mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove "Prefer old SA" option, and ignore it in all existing configurations. Breaks things in many cases with strongSwan. For the very rare circumstances where this is actually desirable, it's just a sysctl that can be set in tunables.

Browse Source
This commit is contained in:
Chris Buechler 2015-03-03 00:16:33 -06:00
parent c8703520b5
commit 911cc213ab
2 changed files with 0 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
etc/inc/vpn.inc
View File

@ -105,8 +105,6 @@ function vpn_ipsec_configure($restart = false)
unlink_if_exists("{$g['vardb_path']}/ipsecpinghosts");
touch("{$g['vardb_path']}/ipsecpinghosts");
vpn_ipsec_configure_preferoldsa();
$syscfg = $config['system'];
$ipseccfg = $config['ipsec'];
if (!isset($ipseccfg['enable'])) {
@ -1769,12 +1767,4 @@ EOD;
return 0;
}
function vpn_ipsec_configure_preferoldsa() {
global $config;
if(isset($config['ipsec']['preferoldsa']))
set_single_sysctl("net.key.preferred_oldsa", "-30");
else
set_single_sysctl("net.key.preferred_oldsa", "0");
}
?>

18
usr/local/www/vpn_ipsec_settings.php
View File

@ -41,7 +41,6 @@ require_once("shaper.inc");
require_once("ipsec.inc");
require_once("vpn.inc");
$pconfig['preferoldsa_enable'] = isset($config['ipsec']['preferoldsa']);
foreach ($ipsec_loglevels as $lkey => $ldescr) {
if (!empty($config['ipsec']["ipsec_{$lkey}"]))
$pconfig["ipsec_{$lkey}"] = $config['ipsec']["ipsec_{$lkey}"];
@ -115,11 +114,6 @@ if ($_POST) {
if (!$input_errors) {
if($_POST['preferoldsa_enable'] == "yes")
$config['ipsec']['preferoldsa'] = true;
elseif (isset($config['ipsec']['preferoldsa']))
unset($config['ipsec']['preferoldsa']);
if (is_array($config['ipsec'])) {
foreach ($ipsec_loglevels as $lkey => $ldescr) {
if (empty($_POST["ipsec_{$lkey}"])) {
@ -182,7 +176,6 @@ if ($_POST) {
else
$savemsg = gettext($retval);
vpn_ipsec_configure_preferoldsa();
vpn_ipsec_configure($needsrestart);
vpn_ipsec_configure_loglevels();
@ -242,17 +235,6 @@ function maxmss_checked(obj) {
<tr>
<td colspan="2" valign="top" class="listtopic"><?=gettext("IPsec Advanced Settings"); ?></td>
</tr>
<tr>
<td width="22%" valign="top" class="vncell"><?=gettext("Security Associations"); ?></td>
<td width="78%" class="vtable">
<input name="preferoldsa_enable" type="checkbox" id="preferoldsa_enable" value="yes" <?php if ($pconfig['preferoldsa_enable']) echo "checked=\"checked\""; ?> />
<strong><?=gettext("Prefer older IPsec SAs"); ?></strong>
<br />
<?=gettext("By default, if several SAs match, the newest one is " .
"preferred if it's at least 30 seconds old. Select this " .
"option to always prefer old SAs over new ones."); ?>
</td>
</tr>
<tr>
<td width="22%" valign="top" class="vncell"><?=gettext("IPsec Debug"); ?></td>
<td width="78%" class="vtable">