freeswan/utils/_realsetup

   1 #!/bin/sh
   2 # IPsec startup and shutdown command
   3 # Copyright (C) 1998, 1999, 2001  Henry Spencer.
   4 #
   5 # This program is free software; you can redistribute it and/or modify it
   6 # under the terms of the GNU General Public License as published by the
   7 # Free Software Foundation; either version 2 of the License, or (at your
   8 # option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9 #
  10 # This program is distributed in the hope that it will be useful, but
  11 # WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12 # or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13 # for more details.
  14 #
  15 # RCSID $Id: _realsetup,v 1.7.2.2 2002/04/11 01:19:05 mcr Exp $
  16
  17 me='ipsec setup'                # for messages
  18
  19 # Misc. paths (some of this should perhaps be overrideable from ipsec.conf).
  20 plutopid=/var/run/pluto.pid
  21 subsyslock=/var/lock/subsys/ipsec
  22 lock=/var/run/ipsec_setup.pid
  23 info=/var/run/ipsec.info
  24 sysflags=/proc/sys/net/ipsec
  25 modules=/proc/modules
  26 ipforward=/proc/sys/net/ipv4/ip_forward
  27 ipsecversion=/proc/net/ipsec_version
  28
  29 # make sure output of (e.g.) ifconfig is in English
  30 unset LANG LANGUAGE LC_ALL LC_MESSAGES
  31
  32 # check we were called properly
  33 if test " $IPSEC_confreadsection" != " setup"
  34 then
  35         echo "$me: must be called by ipsec_setup" >&2
  36         exit 1
  37 fi
  38
  39
  40
  41 # function to set up manually-keyed connections
  42 manualconns() {
  43         if test " $IPSECmanualstart" != " "
  44         then
  45                 for tu in $IPSECmanualstart
  46                 do
  47                         ipsec manual --up $tu
  48                 done
  49         fi
  50 }
  51
  52 # function for no-stdout logging
  53 logonly() {
  54         logger -p $IPSECsyslog -t ipsec_setup
  55 }
  56
  57 killklips() {
  58         for i in `ifconfig | awk '/^ipsec/ { print $1 }'`
  59         do
  60                 ifconfig $i down
  61                 ipsec tncfg --detach --virtual $i
  62         done
  63
  64         if test -r /proc/net/ipsec_klipsdebug
  65         then
  66                 ipsec klipsdebug --none
  67         fi
  68         ipsec eroute --clear
  69         ipsec spi --clear
  70         i=`lsmod 2>&1 | awk '$1 == "ipsec" { print $1 }'`
  71         if test " $i" = " ipsec"
  72         then
  73                 rmmod ipsec
  74         fi
  75 }
  76
  77
  78 # misc. backward compatibility
  79 if test " $IPSECdump" = " yes" -a " $IPSECdumpdir" = " "
  80 then
  81         IPSECdumpdir=/var/tmp
  82 fi
  83 if test " $IPSECpacketdefault" = " "
  84 then
  85         case "$IPSECno_eroute_pass" in
  86         ''|no)  IPSECpacketdefault=drop ;;
  87         yes)    IPSECpacketdefault=pass ;;
  88         *)      echo "unknown (not yes/no) no_eroute_pass value \`$IPSECno_eroute_pass'"
  89                 IPSECpacketdefault=drop
  90                 ;;
  91         esac
  92 fi
  93
  94
  95
  96 # do it
  97 case "$1" in
  98   start|--start|_autostart)
  99         # First, does it seem to be going already?
 100         if test -f $lock
 101         then
 102                 echo "FreeS/WAN IPsec apparently already running, start aborted"
 103                 exit 1
 104         fi
 105
 106         # announcement
 107         # (Warning, changes to this log message may affect barf.)
 108         version="`ipsec --version | awk 'NR == 1 { print $NF }'`"
 109         case "$1" in
 110         start|--start)  echo "Starting FreeS/WAN IPsec $version..."     ;;
 111         _autostart)     echo "Restarting FreeS/WAN IPsec $version..."   ;;
 112         esac
 113
 114         # preliminaries
 115         rm -f $lock
 116         if test ! -r /dev/random
 117         then
 118                 echo "...unable to start FreeS/WAN IPsec, no /dev/random!"
