Running on embedded systems

Running on embedded systems

Openswan’s scripts are pretty advanced. Most embedded systems have horrible shells. Things like msh and hush from busybox are not even close to running the scripts we have. The minish-sh from uClinux-dist is kinda okay, but you still really dont want to use the shell on most of these units. Though if your unit is big enough to have dash or a ash or bash, you’re probably fine.

In the below example we’ll configure the embedded system as 192.168.1.1, and make a PSK conneciton to 192.168.1.3 with psk “test”

Example to start pluto without scripts for KLIPS

tncfg --create ipsec0
tncfg --attach --virtual ipsec0 --physical eth0
ifconfig eth0 192.168.1.1
ifconfig ipsec0 192.168.1.1
echo "192.168.1.1 192.168.1.3: PSK 'test'" > /var/ipsec.secrets
cd /bin/
pluto --stderrlog --use-klips --nofork &
whack --listen

Pluto should be listening, and you should see something along the lines of

# whack --listen                                                                
BINFMT_FLAT: Loading file: /bin/whack                                           
Mapping is 33f000, Entry point is 50, data_start is 11900                       
Load /bin/whack: TEXT=33f040-350900 DATA=350904-355744 BSS=355744-356e74        
p=357ffc                                                                        
start_thread(regs=0xd89fb8, entry=0x33f050, start_stack=0x357f6c)               
listening for IKE messages                                                      
adding interface ipsec0/eth0 192.168.1.1:500                                    
002 listening for IKE messages                                                  
002 adding interface ipsec0/eth0 192.168.1.1:500                                
loading secrets from "/etc/ipsec.secrets"                                       
002 loading secrets from "/etc/ipsec.secrets"                                   

If you want full debugging, also run:

whack --debug-all

Loading and initiating a connection

Now simply load the connection and initiate it:

whack --name test --ipv4 --host 192.168.1.1 --to --host 192.168.1.3 --psk --tunnel
whack --initiate --name test