Re: FreeS/WAN in DMZ

This is a cryptographically signed message in MIME format.

--------------ms020808080805070806000108
Content-Type: multipart/mixed;
 boundary="------------080402000703090009060604"

This is a multi-part message in MIME format.
--------------080402000703090009060604
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit

Michal Ludvig told me that:
> I'm configuring freeswan 1.99 on a machine in DMZ which has only one 
> network card with two IP addresses - one private from the internal 
> address space and one public. I want pluto to listen at least on the 
> public address but it insists on listening only on the internal address 
> (which is listed first in the 'ip addr' list. Is there a way to convince 
> it to listen on the specific address? Of course I could swap the order 
> of addresses on the interface but it's a bit fragile solution.
> 
> I tried interfaces=%defaultroute, interfaces="ipsec0=eth0 ipsec1=eth0", 
> the public address is in the right= line, etc. Nothing helped so far.

OK, replying to myself - as I haven't found a solution I had to develop 
it myself ;-)

Imagine an interface with more addresses but w/o using aliases:
~ # ip -f inet addr show dev eth0
2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
     inet IN.TE.RN.AL/24 scope global eth0
     inet EX.TE.RN.AL/24 scope global eth0

Similar setup isn't unusual in DMZ for example.

In most cases you want to make IPsec connections only with other 
computers outside of your network, so you need to set up tunnel on the 
EX.TE.RN.AL address and let pluto open the port udp/500 on that address 
as well.

Attached is a patch for _startklips that extends the syntax
	interfaces="ipsec0=eth0"
to allow selecting one of the addresses. Now one can write
	interfaces="ipsec0=eth0[EX.TE.RN.AL]"

As far as I looked into the sources, modifying _startklips is enough in
this case because pluto selects the listen-on address from those set to 
ipsecN interfaces.

The only drawback is that it requires the 'ip' command, but I believe 
it's installed on all modern Linux systems.

Any comments?
Is this a correct approach?
Could you add it to your repository?

BTW I did the patch against 1.99 sources.

Michal Ludvig
-- 
* A mouse is a device used to point at the xterm you want to type in.
* Personal homepage - http://www.logix.cz/~mic

--------------080402000703090009060604
Content-Type: text/plain;
 name="startklips-1.diff"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="startklips-1.diff"

# 
# This patch extends the syntax of interfaces= line in /etc/ipsec.conf
# For interfaces with more than one addres it's now possible to 
# specify which one should be used for the tunnel and for listening 
# for ISAKMP messages.
# Of course it's backward compatible - you don't need to change your 
# config unless you want to.
# Example:
# 2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
#    inet 10.20.0.22/20 scope global eth0
#    inet 172.16.0.2/24 scope global eth0
# If you want pluto to use 172.16.0.2 instead of 10.20.0.22 set
# interfaces= in /etc/ipsec.conf to:
#    interfaces="ipsec0=eth0[172.16.0.2]"
# 

--- _startklips	2002-11-01 01:49:20.000000000 +0100
+++ _startklips.mludvig	2003-09-12 21:12:30.000000000 +0200
@@ -84,7 +84,8 @@
 klipsinterface() {
 	# pull apart the interface spec
 	virt=`expr $1 : '\([^=]*\)=.*'`
-	phys=`expr $1 : '[^=]*=\(.*\)'`
+	phys=`expr $1 : '[^=]*=\([^\[]*\)'`
+	req=`expr $1 : '[^=]*=[^\[]*\[\(.*\)\]'`
 	case "$virt" in
 	ipsec[0-9])	;;
 	*)	echo "invalid interface \`$virt' in \`$1'" ; exit 1	;;
@@ -92,22 +93,23 @@
 
