output_ipsec_conf 4.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172
  1. #!/bin/sh
  2. ################################################################################
  3. ## ##
  4. ## Copyright (c) International Business Machines Corp., 2005 ##
  5. ## ##
  6. ## This program is free software; you can redistribute it and#or modify ##
  7. ## it under the terms of the GNU General Public License as published by ##
  8. ## the Free Software Foundation; either version 2 of the License, or ##
  9. ## (at your option) any later version. ##
  10. ## ##
  11. ## This program is distributed in the hope that it will be useful, but ##
  12. ## WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY ##
  13. ## or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ##
  14. ## for more details. ##
  15. ## ##
  16. ## You should have received a copy of the GNU General Public License ##
  17. ## along with this program; if not, write to the Free Software ##
  18. ## Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA ##
  19. ## ##
  20. ## ##
  21. ################################################################################
  22. #
  23. # File:
  24. # output_ipsec_conf
  25. #
  26. # Description:
  27. # Output IPsec configuration
  28. #
  29. # Author:
  30. # Mitsuru Chinen <mitch@jp.ibm.com>
  31. #
  32. # Exit Value:
  33. # 0: Exit normally
  34. # >0: Exit abnormally
  35. #
  36. # History:
  37. # Oct 19 2005 - Created (Mitsuru Chinen)
  38. #
  39. #-----------------------------------------------------------------------
  40. #Uncomment line below for debug output.
  41. $trace_logic
  42. # Encryption algorithm
  43. EALGO="3des-cbc"
  44. EALGO_KEY="_I_want_to_have_chicken_"
  45. # Authentication algorithm
  46. AALGO="hmac-sha1"
  47. AALGO_KEY="beef_fish_pork_salad"
  48. # Compression algorithm
  49. CALGO="deflate"
  50. #-----------------------------------------------------------------------
  51. #
  52. # Function: usage
  53. #
  54. # Description:
  55. # Print the usage of this script, then exit
  56. #
  57. #-----------------------------------------------------------------------
  58. usage(){
  59. cat << EOD >&2
  60. output_ipsec_conf flush
  61. Flush the SAD and SPD entries.
  62. output_ipsec_conf target protocol mode first_spi src_addr dst_addr
  63. target: target of the configuration file ( src / dst )
  64. protocol: ah / esp / ipcomp
  65. mode: transport / tunnel
  66. first_spi: the first spi value
  67. src_addr: source IP address
  68. dst_addr: destination IP address
  69. EOD
  70. exit 1
  71. }
  72. #-----------------------------------------------------------------------
  73. #
  74. # Main
  75. #
  76. #
  77. # When argument is `flush', flush the SAD and SPD
  78. if [ x$1 = x"flush" ]; then
  79. echo "spdflush ;"
  80. echo "flush ;"
  81. exit 0
  82. fi
  83. # source/destination IP addresses
  84. if [ $# -ne 6 ]; then
  85. usage
  86. fi
  87. target=$1
  88. protocol=$2
  89. mode=$3
  90. first_spi=$4
  91. src_ipaddr=$5
  92. dst_ipaddr=$6
  93. # Algorithm options for each protocol
  94. case $protocol in
  95. ah)
  96. algo_line="-A $AALGO \"$AALGO_KEY\""
  97. ;;
  98. esp)
  99. algo_line="-E $EALGO \"$EALGO_KEY\" -A $AALGO \"$AALGO_KEY\""
  100. ;;
  101. ipcomp)
  102. algo_line="-C $CALGO"
  103. ;;
  104. *)
  105. usage
  106. ;;
  107. esac
  108. # Write lines for adding an SAD entry
  109. cat << EOD
  110. add $src_ipaddr $dst_ipaddr $protocol $first_spi
  111. -m $mode
  112. $algo_line ;
  113. add $dst_ipaddr $src_ipaddr $protocol `expr $first_spi + 1`
  114. -m $mode
  115. $algo_line ;
  116. EOD
  117. # Write lines for adding an SPD entry
  118. case $target in
  119. src)
  120. direct1=out
  121. direct2=in
  122. ;;
  123. dst)
  124. direct1=in
  125. direct2=out
  126. ;;
  127. *)
  128. usage
  129. ;;
  130. esac
  131. case $mode in
  132. transport)
  133. cat << EOD
  134. spdadd $src_ipaddr $dst_ipaddr any
  135. -P $direct1 ipsec $protocol/transport//use ;
  136. spdadd $dst_ipaddr $src_ipaddr any
  137. -P $direct2 ipsec $protocol/transport//use ;
  138. EOD
  139. ;;
  140. tunnel)
  141. cat << EOD
  142. spdadd $src_ipaddr $dst_ipaddr any
  143. -P $direct1 ipsec $protocol/tunnel/${src_ipaddr}-${dst_ipaddr}/use ;
  144. spdadd $dst_ipaddr $src_ipaddr any
  145. -P $direct2 ipsec $protocol/tunnel/${dst_ipaddr}-${src_ipaddr}/use ;
  146. EOD
  147. ;;
  148. esac
  149. exit 0