IPsec: Allow to create on-demand connections

This will create IPsec VPN connections with auto=route set
instead of auto=start which will cause the connection being
created, but not brought up yet.

As soon as the first packet is received, the connection will
be established and data will be passed through it.

This allows IPFire to handle more VPN connections on weaker
systems and avoids negotiating many connections which are
rarely used.

Suggested-by: Tom Rymes <tomvend@rymes.com>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Fixes: #10733

diff --git a/doc/language_issues.es b/doc/language_issues.es
index 60ba499c955dc5a5bd6faa88d06889fc74385727..36d4a8211a50dad7ae17368d5d3db02687675d08 100644 (file)
--- a/doc/language_issues.es
+++ b/doc/language_issues.es
@@ -1144,6 +1144,9 @@ WARNING: untranslated string: vendor
 WARNING: untranslated string: visit us at
 WARNING: untranslated string: vpn force mobike
 WARNING: untranslated string: vpn keyexchange
+WARNING: untranslated string: vpn start action
+WARNING: untranslated string: vpn start action route
+WARNING: untranslated string: vpn start action start
 WARNING: untranslated string: vpn statistic n2n
 WARNING: untranslated string: vpn statistic rw
 WARNING: untranslated string: vpn statistics n2n

diff --git a/doc/language_issues.fr b/doc/language_issues.fr
index 863b5291a77277057435b3e1c3b929da5eca0d51..b21c33851c968322fdb2928b9752537fc6b8dc4c 100644 (file)
--- a/doc/language_issues.fr
+++ b/doc/language_issues.fr
@@ -1161,6 +1161,9 @@ WARNING: untranslated string: vendor
 WARNING: untranslated string: visit us at
 WARNING: untranslated string: vpn force mobike
 WARNING: untranslated string: vpn keyexchange
+WARNING: untranslated string: vpn start action
+WARNING: untranslated string: vpn start action route
+WARNING: untranslated string: vpn start action start
 WARNING: untranslated string: vpn statistic n2n
 WARNING: untranslated string: vpn statistic rw
 WARNING: untranslated string: vpn statistics n2n

diff --git a/doc/language_issues.it b/doc/language_issues.it
index 6efef40f4bf4924c4cff93df6ca39b7cce7e0abb..e7230280f90bbfaa7edeb91591cce6c8b898b4b2 100644 (file)
--- a/doc/language_issues.it
+++ b/doc/language_issues.it
@@ -819,6 +819,9 @@ WARNING: untranslated string: unblock
 WARNING: untranslated string: unblock all
 WARNING: untranslated string: uncheck all
 WARNING: untranslated string: vpn force mobike
+WARNING: untranslated string: vpn start action
+WARNING: untranslated string: vpn start action route
+WARNING: untranslated string: vpn start action start
 WARNING: untranslated string: vpn statistic n2n
 WARNING: untranslated string: vpn statistic rw
 WARNING: untranslated string: vpn statistics n2n

diff --git a/doc/language_issues.nl b/doc/language_issues.nl
index c9b10dcd619097c298abab698c490fa8c9f7ad95..22a89343787e94decd3d4ee7728bca97b480e8fc 100644 (file)
--- a/doc/language_issues.nl
+++ b/doc/language_issues.nl
@@ -867,6 +867,9 @@ WARNING: untranslated string: uncheck all
 WARNING: untranslated string: upload dh key
 WARNING: untranslated string: vendor
 WARNING: untranslated string: vpn force mobike
+WARNING: untranslated string: vpn start action
+WARNING: untranslated string: vpn start action route
+WARNING: untranslated string: vpn start action start
 WARNING: untranslated string: vpn statistic n2n
 WARNING: untranslated string: vpn statistic rw
 WARNING: untranslated string: vpn statistics n2n

diff --git a/doc/language_issues.pl b/doc/language_issues.pl
index 60ba499c955dc5a5bd6faa88d06889fc74385727..36d4a8211a50dad7ae17368d5d3db02687675d08 100644 (file)
--- a/doc/language_issues.pl
+++ b/doc/language_issues.pl
@@ -1144,6 +1144,9 @@ WARNING: untranslated string: vendor
 WARNING: untranslated string: visit us at
 WARNING: untranslated string: vpn force mobike
 WARNING: untranslated string: vpn keyexchange
+WARNING: untranslated string: vpn start action
+WARNING: untranslated string: vpn start action route
+WARNING: untranslated string: vpn start action start
 WARNING: untranslated string: vpn statistic n2n
 WARNING: untranslated string: vpn statistic rw
 WARNING: untranslated string: vpn statistics n2n