 	# figure out ifconfig for interface
 	addr=
-	eval `ifconfig $phys |
-		awk '$1 == "inet" && $2 ~ /^addr:/ && $NF ~ /^Mask:/ {
-			gsub(/:/, " ", $0)
-			print "addr=" $3
-			other = $5
-			if ($4 == "Bcast")
-				print "type=broadcast"
-			else if ($4 == "P-t-P")
-				print "type=pointopoint"
-			else if (NF == 5) {
-				print "type="
-				other = ""
-			} else
-				print "type=unknown"
-			print "otheraddr=" other
-			print "mask=" $NF
+	eval `ip -f inet addr show dev $phys |
+		awk -v req=$req '
+		NR == 1 {
+			if ($3 ~ /BROADCAST/)
+				print "type=broadcast";
+			if ($4 ~ /mtu/)
+				print "omtu=" $5;
+		}
+		
+		$1 == "inet" && !have_addr {
+			split ($2, ad, "/");
+			if (req ~ /^$/ || (req !~ /^$/ && ad[1] == req))
+			{
+				printf ("addr=%s\n", ad[1]);
+				printf ("prefix=%s\n", ad[2]);
+				have_addr=1;
+			}
 		}'`
 	if test " $addr" = " "
 	then
@@ -125,11 +127,12 @@
 	else
 		mtu=
 	fi
-	echo "KLIPS $virt on $phys $addr/$mask $type $otheraddr $mtu" | logonly
+	echo "KLIPS $virt on $phys $addr/$prefix" 
 
 	# attach the interface and bring it up
 	ipsec tncfg --attach --virtual $virt --physical $phys
-	ifconfig $virt inet $addr $type $otheraddr netmask $mask $mtu
+	ip link set dev $virt up
+	ip addr add $addr/$prefix dev $virt
 
