X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=debian%2Fopenvswitch-ipsec.init;h=a39dd40e686d32886947ceff02cd83aa1ce02f99;hb=7849d3e4cab657eb42b513b0d9ad656fc38259bd;hp=5f4240672ed840aa7cc439b0303a7a9d654db2ab;hpb=9704460403a02554595b5a7ed17914a0b0357cac;p=sliver-openvswitch.git

diff --git a/debian/openvswitch-ipsec.init b/debian/openvswitch-ipsec.init
index 5f4240672..a39dd40e6 100755
--- a/debian/openvswitch-ipsec.init
+++ b/debian/openvswitch-ipsec.init
@@ -19,11 +19,13 @@
 #
 ### BEGIN INIT INFO
 # Provides:          openvswitch-ipsec
-# Required-Start:    $network $local_fs $remote_fs
+# Required-Start:    $network $local_fs $remote_fs openvswitch-switch
 # Required-Stop:     $remote_fs
 # Default-Start:     2 3 4 5
 # Default-Stop:      0 1 6
 # Short-Description: Open vSwitch GRE-over-IPsec daemon
+# Description:       The ovs-monitor-ipsec script provides support for encrypting GRE
+#                    tunnels with IPsec.
 ### END INIT INFO
 
 PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
@@ -68,10 +70,25 @@ running() {
     return 0
 }
 
+uninstall_mark_rule() {
+    iptables -D INPUT -t mangle $1 -j MARK --set-mark 1/1 || return 0
+}
+
+install_mark_rule() {
+    if ( ! iptables -C INPUT -t mangle $1 -j MARK --set-mark 1/1 2> /dev/null); then
+        iptables -A INPUT -t mangle $1 -j MARK --set-mark 1/1
+    fi
+}
+
 start_server() {
-    PYTHONPATH=/usr/share/openvswitch/python \
-           /usr/share/openvswitch/scripts/ovs-monitor-ipsec \
-           --pidfile-name=$PIDFILE --detach --monitor \
+    if [ ! -d /var/run/openvswitch ]; then
+        install -d -m 755 -o root -g root /var/run/openvswitch
+    fi
+
+    install_mark_rule "-p esp"
+    install_mark_rule "-p udp --dport 4500"
+    /usr/share/openvswitch/scripts/ovs-monitor-ipsec \
+           --pidfile=$PIDFILE --log-file --detach --monitor \
            unix:/var/run/openvswitch/db.sock
 
     return 0
@@ -81,6 +98,8 @@ stop_server() {
     if [ -e $PIDFILE ]; then
         kill `cat $PIDFILE`
     fi
+    uninstall_mark_rule "-p esp"
+    uninstall_mark_rule "-p udp --dport 4500"
 
     return 0
 }