 119                 exit 1
 120         fi
 121         if test ! -r /dev/urandom
 122         then
 123                 echo "...unable to start FreeS/WAN IPsec, no /dev/urandom!"
 124                 exit 1
 125         fi
 126         echo $$ >$lock
 127         if test ! -s $lock
 128         then
 129                 echo "...unable to create $lock, aborting start!"
 130                 rm -f $lock             # might be there but empty
 131                 exit 1
 132         fi
 133         >$info
 134
 135         # here we go
 136         ipsec _startklips --info $info --debug "$IPSECklipsdebug" \
 137                 --omtu "$IPSECoverridemtu" --fragicmp "$IPSECfragicmp" \
 138                 --hidetos "$IPSEChidetos" --default "$IPSECpacketdefault" \
 139                 --log "$IPSECsyslog" $IPSECinterfaces || (rm -f $lock; exit 1)
 140
 141         # misc pre-Pluto setup
 142         if test -d `dirname $subsyslock`
 143         then
 144                 touch $subsyslock
 145         fi
 146         fw=`cat $ipforward`
 147         if test " $IPSECforwardcontrol" = " yes" -a " $fw" = " 0"
 148         then
 149                 echo "enabling IP forwarding:" | logonly
 150                 echo "ipforwardingwas=$fw" >>$info
 151                 echo 1 >$ipforward
 152         fi
 153         manualconns
 154
 155         # Pluto
 156         case "$1" in
 157         start|--start)  re=     ;;
 158         _autostart)     re=--re ;;
 159         esac
 160         if test " $IPSECpluto" != " no"
 161         then
 162                 if ipsec _plutorun $re --debug "$IPSECplutodebug" \
 163                         --uniqueids "$IPSECuniqueids" \
 164                         --nocrsend "$IPSECnocrsend" \
 165                         --nat_traversal "$IPSECnat_traversal" \
 166                         --keep_alive "$IPSECkeep_alive" \
 167                         --force_keepalive "$IPSECforce_keepalive" \
 168                         --disable_port_floating "$IPSECdisable_port_floating" \
 169                         --virtual_private "$IPSECvirtual_private" \
 170                         --dump "$IPSECdumpdir" --load "$IPSECplutoload" \
 171                         --start "$IPSECplutostart" --wait "$IPSECplutowait" \
 172                         --pre "$IPSECprepluto" --post "$IPSECpostpluto" \
 173                         --log "$IPSECsyslog" --pid "$plutopid"
 174                 then
 175                     : everything okay
 176                 else
 177                     killklips
 178                     rm -f $lock
 179                     exit 1
 180                 fi
 181         fi
 182
 183         # done!
 184         echo "...FreeS/WAN IPsec started" | logonly
 185         ;;
 186
 187   stop|--stop|_autostop)                # _autostop is same as stop
 188         # Shut things down.
 189         echo "Stopping FreeS/WAN IPsec..."
 190         if test -r $lock
 191         then
 192                 status=0
 193                 . $info
 194         else
 195                 echo "stop ordered, but IPsec does not appear to be running!"
 196                 echo "doing cleanup anyway..."
 197                 status=1
 198         fi
 199         if test " $IPSECforwardcontrol" = " yes" -a " $ipforwardingwas" = " 0"
 200         then
 201                 echo "disabling IP forwarding:" | logonly
 202                 echo 0 >$ipforward
 203         fi
 204         if test ! -f $plutopid
 205         then
 206                 : nothing
 207         elif test ! -s $plutopid
 208         then
 209                 echo "Removing empty $plutopid -- pluto still running?"
