IPsec: Try to restart always-on tunnels immediately

When a tunnel that is in always-on configuration closes
unexpectedly, we can instruct strongSwan to restart it
immediately which is precisely what we do now.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/config/rootfiles/core/119/filelists/files b/config/rootfiles/core/119/filelists/files
index 053cb12788c5fb2ef33b9f4ef7f8c08355832626..c8f6cc13bbd7b96457bf17f7712c387b939aea02 100644 (file)
--- a/config/rootfiles/core/119/filelists/files
+++ b/config/rootfiles/core/119/filelists/files
@@ -5,4 +5,5 @@ etc/rc.d/init.d/unbound
 srv/web/ipfire/cgi-bin/index.cgi
 srv/web/ipfire/cgi-bin/ovpnmain.cgi
 srv/web/ipfire/cgi-bin/proxy.cgi
+srv/web/ipfire/cgi-bin/vpnmain.cgi
 var/ipfire/langs

diff --git a/config/rootfiles/core/119/update.sh b/config/rootfiles/core/119/update.sh
index e4c7a77ebe9dfeffe4b9fd96bd012ff5199b348a..1231a4941bb35e36b37bd184ebfc93f33e9f73c0 100644 (file)
--- a/config/rootfiles/core/119/update.sh
+++ b/config/rootfiles/core/119/update.sh
@@ -73,8 +73,14 @@ rm -vf \
 
 # Start services
 
-# This update need a reboot...
-#touch /var/run/need_reboot
+# Regenerate IPsec configuration
+sudo -u nobody /srv/web/ipfire/cgi-bin/vpnmain.cgi
+if grep -q "ENABLED=on" /var/ipfire/vpn/settings; then
+       /etc/init.d/ipsec restart
+fi
+
+# This update needs a reboot...
+touch /var/run/need_reboot
 
 # Finish
 /etc/init.d/fireinfo start

diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index 17873d62bea2933affb1d6fa662e66eb63f3eb3d..2a0351ea04c4f31f7b26d0d7ee3e40125f8a6f2b 100644 (file)
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -436,6 +436,12 @@ sub writeipsecfiles {
                        if ($start_action eq 'route' && $inactivity_timeout > 0) {
                                print CONF "\tinactivity=$inactivity_timeout\n";
                        }
+
+                       # Restart the connection immediately when it has gone down
+                       # unexpectedly
+                       if ($start_action eq 'start') {
+                               print CONF "\tcloseaction=restart\n";
+                       }
                }
 
                # Fragmentation