mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixes #4353 Identify when strongswan.conf needs a reload and restart ipsec service.

Browse Source
This commit is contained in:
Ermal LUÇI 2015-01-31 11:06:44 +01:00
parent ee65c642df
commit 41da54ce14
3 changed files with 42 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
etc/inc/vpn.inc
View File

@ -94,7 +94,7 @@ function vpn_ipsec_convert_to_modp($index)
return $convertion;
}
function vpn_ipsec_configure($ipchg = false)
function vpn_ipsec_configure($restart = false)
{
global $config, $g, $sa, $sn, $p1_ealgos, $p2_ealgos;
@ -293,9 +293,15 @@ function vpn_ipsec_configure($ipchg = false)
if (isset($config['ipsec']['acceptunencryptedmainmode']))
$accept_unencrypted = "accept_unencrypted_mainmode_messages = yes";
$stronconf = '';
if (file_exists("{$g['varetc_path']}/ipsec/strongswan.conf"))
$stronconf = file_get_contents("{$g['varetc_path']}/ipsec/strongswan.conf");
$i_dont_care_about_security_and_use_aggressive_mode_psk = "";
if ($aggressive_mode_psk) {
log_error("WARNING: Setting i_dont_care_about_security_and_use_aggressive_mode_psk option because a phase 1 is configured using aggressive mode with pre-shared keys. This is not a secure configuration.");
if (!empty($stronconf) && strpos($stronconf, 'i_dont_care_about_security_and_use_aggressive_mode_psk') === FALSE)
$restart = true;
$i_dont_care_about_security_and_use_aggressive_mode_psk = "i_dont_care_about_security_and_use_aggressive_mode_psk=yes";
}
@ -308,6 +314,8 @@ function vpn_ipsec_configure($ipchg = false)
else
$ifacesuse = '';
unset($strongconf);
$strongswan = <<<EOD
# Automatically generated config file - DO NOT MODIFY. Changes will be overwritten.
@ -993,13 +1001,17 @@ EOD;
set_single_sysctl('net.inet.ipcomp.ipcomp_enable', 0);
/* mange process */
if (isvalidpid("{$g['varrun_path']}/charon.pid")) {
/* Read secrets */
mwexec("/usr/local/sbin/ipsec rereadall", false);
/* Update configuration changes */
mwexec("/usr/local/sbin/ipsec update", false);
if ($restart === true) {
mwexec("/usr/local/sbin/ipsec restart", false);
} else {
mwexec("/usr/local/sbin/ipsec start", false);
if (isvalidpid("{$g['varrun_path']}/charon.pid")) {
/* Read secrets */
mwexec("/usr/local/sbin/ipsec rereadall", false);
/* Update configuration changes */
mwexec("/usr/local/sbin/ipsec update", false);
} else {
mwexec("/usr/local/sbin/ipsec start", false);
}
}
if ($natfilterrules == true)

5
usr/local/www/vpn_ipsec_mobile.php
View File

@ -112,7 +112,8 @@ if ($_POST['create']) {
if ($_POST['apply']) {
$retval = 0;
$retval = vpn_ipsec_configure();
/* NOTE: #4353 Always restart ipsec when mobile clients settings change */
$retval = vpn_ipsec_configure(true);
$savemsg = get_std_save_message($retval);
if ($retval >= 0)
if (is_subsystem_dirty('ipsec'))
@ -227,8 +228,6 @@ if ($_POST['submit']) {
if ($pconfig['login_banner_enable'])
$client['login_banner'] = $pconfig['login_banner'];
// $echo "login banner = {$pconfig['login_banner']}";
$a_client = $client;
write_config();

28
usr/local/www/vpn_ipsec_settings.php
View File

@ -130,20 +130,34 @@ if ($_POST) {
}
}
if($_POST['compression'] == "yes")
$needsrestart = false;
if($_POST['compression'] == "yes") {
if (!isset($config['ipsec']['compression']))
$needsrestart = true;
$config['ipsec']['compression'] = true;
elseif (isset($config['ipsec']['compression']))
} elseif (isset($config['ipsec']['compression'])) {
$needsrestart = true;
unset($config['ipsec']['compression']);
}
if($_POST['unityplugin'] == "yes")
if($_POST['unityplugin'] == "yes") {
if (!isset($config['ipsec']['unityplugin']))
$needsrestart = true;
$config['ipsec']['unityplugin'] = true;
elseif (isset($config['ipsec']['unityplugin']))
} elseif (isset($config['ipsec']['unityplugin'])) {
$needsrestart = true;
unset($config['ipsec']['unityplugin']);
}
if($_POST['acceptunencryptedmainmode'] == "yes")
if($_POST['acceptunencryptedmainmode'] == "yes") {
if (!isset($config['ipsec']['acceptunencryptedmainmode']))
$needsrestart = true;
$config['ipsec']['acceptunencryptedmainmode'] = true;
elseif (isset($config['ipsec']['acceptunencryptedmainmode']))
} elseif (isset($config['ipsec']['acceptunencryptedmainmode'])) {
$needsrestart = true;
unset($config['ipsec']['acceptunencryptedmainmode']);
}
if($_POST['maxmss_enable'] == "yes") {
$config['system']['maxmss_enable'] = true;
@ -163,7 +177,7 @@ if ($_POST) {
$savemsg = gettext($retval);
vpn_ipsec_configure_preferoldsa();
vpn_ipsec_configure();
vpn_ipsec_configure($needsrestart);
vpn_ipsec_configure_loglevels();
// header("Location: vpn_ipsec_settings.php");