2 # SPDX-License-Identifier: BSD-3-Clause
4 CRYPTO_DEV=${CRYPTO_DEV:-'--vdev="crypto_aesni_mb0"'}
6 #generate cfg file for ipsec-secgw
9 cat <<EOF > ${SGW_CFG_FILE}
11 sp ipv4 in esp protect 7 pri 2 src ${REMOTE_IPV4}/32 dst ${LOCAL_IPV4}/32 \
12 sport 0:65535 dport 0:65535
13 sp ipv4 in esp bypass pri 1 sport 0:65535 dport 0:65535
16 sp ipv4 out esp protect 7 pri 2 src ${LOCAL_IPV4}/32 dst ${REMOTE_IPV4}/32 \
17 sport 0:65535 dport 0:65535
18 sp ipv4 out esp bypass pri 1 sport 0:65535 dport 0:65535
21 sp ipv6 in esp protect 9 pri 2 src ${REMOTE_IPV6}/128 dst ${LOCAL_IPV6}/128 \
22 sport 0:65535 dport 0:65535
23 sp ipv6 in esp bypass pri 1 sport 0:65535 dport 0:65535
26 sp ipv6 out esp protect 9 pri 2 src ${LOCAL_IPV6}/128 dst ${REMOTE_IPV6}/128 \
27 sport 0:65535 dport 0:65535
28 sp ipv6 out esp bypass pri 1 sport 0:65535 dport 0:65535
31 sa in 7 cipher_algo aes-128-cbc \
32 cipher_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \
34 auth_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \
35 mode ipv4-tunnel src ${REMOTE_IPV4} dst ${LOCAL_IPV4} ${SGW_CFG_XPRM_IN}
37 sa in 9 cipher_algo aes-128-cbc \
38 cipher_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \
40 auth_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \
41 mode ipv6-tunnel src ${REMOTE_IPV6} dst ${LOCAL_IPV6} ${SGW_CFG_XPRM_IN}
44 sa out 7 cipher_algo aes-128-cbc \
45 cipher_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \
47 auth_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \
48 mode ipv4-tunnel src ${LOCAL_IPV4} dst ${REMOTE_IPV4} ${SGW_CFG_XPRM_OUT}
50 sa out 9 cipher_algo aes-128-cbc \
51 cipher_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \
53 auth_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \
54 mode ipv6-tunnel src ${LOCAL_IPV6} dst ${REMOTE_IPV6} ${SGW_CFG_XPRM_OUT}
57 rt ipv4 dst ${REMOTE_IPV4}/32 port 0
58 rt ipv4 dst ${LOCAL_IPV4}/32 port 1
60 rt ipv6 dst ${REMOTE_IPV6}/128 port 0
61 rt ipv6 dst ${LOCAL_IPV6}/128 port 1
64 neigh port 0 ${REMOTE_MAC}
65 neigh port 1 ${LOCAL_MAC}
73 cat <<EOF > ${SGW_CFG_FILE}
75 sp ipv4 in esp protect 6 pri 2 src ${REMOTE_IPV4}/32 dst ${LOCAL_IPV4}/32 \
76 sport 0:65535 dport 0:65535
77 sp ipv4 in esp bypass pri 1 sport 0:65535 dport 0:65535
80 sp ipv4 out esp protect 6 pri 2 src ${LOCAL_IPV4}/32 dst ${REMOTE_IPV4}/32 \
81 sport 0:65535 dport 0:65535
82 sp ipv4 out esp bypass pri 1 sport 0:65535 dport 0:65535
85 sp ipv6 in esp protect 8 pri 2 src ${REMOTE_IPV6}/128 dst ${LOCAL_IPV6}/128 \
86 sport 0:65535 dport 0:65535
87 sp ipv6 in esp bypass pri 1 sport 0:65535 dport 0:65535
90 sp ipv6 out esp protect 8 pri 2 src ${LOCAL_IPV6}/128 dst ${REMOTE_IPV6}/128 \
91 sport 0:65535 dport 0:65535
92 sp ipv6 out esp bypass pri 1 sport 0:65535 dport 0:65535
95 sa in 8 cipher_algo aes-128-cbc \
96 cipher_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \
98 auth_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \
99 mode ipv4-tunnel src ${REMOTE_IPV4} dst ${LOCAL_IPV4}
101 sa in 6 cipher_algo aes-128-cbc \
102 cipher_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \
103 auth_algo sha1-hmac \
104 auth_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \
105 mode ipv6-tunnel src ${REMOTE_IPV6} dst ${LOCAL_IPV6}
108 sa out 8 cipher_algo aes-128-cbc \
109 cipher_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \
110 auth_algo sha1-hmac \
111 auth_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \
112 mode ipv4-tunnel src ${LOCAL_IPV4} dst ${REMOTE_IPV4}
114 sa out 6 cipher_algo aes-128-cbc \
115 cipher_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \
116 auth_algo sha1-hmac \
117 auth_key de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \
118 mode ipv6-tunnel src ${LOCAL_IPV6} dst ${REMOTE_IPV6}
121 rt ipv4 dst ${REMOTE_IPV4}/32 port 0
122 rt ipv4 dst ${LOCAL_IPV4}/32 port 1
124 rt ipv6 dst ${REMOTE_IPV6}/128 port 0
125 rt ipv6 dst ${LOCAL_IPV6}/128 port 1
128 neigh port 0 ${REMOTE_MAC}
129 neigh port 1 ${LOCAL_MAC}