# ipsec - ipsec services and ike demon (pluto)
#
# IPsec provides encrypted and authenticated communications;
# NETKEY/KLIPS is the kernel half of it, Pluto is the user-level
# management daemon.

description	"libreswan ipsec services"

start on runlevel [2345]
stop on runlevel [!2345]

respawn

pre-start script
    cd /
    . /etc/default/pluto
    @FINALSBINDIR@/ipsec addconn --config @FINALCONFFILE@ --checkconfig
end script

script
    . /etc/default/pluto
    @FINALSBINDIR@/ipsec --checknss
    @FINALSBINDIR@/ipsec --checknflog
    @FINALSBINDIR@/ipsec _stackmanager start
    @FINALLIBEXECDIR@/pluto --config @FINALCONFFILE@ --nofork $PLUTO_OPTIONS
    if [ -f @FINALLIBEXECDIR@/portexcludes ] ; then
	@FINALLIBEXECDIR@/portexcludes
    fi
end script

pre-stop script
    # do not run whack --shutdown in pre-stop, it confused stop into restarting
    # @FINALSBINDIR@/ipsec whack --shutdown
    @FINALSBINDIR@/ipsec --stopnflog
    ip xfrm policy flush
    ip xfrm state flush
end script
