1#! /bin/bash 2# SPDX-License-Identifier: BSD-3-Clause 3 4CRYPTO_DEV=${CRYPTO_DEV:-'--vdev="crypto_aesni_mb0"'} 5 6#generate cfg file for ipsec-secgw 7config_secgw() 8{ 9 cat <<EOF > ${SGW_CFG_FILE} 10#SP in IPv4 rules 11sp ipv4 in esp protect 7 pri 2 src ${REMOTE_IPV4}/32 dst ${LOCAL_IPV4}/32 \ 12sport 0:65535 dport 0:65535 13sp ipv4 in esp bypass pri 1 sport 0:65535 dport 0:65535 14 15#SP out IPv4 rules 16sp ipv4 out esp protect 7 pri 2 src ${LOCAL_IPV4}/32 dst ${REMOTE_IPV4}/32 \ 17sport 0:65535 dport 0:65535 18sp ipv4 out esp bypass pri 1 sport 0:65535 dport 0:65535 19 20#sp in IPv6 rules 21sp ipv6 in esp protect 9 pri 2 src ${REMOTE_IPV6}/128 dst ${LOCAL_IPV6}/128 \ 22sport 0:65535 dport 0:65535 23sp ipv6 in esp bypass pri 1 sport 0:65535 dport 0:65535 24 25#SP out IPv6 rules 26sp ipv6 out esp protect 9 pri 2 src ${LOCAL_IPV6}/128 dst ${REMOTE_IPV6}/128 \ 27sport 0:65535 dport 0:65535 28sp ipv6 out esp bypass pri 1 sport 0:65535 dport 0:65535 29 30#SA in rules 31sa in 7 cipher_algo aes-128-cbc \ 32cipher_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \ 33auth_algo sha1-hmac \ 34auth_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \ 35mode transport ${SGW_CFG_XPRM_IN} 36 37sa in 9 cipher_algo aes-128-cbc \ 38cipher_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \ 39auth_algo sha1-hmac \ 40auth_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \ 41mode transport ${SGW_CFG_XPRM_IN} 42 43#SA out rules 44sa out 7 cipher_algo aes-128-cbc \ 45cipher_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \ 46auth_algo sha1-hmac \ 47auth_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \ 48mode transport ${SGW_CFG_XPRM_OUT} 49 50#SA out rules 51sa out 9 cipher_algo aes-128-cbc \ 52cipher_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \ 53auth_algo sha1-hmac \ 54auth_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \ 55mode transport ${SGW_CFG_XPRM_OUT} 56 57#Routing rules 58rt ipv4 dst ${REMOTE_IPV4}/32 port 0 59rt ipv4 dst ${LOCAL_IPV4}/32 port 1 60 61rt ipv6 dst ${REMOTE_IPV6}/128 port 0 62rt ipv6 dst ${LOCAL_IPV6}/128 port 1 63 64#neighbours 65neigh port 0 ${REMOTE_MAC} 66neigh port 1 ${LOCAL_MAC} 67EOF 68 69 cat ${SGW_CFG_FILE} 70} 71