]> git.ipfire.org Git - ipfire-2.x.git/blame - src/patches/strongswan-4.3.6_ipfire.patch
projects / ipfire-2.x.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Renamed usb_modeswitch.conf to setup at core38 update.
[ipfire-2.x.git] / src / patches / strongswan-4.3.6_ipfire.patch
CommitLineData
6652626c
AF		 1diff -Naur strongswan-4.3.6.org/src/_updown/_updown.in strongswan-4.3.6/src/_updown/_updown.in
2--- strongswan-4.3.6.org/src/_updown/_updown.in 2009-09-27 21:50:42.000000000 +0200
db073a10
AF		 3+++ strongswan-4.3.6/src/_updown/_updown.in 2010-03-27 16:32:13.000000000 +0100
4@@ -374,12 +374,12 @@
6652626c
AF		 5 # connection to me, with (left/right)firewall=yes, coming up
6 # This is used only by the default updown script, not by your custom
7 # ones, so do not mess with it; see CAUTION comment up at top.
8- iptables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
9+ iptables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
10 -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
11 -d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
12- iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
13+ iptables -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
14 -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
db073a10
AF		 15- -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
16+ -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j MARK --set-mark 50
6652626c 17 #
db073a10
AF		 18 # log IPsec host connection setup
19 if [ $VPN_LOGGING ]
6652626c
AF		 20@@ -387,10 +387,10 @@
21 if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
22 then
23 logger -t $TAG -p $FAC_PRIO \
24- "+ $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME"
25+ "host+ $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME"
26 else
27 logger -t $TAG -p $FAC_PRIO \
28- "+ $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
29+ "host+ $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
30 fi
31 fi
32 ;;
db073a10 33@@ -398,12 +398,12 @@
6652626c
AF		 34 # connection to me, with (left/right)firewall=yes, going down
35 # This is used only by the default updown script, not by your custom
36 # ones, so do not mess with it; see CAUTION comment up at top.
37- iptables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
38+ iptables -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
39 -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
40 -d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
41- iptables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
42+ iptables -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
43 -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
db073a10
AF		 44- -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
45+ -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j MARK --set-mark 50
6652626c 46 #
db073a10
AF		 47 # log IPsec host connection teardown
48 if [ $VPN_LOGGING ]
6652626c
AF		 49@@ -411,10 +411,10 @@
50 if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
51 then
52 logger -t $TAG -p $FAC_PRIO -- \
53- "- $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME"
54+ "host- $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME"
55 else
56 logger -t $TAG -p $FAC_PRIO -- \
57- "- $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
58+ "host- $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
59 fi
60 fi
61 ;;
62@@ -424,10 +424,10 @@
63 # ones, so do not mess with it; see CAUTION comment up at top.
64 if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/32" ]
65 then
66- iptables -I FORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
67+ iptables -I IPSECFORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
68 -s $PLUTO_MY_CLIENT $S_MY_PORT \
db073a10 69- -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
6652626c 70- iptables -I FORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
db073a10 71+ -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j MARK --set-mark 50
6652626c
AF		 72+ iptables -I IPSECFORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
73 -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
74 -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
75 fi
db073a10 76@@ -436,12 +436,12 @@
6652626c
AF		 77 # or sometimes host access via the internal IP is needed
78 if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
79 then
80- iptables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
81+ iptables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
82 -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
83 -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
84- iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
85+ iptables -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
86 -s $PLUTO_MY_CLIENT $S_MY_PORT \
db073a10
AF		 87- -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
88+ -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j MARK --set-mark 50
6652626c 89 fi
db073a10
AF		 90 #
91 # log IPsec client connection setup
6652626c
AF		 92@@ -450,12 +450,27 @@
93 if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
94 then
95 logger -t $TAG -p $FAC_PRIO \
96- "+ $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
97+ "client+ $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
98 else
99 logger -t $TAG -p $FAC_PRIO \
100- "+ $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
101+ "client+ $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
102 fi
103 fi
104+
105+ #
db073a10
AF		 106+ # Open Firewall for AH + ESP Traffic
107+ iptables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p AH \
108+ -s $PLUTO_PEER $S_PEER_PORT \
109+ -d $PLUTO_ME $D_MY_PORT -j ACCEPT
6652626c
AF		 110+ iptables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p ESP \
111+ -s $PLUTO_PEER $S_PEER_PORT \
112+ -d $PLUTO_ME $D_MY_PORT -j ACCEPT
6652626c
AF		 113+ if [ $VPN_LOGGING ]
114+ then
115+ logger -t $TAG -p $FAC_PRIO \
116+ "ESP+ $PLUTO_PEER -- $PLUTO_ME"
117+ fi
118+
119 ;;
120 down-client:iptables)
121 # connection to client subnet, with (left/right)firewall=yes, going down
122@@ -463,11 +478,11 @@
123 # ones, so do not mess with it; see CAUTION comment up at top.
