racoon.init (11547B)
1 #!/bin/sh /etc/rc.common 2 # 3 # Copyright (C) 2015 Vitaly Protsko <villy@sft.ru> 4 5 #set -vx 6 7 USE_PROCD=1 8 9 START=60 10 STOP=40 11 12 let connWait=2/2 13 confDir=/var/racoon 14 confExtZone= 15 confIntZone= 16 confPort= 17 confNATPort= 18 confIPMode= 19 20 confPh1ID=0 21 22 log="logger -t init.d/racoon[$$] " 23 24 . /etc/racoon/functions.sh 25 26 setup_load() { 27 config_get confExtZone "$1" ext_zone wan 28 config_get confIntZone "$1" int_zone lan 29 config_get confPort "$1" port 500 30 config_get confNATPort "$1" natt_port 4500 31 config_get confIPMode "$1" ipversion "" 32 33 case X$confIPMode in 34 X4|X6) ;; 35 *) unset confIPMode ;; 36 esac 37 } 38 39 write_header() { 40 echo " 41 # autogenerated, don't edit, look at /etc/config/racoon 42 # 43 path certificate \"$confDir/cert\"; 44 path script \"/etc/racoon\"; 45 path pre_shared_key \"$confDir/psk.txt\"; 46 path pidfile \"$confDir/racoon.pid\"; 47 padding { maximum_length 20; randomize off; strict_check off; exclusive_tail off; } 48 timer { counter 5; interval 20 sec; persend 1; phase1 30 sec; phase2 15 sec; } 49 " 50 } 51 52 setup_conf() { 53 local conf=$confDir/racoon.conf 54 local peerconf=$confDir/peers.txt 55 local pskconf=$confDir/psk.txt 56 local item 57 local data 58 59 data="$(get_zoneiplist $confExtZone)" 60 if [ "X$data" = X ]; then 61 $log "No IP addresses found for zone $confExtZone, exitng" 62 errno=2; return 2 63 fi 64 65 write_header > $conf 66 echo -n > $peerconf 67 echo -n > $pskconf 68 chmod 0600 $conf $peerconf $pskconf 69 70 echo "listen {" >> $conf 71 for item in $data ; do 72 echo " isakmp $item [$confPort]; isakmp_natt $item [$confNATPort];" >> $conf 73 done 74 echo "}" >> $conf 75 76 config_get_bool item "$1" debug 0 77 data=warning 78 test $item -ne 0 && data=debug 79 echo "log $data;" >> $conf 80 81 setup_fw add 82 } 83 84 setup_p1() { 85 local conf=$confDir/racoon.conf 86 local data 87 88 echo " proposal {" >> $conf 89 config_get data "$1" lifetime 28800 90 echo " lifetime time $data sec;" >> $conf 91 92 config_get data "$1" enc_alg 93 test -n "$data" && echo " encryption_algorithm $data;" >> $conf 94 95 config_get data "$1" hash_alg 96 test -n "$data" && echo " hash_algorithm $data;" >> $conf 97 98 config_get data "$1" auth_method 99 test -n "$data" && echo " authentication_method $data;" >> $conf 100 101 config_get data "$1" dh_group 2 102 echo -e " dh_group $data;\n }" >> $conf 103 } 104 105 setup_fw() { 106 local cmd=/usr/sbin/iptables 107 local mode 108 109 case "$1" in 110 add|up|1) mode=A ;; 111 del|down|0) mode=D ;; 112 *) return 3 ;; 113 esac 114 115 $cmd -$mode input_${confExtZone}_rule -p AH -j ACCEPT 116 $cmd -$mode input_${confExtZone}_rule -p ESP -j ACCEPT 117 $cmd -$mode input_${confExtZone}_rule -p UDP --dport $confPort -j ACCEPT 118 $cmd -$mode input_${confExtZone}_rule -p UDP --dport $confNATPort -j ACCEPT 119 } 120 121 setup_sa() { 122 local conf=$confDir/racoon.conf 123 local remote="${2/ *}" 124 local client="${2#* }" 125 local locnet 126 local remnet 127 local p2 128 local data 129 130 test "$2" = "$client" && unset client 131 132 if [ -z "$client" ]; then 133 config_get locnet "$1" local_net 134 config_get remnet "$1" remote_net 135 if [ -z "$locnet" ] || [ -z "$remnet" ]; then 136 $log "Remote and local networks for $1 must be configured ($2)" 137 errno=4; return 4 138 fi 139 140 if [ "$remote" = "anonymous" ]; then 141 echo "sainfo anonymous {" >> $conf 142 else 143 echo "sainfo address $locnet any address $remnet any {" >> $conf 144 fi 145 else 146 echo "sainfo anonymous {" >> $conf 147 fi 148 149 config_get p2 "$1" p2_proposal 150 if [ -z "$p2" ]; then 151 $log "Phase2 proposal must be configured in $1 sainfo" 152 errno=5; return 5 153 fi 154 155 echo " remoteid $confPh1ID;" >> $conf 156 157 config_get data "$p2" pfs_group 158 test -n "$data" && echo " pfs_group $data;" >> $conf 159 config_get data "$p2" lifetime 14400 160 test -n "$data" && echo " lifetime time $data sec;" >> $conf 161 config_get data "$p2" enc_alg 162 test -n "$data" && echo " encryption_algorithm $data;" >> $conf 163 config_get data "$p2" auth_alg 164 test -n "$data" && echo " authentication_algorithm $data;" >> $conf 165 166 echo -e " compression_algorithm deflate;\n}" >> $conf 167 168 if [ "$remote" = "anonymous" ]; then 169 echo -e "mode_cfg {\n auth_source system;\n conf_source local;" >> $conf 170 171 config_get data "$1" dns4 172 test -n "$data" && echo " dns4 $data;" >> $conf 173 config_get data "$1" defdomain 174 test -n "$data" && echo " default_domain \"$data\";" >> $conf 175 176 data=${remnet%/*} 177 let "data=${data##*.}+1" 178 echo " network4 ${remnet%.*}.$data;" >> $conf 179 180 let "data=255<<(24-${remnet#*/}+8)&255" 181 echo " netmask4 255.255.255.$data;" >> $conf 182 183 echo -e " split_network include $locnet;\n}" >> $conf 184 185 elif [ -z "$client" ]; then 186 manage_sa add $locnet $remnet $remote 187 test $? -gt 0 -o $errno -gt 0 && return $errno 188 189 manage_fw add $confIntZone $confExtZone $remnet 190 fi 191 } 192 193 setup_tunnel() { 194 local conf=$confDir/racoon.conf 195 local peerconf=$confDir/peers.txt 196 local data 197 local remote 198 local xauth 199 200 config_get_bool data "$1" enabled 0 201 test "$data" = "0" && return 0 202 203 config_get remote "$1" remote 204 if [ "$remote" = "anonymous" ]; then 205 echo -e "remote anonymous {\n generate_policy on;" >> $conf 206 else 207 data=$(nslookup "$remote" | awk 'NR == 5 {print $3}') 208 test -n "$data" && remote="$data" 209 echo -e "remote \"$1\" {\n remote_address $remote;" >> $conf 210 echo "$data" >> $peerconf 211 fi 212 213 config_get data "$1" pre_shared_key "" 214 if [ -n "$data" ]; then 215 if [ "$remote" != "anonymous" ]; then 216 echo "$remote $data" >> $confDir/psk.txt 217 else 218 echo "* $data" >> $confDir/psk.txt 219 fi 220 fi 221 222 let confPh1ID=$confPh1ID+1 223 echo " ph1id $confPh1ID;" >> $conf 224 225 config_get xauth "$1" username "" 226 227 config_get data "$1" certificate "" 228 if [ -n "$data" ]; then 229 echo -en " verify_cert on;\n my_identifier asn1dn;\n certificate_type x509 " >> $conf 230 echo -en "\"$data.crt\" \"$data.key\";\n send_cr