shopts
|
||||
fi
|
||||
Reference in new issue
Block a user