You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 

348 lines
9.2 KiB

#!/bin/sh /etc/rc.common
START=90
STOP=10
. $IPKG_INSTROOT/lib/functions.sh
UCI_IPSEC_CONFIG=/etc/config/ipsec
IPSEC_SECRETS_FILE=/etc/ipsec.secrets
IPSEC_CONN_FILE=/etc/ipsec.conf
STRONGSWAN_CONF_FILE=/etc/strongswan.conf
IPSEC_VAR_SECRETS_FILE=/var/ipsec/ipsec.secrets
IPSEC_VAR_CONN_FILE=/var/ipsec/ipsec.conf
STRONGSWAN_VAR_CONF_FILE=/var/ipsec/strongswan.conf
ENABLED_REMOTE_PEERS=0
file_reset() {
: > "$1"
}
xappend() {
local file="$1"
shift
echo "${@}" >> "${file}"
}
remove_include() {
local file="$1"
local include="$2"
sed -i "\_${include}_d" "${file}"
}
remove_includes() {
remove_include "${IPSEC_CONN_FILE}" "${IPSEC_VAR_CONN_FILE}"
remove_include "${IPSEC_SECRETS_FILE}" "${IPSEC_VAR_SECRETS_FILE}"
remove_include "${STRONGSWAN_CONF_FILE}" "${STRONGSWAN_VAR_CONF_FILE}"
}
do_include() {
local conf="$1"
local uciconf="$2"
local backup=`mktemp -t -p /tmp/ ipsec-init-XXXXXX`
[ ! -f "${conf}" ] && rm -rf "${conf}"
touch "${conf}"
cat "${conf}" | grep -v "${uciconf}" > "${backup}"
mv "${backup}" "${conf}"
xappend "${conf}" "include ${uciconf}"
file_reset "${uciconf}"
}
ipsec_reset() {
do_include "${IPSEC_CONN_FILE}" "${IPSEC_VAR_CONN_FILE}"
}
ipsec_xappend() {
xappend "${IPSEC_VAR_CONN_FILE}" "$@"
}
swan_reset() {
do_include "${STRONGSWAN_CONF_FILE}" "${STRONGSWAN_VAR_CONF_FILE}"
}
swan_xappend() {
xappend "${STRONGSWAN_VAR_CONF_FILE}" "$@"
}
secret_reset() {
do_include "${IPSEC_SECRETS_FILE}" "${IPSEC_VAR_SECRETS_FILE}"
}
secret_xappend() {
xappend "${IPSEC_VAR_SECRETS_FILE}" "$@"
}
warning() {
echo "WARNING: $@" >&2
}
add_crypto_proposal() {
local encryption_algorithm
local hash_algorithm
local dh_group
config_get encryption_algorithm "$1" encryption_algorithm
config_get hash_algorithm "$1" hash_algorithm
config_get dh_group "$1" dh_group
[ -n "${encryption_algorithm}" ] && \
crypto="${crypto:+${crypto},}${encryption_algorithm}${hash_algorithm:+-${hash_algorithm}}${dh_group:+-${dh_group}}"
}
set_crypto_proposal() {
local conf="$1"
local proposal
crypto=""
config_get crypto_proposal "$conf" crypto_proposal ""
for proposal in $crypto_proposal; do
add_crypto_proposal "$proposal"
done
[ -n "${crypto}" ] && {
local force_crypto_proposal
config_get_bool force_crypto_proposal "$conf" force_crypto_proposal
[ "${force_crypto_proposal}" = "1" ] && crypto="${crypto}!"
}
crypto_proposal="${crypto}"
}
config_conn() {
# Generic ipsec conn section shared by tunnel and transport
local mode
local local_subnet
local local_nat
local local_sourceip
local local_updown
local local_firewall
local remote_subnet
local remote_sourceip
local remote_updown
local remote_firewall
local ikelifetime
local lifetime
local margintime
local keyingtries
local dpdaction
local dpddelay
local inactivity
local keyexchange
config_get mode "$1" mode "route"
config_get local_subnet "$1" local_subnet ""
config_get local_nat "$1" local_nat ""
config_get local_sourceip "$1" local_sourceip ""
config_get local_updown "$1" local_updown ""
config_get local_firewall "$1" local_firewall ""
config_get remote_subnet "$1" remote_subnet ""
config_get remote_sourceip "$1" remote_sourceip ""
config_get remote_updown "$1" remote_updown ""
config_get remote_firewall "$1" remote_firewall ""
config_get ikelifetime "$1" ikelifetime "3h"
config_get lifetime "$1" lifetime "1h"
config_get margintime "$1" margintime "9m"
config_get keyingtries "$1" keyingtries "3"
config_get dpdaction "$1" dpdaction "none"
config_get dpddelay "$1" dpddelay "30s"
config_get inactivity "$1" inactivity
config_get keyexchange "$1" keyexchange "ikev2"
[ -n "$local_nat" ] && local_subnet=$local_nat
ipsec_xappend "conn $config_name-$1"
ipsec_xappend " left=%any"
ipsec_xappend " right=$remote_gateway"
[ -n "$local_sourceip" ] && ipsec_xappend " leftsourceip=$local_sourceip"
[ -n "$local_subnet" ] && ipsec_xappend " leftsubnet=$local_subnet"
[ -n "$local_firewall" ] && ipsec_xappend " leftfirewall=$local_firewall"
[ -n "$remote_firewall" ] && ipsec_xappend " rightfirewall=$remote_firewall"
ipsec_xappend " ikelifetime=$ikelifetime"
ipsec_xappend " lifetime=$lifetime"
ipsec_xappend " margintime=$margintime"
ipsec_xappend " keyingtries=$keyingtries"
ipsec_xappend " dpdaction=$dpdaction"
ipsec_xappend " dpddelay=$dpddelay"
[ -n "$inactivity" ] && ipsec_xappend " inactivity=$inactivity"
