From 0fabced3c4d3c5fa8cb1fa28413f469f73f97875 Mon Sep 17 00:00:00 2001
From: Seth Mos <seth.mos@xs4all.nl>
Date: Sun, 20 May 2007 16:52:34 +0000
Subject: [PATCH] Commit forgotten vpn_ipsec_force_reload()

---
 etc/inc/vpn.inc | 39 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc
index 16b4bb8e6c..0e2c71c72f 100644
--- a/etc/inc/vpn.inc
+++ b/etc/inc/vpn.inc
@@ -1018,4 +1018,43 @@ EOD;
 	return 0;
 }
 
+/* Forcefully restart IPSEC
+ * This is required for when dynamic interfaces reload
+ * For all other occasions the normal vpn_ipsec_configure()
+ * will gracefully reload the settings without restarting
+ */
+function vpn_ipsec_force_reload() {
+	global $config;
+	global $g;
+
+	$ipseccfg = $config['ipsec'];
+
+	/* kill any ipsec communications regardless when we are invoked */
+	mwexec("/sbin/ifconfig enc0 down");
+	mwexec("/sbin/ifconfig enc0 destroy");
+
+	/* kill racoon */
+	mwexec("/usr/bin/killall racoon");
+
+	/* wait for process to die */
+	sleep(2);
+
+	/* send a SIGKILL to be sure */
+	sigkillbypid("{$g['varrun_path']}/racoon.pid", "KILL");
+
+	/* flush SPD and SAD */
+	mwexec("/sbin/setkey -FP");
+	mwexec("/sbin/setkey -F");
+
+	/* wait for flushing to finish */
+	sleep(5);
+
+	/* if ipsec is enabled, start up again */
+	if (isset($ipseccfg['enable'])) {
+		log_error("Forcefully reloading IPSEC racoon daemon");
+		vpn_ipsec_configure();
+	}
+
+}
+
 ?>