| --- a/feeds/packages/net/strongswan/Makefile |
| +++ b/feeds/packages/net/strongswan/Makefile |
| @@ -259,6 +259,7 @@ $(call Package/strongswan/Default) |
| TITLE+= (default) |
| DEPENDS:= strongswan \ |
| +strongswan-charon \ |
| + +strongswan-ipsec \ |
| +strongswan-mod-aes \ |
| +strongswan-mod-attr \ |
| +strongswan-mod-connmark \ |
| @@ -536,25 +537,8 @@ define Package/strongswan-ipsec/conffile |
| endef |
| |
| define Package/strongswan-ipsec/install |
| - $(INSTALL_DIR) $(1)/etc/ $(1)/usr/sbin |
| - $(INSTALL_CONF) $(PKG_INSTALL_DIR)/etc/ipsec.conf $(1)/etc/ |
| - echo -e "\ninclude /var/ipsec/ipsec.conf" >> $(1)/etc/ipsec.conf |
| - $(INSTALL_CONF) ./files/ipsec.secrets $(1)/etc/ |
| - echo -e "\ninclude /var/ipsec/ipsec.secrets" >> $(1)/etc/ipsec.secrets |
| - $(INSTALL_CONF) ./files/ipsec.user $(1)/etc/ |
| - $(INSTALL_DIR) $(1)/etc/init.d |
| - $(INSTALL_BIN) ./files/ipsec.init $(1)/etc/init.d/ipsec |
| - $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/ipsec $(1)/usr/sbin/ |
| -endef |
| - |
| -define Package/strongswan-ipsec/postinst |
| -#!/bin/sh |
| - |
| -[ -z "$${IPKG_INSTROOT}" ] || exit 0 |
| - |
| -opkg list-changed-conffiles | grep -qx /etc/ipsec.conf || { |
| - rm -f /etc/ipsec.conf-opkg |
| -} |
| + $(INSTALL_DIR) $(1)/etc/config |
| + $(INSTALL_DATA) ./files/ipsec.conf $(1)/etc/config/ipsec |
| endef |
| |
| define Package/strongswan-libnttfft/install |
| --- /dev/null |
| +++ b/feeds/packages/net/strongswan/files/ipsec.conf |
| @@ -0,0 +1,38 @@ |
| +config 'ipsec' |
| + |
| +config 'remote' 'TEST' |
| + option 'enabled' '0' |
| + option 'gateway' '10.10.20.253' |
| + option 'authentication_method' 'psk' |
| + option 'pre_shared_key' '123456789' |
| + option 'mode' 'tunnel' |
| + list 'crypto_proposal' 'phase_1_settings' |
| + list 'tunnel' 'TUNNEL' |
| + list 'transport' 'TRANSPORT' |
| + |
| +config 'crypto_proposal' 'phase_1_settings' |
| + option 'encryption_algorithm' 'aes128' |
| + option 'hash_algorithm' 'sha1' |
| + option 'dh_group' 'modp768' |
| + |
| +config 'tunnel' 'TUNNEL' |
| + option 'mode' 'add' |
| + list 'local_subnet' '192.168.1.0/24' |
| + list 'remote_subnet' '192.168.2.0/24' |
| + list 'crypto_proposal' 'phase_2_settings' |
| + option 'keyexchange' 'ikev2' |
| + option 'ikelifetime' '10800' |
| + option 'lifetime' '3600' |
| + |
| +config tunnel 'TRANSPORT' |
| + option keyexchange 'ikev2' |
| + option ikelifetime '10800' |
| + option lifetime '3600' |
| + option startaction 'none' |
| + option hw_offload 'packet' |
| + list crypto_proposal 'phase_2_settings' |
| + |
| +config 'crypto_proposal' 'phase_2_settings' |
| + option 'encryption_algorithm' 'aes128' |
| + option 'hash_algorithm' 'sha1' |
| + option 'dh_group' 'modp768' |
| --- a/feeds/packages/net/strongswan/files/swanctl.init |
| +++ b/feeds/packages/net/strongswan/files/swanctl.init |
| @@ -241,6 +241,7 @@ config_child() { |
| local if_id |
| local rekeytime |
| local rekeybytes |
| + local replay_window |
| local lifebytes |
| local rekeypackets |
| local lifepackets |
| @@ -258,6 +259,7 @@ config_child() { |
| config_get interface "$conf" interface "" |
| config_get hw_offload "$conf" hw_offload "" |
| config_get priority "$conf" priority "" |
| + config_get replay_window "$conf" replay_window 32 |
| config_get rekeybytes "$conf" rekeybytes "" |
| config_get lifebytes "$conf" lifebytes "" |
| config_get rekeypackets "$conf" rekeypackets "" |
| @@ -323,7 +325,7 @@ config_child() { |
| esac |
| |
| case "$hw_offload" in |
| - yes|no|auto|"") |
| + yes|no|auto|crypto|packet|"") |
| ;; |
| *) |
| fatal "hw_offload value $hw_offload invalid" |
| @@ -339,6 +341,7 @@ config_child() { |
| [ -n "$remote_subnet" ] && swanctl_xappend4 "remote_ts = $remote_subnet" |
| |
| [ -n "$hw_offload" ] && swanctl_xappend4 "hw_offload = $hw_offload" |
| + [ -n "$replay_window" ] && swanctl_xappend4 "replay_window = $replay_window" |
| [ $ipcomp -eq 1 ] && swanctl_xappend4 "ipcomp = 1" |
| [ -n "$interface" ] && swanctl_xappend4 "interface = $interface" |
| [ -n "$priority" ] && swanctl_xappend4 "priority = $priority" |