2 ###############################################################################
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2017 IPFire Network Development Team #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
20 ###############################################################################
22 LOG_DISABLE_STDOUT
="true"
24 .
/usr
/lib
/network
/functions
26 # Read network settings
29 # Make sure we are called by strongSwan
30 assert isset PLUTO_VERSION
32 CONNECTION
="${PLUTO_CONNECTION}"
34 # Interface name for this IPsec connection
35 INTERFACE
="ipsec-${CONNECTION}"
37 if ! ipsec_connection_read_config
"${CONNECTION}"; then
38 log ERROR
"Could not read configuration for ${CONNECTION}"
42 log DEBUG
"${0} called for ${CONNECTION}: ${PLUTO_VERB}"
44 case "${PLUTO_VERB}" in
45 up-client|up-client-v6|up-host|up-host-v6
)
48 if ! device_exists
"${INTERFACE}"; then
49 ip_tunnel_add
"${INTERFACE}" \
51 --local-address="${TUNNEL_ADDRESS}" \
52 --remote-address="${TUNNEL_PEER}"
54 device_set_up
"${INTERFACE}"
58 if device_exists
"${INTERFACE}"; then
59 ip_tunnel_change_keys
"${INTERFACE}" \
60 --ikey="${PLUTO_MARK_IN%/*}" \
61 --okey="${PLUTO_MARK_OUT%/*}"
64 if ! ip_tunnel_add
"${INTERFACE}" \
66 --local-address="${PLUTO_ME}" \
67 --remote-address="${PLUTO_PEER}" \
68 --ikey="${PLUTO_MARK_IN%/*}" \
69 --okey="${PLUTO_MARK_OUT%/*}"; then
70 log ERROR
"Could not create VTI device for ${CONNECTION}"
74 device_set_up
"${INTERFACE}"
79 down-client|down-client-v6|down-host|down-host-v6
)
82 if device_exists
"${INTERFACE}"; then
83 device_set_down
"${INTERFACE}"
85 ip_tunnel_del
"${INTERFACE}"