From d1073bf6778a4ee5481d34763cdfb4bf3d3ce279 Mon Sep 17 00:00:00 2001
From: Seth <seth.mos@xs4all.nl>
Date: Sat, 11 Jul 2009 23:05:04 +0200
Subject: [PATCH] Do not add hostname to watch in the refresh ipsec policy
 section, there may be other tunnels using the same endpoint which need
 refreshing as well. This is also done in the part where the racoon
 configuration is written so it's safe to skip it here.

Silence the logging in the dnscache code and the ipsec route add code into a debug check

FIXME: there is a possible situation where hostname changes can be missed. In a lot of tunnels situation there
might be updates of other hostnames that changed while we were reconfiguring. Not sure how to handle that.
---
 etc/inc/pfsense-utils.inc | 6 ++++--
 etc/inc/vpn.inc           | 5 +++--
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/etc/inc/pfsense-utils.inc b/etc/inc/pfsense-utils.inc
index 670d91b520..d5559ebd74 100644
--- a/etc/inc/pfsense-utils.inc
+++ b/etc/inc/pfsense-utils.inc
@@ -3830,7 +3830,9 @@ function compare_hostname_to_dnscache($hostname) {
 	}
 
 	if(trim($oldcontents) != trim($contents)) {
-		log_error("DNSCACHE: Found old IP {$oldcontents} and new IP {$contents}");
+		if($g['debug']) {
+			log_error("DNSCACHE: Found old IP {$oldcontents} and new IP {$contents}");
+		}
 		return ($oldcontents);
 	} else {
 		return false;
@@ -3855,4 +3857,4 @@ function is_fqdn($fqdn) {
 }
 
 
-?>
\ No newline at end of file
+?>
diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc
index 89528b653d..73aa6ea182 100644
--- a/etc/inc/vpn.inc
+++ b/etc/inc/vpn.inc
@@ -277,7 +277,9 @@ function vpn_ipsec_configure($ipchg = false) {
 							/* if the remote gateway is in the local subnet, then don't add a route */
 							if(! ip_in_subnet($tunnel['remote-gateway'], "{$subnet_ip}/{$subnet_bits}")) {
 								if(is_ipaddr($gatewayip)) {
-									log_error("IPSEC interface is not WAN but {$parentinterface}, adding static route for VPN endpoint {$tunnel['remote-gateway']} via {$gatewayip}");
+									if($g['debug']) {
+										log_error("IPSEC interface is not WAN but {$parentinterface}, adding static route for VPN endpoint {$tunnel['remote-gateway']} via {$gatewayip}");
+									}
 									mwexec("/sbin/route delete -host {$tunnel['remote-gateway']}");
                                                                         mwexec("/sbin/route add -host {$tunnel['remote-gateway']} {$gatewayip}");
 								}
@@ -1242,7 +1244,6 @@ function reload_tunnel_spd_policy($tunnel, $oldtunnel) {
 	 * try to resolve it now and add it to the list for dnswatch */
 	if (!is_ipaddr($tunnel['remote-gateway'])) {
 		$rgip = resolve_retry($tunnel['remote-gateway']);
-		add_hostname_to_watch($tunnel['remote-gateway']);
 		if (!$rgip) {
 			log_error("Could not determine VPN endpoint for {$tunnel['descr']}");
 			return false;