From 237f3ab7d35facc6ab53bbde05b448e7e61b4cd3 Mon Sep 17 00:00:00 2001
From: Michael Tremer <michael.tremer@ipfire.org>
Date: Wed, 13 Jun 2018 15:47:57 +0100
Subject: [PATCH] IPsec: Allow to configure a connection in waiting state

This allows to create an IPsec connection that will never actively
try to reach the other peer. It helps in environments where this is
not desired or impossible because of NAT.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---
 html/cgi-bin/index.cgi   | 3 +++
 html/cgi-bin/vpnmain.cgi | 5 +++++
 langs/de/cgi-bin/de.pl   | 2 ++
 langs/en/cgi-bin/en.pl   | 2 ++
 4 files changed, 12 insertions(+)

diff --git a/html/cgi-bin/index.cgi b/html/cgi-bin/index.cgi
index 580671b719..ef9da2389b 100644
--- a/html/cgi-bin/index.cgi
+++ b/html/cgi-bin/index.cgi
@@ -479,6 +479,9 @@ END
 						} elsif ($line =~ /$vpnconfig{$key}[1]\{.*ROUTED/) {
 							$activecolor = $Header::colourorange;
 							$activestatus = $Lang::tr{'vpn on-demand'};
+						} elsif ($vpnconfig{$key}[33] eq "add") {
+							$activecolor = ${Header::colourorange};
+							$activestatus = $Lang::tr{'vpn wait'};
 						}
 					}
 				}
diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index 378acb3268..eefe975990 100644
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -2439,6 +2439,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
 	$selected{'DPD_ACTION'}{'none'} = '';
 	$selected{'DPD_ACTION'}{$cgiparams{'DPD_ACTION'}} = "selected='selected'";
 
+	$selected{'START_ACTION'}{'add'} = '';
 	$selected{'START_ACTION'}{'route'} = '';
 	$selected{'START_ACTION'}{'start'} = '';
 	$selected{'START_ACTION'}{$cgiparams{'START_ACTION'}} = "selected='selected'";
@@ -2664,6 +2665,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
 			<select name="START_ACTION">
 				<option value="route" $selected{'START_ACTION'}{'route'}>$Lang::tr{'vpn start action route'}</option>
 				<option value="start" $selected{'START_ACTION'}{'start'}>$Lang::tr{'vpn start action start'}</option>
+				<option value="add"   $selected{'START_ACTION'}{'add'}  >$Lang::tr{'vpn start action add'}</option>
 			</select>
 		</td>
 	</tr>
@@ -2861,6 +2863,9 @@ END
 		} elsif ($line =~ /$confighash{$key}[1]\{.*ROUTED/) {
 			$col1="bgcolor='${Header::colourorange}'";
 			$active = "<b><font color='#FFFFFF'>$Lang::tr{'vpn on-demand'}</font></b>";
+		} elsif ($confighash{$key}[33] eq "add") {
+			$col1="bgcolor='${Header::colourorange}'";
+			$active = "<b><font color='#FFFFFF'>$Lang::tr{'vpn wait'}</font></b>";
 		}
 	}
 	# move to blue if really down
diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl
index edff684ea7..630d9b2f0c 100644
--- a/langs/de/cgi-bin/de.pl
+++ b/langs/de/cgi-bin/de.pl
@@ -2708,11 +2708,13 @@
 'vpn red name' => 'Öffentliche IP oder FQDN für das rote Interface oder <%defaultroute>',
 'vpn remote id' => 'Remote ID',
 'vpn start action' => 'Startaktion',
+'vpn start action add' => 'Auf Verbindungseingang warten',
 'vpn start action route' => 'Bei Bedarf',
 'vpn start action start' => 'Immer An',
 'vpn statistic n2n' => 'OpenVPN-Netz-zu-Netz-Statistik',
 'vpn statistic rw' => 'OpenVPN-Roadwarrior-Statistik',
 'vpn subjectaltname' => 'Subjekt Alternativer Name',
+'vpn wait' => 'WARTE',
 'vpn watch' => 'Netz-zu-Netz VPN neu starten, wenn sich Remote-IP ändert (DynDNS).',
 'vpn weak' => 'schwach',
 'waiting to synchronize clock' => 'Bitte warten, die Uhr wird synchronisiert',
diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl
index 0c77ce4b24..8ec5bf4868 100644
--- a/langs/en/cgi-bin/en.pl
+++ b/langs/en/cgi-bin/en.pl
@@ -2753,11 +2753,13 @@
 'vpn red name' => 'Public IP or FQDN for RED interface or <%defaultroute>',
 'vpn remote id' => 'Remote ID',
 'vpn start action' => 'Start Action',
+'vpn start action add' => 'Wait for connection initiation',
 'vpn start action route' => 'On Demand',
 'vpn start action start' => 'Always On',
 'vpn statistic n2n' => 'OpenVPN Net-to-Net Statistics',
 'vpn statistic rw' => 'OpenVPN Roadwarrior Statistics',
 'vpn subjectaltname' => 'Subject Alt Name',
+'vpn wait' => 'WAITING',
 'vpn watch' => 'Restart net-to-net vpn when remote peer IP changes (dyndns).',
 'vpn weak' => 'Weak',
 'waiting to synchronize clock' => 'Waiting to synchronize clock',
-- 
2.39.5