File: _startklips.in

package info (click to toggle)
strongswan 2.8.0+dfsg-1+etch2
  • links: PTS
  • area: main
  • in suites: etch
  • size: 15,344 kB
  • ctags: 15,752
  • sloc: ansic: 104,081; sh: 6,913; asm: 4,026; perl: 3,711; makefile: 3,215; pascal: 250; yacc: 221; lex: 190; xml: 147; awk: 124; sed: 98; lisp: 3
file content (367 lines) | stat: -rwxr-xr-x 8,515 bytes parent folder | download | duplicates (2)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
#!/bin/sh
# KLIPS startup script
# Copyright (C) 1998, 1999, 2001, 2002  Henry Spencer.
# 
# This program is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2 of the License, or (at your
# option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
# 
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
# or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
# for more details.
#
# RCSID $Id: _startklips.in,v 1.6 2005/05/06 22:11:33 as Exp $

me='ipsec _startklips'		# for messages

# KLIPS-related paths
sysflags=/proc/sys/net/ipsec
modules=/proc/modules
# full rp_filter path is $rpfilter1/interface/$rpfilter2
rpfilter1=/proc/sys/net/ipv4/conf
rpfilter2=rp_filter
# %unchanged or setting (0, 1, or 2)
rpfiltercontrol=0
ipsecversion=/proc/net/ipsec_version
moduleplace=/lib/modules/`uname -r`/kernel/net/ipsec
bareversion=`uname -r | sed -e 's/^\(2\.[0-9]\.[1-9][0-9]*-[1-9][0-9]*\(\.[0-9][0-9]*\)*\(\.x\)*\).*$/\1/'`
moduleinstplace=/lib/modules/$bareversion/kernel/net/ipsec
modulename=ipsec.o
klips=true
netkey=/proc/net/pfkey

info=/dev/null
log=daemon.error
for dummy
do
	case "$1" in
	--log)		log="$2" ; shift	;;
	--info)		info="$2" ; shift	;;
	--debug)	debug="$2" ; shift	;;
	--omtu)		omtu="$2" ; shift	;;
	--fragicmp)	fragicmp="$2" ; shift	;;
	--hidetos)	hidetos="$2" ; shift	;;
	--rpfilter)	rpfiltercontrol="$2" ; shift	;;
	--)	shift ; break	;;
	-*)	echo "$me: unknown option \`$1'" >&2 ; exit 2	;;
	*)	break	;;
	esac
	shift
done



# some shell functions, to clarify the actual code

# set up a system flag based on a variable
# sysflag value shortname default flagname
sysflag() {
	case "$1" in
	'')	v="$3"	;;
	*)	v="$1"	;;
	esac
	if test ! -f $sysflags/$4
	then
		if test " $v" != " $3"
		then
			echo "cannot do $2=$v, $sysflags/$4 does not exist"
			exit 1
		else
			return	# can't set, but it's the default anyway
		fi
	fi
	case "$v" in
	yes|no)	;;
	*)	echo "unknown (not yes/no) $2 value \`$1'"
		exit 1
		;;
	esac
	case "$v" in
	yes)	echo 1 >$sysflags/$4	;;
	no)	echo 0 >$sysflags/$4	;;
	esac
}

# set up a Klips interface
klipsinterface() {
	# pull apart the interface spec
	virt=`expr $1 : '\([^=]*\)=.*'`
	phys=`expr $1 : '[^=]*=\(.*\)'`
	case "$virt" in
	ipsec[0-9])	;;
	*)	echo "invalid interface \`$virt' in \`$1'" ; exit 1	;;
	esac

	# figure out ifconfig for interface
	addr=
	eval `ifconfig $phys |
		awk '$1 == "inet" && $2 ~ /^addr:/ && $NF ~ /^Mask:/ {
			gsub(/:/, " ", $0)
			print "addr=" $3
			other = $5
			if ($4 == "Bcast")
				print "type=broadcast"
			else if ($4 == "P-t-P")
				print "type=pointopoint"
			else if (NF == 5) {
				print "type="
				other = ""
			} else
				print "type=unknown"
			print "otheraddr=" other
			print "mask=" $NF
		}'`
	if test " $addr" = " "
	then
		echo "unable to determine address of \`$phys'"
		exit 1
	fi
	if test " $type" = " unknown"
	then
		echo "\`$phys' is of an unknown type"
		exit 1
	fi
	if test " $omtu" != " "
	then
		mtu="mtu $omtu"
	else
		mtu=
	fi
	echo "KLIPS $virt on $phys $addr/$mask $type $otheraddr $mtu" | logonly

	if $klips
	then
		# attach the interface and bring it up
		ipsec tncfg --attach --virtual $virt --physical $phys
		ifconfig $virt inet $addr $type $otheraddr netmask $mask $mtu
	fi

	# if %defaultroute, note the facts
	if test " $2" != " "
	then
		(
			echo "defaultroutephys=$phys"
			echo "defaultroutevirt=$virt"
			echo "defaultrouteaddr=$addr"
			if test " $2" != " 0.0.0.0"
			then
				echo "defaultroutenexthop=$2"
			fi
		) >>$info
	else
		echo '#dr: no default route' >>$info
	fi