off;\n peers_identifier " >> $conf 231 else 232 config_get data "$1" my_id_type "" 233 if [ -n "$data" ]; then 234 echo -n " my_identifier $data" >> $conf 235 config_get data "$1" my_id "" 236 if [ -n "$data" ]; then 237 echo " \"$data\";" >> $conf 238 elif [ -n "$xauth" ]; then 239 echo " \"$xauth\";" >> $conf 240 else 241 echo ";" >> $conf 242 fi 243 elif [ -n "$xauth" ]; then 244 echo " my_identifier user_fqdn \"$xauth\";" >> $conf 245 fi 246 echo -n " peers_identifier " >> $conf 247 fi 248 249 if [ "$remote" = "anonymous" ]; then 250 echo "user_fqdn;" >> $conf 251 else 252 config_get data "$1" peer_id_type "asn1dn" 253 echo -n "$data" >> $conf 254 255 config_get data "$1" peer_id "" 256 test -n "$data" && echo -n " \"$data\"" >> $conf 257 258 echo ";" >> $conf 259 fi 260 261 if [ -n "$xauth" ]; then 262 config_get data "$1" password 263 if [ -z "$data" ]; then 264 $log "Password must be given in $1 tunnel" 265 errno=7; return 7 266 fi 267 echo "$xauth $data" >> $confDir/psk.txt 268 269 echo " xauth_login \"$xauth\";" >> $conf 270 echo -e " script \"p1client-up\" phase1_up;\n script \"p1client-down\" phase1_down;" >> $conf 271 fi 272 273 config_get data "$1" exchange_mode 274 if [ -z "$data" ]; then 275 data=main 276 test -n "$xauth" && data="${data},aggressive" 277 fi 278 echo -e " exchange_mode $data;\n nat_traversal on;\n support_proxy on;" >> $conf 279 280 config_get data "$1" prop_check "obey" 281 test -n "$data" && echo " proposal_check $data;" >> $conf 282 283 config_get_bool data "$1" weak_p1check 1 284 if [ $data -eq 0 ]; then data=off; else data=on; fi 285 echo " weak_phase1_check $data;" >> $conf 286 287 config_get_bool data "$1" verify_id 1 288 if [ $data -eq 0 ]; then data=off; else data=on; fi 289 echo " verify_identifier $data;" >> $conf 290 291 config_get data "$1" dpd_delay "" 292 test -n "$data" && echo " dpd_delay $data;" >> $conf 293 294 unset data 295 test -n "$xauth" && data="on" 296 config_get data "$1" mode_cfg "$data" 297 test -n "$data" && echo " mode_cfg $data;" >> $conf 298 299 config_get_bool data "$1" init 0 300 if [ $data -eq 0 ]; then data=off; else data=on; fi 301 echo " initial_contact $data;" >> $conf 302 303 304 config_list_foreach "$1" p1_proposal setup_p1 305 echo "}" >> $conf 306 307 config_list_foreach "$1" sainfo setup_sa "$remote $xauth" 308 } 309 310 setup_cert() { 311 local item 312 local data 313 314 for item in key crt ; do 315 config_get data "$1" $item "" 316 test -z "$data" && continue 317 318 echo "$data" |\ 319 sed 's/-\+[A-Z ]\+-\+/\n&\n/g' | sed 's/.\{50,50\}/&\n/g' | sed '/^$/d'\ 320 > $confDir/cert/$1.$item 321 322 chmod 600 $confDir/cert/$1.