FYI:
XFRMi seems to be picking up fast. A proposed patch to OpenWRT network
scripts would add support for an xfrm device. I guess we/Libreswan should
merge our branch soon!
OpenWRT patch proposal suggest the whole interface creation and its
lifecycle could be managed by system network scripts.
I imagine on Debian/Fedora systemd-networkd would get similar support soon.
Or may be NetworkManager. I am not sure.
Note they also planned to add ip address there. I wonder how this would work
in various cases, road warrior, or BGP/routing protocol situations.
here is the config example for the interface, this not strongswan. It is
just network config as far as I understand. My guess is libreswan could
also use the same.
specific to A link to full patch set bellow.
--
This package adds scripts for xfrm interfaces support.
Example configuration via /etc/config/network:
config interface 'xfrm0'
option proto 'xfrm'
option mtu '1300'
option zone 'VPN'
option tunlink 'wan'
option ifid 30
config interface 'xfrm0_static'
option proto 'static'
option ifname '@xfrm0'
option ip6addr 'fe80::1/64'
option ipaddr '10.0.0.1/30'
Now set in strongswan IPsec policy:
if_id_in = 30
if_id_out = 30
https://patchwork.ozlabs.org/patch/1111499/
https://patchwork.ozlabs.org/patch/1111500/
--- Begin Message ---
This package adds scripts for xfrm interfaces support.
Example configuration via /etc/config/network:
config interface 'xfrm0'
option proto 'xfrm'
option mtu '1300'
option zone 'VPN'
option tunlink 'wan'
option ifid 30
config interface 'xfrm0_static'
option proto 'static'
option ifname '@xfrm0'
option ip6addr 'fe80::1/64'
option ipaddr '10.0.0.1/30'
Now set in strongswan IPsec policy:
if_id_in = 30
if_id_out = 30
---
package/network/config/xfrm/Makefile | 38 ++++++++++++++++++
package/network/config/xfrm/files/xfrm.sh | 65 +++++++++++++++++++++++++++++++
2 files changed, 103 insertions(+)
create mode 100644 package/network/config/xfrm/Makefile
create mode 100755 package/network/config/xfrm/files/xfrm.sh
diff --git a/package/network/config/xfrm/Makefile
b/package/network/config/xfrm/Makefile
new file mode 100644
index 0000000000..efc90cf318
--- /dev/null
+++ b/package/network/config/xfrm/Makefile
@@ -0,0 +1,38 @@
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=xfrm
+PKG_VERSION:=1
+PKG_RELEASE:=1
+PKG_LICENSE:=GPL-2.0
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/xfrm/Default
+ SECTION:=net
+ CATEGORY:=Network
+ MAINTAINER:=Andre Valentin <[email protected]>
+endef
+
+define Package/xfrm
+$(call Package/xfrm/Default)
+ TITLE:=XFRM IPsec Tunnel Interface config support
+ DEPENDS:=+kmod-xfrm-interface
+endef
+
+define Package/xfrm/description
+ XFRM IPsec Tunnel Interface config support (IPv4 and IPv6) in
/etc/config/network.
+endef
+
+define Build/Compile
+endef
+
+define Build/Configure
+endef
+
+define Package/xfrm/install
+ $(INSTALL_DIR) $(1)/lib/netifd/proto
+ $(INSTALL_BIN) ./files/xfrm.sh $(1)/lib/netifd/proto/xfrm.sh
+endef
+
+$(eval $(call BuildPackage,xfrm))
diff --git a/package/network/config/xfrm/files/xfrm.sh
b/package/network/config/xfrm/files/xfrm.sh
new file mode 100755
index 0000000000..df28d38613
--- /dev/null
+++ b/package/network/config/xfrm/files/xfrm.sh
@@ -0,0 +1,65 @@
+#!/bin/sh
+
+[ -n "$INCLUDE_ONLY" ] || {
+ . /lib/functions.sh
+ . /lib/functions/network.sh
+ . ../netifd-proto.sh
+ init_proto "$@"
+}
+
+proto_xfrm_setup() {
+ local cfg="$1"
+ local mode="xfrm"
+
+ local tunlink ifid mtu zone
+ json_get_vars tunlink ifid mtu zone
+
+ proto_init_update "$cfg" 1
+
+ proto_add_tunnel
+ json_add_string mode "$mode"
+ json_add_int mtu "${mtu:-1280}"
+
+ [ -z "$tunlink" ] && {
+ proto_notify_error "$cfg" NO_TUNLINK
+ proto_block_restart "$cfg"
+ exit
+ }
+ json_add_string link "$tunlink"
+
+ [ -z "$ifid" ] && {
+ proto_notify_error "$cfg" NO_IFID
+ proto_block_restart "$cfg"
+ exit
+ }
+ json_add_object 'data'
+ [ -n "$ifid" ] && json_add_int ifid "$ifid"
+ json_close_object
+
+ proto_close_tunnel
+
+ proto_add_data
+ [ -n "$zone" ] && json_add_string zone "$zone"
+ proto_close_data
+
+ proto_send_update "$cfg"
+}
+
+proto_xfrm_teardown() {
+ local cfg="$1"
+}
+
+proto_xfrm_init_config() {
+ no_device=1
+ available=1
+
+ proto_config_add_int "mtu"
+ proto_config_add_string "tunlink"
+ proto_config_add_string "zone"
+ proto_config_add_int "ifid"
+}
+
+
+[ -n "$INCLUDE_ONLY" ] || {
+ [ -f /lib/modules/$(uname -r)/xfrm_interface.ko -o -d
/sys/module/xfrm_interface ] && add_protocol xfrm
+}
--
2.11.0
_______________________________________________
openwrt-devel mailing list
[email protected]
https://lists.openwrt.org/mailman/listinfo/openwrt-devel
--- End Message ---
_______________________________________________
Swan-dev mailing list
[email protected]
https://lists.libreswan.org/mailman/listinfo/swan-dev
