mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove the vpn_endpoint_determine function. It did not work properly when

Browse Source 
CARP devices were in use. Use the newer ipsec_get_phase1_src instead.
This commit is contained in:
Matthew Grooms 2008-08-02 02:04:05 +00:00
parent 5878ca478d
commit 0af7398aab
3 changed files with 9 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
etc/inc/filter.inc
View File

@ -2513,11 +2513,8 @@ EOD;
/* determine local and remote peer addresses */
if (!isset($ph1ent['mobile'])) {
$rgip = $ph1ent['remote-gateway'];
if(!is_ipaddr($rgip))
$rgip = resolve_retry($rgip);
if (!is_ipaddr($rgip)) {
$rgip = ipsec_get_phase1_dst($ph1ent);
if (!$rgip) {
$ipfrules .= "# ERROR! Unable to determine remote IPsec peer address for {$ph1ent['remote-gateway']}\n";
continue;
}

3
etc/inc/ipsec.inc
View File

@ -112,6 +112,9 @@ function ipsec_get_phase1_dst(& $ph1ent) {
if (!is_ipaddr($rg))
return resolve_retry($rg);
if(!is_ipaddr($rg))
return false;
return $rg;
}

37
etc/inc/vpn.inc
View File

@ -176,7 +176,7 @@ function vpn_ipsec_configure($ipchg = false)
if (isset($ph1ent['disabled']))
continue;
$ep = vpn_endpoint_determine($ph1ent, $curwanip);
$ep = ipsec_get_phase1_src($ph1ent);
if (!$ep)
continue;
@ -194,8 +194,7 @@ function vpn_ipsec_configure($ipchg = false)
if (!is_ipaddr($rg)) {
$dnswatch_list[] = $rg;
$rg = resolve_retry($rg);
if (!$rgip)
if (!$rg)
continue;
}
@ -408,7 +407,7 @@ function vpn_ipsec_configure($ipchg = false)
$ikeid = $ph1ent['ikeid'];
$ep = vpn_endpoint_determine($ph1ent, $curwanip);
$ep = ipsec_get_phase1_src($ph1ent);
if (!$ep)
continue;
@ -723,7 +722,7 @@ EOD;
if (isset($ph2ent['disabled']))
continue;
$ep = vpn_endpoint_determine($ph1ent, $curwanip);
$ep = ipsec_get_phase1_src($ph1ent);
if (!$ep)
continue;
@ -863,34 +862,6 @@ function vpn_localnet_determine($adr, & $sa, & $sn) {
}
}
/* XXX: is there a need for this get_current_wan_address() does already this?! */
function vpn_endpoint_determine($ph1ent, $curwanip) {
global $g, $config;
if ((!$ph1ent['interface']) || ($ph1ent['interface'] == "wan")) {
if ($curwanip)
return $curwanip;
else
return null;
} elseif ($ph1ent['interface'] == "lan") {
return $config['interfaces']['lan']['ipaddr'];
} else {
$iface = $config['interfaces'][$ph1ent['interface']]['if'];
$oc = $config['interfaces'][$ph1ent['interface']];
/* carp ips, etc */
$ip = find_interface_ip($iface);
if($ip)
return $ip;
if (isset ($oc['enable']) && $oc['if']) {
return $oc['ipaddr'];
}
}
return null;
}
/* Forcefully restart IPsec
* This is required for when dynamic interfaces reload
* For all other occasions the normal vpn_ipsec_configure()