$item 323 done 324 325 if [ -s $confDir/cert/$1.crt ]; then 326 data=$(openssl x509 -noout -hash -in $confDir/cert/$1.crt) 327 ln -sf $confDir/cert/$1.crt $confDir/cert/$data.0 328 fi 329 } 330 331 destroy_sa() { 332 local locnet 333 local remnet 334 335 config_get locnet "$1" local_net 336 config_get remnet "$1" remote_net 337 if [ -z "$locnet" ] || [ -z "$remnet" ]; then 338 $log "Remote and local networks for $1 must be configured" 339 errno=4; return 4 340 fi 341 342 manage_sa del $locnet $remnet $2 343 manage_fw del $confIntZone $confExtZone $remnet 344 } 345 346 destroy_tunnel() { 347 local data 348 349 config_get_bool data "$1" enabled 0 350 test "$data" = "0" && return 0 351 352 config_get remote "$1" remote 353 data=$(nslookup "$remote" | awk 'NR == 5 {print $3}') 354 test -n "$data" && remote="$data" 355 356 config_get data "$1" username "" 357 if [ -z "$data" ]; then 358 config_list_foreach "$1" sainfo destroy_sa $remote 359 fi 360 } 361 362 destroy_conf() { 363 setup_fw del 364 } 365 366 check_software() { 367 local item 368 369 for item in /usr/sbin/setkey /usr/bin/openssl /usr/sbin/ip ; do 370 if [ ! -x $item ]; then 371 $log "Needed program $item not found, exiting" 372 errno=9; return 9 373 fi 374 done 375 } 376 377 cleanup_conf() { 378 config_load racoon 379 config_foreach setup_load racoon 380 config_foreach destroy_conf racoon 381 config_foreach destroy_tunnel tunnel 382 383 /usr/sbin/setkey -P -F 384 /usr/sbin/setkey -F 385 } 386 387 check_dir() { 388 local item 389 390 for item in $confDir $confDir/cert ; do 391 if [ ! -d $item ]; then 392 mkdir -m 0700 -p $item 393 fi 394 done 395 } 396 397 wait4wanzone() { 398 local item=$connWait 399 local data 400 401 data="$(get_zoneiplist $confExtZone)" 402 while [ $item -gt 0 ]; do 403 test -n "$data" && break 404 sleep 2 405 let "item=$item-1" 406 data="$(get_zoneiplist $confExtZone)" 407 done 408 409 test -z "$data" && return 10 410 } 411 412 start_service() { 413 check_software 414 test $? -gt 0 -o $errno -gt 0 && exit $errno 415 416 check_dir 417 418 config_load racoon 419 config_foreach setup_load racoon 420 421 config_foreach wait4wanzone racoon 422 if [ $? -gt 0 ] || [ $errno -gt 0 ]; then 423 $log "No active interfaces in $confExtZone zone found, exiting" 424 exit $errno 425 fi 426 427 config_foreach setup_conf racoon 428 test $? -gt 0 -o $errno -gt 0 && exit $errno 429 430 config_foreach setup_tunnel tunnel 431 test $? -gt 0 -o $errno -gt 0 && exit $errno 432 433 config_foreach setup_cert certificate 434 435 procd_open_instance 436 procd_set_param command /usr/sbin/racoon 437 test -n "$confIPMode" && procd_append_param command -$confIPMode 438 procd_append_param command -F -f $confDir/racoon.conf 439 procd_set_param file $confDir/racoon.conf 440 procd_close_instance 441 442 if [ -x /etc/racoon/vpnctl ]; then 443 let connWait=$connWait*2+2 444 ( sleep $connWait; /etc/racoon/vpnctl up ) & 445 fi 446 } 447 448 service_triggers() { 449 local item 450 local data 451 452 procd_add_reload_trigger "racoon" "network" 453 454 config_load racoon 455 config_foreach setup_load racoon 456 457 data=$(get_zoneiflist $confExtZone) 458 if [ $? -gt 0 ] || [ $errno -gt 0 ] || [ -z "$data" ]; then 459 $log "Can not find interfaces for $confExtZone zone" 460 else 461 for item in $data ; do 462 procd_add_reload_interface_trigger $item 463 done 464 fi 465 } 466 467 stop_service() { 468 cleanup_conf 469 procd_kill racoon 470 } 471 472 trap "cleanup_conf" 1 2 3 4 5 6 7 8 9 10 473 474 475 # EOF /etc/init.d/racoon