src/starter/netkey.c

   1 /* strongSwan netkey starter
   2  * Copyright (C) 2001-2002 Mathieu Lafon - Arkoon Network Security
   3  *
   4  * This program is free software; you can redistribute it and/or modify it
   5  * under the terms of the GNU General Public License as published by the
   6  * Free Software Foundation; either version 2 of the License, or (at your
   7  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   8  *
   9  * This program is distributed in the hope that it will be useful, but
  10  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  11  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  12  * for more details.
  13  */
  14
  15 #include <sys/types.h>
  16 #include <sys/stat.h>
  17 #include <stdlib.h>
  18
  19 #include <freeswan.h>
  20
  21 #include "../pluto/constants.h"
  22 #include "../pluto/defs.h"
  23 #include "../pluto/log.h"
  24
  25 #include "files.h"
  26
  27 bool
  28 starter_netkey_init(void)
  29 {
  30         struct stat stb;
  31
  32         if (stat(PROC_NETKEY, &stb) != 0)
  33         {
  34                 /* af_key module makes the netkey proc interface visible */
  35                 if (stat(PROC_MODULES, &stb) == 0)
  36                 {
  37                         ignore_result(system("modprobe -qv af_key"));
  38                 }
  39
  40                 /* now test again */
  41                 if (stat(PROC_NETKEY, &stb) != 0)
  42                 {
  43                         DBG(DBG_CONTROL,
  44                                 DBG_log("kernel appears to lack the native netkey IPsec stack")
  45                         )
  46                         return FALSE;
  47                 }
  48         }
  49
  50         /* make sure that all required IPsec modules are loaded */
  51         if (stat(PROC_MODULES, &stb) == 0)
  52         {
  53                 ignore_result(system("modprobe -qv ah4"));
  54                 ignore_result(system("modprobe -qv esp4"));
  55                 ignore_result(system("modprobe -qv ipcomp"));
  56                 ignore_result(system("modprobe -qv xfrm4_tunnel"));
  57                 ignore_result(system("modprobe -qv xfrm_user"));
  58         }
  59
  60         DBG(DBG_CONTROL,
  61                 DBG_log("Found netkey IPsec stack")
  62         )
  63         return TRUE;
  64 }
  65
  66 void
  67 starter_netkey_cleanup(void)
  68 {
  69         if (system("ip xfrm state > /dev/null 2>&1") == 0)
  70         {
  71                 ignore_result(system("ip xfrm state flush"));
  72                 ignore_result(system("ip xfrm policy flush"));
  73         }
  74         else if (system("type setkey > /dev/null 2>&1") == 0)
  75         {
  76                 ignore_result(system("setkey -F"));
  77                 ignore_result(system("setkey -FP"));
  78         }
  79         else
  80         {
  81                 plog("WARNING: cannot flush IPsec state/policy database");
  82         }
  83 }