#!/usr/bin/perl -w
#
# genkey_ipsec - Generate IPSec config lines.
#
# Leon Towns-von Stauber, edge2net
#
# $Id: ipsec_genkey.pl,v 1.1 2001/09/05 23:43:19 leonvs Exp $
#

use strict;
require 5.004;
use Getopt::Std;

my ($USAGE, $progname);
my ($authAlg, $encrAlg);
my ($srcAddr, $dstAddr);

processArgs();
printIpsecConfig();

sub processArgs {
	$progname = $0; $progname =~ s/.*\///;
	$USAGE = <<EOF;
usage:	$progname auth_alg encr_alg dest_addr [src_addr]

	'auth_alg' may be either 'md5' or 'sha'.
	'encr_alg' may be either 'des' or '3des'.
	'dest_addr' and 'src_addr' are either IP addresses or hostnames.

	Use 'man ipseckey' (on Solaris) or 'man ipsec.conf' (on Linux)
	for more information.
EOF

	$authAlg = shift @ARGV or die $USAGE;
	$authAlg =~ /^(md5|sha)$/ or die $USAGE;

	$encrAlg = shift @ARGV or die $USAGE;
	$encrAlg =~ /^(des|3des)$/ or die $USAGE;

	# Address can be a hostname or an IP address, and should include only
	# alphanumerics, hyphens, and dots. It should not begin with hyphen (or
	# risk being interpreted as a command-line option).
	$dstAddr = shift @ARGV or die $USAGE;
	$dstAddr =~ /^\w[\w\-\.]*$/ or die $USAGE;

	# Source address is optional.
	if (defined($srcAddr = shift @ARGV)) {
		$srcAddr =~ /^\w[\w\-\.]*$/ or die $USAGE;
	} else {
		$srcAddr = "";
	}

	# No arguments should be left.
	@ARGV and die $USAGE;
}

sub genHexKey {
	my $keyType = shift;
	my $key;
	my $i;

	my %bitLength = ();		# bit lengths of various kinds of keys
	$bitLength{"spifreeswan"} = 12;	# 3 digits for FreeS/WAN manual keying
	$bitLength{"spi"} = 32;		# acc. to ipsec(7P)
	$bitLength{"md5"} = 128;	# acc. to authmd5h(7M)
	$bitLength{"sha"} = 160;	# acc. to authsha1(7M)
	$bitLength{"des"} = 64;		# acc. to encrdes(7M)
	$bitLength{"3des"} = 192;	# acc. to encr3des(7M)

	# length in hexadecimal characters (4 bits per char)
	my $keyLength = int $bitLength{"$keyType"} / 4;

	for ($i = 0; $i < $keyLength; $i++) {
		# random integer from 0 to 15, converted to hex
		$key .= sprintf "%x", int rand 16;
	}

	return $key;
}

# Generate an SPI based on the destination IP address.
sub genSpiFromAddr {
	my $addr = shift;
	my $spi;
	my $i;

	$addr =~ s/\D//g;		# strip out all non-digits
	$spi = substr $addr, -3;
	# If $spi begins with a "0", backtrack along IP address until we get a
	# non-zero starting digit.
	for ($i = -4; $spi =~ /^0/; $i--) {
		substr($spi, 0, 1) = substr $addr, $i;
	}

	# Check SPI format. If no good, just generate a random one.
	$spi = genHexKey("spifreeswan") unless $spi =~ /^[1-9]\d\d$/;

	return $spi;
}

sub printIpsecConfig {
	my $spi = genSpiFromAddr($dstAddr);
	my $authKeyAH = genHexKey($authAlg);
	my $authKeyESP = genHexKey($authAlg);
	my $encrKey = genHexKey($encrAlg);

	print "Solaris\n";
	print "-------\n";
	print "add ah";
	print " spi 0x$spi";
	print " src $srcAddr" if $srcAddr;
	print " dst $dstAddr";
	print " authalg $authAlg authkey $authKeyAH";
	print "\n";
	print "add esp";
	print " spi 0x$spi";
	print " src $srcAddr" if $srcAddr;
	print " dst $dstAddr";
	print " authalg $authAlg authkey $authKeyESP";
	print " encralg $encrAlg encrkey $encrKey";
	print "\n";
	print "\n";

	print "FreeS/WAN\n";
	print "---------\n";
	print "\tleft=$srcAddr\n" if $srcAddr;
	print "\tspi=0x$spi\n";
	print "\tright=$dstAddr\n";
	print "\trightahkey=0x$authKeyAH\n";
	print "\trightespauthkey=0x$authKeyESP\n";
	print "\trightespenckey=0x$encrKey\n";
	print "\n";
}