IPsec: Fix routing

[network.git] / src / helpers / ipsec-updown

diff --git a/src/helpers/ipsec-updown b/src/helpers/ipsec-updown
index 12ead035631ea64b433dfb8335de2755c21f07ca..3764085f452381a4bb02eb0fcfef9edf049a23ac 100644 (file)
--- a/src/helpers/ipsec-updown
+++ b/src/helpers/ipsec-updown
@@ -86,13 +86,45 @@ case "${PLUTO_VERB}" in
                                ;;
                esac
 
-               # Set routes
-               if isset INTERFACE; then
-                       cmd ip route add "${PLUTO_PEER_CLIENT}" \
-                               dev "${INTERFACE}"
-               else
-                       cmd ip route add "${PLUTO_PEER_CLIENT}" \
-                               via "${PLUTO_PEER}"
+               #Get sources IP for routes
+               SRC_IP=($(ip_get_assigned_addresses_from_net \
+                       "${PLUTO_MY_CLIENT}" "permanent"))
+
+               # Set routes if we have a source IP.
+               # If not the machine does not has a leg on the net
+               # and we can go on without routes.
+               if isset SRC_IP; then
+                       # We take the lowest source IP we found,
+                       # which is ugly because the value is unpredictable.
+                       SRC_IP=${SRC_IP[0]}
+
+                       if isset INTERFACE; then
+                               if ! cmd ip route add \
+                                       "${PLUTO_PEER_CLIENT}" \
+                                       dev "${INTERFACE}" \
+                                       src "${SRC_IP}"; then
+                                               log ERROR \
+                                                       "Could not set routes for ${PLUTO_PEER_CLIENT}"
+                               fi
+                       else
+                               # Get the device which we use to peer with the other site.
+                               ME_DEVICE = "$(device_get_by_ip_address "${PLUTO_ME}")"
+
+                               # We can only go on if we found a device.
+                               if isset ME_DEVICE; then
+                                       if ! cmd ip route add \
+                                               "${PLUTO_PEER_CLIENT}" \
+                                               dev "${ME_DEVICE}" \
+                                               proto static \
+                                               src "${SRC_IP}" \
+                                               table 220; then
+                                                       log ERROR \
+                                                               "Could not set routes for ${PLUTO_PEER_CLIENT}"
+                                       fi
+                               else
+                                       log ERROR "Could not get device for ${PLUTO_ME}"
+                               fi
+                       fi
                fi
                ;;