/usr/lib/ipsec/setup is in libreswan 3.23-4.
This file is owned by root:root, with mode 0o755.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 | #!/bin/sh
# IPsec startup and shutdown command
# Copyright (C) 1998, 1999, 2001 Henry Spencer.
# Copyright (C) 2012 Paul Wouters <paul@libreswan.org>
# Copyright (C) 2013, 2017 Tuomo Soini <tis@foobar.fi>
# Copyright (C) 2016 Kim B. Heino <b@bbbs.net>
#
# This program is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2 of the License, or (at your
# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
# for more details.
#
# This is the version for use on Linux.
# Misc. paths (some of this should perhaps be overrideable from ipsec.conf).
rundir=/run/pluto
#pluto searches the current directory, so this is required for making it selinux compliant
cd /
#/etc/resolv.conf related paths
LIBRESWAN_RESOLV_CONF=${rundir}/libreswan-resolv-conf-backup
ORIG_RESOLV_CONF=/etc/resolv.conf
if [ $(ip addr list|grep -c cipsec) -ne 0 ]; then
echo "Cisco IPsec client is already loaded, aborting! (cipsec# device found)"
exit 1
fi
initsystem=unknown
if [ -d /run/systemd/system ]; then
initsystem=systemd
elif [ -f /sbin/start ]; then
if [ -r /etc/redhat-release ]; then
initsystem=rhsysv
else
initsystem=upstart
fi
elif [ -f /sbin/rc-service ]; then
initsystem=openrc
elif [ -x /etc/init.d/ipsec ]; then
initsystem=sysv
fi
case "$1" in
start|--start|_autostart)
# preliminaries
mkdir -p ${rundir}
chmod 700 ${rundir} > /dev/null 2>/dev/null
# starting a stack will unload any loaded stack first (same or different stack)
[ -f /proc/modules ] && ipsec _stackmanager start
# Finally start the pluto daemon in a restart loop
if [ ${initsystem} = systemd ]; then
systemctl status ipsec.service > /dev/null
RETVAL=$?
if [ $RETVAL -eq 0 ]; then
echo "systemd: ipsec service is already running"
exit 1
else
echo "Redirecting to: systemctl start ipsec.service"
exec systemctl start ipsec.service
fi
elif [ ${initsystem} = rhsysv ]; then
echo "Redirecting to: service ipsec start"
exec service ipsec start
elif [ ${initsystem} = upstart ]; then
echo "Redirecting to: start ipsec"
exec start ipsec
elif [ ${initsystem} = openrc ]; then
echo "Redirecting to: rc-service ipsec start"
exec rc-service ipsec start
elif [ ${initsystem} = sysv ]; then
echo "Redirecting to: /etc/init.d/ipsec start"
exec /etc/init.d/ipsec start
else
echo "Unknown init system in use - aborted"
exit 3
fi
exit 0
;;
stop|--stop|_autostop) # _autostop is same as stop
# Shut things down.
if [ ${initsystem} = systemd ]; then
echo "Redirecting to: systemctl stop ipsec.service"
# don't exec, we need to cleanup the IPsec stack afterwards
systemctl stop ipsec.service
elif [ ${initsystem} = rhsysv ]; then
echo "Redirecting to: service ipsec stop"
exec service ipsec stop
elif [ ${initsystem} = upstart ]; then
echo "Redirecting to: stop ipsec"
stop ipsec
elif [ ${initsystem} = openrc ]; then
echo "Redirecting to: rc-service ipsec stop"
exec rc-service ipsec stop
elif [ ${initsystem} = sysv ]; then
echo "Redirecting to: /etc/init.d/ipsec stop"
exec /etc/init.d/ipsec stop
else
echo "Unknown init system in use - aborted"
exit 3
fi
# Remove any loaded IPsec stack
[ -f /proc/modules ] && ipsec _stackmanager stop
# If stack is non-modular, we want to force clean too
[ -f /proc/net/pf_key ] && ipsec eroute --clear
[ -f /proc/net/pfkey ] && ip xfrm state flush && ip xfrm policy flush
# Cleaning up backup resolv.conf
if [ -e ${LIBRESWAN_RESOLV_CONF} ]; then
if grep 'Libreswan' ${ORIG_RESOLV_CONF} > /dev/null 2>&1; then
cp ${LIBRESWAN_RESOLV_CONF} ${ORIG_RESOLV_CONF}
fi
rm -f ${LIBRESWAN_RESOLV_CONF}
fi
exit 0
;;
status|--status)
if [ ${initsystem} = systemd ]; then
echo "Redirecting to: systemctl status ipsec.service"
exec systemctl status ipsec.service
elif [ ${initsystem} = rhsysv ]; then
echo "Redirecting to: service ipsec status"
exec service ipsec status
elif [ ${initsystem} = upstart ]; then
echo "Redirecting to: status ipsec"
exec status ipsec
elif [ ${initsystem} = openrc ]; then
echo "Redirecting to: rc-service ipsec status"
exec rc-service ipsec status
elif [ ${initsystem} = sysv ]; then
echo "Redirecting to: /etc/init.d/ipsec status"
exec /etc/init.d/ipsec status
else
echo "Unknown init system in use - aborted"
exit 3
fi
exit 0
;;
restart|--restart)
# assumes preparations for running have already been done, as service should be running now
if [ ${initsystem} = systemd ]; then
systemctl status ipsec.service > /dev/null
RETVAL=$?
if [ $RETVAL -ne 0 ]; then
echo "systemd: ipsec service is not running"
exit 1
else
# do not use 'restart' because systemd is overly "smart"
# and will refuse the restart when stopped.
echo "Redirecting to: systemctl stop+start ipsec.service"
systemctl stop ipsec.service
exec systemctl start ipsec.service
fi
elif [ ${initsystem} = rhsysv ]; then
echo "Redirecting to: service ipsec restart"
exec service ipsec restart
elif [ ${initsystem} = upstart ]; then
echo "Redirecting to: restart ipsec"
exec restart ipsec
elif [ ${initsystem} = openrc ]; then
echo "Redirecting to: rc-service ipsec restart"
exec rc-service ipsec restart
elif [ ${initsystem} = sysv ]; then
echo "Redirecting to: /etc/init.d/ipsec restart"
exec /etc/init.d/ipsec restart
else
echo "Unknown init system in use - aborted"
exit 3
fi
exit 0
;;
*)
echo "Usage: {--start|--stop|--restart|--status}" >&2
exit 2
esac
exit 0
|