mirror/setup-ipsec-vpn
1
0
Fork 0
mirror of synced 2024-11-25 06:16:07 +03:00
Code Issues Projects Releases Wiki Activity

New Libreswan version

Browse Source 
- Upgrade Libreswan to 3.28
- Patches applied for Debian and CentOS 6. See 1659d03
This commit is contained in:
hwdsl2 2019-06-09 00:15:11 -05:00
parent 6c0c006d24
commit f69a0a9c97
2 changed files with 20 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
vpnsetup.sh
View File

@ -170,7 +170,7 @@ apt-get -yq install fail2ban || exiterr2
bigecho "Compiling and installing Libreswan..." bigecho "Compiling and installing Libreswan..."
SWAN_VER=3.27 SWAN_VER=3.28
swan_file="libreswan-$SWAN_VER.tar.gz" swan_file="libreswan-$SWAN_VER.tar.gz"
swan_url1="https://github.com/libreswan/libreswan/archive/v$SWAN_VER.tar.gz" swan_url1="https://github.com/libreswan/libreswan/archive/v$SWAN_VER.tar.gz"
swan_url2="https://download.libreswan.org/$swan_file" swan_url2="https://download.libreswan.org/$swan_file"
@ -180,10 +180,21 @@ fi
/bin/rm -rf "/opt/src/libreswan-$SWAN_VER" /bin/rm -rf "/opt/src/libreswan-$SWAN_VER"
tar xzf "$swan_file" && /bin/rm -f "$swan_file" tar xzf "$swan_file" && /bin/rm -f "$swan_file"
cd "libreswan-$SWAN_VER" || exit 1 cd "libreswan-$SWAN_VER" || exit 1
if ! printf '%s' "$os_type" | head -n 1 | grep -qiF ubuntu; then
apt-get -yq install patch || exiterr2
patch_url1="https://raw.githubusercontent.com/libreswan/libreswan/37c4736/programs/barf/barf.in"
patch_url2="https://github.com/libreswan/libreswan/commit/716f4b7.patch"
wget -t 3 -T 30 -nv -O programs/barf/barf.in "$patch_url1" || exit 1
wget -t 3 -T 30 -nv -O xfrm.patch "$patch_url2" || exit 1
patch -s -p1 < xfrm.patch || exit 1
/bin/rm -f xfrm.patch
fi
cat > Makefile.inc.local <<'EOF' cat > Makefile.inc.local <<'EOF'
WERROR_CFLAGS = WERROR_CFLAGS =
USE_DNSSEC = false USE_DNSSEC = false
USE_DH31 = false USE_DH31 = false
USE_NSS_AVA_COPY = true
USE_NSS_IPSEC_PROFILE = false
USE_GLIBC_KERN_FLIP_HEADERS = true USE_GLIBC_KERN_FLIP_HEADERS = true
EOF EOF
if [ "$(packaging/utils/lswan_detect.sh init)" = "systemd" ]; then if [ "$(packaging/utils/lswan_detect.sh init)" = "systemd" ]; then
@ -234,6 +245,7 @@ conn shared
dpddelay=30 dpddelay=30
dpdtimeout=120 dpdtimeout=120
dpdaction=clear dpdaction=clear
ikev2=never
ike=aes256-sha2,aes128-sha2,aes256-sha1,aes128-sha1,aes256-sha2;modp1024,aes128-sha1;modp1024 ike=aes256-sha2,aes128-sha2,aes256-sha1,aes128-sha1,aes256-sha2;modp1024,aes128-sha1;modp1024
phase2alg=aes_gcm-null,aes128-sha1,aes256-sha1,aes256-sha2_512,aes128-sha2,aes256-sha2 phase2alg=aes_gcm-null,aes128-sha1,aes256-sha1,aes256-sha2_512,aes128-sha2,aes256-sha2
sha2-truncbug=yes sha2-truncbug=yes
@ -258,7 +270,6 @@ conn xauth-psk
modecfgpull=yes modecfgpull=yes
xauthby=file xauthby=file
ike-frag=yes ike-frag=yes
ikev2=never
cisco-unity=yes cisco-unity=yes
also=shared also=shared
EOF EOF

9
vpnsetup_centos.sh
View File

@ -160,7 +160,7 @@ yum "$REPO1" -y install fail2ban || exiterr2
bigecho "Compiling and installing Libreswan..." bigecho "Compiling and installing Libreswan..."
SWAN_VER=3.27 SWAN_VER=3.28
swan_file="libreswan-$SWAN_VER.tar.gz" swan_file="libreswan-$SWAN_VER.tar.gz"
swan_url1="https://github.com/libreswan/libreswan/archive/v$SWAN_VER.tar.gz" swan_url1="https://github.com/libreswan/libreswan/archive/v$SWAN_VER.tar.gz"
swan_url2="https://download.libreswan.org/$swan_file" swan_url2="https://download.libreswan.org/$swan_file"
@ -170,10 +170,15 @@ fi
/bin/rm -rf "/opt/src/libreswan-$SWAN_VER" /bin/rm -rf "/opt/src/libreswan-$SWAN_VER"
tar xzf "$swan_file" && /bin/rm -f "$swan_file" tar xzf "$swan_file" && /bin/rm -f "$swan_file"
cd "libreswan-$SWAN_VER" || exit 1 cd "libreswan-$SWAN_VER" || exit 1
if grep -qs "release 6" /etc/redhat-release; then
sed -i '28iLDFLAGS += -lrt' testing/timecheck/Makefile
fi
cat > Makefile.inc.local <<'EOF' cat > Makefile.inc.local <<'EOF'
WERROR_CFLAGS = WERROR_CFLAGS =
USE_DNSSEC = false USE_DNSSEC = false
USE_DH31 = false USE_DH31 = false
USE_NSS_AVA_COPY = true
USE_NSS_IPSEC_PROFILE = false
USE_GLIBC_KERN_FLIP_HEADERS = true USE_GLIBC_KERN_FLIP_HEADERS = true
EOF EOF
NPROCS=$(grep -c ^processor /proc/cpuinfo) NPROCS=$(grep -c ^processor /proc/cpuinfo)
@ -221,6 +226,7 @@ conn shared
dpddelay=30 dpddelay=30
dpdtimeout=120 dpdtimeout=120
dpdaction=clear dpdaction=clear
ikev2=never
ike=aes256-sha2,aes128-sha2,aes256-sha1,aes128-sha1,aes256-sha2;modp1024,aes128-sha1;modp1024 ike=aes256-sha2,aes128-sha2,aes256-sha1,aes128-sha1,aes256-sha2;modp1024,aes128-sha1;modp1024
phase2alg=aes_gcm-null,aes128-sha1,aes256-sha1,aes256-sha2_512,aes128-sha2,aes256-sha2 phase2alg=aes_gcm-null,aes128-sha1,aes256-sha1,aes256-sha2_512,aes128-sha2,aes256-sha2
sha2-truncbug=yes sha2-truncbug=yes
@ -245,7 +251,6 @@ conn xauth-psk
modecfgpull=yes modecfgpull=yes
xauthby=file xauthby=file
ike-frag=yes ike-frag=yes
ikev2=never
cisco-unity=yes cisco-unity=yes
also=shared also=shared
EOF EOF