if [ "$auth_method" = "psk" ]; then
ipsec_xappend " leftauth=psk"
ipsec_xappend " rightauth=psk"
[ "$remote_sourceip" != "" ] && ipsec_xappend " rightsourceip=$remote_sourceip"
[ "$remote_subnet" != "" ] && ipsec_xappend " rightsubnet=$remote_subnet"
ipsec_xappend " auto=$mode"
else
warning "AuthenticationMethod $auth_method not supported"
fi
[ -n "$local_identifier" ] && ipsec_xappend " leftid=$local_identifier"
[ -n "$remote_identifier" ] && ipsec_xappend " rightid=$remote_identifier"
[ -n "$local_updown" ] && ipsec_xappend " leftupdown=$local_updown"
[ -n "$remote_updown" ] && ipsec_xappend " rightupdown=$remote_updown"
ipsec_xappend " keyexchange=$keyexchange"
set_crypto_proposal "$1"
[ -n "${crypto_proposal}" ] && ipsec_xappend " esp=$crypto_proposal"
[ -n "${ike_proposal}" ] && ipsec_xappend " ike=$ike_proposal"
}
config_tunnel() {
config_conn "$1"
# Specific for the tunnel part
ipsec_xappend " type=tunnel"
}
config_transport() {
config_conn "$1"
# Specific for the transport part
ipsec_xappend " type=transport"
}
config_remote() {
local enabled
local gateway
local pre_shared_key
local auth_method
config_name=$1
config_get_bool enabled "$1" enabled 0
[ "$enabled" = "0" ] && return
ENABLED_REMOTE_PEERS=$((ENABLED_REMOTE_PEERS + 1))
config_get gateway "$1" gateway
config_get pre_shared_key "$1" pre_shared_key
config_get auth_method "$1" authentication_method
config_get local_identifier "$1" local_identifier ""
config_get remote_identifier "$1" remote_identifier ""
[ "$gateway" = "any" ] && remote_gateway="%any" || remote_gateway="$gateway"
[ -z "$local_identifier" ] && {
local ipdest
[ "$remote_gateway" = "%any" ] && ipdest="1.1.1.1" || ipdest="$remote_gateway"
local_gateway=`ip route get $ipdest | awk -F"src" '/src/{gsub(/ /,"");print $2}'`
}
[ -n "$local_identifier" ] && secret_xappend -n "$local_identifier " || secret_xappend -n "$local_gateway "
[ -n "$remote_identifier" ] && secret_xappend -n "$remote_identifier " || secret_xappend -n "$remote_gateway "
secret_xappend ": PSK \"$pre_shared_key\""
set_crypto_proposal "$1"
ike_proposal="$crypto_proposal"
config_list_foreach "$1" tunnel config_tunnel
config_list_foreach "$1" transport config_transport
ipsec_xappend ""
}
config_ipsec() {
local debug
local rtinstall_enabled
local routing_tables_ignored
local routing_table
local routing_table_id
local interface
local device_list
ipsec_reset
secret_reset
swan_reset
ipsec_xappend "# generated by /etc/init.d/ipsec"
ipsec_xappend "version 2"
ipsec_xappend ""
secret_xappend "# generated by /etc/init.d/ipsec"
config_get debug "$1" debug 0
config_get_bool rtinstall_enabled "$1" rtinstall_enabled 1
[ $rtinstall_enabled = "1" ] && install_routes=yes || install_routes=no
# prepare extra charon config option ignore_routing_tables
for routing_table in $(config_get "$1" "ignore_routing_tables"); do
if [ "$routing_table" -ge 0 ] 2>/dev/null; then
routing_table_id=$routing_table
else
routing_table_id=$(sed -n '/[ \t]*[0-9]\+[ \t]\+'$routing_table'[ \t]*$/s/[ \t]*\([0-9]\+\).*/\1/p' /etc/iproute2/rt_tables)
fi
[ -n "$routing_table_id" ] && append routing_tables_ignored "$routing_table_id"
done
swan_xappend "# generated by /etc/init.d/ipsec"
swan_xappend "charon {"
swan_xappend " load_modular = yes"
swan_xappend " install_routes = $install_routes"
[ -n "$routing_tables_ignored" ] && swan_xappend " ignore_routing_tables = $routing_tables_ignored"
swan_xappend " plugins {"
swan_xappend " include /etc/strongswan.d/charon/*.conf"
swan_xappend " }"
swan_xappend " syslog {"
swan_xappend " identifier = ipsec"
swan_xappend " daemon {"
swan_xappend " default = $debug"
swan_xappend " }"
swan_xappend " auth {"
swan_xappend " default = $debug"
swan_xappend " }"
swan_xappend " }"
swan_xappend "}"
}
prepare_env() {
mkdir -p /var/ipsec
remove_includes
config_load ipsec
config_foreach config_ipsec ipsec
config_foreach config_remote remote
}
start() {
prepare_env
[ $ENABLED_REMOTE_PEERS != 0 -o ! -f $UCI_IPSEC_CONFIG ] && ipsec start
}
stop() {
ipsec stop
}
restart() {
prepare_env
[ $ENABLED_REMOTE_PEERS != 0 -o ! -f $UCI_IPSEC_CONFIG ] && ipsec restart || ipsec stop
}
reload() {
prepare_env
[ $ENABLED_REMOTE_PEERS != 0 -o ! -f $UCI_IPSEC_CONFIG ] && {
ipsec secrets
if [[ ! -z "$(ipsec status)" ]]; then
ipsec reload
else
ipsec start
fi
} || ipsec stop
}