package/openswan/files/ipsec.init

   1 #!/bin/sh /etc/rc.common
   2 # IPsec startup and shutdown script
   3 # Copyright (C) 1998, 1999, 2001  Henry Spencer.
   4 # Copyright (C) 2002              Michael Richardson <mcr@freeswan.org>
   5 # Copyright (C) 2006              OpenWrt.org
   6 #
   7 # This program is free software; you can redistribute it and/or modify it
   8 # under the terms of the GNU General Public License as published by the
   9 # Free Software Foundation; either version 2 of the License, or (at your
  10 # option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  11 #
  12 # This program is distributed in the hope that it will be useful, but
  13 # WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  14 # or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  15 # for more details.
  16 #
  17 # RCSID $Id: setup.in,v 1.122.6.1 2005/07/25 19:17:03 ken Exp $
  18 #
  19 # ipsec         init.d script for starting and stopping
  20 #               the IPsec security subsystem (KLIPS and Pluto).
  21 #
  22 # This script becomes /etc/rc.d/init.d/ipsec (or possibly /etc/init.d/ipsec)
  23 # and is also accessible as "ipsec setup" (the preferred route for human
  24 # invocation).
  25 #
  26 # The startup and shutdown times are a difficult compromise (in particular,
  27 # it is almost impossible to reconcile them with the insanely early/late
  28 # times of NFS filesystem startup/shutdown).  Startup is after startup of
  29 # syslog and pcmcia support; shutdown is just before shutdown of syslog.
  30 #
  31 # chkconfig: 2345 47 76
  32 # description: IPsec provides encrypted and authenticated communications; \
  33 # KLIPS is the kernel half of it, Pluto is the user-level management daemon.
  34
  35 START=60
  36 script_init() {
  37         me='ipsec setup'                # for messages
  38
  39         # where the private directory and the config files are
  40         IPSEC_EXECDIR="${IPSEC_EXECDIR-/usr/libexec/ipsec}"
  41         IPSEC_LIBDIR="${IPSEC_LIBDIR-/usr/lib/ipsec}"
  42         IPSEC_SBINDIR="${IPSEC_SBINDIR-/usr/sbin}"
  43         IPSEC_CONFS="${IPSEC_CONFS-/etc}"
  44
  45         if test " $IPSEC_DIR" = " "     # if we were not called by the ipsec command
  46         then
  47             # we must establish a suitable PATH ourselves
  48             PATH="${IPSEC_SBINDIR}":/sbin:/usr/sbin:/usr/local/bin:/bin:/usr/bin
  49             export PATH
  50
  51             IPSEC_DIR="$IPSEC_LIBDIR"
  52             export IPSEC_DIR IPSEC_CONFS IPSEC_LIBDIR IPSEC_EXECDIR
  53         fi
  54
  55         # Check that the ipsec command is available.
  56         found=
  57         for dir in `echo $PATH | tr ':' ' '`
  58         do
  59                 if test -f $dir/ipsec -a -x $dir/ipsec
  60                 then
  61                         found=yes
  62                         break                   # NOTE BREAK OUT
  63                 fi
  64         done
  65         if ! test "$found"
  66         then
  67                 echo "cannot find ipsec command -- \`$1' aborted" |
  68                         logger -s -p daemon.error -t ipsec_setup
  69                 exit 1
  70         fi
  71
  72         # Pick up IPsec configuration (until we have done this, successfully, we
  73         # do not know where errors should go, hence the explicit "daemon.error"s.)
  74         # Note the "--export", which exports the variables created.
  75         eval `ipsec _confread $config --optional --varprefix IPSEC --export --type config setup`
  76
  77         if test " $IPSEC_confreadstatus" != " "
  78         then
  79             case $1 in
  80             stop|--stop|_autostop)
  81                 echo "$IPSEC_confreadstatus -- \`$1' may not work" |
  82                         logger -s -p daemon.error -t ipsec_setup;;
  83
  84             *) echo "$IPSEC_confreadstatus -- \`$1' aborted" |
  85                     logger -s -p daemon.error -t ipsec_setup;
  86                 exit 1;;
  87             esac
  88         fi
  89
  90         IPSEC_confreadsection=${IPSEC_confreadsection:-setup}
  91         export IPSEC_confreadsection
  92
  93         IPSECsyslog=${IPSECsyslog-daemon.error}
  94         export IPSECsyslog
  95
  96         # misc setup
  97         umask 022
  98
  99         mkdir -p /var/run/pluto
 100 }
 101
 102 script_command() {
 103         if [ "${USER}" != "root" ]
 104         then
 105                 echo "permission denied (must be superuser)" |
 106                         logger -s -p $IPSECsyslog -t ipsec_setup 2>&1
 107                 exit 1
 108         fi
 109         # make sure all required directories exist
 110         if [ ! -d /var/run/pluto ]
 111         then
 112                 mkdir -p /var/run/pluto
 113         fi
 114         if [ ! -d /var/lock/subsys ]
 115         then
 116                 mkdir -p /var/lock/subsys
 117         fi
 118         tmp=/var/run/pluto/ipsec_setup.st
 119         outtmp=/var/run/pluto/ipsec_setup.out
 120         (
 121                 ipsec _realsetup $1
 122                 echo "$?" >$tmp
 123         ) > ${outtmp} 2>&1
 124         st=$?
 125         if test -f $tmp
 126         then
 127                 st=`cat $tmp`
 128                 rm -f $tmp
 129         fi
 130         if [ -f ${outtmp} ]; then
 131                 cat ${outtmp} | logger -s -p $IPSECsyslog -t ipsec_setup 2>&1
 132                 rm -f ${outtmp}
 133         fi
 134 }
 135
 136
 137 start() {
 138         script_init start "$@"
 139         script_command start "$@"
 140 }
 141
 142 stop() {
 143         script_init stop "$@"
 144         script_command stop "$@"
 145 }
 146
 147 restart() {
 148         script_init stop "$@"
 149         script_command stop "$@"
 150         script_command start "$@"
 151 }
 152
 153 status() {
 154         script_init status "$@"
 155         ipsec _realsetup status
 156 }
 157 EXTRA_COMMANDS=status
 158 EXTRA_HELP="    status  Show the status of the service"