blob: 443e2e4738a2c3749ca482e58f41ec4b9f77a494 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
|
#!/bin/sh
# Start or stop strongswan
# PROVIDE: strongswan
# REQUIRE: DAEMON
# BEFORE: LOGIN
# KEYWORD: shutdown
# strongswan_enable (bool):
# Set it to "YES" to enable strongswan
# Default is "NO"
# strongswan_interface (string):
# Set the control interface to use.
# Valid options are:
# "stroke" for the old ipsec/startr interface
# "vici" for the newer swanctl intrface
# Default is "%%INTERFACE%%"
. /etc/rc.subr
name=strongswan
desc="Strongswan IPsec startup script"
required_modules="ipsec"
rcvar=strongswan_enable
load_rc_config $name
: ${strongswan_enable:=NO}
: ${strongswan_interface:="%%INTERFACE%%"}
extra_commands="reload statusall"
charon_command=%%PREFIX%%/libexec/ipsec/charon
charon_pidfile=/var/run/charon.pid
swanctl_command=%%PREFIX%%/sbin/swanctl
case $strongswan_interface in
[Ss][Tt][Rr][Oo][Kk][Ee])
# "stroke"
command="%%PREFIX%%/sbin/ipsec"
start_precmd=command_args=start
stop_cmd="${command} stop"
status_cmd="${command} status"
reload_cmd="${command} reload"
statusall_cmd="${command} statusall"
;;
[Vv][Ii][Cc][Ii])
# "vici"
command=/usr/sbin/daemon
pidfile=/var/run/daemon-charon.pid
command_args="-S -P ${pidfile} ${charon_command} --use-syslog"
required_files=${charon_command}
extra_commands="reload statusall"
start_postcmd=${name}_swanctl_poststart
status_cmd="${swanctl_command} --stats"
reload_cmd=${name}_swanctl_reload
statusall_cmd=${name}_swanctl_statusall
;;
*)
# "default"
warn "\$strongswan_interface setting is invalid - options supported are \"stroke\" or \"vici\"."
exit 1
;;
esac
strongswan_swanctl_poststart()
{
local _waitmax=5
# Need to wait for charon to finish startup,
# else vici socket is unreadable
while [ ! -f ${charon_pidfile} ] && [ ${_waitmax} -gt 0 ]; do
sleep 1
_waitmax=$((_waitmax - 1))
done
${swanctl_command} --load-all --noprompt
}
strongswan_swanctl_reload()
{
${swanctl_command} --reload-settings
${swanctl_command} --load-all --noprompt
}
strongswan_swanctl_statusall()
{
${swanctl_command} --stats
${swanctl_command} --list-conns
${swanctl_command} --list-sas
}
run_rc_command "$1"
|
