nm-openswan

[steve <keyhman gmail com>]

Greetings,

I love the simplicity of Network Manager. For a road warrior with a 
laptop, it's a must have. I currently use FC6 on my Laptop. The only 
thing NM doesn't do for me, that I'd like to see, is manage my IPsec vpn 
connections I configured for OpenSwan.

First , I didn't like the way the secrets files were used by Openswan. I 
had a lot of inconsistency when trying to match secrets to the %any 
identifier, and found that the only reliable way to manage multiple 
secrets for multiple IPsec connections was to regenerate the secrets 
file everytime the network interface / IP address changed.

Requirement: /etc/ipsec.d is used to store per-connection information in 
two files: conn.conf and conn.secrets

So I wrote a small patch to the openswan init scripts which come with 
the FC6 distribution that adds some simple automation to the startup 
procedure: Everytime /etc/init.d/ipsec start/stop/restart is called, it 
will automatically detect which interface is being used to route the 
connection, grab the IP address of the interface and then generate  a 
1-to-1 match in the /etc/ipsec.secrets file, used by pluto, by pairing 
that IP address with the secret and the connection target address 
sourced from /etc/ipsec.d/conn.conf and /etc/init.d/conn.secrets.

The result was that by restarting IPsec services I created a 
/etc/ipsec.secrets file that always had a perfect match for any 
connection I wanted to initiate.

Once I had a reliable way to manage multiple IPsec connections, I 
thought, why not make my IPsec connections manageable through NM?

So I grabbed the source, the source to nm-vpnc and nm-openvpn, and 
started reverse engineering how they manage those two services.

Obviously IPsec is different, but I got the basics from those source trees.

Now I'm writing my own "plugin" to network manager that will allow you 
to start / stop / create / delete IPsec connections for OpenSwan. The 
caveat is that it relys on the automation from my init script for now 
but that may change as I continue to develop my code.

Is anyone else working on a project like this? Does anyone have need for 
this type of plugin, or is this software only useful for me?

Steve