123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172 |
- #!/bin/sh
- ################################################################################
- ## ##
- ## Copyright (c) International Business Machines Corp., 2005 ##
- ## ##
- ## This program is free software; you can redistribute it and#or modify ##
- ## it under the terms of the GNU General Public License as published by ##
- ## the Free Software Foundation; either version 2 of the License, or ##
- ## (at your option) any later version. ##
- ## ##
- ## This program is distributed in the hope that it will be useful, but ##
- ## WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY ##
- ## or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ##
- ## for more details. ##
- ## ##
- ## You should have received a copy of the GNU General Public License ##
- ## along with this program; if not, write to the Free Software ##
- ## Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA ##
- ## ##
- ## ##
- ################################################################################
- #
- # File:
- # output_ipsec_conf
- #
- # Description:
- # Output IPsec configuration
- #
- # Author:
- # Mitsuru Chinen <mitch@jp.ibm.com>
- #
- # Exit Value:
- # 0: Exit normally
- # >0: Exit abnormally
- #
- # History:
- # Oct 19 2005 - Created (Mitsuru Chinen)
- #
- #-----------------------------------------------------------------------
- #Uncomment line below for debug output.
- $trace_logic
- # Encryption algorithm
- EALGO="3des-cbc"
- EALGO_KEY="_I_want_to_have_chicken_"
- # Authentication algorithm
- AALGO="hmac-sha1"
- AALGO_KEY="beef_fish_pork_salad"
- # Compression algorithm
- CALGO="deflate"
- #-----------------------------------------------------------------------
- #
- # Function: usage
- #
- # Description:
- # Print the usage of this script, then exit
- #
- #-----------------------------------------------------------------------
- usage(){
- cat << EOD >&2
- output_ipsec_conf flush
- Flush the SAD and SPD entries.
- output_ipsec_conf target protocol mode first_spi src_addr dst_addr
- target: target of the configuration file ( src / dst )
- protocol: ah / esp / ipcomp
- mode: transport / tunnel
- first_spi: the first spi value
- src_addr: source IP address
- dst_addr: destination IP address
- EOD
- exit 1
- }
- #-----------------------------------------------------------------------
- #
- # Main
- #
- #
- # When argument is `flush', flush the SAD and SPD
- if [ x$1 = x"flush" ]; then
- echo "spdflush ;"
- echo "flush ;"
- exit 0
- fi
- # source/destination IP addresses
- if [ $# -ne 6 ]; then
- usage
- fi
- target=$1
- protocol=$2
- mode=$3
- first_spi=$4
- src_ipaddr=$5
- dst_ipaddr=$6
- # Algorithm options for each protocol
- case $protocol in
- ah)
- algo_line="-A $AALGO \"$AALGO_KEY\""
- ;;
- esp)
- algo_line="-E $EALGO \"$EALGO_KEY\" -A $AALGO \"$AALGO_KEY\""
- ;;
- ipcomp)
- algo_line="-C $CALGO"
- ;;
- *)
- usage
- ;;
- esac
- # Write lines for adding an SAD entry
- cat << EOD
- add $src_ipaddr $dst_ipaddr $protocol $first_spi
- -m $mode
- $algo_line ;
- add $dst_ipaddr $src_ipaddr $protocol `expr $first_spi + 1`
- -m $mode
- $algo_line ;
- EOD
- # Write lines for adding an SPD entry
- case $target in
- src)
- direct1=out
- direct2=in
- ;;
- dst)
- direct1=in
- direct2=out
- ;;
- *)
- usage
- ;;
- esac
- case $mode in
- transport)
- cat << EOD
- spdadd $src_ipaddr $dst_ipaddr any
- -P $direct1 ipsec $protocol/transport//use ;
- spdadd $dst_ipaddr $src_ipaddr any
- -P $direct2 ipsec $protocol/transport//use ;
- EOD
- ;;
- tunnel)
- cat << EOD
- spdadd $src_ipaddr $dst_ipaddr any
- -P $direct1 ipsec $protocol/tunnel/${src_ipaddr}-${dst_ipaddr}/use ;
- spdadd $dst_ipaddr $src_ipaddr any
- -P $direct2 ipsec $protocol/tunnel/${dst_ipaddr}-${src_ipaddr}/use ;
- EOD
- ;;
- esac
- exit 0
|