#!/bin/bash
#
# ipsec         init.d script for starting and stopping
#               the IPsec security subsystem (KLIPS and Pluto).
#
# chkconfig: - 47 76
# description: IPsec provides encrypted and authenticated communications; \
# KLIPS is the kernel half of it, Pluto is the user-level management daemon.


# IPsec startup and shutdown script
# Copyright (C) 1998, 1999, 2001  Henry Spencer.
# Copyright (C) 2002              Michael Richardson <mcr@freeswan.org>
# 
# This program is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2 of the License, or (at your
# option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
# 
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
# or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
# for more details.
#
# RCSID $Id: ipsec.init,v 1.1 2004/08/17 12:26:49 harald Exp $
#
# This script becomes /etc/rc.d/init.d/ipsec (or possibly /etc/init.d/ipsec)
# and is also accessible as "ipsec setup" (the preferred route for human
# invocation).
#
# The startup and shutdown times are a difficult compromise (in particular,
# it is almost impossible to reconcile them with the insanely early/late
# times of NFS filesystem startup/shutdown).  Startup is after startup of
# syslog and pcmcia support; shutdown is just before shutdown of syslog.

# Source function library.
. /etc/init.d/functions

# Check that we are root ... so non-root users stop here
[ `id -u` = 0 ] || exit 1


me='ipsec setup'		# for messages

syslog ()
{
    /sbin/initlog -s "$*" -f daemon -p ${IPSECsyslog:-error} -n ipsec_setup
}

[ "$(tty)" != '/dev/console' ] && TTY=1;
log ()
{
    if [ "$1" = "-n" ]; then 
       nonl="-n";
       shift;
    fi;
    [ -n "$TTY" ] && echo $nonl $0: "$*";
    syslog $1;
}
fail()
{
    
    log -n "$*";
    failure;
    echo;
    exit 1;
}

# where the private directory and the config files are
IPSEC_EXECDIR="${IPSEC_EXECDIR-/usr/libexec/ipsec}"
IPSEC_LIBDIR="${IPSEC_LIBDIR-/usr/lib/ipsec}"
IPSEC_SBINDIR="${IPSEC_SBINDIR-/usr/sbin}"
IPSEC_CONFS="${IPSEC_CONFS-/etc}"

if test " $IPSEC_DIR" = " "	# if we were not called by the ipsec command
then
    # we must establish a suitable PATH ourselves
    PATH="${IPSEC_SBINDIR}":/sbin:/usr/sbin:/usr/local/bin:/bin:/usr/bin
    export PATH

    IPSEC_DIR="$IPSEC_LIBDIR"
    export IPSEC_DIR IPSEC_CONFS IPSEC_LIBDIR IPSEC_EXECDIR
fi

# Check that the ipsec command is available.
found=
for dir in `echo $PATH | tr ':' ' '`
do
	if test -f $dir/ipsec -a -x $dir/ipsec
	then
		found=yes
		break			# NOTE BREAK OUT
	fi
done
if ! test "$found"
then
	
	fail $"cannot find ipsec command"' -- `'$1"'"$" aborted"
fi

# accept a few flags

export IPSEC_setupflags
IPSEC_setupflags=""

config=""

for dummy
do
	case "$1" in
	--showonly|--show)  IPSEC_setupflags="$1" ;;
	--config)  config="--config $2" ; shift	;;
	*) break ;;
	esac
	shift
done


# Pick up IPsec configuration (until we have done this, successfully, we
# do not know where errors should go, hence the explicit "daemon.error"s.)
# Note the "--export", which exports the variables created.
eval `ipsec _confread $config --optional --varprefix IPSEC --export --type config setup`
if test " $IPSEC_confreadstatus" != " "
then
	fail "$IPSEC_confreadstatus -- "'`'$1' '$"aborted"		
fi

IPSEC_confreadsection=${IPSEC_confreadsection:-setup}
export IPSEC_confreadsection

IPSECsyslog=${IPSECsyslog-daemon.error}
export IPSECsyslog

# misc setup
umask 022

RETVAL=0

prog="IPsec"

# do it
start_it()
{
	action $"Starting $prog: " ipsec _realsetup $1;
	return $?;
}

stop_it()
{
        action $"Shutting down $prog: " ipsec _realsetup $1;
        return $?;
}

case "$1" in
  start|--start|_autostart)
	start_it $1;
	RETVAL=$?;
	;;

  stop|--stop|_autostop)
	stop_it $1;
	RETVAL=$?;
        ;;

  condrestart)
        if [ -f /var/lock/subsys/ipsec ]; then
	        stop_it stop
	        start_it start
	        RETVAL=$?
	else 
		RETVAL=-1
	fi
        ;;

  restart|--restart|force-reload)
	stop_it stop
	start_it start
        RETVAL=$?
	;;

  _autorestart)			# for internal use only
        stop_it _autostop
        start_it _autostart
	;;

  status|--status)
	ipsec _realsetup $1
	exit
	;;

  --version)
	echo "$me $IPSEC_VERSION"
	exit 0
	;;

  --help)
	echo $"Usage: $0 {start|stop|restart|condrestart|status}"
	exit 0
	;;

  *)
	echo $"Usage: $0 {start|stop|restart|condrestart|status}"
	exit 2
esac

exit $RETVAL