124 if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/32" ]
125 then
126- iptables -D FORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
127+ iptables -D IPSECFORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
128 -s $PLUTO_MY_CLIENT $S_MY_PORT \
129 -d $PLUTO_PEER_CLIENT $D_PEER_PORT \
db073a10 130- $IPSEC_POLICY_OUT -j ACCEPT
6652626c 131- iptables -D FORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
db073a10 132+ $IPSEC_POLICY_OUT -j MARK --set-mark 50
6652626c
AF		 133+ iptables -D IPSECFORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
134 -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
135 -d $PLUTO_MY_CLIENT $D_MY_PORT \
136 $IPSEC_POLICY_IN -j ACCEPT
db073a10 137@@ -477,14 +492,14 @@
6652626c
AF		 138 # or sometimes host access via the internal IP is needed
139 if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
140 then
141- iptables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
142+ iptables -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
143 -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
144 -d $PLUTO_MY_CLIENT $D_MY_PORT \
145 $IPSEC_POLICY_IN -j ACCEPT
146- iptables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
147+ iptables -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
148 -s $PLUTO_MY_CLIENT $S_MY_PORT \
149 -d $PLUTO_PEER_CLIENT $D_PEER_PORT \
db073a10
AF		 150- $IPSEC_POLICY_OUT -j ACCEPT
151+ $IPSEC_POLICY_OUT -j MARK --set-mark 50
152 fi
153 #
154 # log IPsec client connection teardown
6652626c
AF		 155@@ -493,12 +508,27 @@
156 if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
157 then
158 logger -t $TAG -p $FAC_PRIO -- \
159- "- $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
160+ "client- $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
161 else
162 logger -t $TAG -p $FAC_PRIO -- \
163- "- $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
164+ "client- $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
165 fi
166 fi
167+
168+ #
db073a10
AF		 169+ # Close Firewall for AH+ESP Traffic
170+ iptables -D IPSECINPUT -i $PLUTO_INTERFACE -p AH \
171+ -s $PLUTO_PEER $S_PEER_PORT \
172+ -d $PLUTO_ME $D_MY_PORT -j ACCEPT
6652626c
AF		 173+ iptables -D IPSECINPUT -i $PLUTO_INTERFACE -p ESP \
174+ -s $PLUTO_PEER $S_PEER_PORT \
175+ -d $PLUTO_ME $D_MY_PORT -j ACCEPT
6652626c
AF		 176+ if [ $VPN_LOGGING ]
177+ then
178+ logger -t $TAG -p $FAC_PRIO \
179+ "ESP- $PLUTO_PEER -- $PLUTO_ME"
180+ fi
181+
182 ;;
183 #
184 # IPv6
185@@ -533,10 +563,10 @@
186 # connection to me, with (left/right)firewall=yes, coming up
187 # This is used only by the default updown script, not by your custom
188 # ones, so do not mess with it; see CAUTION comment up at top.
189- ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
190+ ip6tables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
191 -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
192 -d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
193- ip6tables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
194+ ip6tables -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
195 -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
196 -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
197 #
198@@ -557,10 +587,10 @@
199 # connection to me, with (left/right)firewall=yes, going down
200 # This is used only by the default updown script, not by your custom
201 # ones, so do not mess with it; see CAUTION comment up at top.
202- ip6tables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
203+ ip6tables -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
204 -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
205 -d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
206- ip6tables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
207+ ip6tables -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
208 -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
209 -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
210 #
211@@ -583,10 +613,10 @@
212 # ones, so do not mess with it; see CAUTION comment up at top.
213 if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/128" ]
214 then
215- ip6tables -I FORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
216+ ip6tables -I IPSECFORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
217 -s $PLUTO_MY_CLIENT $S_MY_PORT \
218 -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
219- ip6tables -I FORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
220+ ip6tables -I IPSECFORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
221 -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
222 -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
223 fi
224@@ -595,10 +625,10 @@
225 # or sometimes host access via the internal IP is needed
226 if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
227 then
228- ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
229+ ip6tables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
230 -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
231 -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
232- ip6tables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
233+ ip6tables -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
234 -s $PLUTO_MY_CLIENT $S_MY_PORT \
235 -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
236 fi
237@@ -622,11 +652,11 @@
238 # ones, so do not mess with it; see CAUTION comment up at top.
239 if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/128" ]
240 then
241- ip6tables -D FORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
242+ ip6tables -D IPSECFORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
243 -s $PLUTO_MY_CLIENT $S_MY_PORT \
244 -d $PLUTO_PEER_CLIENT $D_PEER_PORT \
245 $IPSEC_POLICY_OUT -j ACCEPT
246- ip6tables -D FORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
247+ ip6tables -D IPSECFORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
248 -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
249 -d $PLUTO_MY_CLIENT $D_MY_PORT \
250 $IPSEC_POLICY_IN -j ACCEPT
251@@ -636,11 +666,11 @@
252 # or sometimes host access via the internal IP is needed
253 if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
254 then
255- ip6tables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
256+ ip6tables -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
257 -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
258 -d $PLUTO_MY_CLIENT $D_MY_PORT \
259 $IPSEC_POLICY_IN -j ACCEPT
260- ip6tables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
261+ ip6tables -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
262 -s $PLUTO_MY_CLIENT $S_MY_PORT \
263 -d $PLUTO_PEER_CLIENT $D_PEER_PORT \
264 $IPSEC_POLICY_OUT -j ACCEPT
IPFire 2.x development tree