This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via d1bd615e9f10000bcf307e984a78a1ba384231cd (commit)
via 6e2ba31bff62dc8eda9450139961cfb3c668240f (commit)
from 86525dfc52009003a0976fb8df135ba0808ae121 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit d1bd615e9f10000bcf307e984a78a1ba384231cd
Merge: 6e2ba31 86525df
Author: Arne Fitzenreiter <arne_f(a)ipfire.org>
Date: Mon Aug 22 20:53:02 2011 +0200
Merge branch 'next' of ssh://arne_f@git.ipfire.org/pub/git/ipfire-2.x into next
commit 6e2ba31bff62dc8eda9450139961cfb3c668240f
Author: Arne Fitzenreiter <arne_f(a)ipfire.org>
Date: Mon Aug 22 20:47:35 2011 +0200
ipsec: change ipsecctrl and vpn-watch to restart a single tunnel.
-----------------------------------------------------------------------
Summary of changes:
src/misc-progs/ipsecctrl.c | 39 ++++++++++++++++++++++++++++++++++++---
src/scripts/vpn-watch | 11 +++--------
2 files changed, 39 insertions(+), 11 deletions(-)
Difference in files:
diff --git a/src/misc-progs/ipsecctrl.c b/src/misc-progs/ipsecctrl.c
index a018289..0b05177 100644
--- a/src/misc-progs/ipsecctrl.c
+++ b/src/misc-progs/ipsecctrl.c
@@ -142,10 +142,42 @@ int decode_line (char *s,
*/
void turn_connection_on (char *name, char *type) {
/*
- if you find a way to start a single connection without changing all add it
- here. Change also vpn-watch.
+ Rename the connection and run ipsec update and rename it back to readd
+ a deleted connection. Because ipsec update ignores connection that have
+ not changed since last load.
*/
- safe_system("/etc/rc.d/init.d/ipsec restart >/dev/null");
+ char command[STRING_SIZE];
+ memset(command, 0, STRING_SIZE);
+ snprintf(command, STRING_SIZE - 1,
+ "sed -i -e 's|^conn %s$|conn %s-renamed|g' /var/ipfire/vpn/ipsec.conf >/dev/null", name, name);
+ safe_system(command);
+
+ // Down and delete IKEv2 Tunnel before ipsec update
+ snprintf(command, STRING_SIZE - 1,
+ "/usr/sbin/ipsec stroke down %s >/dev/null", name);
+ safe_system(command);
+ snprintf(command, STRING_SIZE - 1,
+ "/usr/sbin/ipsec stroke delete %s >/dev/null", name);
+ safe_system(command);
+
+ safe_system("/etc/rc.d/init.d/ipsec update >/dev/null");
+
+ sleep(1);
+
+ // Back to original name
+ snprintf(command, STRING_SIZE - 1,
+ "sed -i -e 's|^conn %s-renamed$|conn %s|g' /var/ipfire/vpn/ipsec.conf >/dev/null", name, name);
+ safe_system(command);
+
+ // Down and delete IKEv2 Tunnel before ipsec update
+ snprintf(command, STRING_SIZE - 1,
+ "/usr/sbin/ipsec stroke down %s-renamed >/dev/null", name);
+ safe_system(command);
+ snprintf(command, STRING_SIZE - 1,
+ "/usr/sbin/ipsec stroke delete %s-renamed >/dev/null", name);
+ safe_system(command);
+
+ safe_system("/etc/rc.d/init.d/ipsec update >/dev/null");
}
/*
issue ipsec commmands to turn off connection 'name'
@@ -162,6 +194,7 @@ void turn_connection_off (char *name) {
snprintf(command, STRING_SIZE - 1,
"/usr/sbin/ipsec stroke delete %s >/dev/null", name);
safe_system(command);
+
safe_system("/usr/sbin/ipsec whack --rereadall >/dev/null");
safe_system("/usr/sbin/ipsec stroke rereadall >/dev/null");
diff --git a/src/scripts/vpn-watch b/src/scripts/vpn-watch
index 63b2442..563c14c 100755
--- a/src/scripts/vpn-watch
+++ b/src/scripts/vpn-watch
@@ -1,6 +1,6 @@
#!/usr/bin/perl
##################################################
-##### VPN-Watch.pl Version 0.6a #####
+##### VPN-Watch.pl Version 0.7 #####
##################################################
# #
# VPN-Watch is part of the IPFire Firewall #
@@ -39,12 +39,11 @@ while ( $i == 0){
unless(@vpnsettings) {exit 1;}
}
-my $status = `ipsec whack --status`;
+my $status = `ipsec status`;
foreach (@vpnsettings){
my @settings = split(/,/,$_);
chomp($settings[30]);
- if ($settings[30] eq 'ikev2'){next;}
if ($settings[27] ne 'RED'){next;}
if ($settings[4] ne 'net'){next;}
if ($settings[1] ne 'on'){next;}chomp($settings[29]);
@@ -57,15 +56,13 @@ foreach (@vpnsettings){
my $remoteip = `/usr/bin/ping -c 1 $remotehostname 2>/dev/null | head -n1 | awk '{print \$3}' | tr -d '()' | tr -d ':'`;chomp($remoteip);
if ($remoteip eq ""){next;if ($debug){logger("Unable to resolve $remotehostname.");}}
my $ipmatch= `echo "$status" | grep '$remoteip' | grep '$settings[2]'`;
- my $established= `echo "$status" | grep '$settings[2]' | grep 'erouted;'`;
+ my $established= `echo "$status" | grep '$settings[2]' | grep -e 'erouted;' -e 'INSTALLED'`;
my $known= `echo "$status" | grep '$settings[2]'`;
if ( $ipmatch eq '' && $known ne '' ){
logger("Remote IP for host $remotehostname($remoteip) has changed, restarting ipsec.");
system("/usr/local/bin/ipsecctrl S $settings[0]");
$round=0;
- last; #all connections will reloaded
- #remove this if ipsecctrl can restart single con again
}
if ($debug){logger("Round=".$round." and established=".$established);}
@@ -74,8 +71,6 @@ foreach (@vpnsettings){
logger("Connection to $remotehostname($remoteip) not erouted, restarting ipsec.");
system("/usr/local/bin/ipsecctrl S $settings[0]");
$round=0;
- last; #all connections will reloaded
- #remove this if ipsecctrl can restart single con again
}
}
hooks/post-receive
--
IPFire 2.x development tree