 	# if %defaultroute, note the facts
 	if test " $2" != " "

--------------080402000703090009060604--

--------------ms020808080805070806000108
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEH
AQAAoIIJbjCCAxUwggJ+oAMCAQICAwpUQjANBgkqhkiG9w0BAQQFADCBkjEL
MAkGA1UEBhMCWkExFTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJ
Q2FwZSBUb3duMQ8wDQYDVQQKEwZUaGF3dGUxHTAbBgNVBAsTFENlcnRpZmlj
YXRlIFNlcnZpY2VzMSgwJgYDVQQDEx9QZXJzb25hbCBGcmVlbWFpbCBSU0Eg
MjAwMC44LjMwMB4XDTAzMDcxMTEzMzMzMloXDTA0MDcxMDEzMzMzMlowWjEP
MA0GA1UEBBMGTHVkdmlnMQ8wDQYDVQQqEwZNaWNoYWwxFjAUBgNVBAMTDU1p
Y2hhbCBMdWR2aWcxHjAcBgkqhkiG9w0BCQEWD21pY2hhbEBsb2dpeC5jejCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMNjvRsPqSGyI1vV9Umr
+ziHJhN+sj1/aqlkItjrJzmFvggDycHClp3+2i+FPo2kyJixWhSLBIdCCv1k
zjub6azfVRZkkwIMgOYExAQPxvDCQb2V2Q+GNhz25gGgNX+KXaO46JkqhjA3
zlrcvisGuGaJ+aSJiUwXxEQCcMBlUlXFDqYK3JXrkRO/ROzkzzjv+ROtqykM
j54jcUDYmsUwTwfA7hmXiImqJMAof+oaS2tBrgzHutbeHdcYgrjA1HeV6Ldn
5k3JiHUvdPN/bJ0ukLvRIxZaDxEt2ABAbdCPpzsH8XlN/BURUP5g5fUuvBVK
9XepDs3rgsR2kaFICYLMqFcCAwEAAaMsMCowGgYDVR0RBBMwEYEPbWljaGFs
QGxvZ2l4LmN6MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQEEBQADgYEACFdY
sdAE3qiFsQjAmGlAtv2+dbUKQVjSn87L8QbggDIN3tGdyazHnkdP2tJwGTR4
MkxYmIXhryb6Qj/cpoHG7kGsBZmdhL2mfuo9U9bsUtGGmu9Gei2xPTcyGGCu
mRKaubOAcNDI4nVbkL5vKUZthQScsNnfr8dPXjrZuQqoq6owggMVMIICfqAD
AgECAgMKVEIwDQYJKoZIhvcNAQEEBQAwgZIxCzAJBgNVBAYTAlpBMRUwEwYD
VQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNhcGUgVG93bjEPMA0GA1UE
ChMGVGhhd3RlMR0wGwYDVQQLExRDZXJ0aWZpY2F0ZSBTZXJ2aWNlczEoMCYG
A1UEAxMfUGVyc29uYWwgRnJlZW1haWwgUlNBIDIwMDAuOC4zMDAeFw0wMzA3
MTExMzMzMzJaFw0wNDA3MTAxMzMzMzJaMFoxDzANBgNVBAQTBkx1ZHZpZzEP
MA0GA1UEKhMGTWljaGFsMRYwFAYDVQQDEw1NaWNoYWwgTHVkdmlnMR4wHAYJ
KoZIhvcNAQkBFg9taWNoYWxAbG9naXguY3owggEiMA0GCSqGSIb3DQEBAQUA
A4IBDwAwggEKAoIBAQDDY70bD6khsiNb1fVJq/s4hyYTfrI9f2qpZCLY6yc5
hb4IA8nBwpad/tovhT6NpMiYsVoUiwSHQgr9ZM47m+ms31UWZJMCDIDmBMQE
D8bwwkG9ldkPhjYc9uYBoDV/il2juOiZKoYwN85a3L4rBrhmifmkiYlMF8RE
AnDAZVJVxQ6mCtyV65ETv0Ts5M847/kTraspDI+eI3FA2JrFME8HwO4Zl4iJ
qiTAKH/qGktrQa4Mx7rW3h3XGIK4wNR3lei3Z+ZNyYh1L3Tzf2ydLpC70SMW
Wg8RLdgAQG3Qj6c7B/F5TfwVEVD+YOX1LrwVSvV3qQ7N64LEdpGhSAmCzKhX
AgMBAAGjLDAqMBoGA1UdEQQTMBGBD21pY2hhbEBsb2dpeC5jejAMBgNVHRMB
Af8EAjAAMA0GCSqGSIb3DQEBBAUAA4GBAAhXWLHQBN6ohbEIwJhpQLb9vnW1
CkFY0p/Oy/EG4IAyDd7Rncmsx55HT9rScBk0eDJMWJiF4a8m+kI/3KaBxu5B
rAWZnYS9pn7qPVPW7FLRhprvRnotsT03MhhgrpkSmrmzgHDQyOJ1W5C+bylG
bYUEnLDZ36/HT1462bkKqKuqMIIDODCCAqGgAwIBAgIQZkVyt8x09c9jdkWE
0C6RATANBgkqhkiG9w0BAQQFADCB0TELMAkGA1UEBhMCWkExFTATBgNVBAgT
DFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMRowGAYDVQQKExFU
aGF3dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBTZXJ2
aWNlcyBEaXZpc2lvbjEkMCIGA1UEAxMbVGhhd3RlIFBlcnNvbmFsIEZyZWVt
YWlsIENBMSswKQYJKoZIhvcNAQkBFhxwZXJzb25hbC1mcmVlbWFpbEB0aGF3
dGUuY29tMB4XDTAwMDgzMDAwMDAwMFoXDTA0MDgyNzIzNTk1OVowgZIxCzAJ
BgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNh
cGUgVG93bjEPMA0GA1UEChMGVGhhd3RlMR0wGwYDVQQLExRDZXJ0aWZpY2F0
ZSBTZXJ2aWNlczEoMCYGA1UEAxMfUGVyc29uYWwgRnJlZW1haWwgUlNBIDIw
MDAuOC4zMDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA3jMypmPHCSVF
PtJueCdngcXaiBmClw7jRCmKYzUqbXA8+tyu9+50bzC8M5B/+TRxoKNtmPHD
T6Jl2w36S/HW3WGl+YXNVZo1Gp2Sdagnrthy+boC9tewkd4c6avgGAOofENC
UFGHgzzwObSbVIoTh/+zm51JZgAtCYnslGvpoWkCAwEAAaNOMEwwKQYDVR0R
BCIwIKQeMBwxGjAYBgNVBAMTEVByaXZhdGVMYWJlbDEtMjk3MBIGA1UdEwEB
/wQIMAYBAf8CAQAwCwYDVR0PBAQDAgEGMA0GCSqGSIb3DQEBBAUAA4GBADGx
S0dd+QFx5fVTbF151j2YwCYTYoEipxL4IpXoG0m3J3sEObr85vIk65H6vewN
Kjj3UFWobPcNrUwbvAP0teuiR59sogxYjTFCCRFssBpp0SsSskBdavl50Oou
Jd2K5PzbDR+dAvNa28o89kTqJmmHf0iezqWf54TYyWJirQXGMYID1TCCA9EC
AQEwgZowgZIxCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUx
EjAQBgNVBAcTCUNhcGUgVG93bjEPMA0GA1UEChMGVGhhd3RlMR0wGwYDVQQL
ExRDZXJ0aWZpY2F0ZSBTZXJ2aWNlczEoMCYGA1UEAxMfUGVyc29uYWwgRnJl
ZW1haWwgUlNBIDIwMDAuOC4zMAIDClRCMAkGBSsOAwIaBQCgggIPMBgGCSqG
SIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTAzMDkxMjIw
MDM1M1owIwYJKoZIhvcNAQkEMRYEFOYaGIa5TuB/2so+DANnqWYIfh6BMFIG
CSqGSIb3DQEJDzFFMEMwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0G
CCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMIGrBgkrBgEE
AYI3EAQxgZ0wgZowgZIxCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJu
IENhcGUxEjAQBgNVBAcTCUNhcGUgVG93bjEPMA0GA1UEChMGVGhhd3RlMR0w
GwYDVQQLExRDZXJ0aWZpY2F0ZSBTZXJ2aWNlczEoMCYGA1UEAxMfUGVyc29u
YWwgRnJlZW1haWwgUlNBIDIwMDAuOC4zMAIDClRCMIGtBgsqhkiG9w0BCRAC
CzGBnaCBmjCBkjELMAkGA1UEBhMCWkExFTATBgNVBAgTDFdlc3Rlcm4gQ2Fw
ZTESMBAGA1UEBxMJQ2FwZSBUb3duMQ8wDQYDVQQKEwZUaGF3dGUxHTAbBgNV
BAsTFENlcnRpZmljYXRlIFNlcnZpY2VzMSgwJgYDVQQDEx9QZXJzb25hbCBG
cmVlbWFpbCBSU0EgMjAwMC44LjMwAgMKVEIwDQYJKoZIhvcNAQEBBQAEggEA
CBrKJ38zhsqLj2eupG7pj2jTk5I64HQGFE3jUeAWoan95mclAcs7wQsfFeHd
DbIAVxMGUzjTpuBvecvlAP3SEuEXlx737AxUUQVtd0JZiX3U5yU3ZMXMVvMI
Rs5nn0tZ4MWR5QFquAzlc6kV7sXZicTxrglg8Y6s6indd6fuUIk2EeJYXauN
RAs/Sxl8sohCyuwI9YI+7rAUMdmlQzh30Z1Y+8J0dL1HeKeeJnwluR2EAxOg
yeAr/9mSjtNx7kGVx0kz9gGmxeCb1Jlb0vsbg6BtvPbk/BI5YS/GFbif7DW0
dHYFb7rRE0XXDI/xOeCtb0Qnbcb7lom7huXQabvxiAAAAAAAAA==

--------------ms020808080805070806000108--