I love the simplicity of Network Manager. For a road warrior with a laptop, it's a must have. I currently use FC6 on my Laptop. The only thing NM doesn't do for me, that I'd like to see, is manage my IPsec vpn connections I configured for OpenSwan.

First , I didn't like the way the secrets files were used by Openswan. I had a lot of inconsistency when trying to match secrets to the %any identifier, and found that the only reliable way to manage multiple secrets for multiple IPsec connections was to regenerate the secrets file everytime the network interface / IP address changed.

Requirement: /etc/ipsec.d is used to store per-connection information in two files: conn.conf and conn.secrets

So I wrote a small patch to the openswan init scripts which come with the FC6 distribution that adds some simple automation to the startup procedure: Everytime /etc/init.d/ipsec start/stop/restart is called, it will automatically detect which interface is being used to route the connection, grab the IP address of the interface and then generate a 1-to-1 match in the /etc/ipsec.secrets file, used by pluto, by pairing that IP address with the secret and the connection target address sourced from /etc/ipsec.d/conn.conf and /etc/init.d/conn.secrets.

The result was that by restarting IPsec services I created a /etc/ipsec.secrets file that always had a perfect match for any connection I wanted to initiate.

Once I had a reliable way to manage multiple IPsec connections, I thought, why not make my IPsec connections manageable through NM?

So I grabbed the source, the source to nm-vpnc and nm-openvpn, and started reverse engineering how they manage those two services.

Obviously IPsec is different, but I got the basics from those source trees.

Now I'm writing my own "plugin" to network manager that will allow you to start / stop / create / delete IPsec connections for OpenSwan. The caveat is that it relys on the automation from my init script for now but that may change as I continue to develop my code.

Is anyone else working on a project like this? Does anyone have need for this type of plugin, or is this software only useful for me?


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]