#!/bin/sh
# Pluto database-loading script
# Copyright (C) 1998, 1999, 2001  Henry Spencer.
# 
# This program is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2 of the License, or (at your
# option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
# 
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
# or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
# for more details.
#
# exit status is 13 for protocol violation, that of Pluto otherwise

me='ipsec _plutoload'		# for messages

for dummy
do
	case "$1" in
	--load)	plutoload="$2" ; shift	;;
	--start)	plutostart="$2" ; shift	;;
	--wait)	plutowait="$2" ; shift	;;
	--post)	postpluto="$2" ; shift	;;
	--)	shift ; break	;;
	-*)	echo "$me: unknown option \`$1'" >&2 ; exit 2	;;
	*)	break	;;
	esac
	shift
done

# searches, if needed
# the way the searches were done ensures plutoload >= plutoroute >= plutostart

plutoroute=`ipsec addconn --listroute`
plutostart=`ipsec addconn --liststart`

# await Pluto's readiness (not likely to be an issue, but...)
eofed=y
while read saying
do
	case "$saying" in
	'Pluto initialized')	eofed= ; break	;;	# NOTE BREAK OUT
	*)	echo "pluto unexpectedly said \`$saying'"	;;
	esac
done

info=/var/run/pluto/ipsec.info
if test -s $info
then
	. $info
fi

# finally, handle --add|--replace
if [ -n "$defaultrouteaddr" ]
then
    options="--defaultroute $defaultrouteaddr"
fi
if [ -n "$defaultroutenexthop" ]
then
    options="$options --defaultroutenexthop $defaultroutenexthop"
fi
ipsec addconn $options --addall

# enable listening
ipsec auto --ready

# execute any post-startup cleanup
if test " $postpluto" != " "
then
	$postpluto
	st=$?
	if test " $st" -ne 0
	then
	    echo "...postpluto command exited with status $st"
	fi
fi

# quickly establish routing
for tu in $plutoroute
do
	ipsec auto --route $tu ||
		echo "...could not route conn \"$tu\""
done

# tunnel initiation, which may take a while
async=
if test " $plutowait" = " no"
then
	async="--asynchronous"
fi
err=0
for tu in $plutostart
do
	ipsec auto --up $async $tu
	err=$?
	if test -z "$async" -a $err -gt 0
	then
		echo "...could not start conn \"$tu\""
	fi
done

# report any further utterances, and watch for exit status
eofed=y
while read saying
do
	case "$saying" in
	exit)	eofed= ; break	;;		# NOTE BREAK OUT
	*)	echo "pluto unexpectedly says \`$saying'"	;;
	esac
done
if test "$eofed"
then
	echo "pluto died without exit status!?!"
	exit 13
fi
if read status
then
	exit $status
else
	echo "pluto yielded no exit status!?!"
	exit 13
fi
