|
Lines 13-20
Link Here
|
| 13 |
# strongswan_interface (string): |
13 |
# strongswan_interface (string): |
| 14 |
# Set the control interface to use. |
14 |
# Set the control interface to use. |
| 15 |
# Valid options are: |
15 |
# Valid options are: |
| 16 |
# "stroke" for the old ipsec/startr interface |
16 |
# "stroke" for the old ipsec/starter interface |
| 17 |
# "vici" for the newer swanctl intrface |
17 |
# "vici" for the newer swanctl interface |
| 18 |
# Default is "stroke" |
18 |
# Default is "stroke" |
| 19 |
|
19 |
|
| 20 |
. /etc/rc.subr |
20 |
. /etc/rc.subr |
|
Lines 26-39
rcvar=strongswan_enable
Link Here
|
| 26 |
load_rc_config $name |
26 |
load_rc_config $name |
| 27 |
|
27 |
|
| 28 |
: ${strongswan_enable:=NO} |
28 |
: ${strongswan_enable:=NO} |
| 29 |
: ${strongswan_interface:="stroke"} |
29 |
strongswan_interface=${strongswan_interface:-"stroke"} |
| 30 |
|
30 |
|
| 31 |
extra_commands="reload statusall" |
31 |
extra_commands="reload statusall" |
| 32 |
|
32 |
|
| 33 |
charon_command=%%PREFIX%%/libexec/ipsec/charon |
|
|
| 34 |
charon_pidfile=/var/run/charon.pid |
| 35 |
swanctl_command=%%PREFIX%%/sbin/swanctl |
| 36 |
|
| 37 |
case $strongswan_interface in |
33 |
case $strongswan_interface in |
| 38 |
[Ss][Tt][Rr][Oo][Kk][Ee]) |
34 |
[Ss][Tt][Rr][Oo][Kk][Ee]) |
| 39 |
# "stroke" |
35 |
# "stroke" |
|
Lines 48-97
case $strongswan_interface in
Link Here
|
| 48 |
[Vv][Ii][Cc][Ii]) |
44 |
[Vv][Ii][Cc][Ii]) |
| 49 |
# "vici" |
45 |
# "vici" |
| 50 |
command=/usr/sbin/daemon |
46 |
command=/usr/sbin/daemon |
|
|
47 |
charon_command=%%PREFIX%%/libexec/ipsec/charon |
| 48 |
charon_pidfile=/var/run/charon.pid |
| 49 |
swanctl_command=%%PREFIX%%/sbin/swanctl |
| 51 |
pidfile=/var/run/daemon-charon.pid |
50 |
pidfile=/var/run/daemon-charon.pid |
| 52 |
command_args="-S -P ${pidfile} ${charon_command} --use-syslog" |
51 |
command_args="-S -P ${pidfile} ${charon_command} --use-syslog" |
| 53 |
|
52 |
|
| 54 |
required_files=${charon_command} |
|
|
| 55 |
extra_commands="reload statusall" |
| 56 |
|
| 57 |
start_postcmd=${name}_swanctl_poststart |
53 |
start_postcmd=${name}_swanctl_poststart |
| 58 |
status_cmd="${swanctl_command} --stats" |
54 |
status_cmd=${name}_swanctl_status |
|
|
55 |
stop_postcmd="wait_charon stop" |
| 59 |
reload_cmd=${name}_swanctl_reload |
56 |
reload_cmd=${name}_swanctl_reload |
| 60 |
statusall_cmd=${name}_swanctl_statusall |
57 |
statusall_cmd=${name}_swanctl_statusall |
| 61 |
;; |
58 |
;; |
| 62 |
|
59 |
|
| 63 |
*) |
60 |
*) |
| 64 |
# "default" |
61 |
# "default" |
| 65 |
warn "\$strongswan_interface setting is invalid - options supported are \"stroke\" or \"vici\"." |
62 |
warn "\$strongswan_interface setting is invalid - supported options are \"stroke\" or \"vici\"." |
| 66 |
exit 1 |
63 |
exit 1 |
| 67 |
;; |
64 |
;; |
| 68 |
esac |
65 |
esac |
| 69 |
|
66 |
|
| 70 |
strongswan_swanctl_poststart() |
67 |
strongswan_swanctl_poststart() |
| 71 |
{ |
68 |
{ |
| 72 |
local _waitmax=5 |
69 |
wait_charon |
| 73 |
|
|
|
| 74 |
# Need to wait for charon to finish startup, |
| 75 |
# else vici socket is unreadable |
| 76 |
while [ ! -f ${charon_pidfile} ] && [ ${_waitmax} -gt 0 ]; do |
| 77 |
sleep 1 |
| 78 |
_waitmax=$((_waitmax - 1)) |
| 79 |
done |
| 80 |
|
70 |
|
| 81 |
${swanctl_command} --load-all --noprompt |
71 |
${swanctl_command} --load-all --noprompt |
| 82 |
} |
72 |
} |
| 83 |
|
73 |
|
| 84 |
strongswan_swanctl_reload() |
74 |
strongswan_swanctl_reload() |
| 85 |
{ |
75 |
{ |
|
|
76 |
check_charon |
| 77 |
|
| 86 |
${swanctl_command} --reload-settings |
78 |
${swanctl_command} --reload-settings |
| 87 |
${swanctl_command} --load-all --noprompt |
79 |
${swanctl_command} --load-all --noprompt |
| 88 |
} |
80 |
} |
| 89 |
|
81 |
|
|
|
82 |
strongswan_swanctl_status() |
| 83 |
{ |
| 84 |
check_charon |
| 85 |
|
| 86 |
${swanctl_command} --stats |
| 87 |
} |
| 88 |
|
| 90 |
strongswan_swanctl_statusall() |
89 |
strongswan_swanctl_statusall() |
| 91 |
{ |
90 |
{ |
|
|
91 |
check_charon |
| 92 |
|
| 92 |
${swanctl_command} --stats |
93 |
${swanctl_command} --stats |
| 93 |
${swanctl_command} --list-conns |
94 |
${swanctl_command} --list-conns |
| 94 |
${swanctl_command} --list-sas |
95 |
${swanctl_command} --list-sas |
| 95 |
} |
96 |
} |
| 96 |
|
97 |
|
|
|
98 |
check_charon() |
| 99 |
{ |
| 100 |
if [ ! -e "${charon_pidfile}" ]; then |
| 101 |
echo "${name} is not running." >&2 |
| 102 |
exit 7 |
| 103 |
fi |
| 104 |
} |
| 105 |
|
| 106 |
wait_charon() |
| 107 |
{ |
| 108 |
if [ "$1" = "stop" ]; then |
| 109 |
charon_status="[ -f ${charon_pidfile} ]" |
| 110 |
else |
| 111 |
charon_status="[ ! -f ${charon_pidfile} ]" |
| 112 |
fi |
| 113 |
|
| 114 |
local _waitmax=5 |
| 115 |
|
| 116 |
# Need to wait for charon, |
| 117 |
# else vici socket is unreadable |
| 118 |
while eval "${charon_status}" && [ ${_waitmax} -gt 0 ]; do |
| 119 |
sleep 1 |
| 120 |
_waitmax=$((_waitmax - 1)) |
| 121 |
done |
| 122 |
} |
| 123 |
|
| 97 |
run_rc_command "$1" |
124 |
run_rc_command "$1" |