# Consolidated IPsec configuration. Drives algorithm table, static SAs,
# and policy database from one oneshot. The original SMF split (algs +
# manual-key + policy) supports independent enabling of each piece;
# Hammerhead bundles them and skips steps where the config file is
# absent, covering every real combination cleanly.
#
# Replaces:
#   /lib/svc/manifest/network/ipsec/ipsecalgs.xml
#   /lib/svc/manifest/network/ipsec/manual-key.xml
#   /lib/svc/manifest/network/ipsec/policy.xml
[service]
name = "ipsec"
description = "IPsec algorithms, SAs, and policy"
type = "oneshot"
[exec]
start = "/etc/zyginit/services/ipsec/start.sh"
stop  = "/etc/zyginit/services/ipsec/stop.sh"
[dependencies]
requires = ["network"]
[restart]
on = "never"
#!/bin/sh
# IPsec setup. Three steps, executed only when their input is present:
#   1. ipsecalgs -s     — load algorithm table from /etc/inet/ipsecalgs
#   2. ipseckey -f ...  — install static SAs (skip if no keyfile)
#   3. ipsecconf -q -a  — install policy DB (skip if no config)
set -e
/usr/sbin/ipsecalgs -s
[ -s /etc/inet/secret/ipseckeys ] && /usr/sbin/ipseckey -f /etc/inet/secret/ipseckeys
[ -s /etc/inet/ipsecinit.conf ]   && /usr/sbin/ipsecconf -q -a /etc/inet/ipsecinit.conf
exit 0
#!/bin/sh
# Tear down IPsec policy and static SAs. Algorithm table cannot be
# unloaded without a reboot, so it stays.
/usr/sbin/ipsecconf -F 2>/dev/null
/usr/sbin/ipseckey flush 2>/dev/null
exit 0