 210                 rm -f $plutopid
 211         elif ps -p `cat $plutopid` >/dev/null           # process exists
 212         then
 213                 ipsec whack --shutdown | awk '$1 != "002"'
 214                 sleep 1                 # general paranoia
 215                 if test -s $plutopid
 216                 then
 217                         echo "Attempt to shut Pluto down failed!  Trying kill:"
 218                         kill `cat $plutopid`
 219                         sleep 5
 220                 fi
 221                 rm -f $plutopid         # harmless if already gone
 222         else
 223                 echo "Removing orphaned $plutopid:"
 224                 rm -f $plutopid
 225         fi
 226
 227         killklips
 228
 229         if test -d `dirname $subsyslock`
 230         then
 231                 rm -f $subsyslock
 232         fi
 233         rm -f $info $lock
 234         echo "...FreeS/WAN IPsec stopped" | logonly
 235         exit $status
 236         ;;
 237
 238   status|--status)
 239         if test -f $info
 240         then
 241                 hasinfo=yes
 242         fi
 243         if test -f $lock
 244         then
 245                 haslock=yes
 246         fi
 247         if test -f $subsyslock
 248         then
 249                 hassublock=yes
 250         fi
 251
 252         if test -s $plutopid
 253         then
 254                 if ps -p `cat $plutopid` >/dev/null
 255                 then
 256                         plutokind=normal
 257                 elif ps -C pluto >/dev/null
 258                 then
 259                         plutokind=illicit
 260                 fi
 261         elif ps -C pluto >/dev/null
 262         then
 263                 plutokind=orphaned
 264         else
 265                 plutokind=no
 266         fi
 267
 268         if test -r /proc/net/ipsec_eroute
 269         then
 270                 if test " `wc -l </proc/net/ipsec_eroute`" -gt 0
 271                 then
 272                         eroutes=yes
 273                 fi
 274         fi
 275
 276         if test -r $ipsecversion
 277         then
 278                 klips=yes
 279         elif test -r $modules
 280         then
 281                 klips=maybe
 282         else
 283                 klips=none
 284         fi
 285
 286         if test "$haslock"
 287         then
 288                 echo "IPsec running"
 289                 # might not be a subsystem lock dir, ignore that issue
 290                 if test "$plutokind" = "normal" -a "$klips" = "yes" -a "$hasinfo"
 291                 then
 292                         echo "pluto pid `cat $plutopid`"
 293                         exit 0
 294                 fi
 295                 echo "but..."
 296                 if test "$plutokind" != "normal"
 297                 then
 298                         echo "$plutokind Pluto running!"
 299                 fi
 300                 if test ! "$hasinfo"
 301                 then
 302                         echo "$info file missing!"
 303                 fi
 304                 case $klips in
 305                 maybe)  echo "KLIPS module is not loaded!"      ;;
 306                 none)   echo "no KLIPS in kernel!"              ;;
 307                 esac
 308                 if test "$eroutes"
 309                 then
 310                         echo "some eroutes exist"
 311                 fi
 312                 exit 1
 313         else
 314                 echo "IPsec stopped"
 315                 if test ! "$hassublock" -a ! "$hasinfo" -a "$plutokind" = "no" \
 316                                                                 -a ! "$eroutes"
 317                 then
 318                         exit 0
 319                 fi
 320                 echo "but..."
 321                 if test "$hassublock"
 322                 then
 323                         echo "has subsystem lock ($subsyslock)!"
 324                 fi
 325                 if test "$hasinfo"
 326                 then
 327                         echo "has $info file!"
 328                 fi
 329                 if test "$plutokind" != "normal"
 330                 then
 331                         echo "$plutokind Pluto is running!"
 332                 fi
 333                 if test "$eroutes"
 334                 then
 335                         echo "some eroutes exist!"
 336                 fi
 337                 exit 1
 338         fi
 339         ;;
 340
 341   --version)
 342         echo "$me $IPSEC_VERSION"
 343         exit 0
 344         ;;
 345
 346   --help)
 347         echo "Usage: $me {--start|--stop|--restart|--status}"
 348         exit 0
 349         ;;
 350
 351   *)
 352         echo "Usage: $me {--start|--stop|--restart|--status}" >&2
 353         exit 2
 354 esac
 355
 356 exit 0