1#! /bin/bash 2# SPDX-License-Identifier: BSD-3-Clause 3 4CRYPTO_DEV=${CRYPTO_DEV:-'--vdev="crypto_aesni_mb0"'} 5 6#generate cfg file for ipsec-secgw 7config_secgw() 8{ 9 cat <<EOF > ${SGW_CFG_FILE} 10#SP in IPv4 rules 11sp ipv4 in esp protect 7 pri 2 src ${REMOTE_IPV4}/32 dst ${LOCAL_IPV4}/32 \ 12sport 0:65535 dport 0:65535 13sp ipv4 in esp bypass pri 1 sport 0:65535 dport 0:65535 14 15#SP out IPv4 rules 16sp ipv4 out esp protect 7 pri 2 src ${LOCAL_IPV4}/32 dst ${REMOTE_IPV4}/32 \ 17sport 0:65535 dport 0:65535 18sp ipv4 out esp bypass pri 1 sport 0:65535 dport 0:65535 19 20#sp in IPv6 rules 21sp ipv6 in esp protect 9 pri 2 src ${REMOTE_IPV6}/128 dst ${LOCAL_IPV6}/128 \ 22sport 0:65535 dport 0:65535 23sp ipv6 in esp bypass pri 1 sport 0:65535 dport 0:65535 24 25#SP out IPv6 rules 26sp ipv6 out esp protect 9 pri 2 src ${LOCAL_IPV6}/128 dst ${REMOTE_IPV6}/128 \ 27sport 0:65535 dport 0:65535 28sp ipv6 out esp bypass pri 1 sport 0:65535 dport 0:65535 29 30#SA in rules 31sa in 7 cipher_algo 3des-cbc \ 32cipher_key \ 33de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \ 34auth_algo sha1-hmac \ 35auth_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \ 36mode transport ${SGW_CFG_XPRM_IN} 37 38sa in 9 cipher_algo 3des-cbc \ 39cipher_key \ 40de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \ 41auth_algo sha1-hmac \ 42auth_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \ 43mode transport ${SGW_CFG_XPRM_IN} 44 45#SA out rules 46sa out 7 cipher_algo 3des-cbc \ 47cipher_key \ 48de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \ 49auth_algo sha1-hmac \ 50auth_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \ 51mode transport ${SGW_CFG_XPRM_OUT} 52 53#SA out rules 54sa out 9 cipher_algo 3des-cbc \ 55cipher_key \ 56de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \ 57auth_algo sha1-hmac \ 58auth_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \ 59mode transport ${SGW_CFG_XPRM_OUT} 60 61#Routing rules 62rt ipv4 dst ${REMOTE_IPV4}/32 port 0 63rt ipv4 dst ${LOCAL_IPV4}/32 port 1 64 65rt ipv6 dst ${REMOTE_IPV6}/128 port 0 66rt ipv6 dst ${LOCAL_IPV6}/128 port 1 67 68#neighbours 69neigh port 0 ${REMOTE_MAC} 70neigh port 1 ${LOCAL_MAC} 71EOF 72 73 cat ${SGW_CFG_FILE} 74} 75