	# check for rp_filter trouble
	checkif $phys			# thought to be a problem only on phys
}

# check an interface for problems
checkif() {
	$klips || return 0
	rpf=$rpfilter1/$1/$rpfilter2
	if test -f $rpf
	then
		r="`cat $rpf`"
		if test " $r" != " 0"
		then
			case "$r-$rpfiltercontrol" in
			0-%unchanged|0-0|1-1|2-2)
				# happy state
				;;
			*-%unchanged)
				echo "WARNING: $1 has route filtering turned on; KLIPS may not work ($rpf is $r)"
				;;
			[012]-[012])
				echo "WARNING: changing route filtering on $1 (changing $rpf from $r to $rpfiltercontrol)"
				echo "$rpfiltercontrol" >$rpf
				;;
			[012]-*)
				echo "ERROR: unknown rpfilter setting: $rpfiltercontrol"
				;;
			*)
				echo "ERROR: unknown $rpf value $r"
				;;
			esac
		fi
	fi
}

# interfaces=%defaultroute:  put ipsec0 on top of default route's interface
defaultinterface() {
	phys=`netstat -nr |
		awk '$1 == "0.0.0.0" && $3 == "0.0.0.0" { print $NF }'`
	if test " $phys" = " "
	then
		echo "no default route, %defaultroute cannot cope!!!"
		exit 1
	fi
	if test `echo " $phys" | wc -l` -gt 1
	then
		echo "multiple default routes, %defaultroute cannot cope!!!"
		exit 1
	fi
	next=`netstat -nr |
		awk '$1 == "0.0.0.0" && $3 == "0.0.0.0" { print $2 }'`
	klipsinterface "ipsec0=$phys" $next
}

# log only to syslog, not to stdout/stderr
logonly() {
	logger -p $log -t ipsec_setup
}

# sort out which module is appropriate, changing it if necessary
setmodule() {
        wantgoo="`ipsec calcgoo /proc/ksyms`"
        module=$moduleplace/$modulename
        if test -f $module
        then
                goo="`nm -ao $module | ipsec calcgoo`"
                if test " $wantgoo" = " $goo"
                then
                        return          # looks right
                fi
        fi
        if test -f $moduleinstplace/$wantgoo
        then
                echo "insmod failed, but found matching template module $wantgoo."
                echo "Copying $moduleinstplace/$wantgoo to $module."
                rm -f $module
                mkdir -p $moduleplace
                cp -p $moduleinstplace/$wantgoo $module
                # "depmod -a" gets done by caller
        fi
}



# main line

# load module if possible
if test ! -f $ipsecversion && test ! -f $netkey
then
    # statically compiled KLIPS not found; try to load the module
    insmod ipsec
fi

if test ! -f $ipsecversion && test ! -f $netkey
then
	modprobe -v af_key
fi

if test -f $netkey
then
	klips=false
	if test -f $modules
	then
		modprobe -qv ah4
		modprobe -qv esp4
		modprobe -qv ipcomp
		modprobe -qv xfrm4_tunnel
		modprobe -qv xfrm_user
	fi
fi

if test ! -f $ipsecversion && $klips
then
        if test -r $modules             # kernel does have modules
        then
                setmodule
                unset MODPATH MODULECONF        # no user overrides!
                depmod -a >/dev/null 2>&1
                modprobe -v ipsec
        fi
        if test ! -f $ipsecversion
        then
                echo "kernel appears to lack KLIPS"
                exit 1
        fi
fi

# load all compiled algo modules
if $klips
then
	for alg in aes serpent twofish blowfish sha2
	do
		if test -f $moduleinstplace/alg/ipsec_$alg.o
		then
			modprobe ipsec_$alg
		fi
	done
fi

# figure out debugging flags
case "$debug" in
'')	debug=none	;;
esac
if test -r /proc/net/ipsec_klipsdebug
then
	echo "KLIPS debug \`$debug'" | logonly
	case "$debug" in
	none)	ipsec klipsdebug --none	;;
	all)	ipsec klipsdebug --all	;;
	*)	ipsec klipsdebug --none
		for d in $debug
		do
			ipsec klipsdebug --set $d
		done
		;;
	esac
elif $klips
then
	if test " $debug" != " none"
	then
		echo "klipsdebug=\`$debug' ignored, KLIPS lacks debug facilities"
	fi
fi

# figure out misc. kernel config
if test -d $sysflags
then
	sysflag "$fragicmp" "fragicmp" yes icmp
	echo 1 >$sysflags/inbound_policy_check		# no debate
	sysflag no "no_eroute_pass" no no_eroute_pass	# obsolete parm
	sysflag no "opportunistic" no opportunistic	# obsolete parm
	sysflag "$hidetos" "hidetos" yes tos
elif $klips
then
	echo "WARNING: cannot adjust KLIPS flags, no $sysflags directory!"
	# carry on
fi

if $klips; then
	# clear tables out in case dregs have been left over
	ipsec eroute --clear
	ipsec spi --clear
elif test $netkey
then
	if ip xfrm state > /dev/null 2>&1
	then
		ip xfrm state flush
		ip xfrm policy flush
	elif type setkey > /dev/null 2>&1
	then
          	setkey -F
          	setkey -FP
	else
        	echo "WARNING: cannot flush state/policy database -- \`$1'" |
                	logger -s -p $log -t ipsec_setup
  	fi
fi

# figure out interfaces
for i
do
	case "$i" in
	ipsec*=?*)	klipsinterface "$i"	;;
	%defaultroute)	defaultinterface	;;
	*)	echo "interface \`$i' not understood"
		exit 1
		;;
	esac
done

exit 0