diff --git a/doc/language_issues.ru b/doc/language_issues.ru
index 255df2f6888f802e60f74d1e1b12b7d729d5fe6e..fc727d607adf6b3def12c358cfeaddab7066a81d 100644 (file)
--- a/doc/language_issues.ru
+++ b/doc/language_issues.ru
@@ -1139,6 +1139,9 @@ WARNING: untranslated string: vendor
 WARNING: untranslated string: visit us at
 WARNING: untranslated string: vpn force mobike
 WARNING: untranslated string: vpn keyexchange
+WARNING: untranslated string: vpn start action
+WARNING: untranslated string: vpn start action route
+WARNING: untranslated string: vpn start action start
 WARNING: untranslated string: vpn statistic n2n
 WARNING: untranslated string: vpn statistic rw
 WARNING: untranslated string: vpn statistics n2n

diff --git a/doc/language_issues.tr b/doc/language_issues.tr
index 8cf2dfe11e91156adc1ab5626a1da13c515d1e8c..59c904657dfd393e3a0ea0ef0c5fcd4677ee7d40 100644 (file)
--- a/doc/language_issues.tr
+++ b/doc/language_issues.tr
@@ -752,4 +752,7 @@ WARNING: untranslated string: route config changed
 WARNING: untranslated string: routing config added
 WARNING: untranslated string: routing config changed
 WARNING: untranslated string: routing table
+WARNING: untranslated string: vpn start action
+WARNING: untranslated string: vpn start action route
+WARNING: untranslated string: vpn start action start
 WARNING: untranslated string: vpn statistics n2n

diff --git a/doc/language_missings b/doc/language_missings
index 32e1e48ecc43d8d8f6774a23363397606fcc8ab4..49def615f3a4d23b57150446713938362a4345f2 100644 (file)
--- a/doc/language_missings
+++ b/doc/language_missings
@@ -561,6 +561,9 @@
 < vendor
 < visit us at
 < vpn keyexchange
+< vpn start action
+< vpn start action route
+< vpn start action start
 < vpn statistic n2n
 < vpn statistic rw
 < wlanap access point
@@ -1175,6 +1178,9 @@
 < vendor
 < visit us at
 < vpn keyexchange
+< vpn start action
+< vpn start action route
+< vpn start action start
 < vpn statistic n2n
 < vpn statistic rw
 < wlanap country
@@ -1754,6 +1760,9 @@
 < vendor
 < visit us at
 < vpn keyexchange
+< vpn start action
+< vpn start action route
+< vpn start action start
 < vpn statistic n2n
 < vpn statistic rw
 < wlanap country
@@ -2338,6 +2347,9 @@
 < vendor
 < visit us at
 < vpn keyexchange
+< vpn start action
+< vpn start action route
+< vpn start action start
 < vpn statistic n2n
 < vpn statistic rw
 < week-graph

diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index f1cffb88448155cc2a9f5c8ad4793e6b8c187b5e..b6469c03c21af879524e99c25def5f0eca28ebd8 100644 (file)
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -108,6 +108,7 @@ $cgiparams{'RW_NET'} = '';
 $cgiparams{'DPD_DELAY'} = '30';
 $cgiparams{'DPD_TIMEOUT'} = '120';
 $cgiparams{'FORCE_MOBIKE'} = 'off';
+$cgiparams{'START_ACTION'} = 'start';
 &Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
 
 ###
@@ -401,12 +402,17 @@ sub writeipsecfiles {
                        print CONF "\trightrsasigkey=%cert\n";
                }
 
+               my $start_action = $lconfighash{$key}[33];
+               if (!$start_action) {
+                       $start_action = "start";
+               }
+
                # Automatically start only if a net-to-net connection
                if ($lconfighash{$key}[3] eq 'host') {
                        print CONF "\tauto=add\n";
                        print CONF "\trightsourceip=$lvpnsettings{'RW_NET'}\n";
                } else {
-                       print CONF "\tauto=start\n";
+                       print CONF "\tauto=$start_action\n";
                }
 
                # Fragmentation
@@ -1778,7 +1784,7 @@ END
        my $key = $cgiparams{'KEY'};
        if (! $key) {
                $key = &General::findhasharraykey (\%confighash);
-               foreach my $i (0 .. 32) { $confighash{$key}[$i] = "";}
+               foreach my $i (0 .. 33) { $confighash{$key}[$i] = "";}
        }
        $confighash{$key}[0] = $cgiparams{'ENABLED'};
        $confighash{$key}[1] = $cgiparams{'NAME'};
@@ -2256,6 +2262,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                $confighash{$cgiparams{'KEY'}}[30] = $cgiparams{'DPD_TIMEOUT'};
                $confighash{$cgiparams{'KEY'}}[31] = $cgiparams{'DPD_DELAY'};
                $confighash{$cgiparams{'KEY'}}[32] = $cgiparams{'FORCE_MOBIKE'};
+               $confighash{$cgiparams{'KEY'}}[33] = $cgiparams{'START_ACTION'};
                &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
                &writeipsecfiles();
                if (&vpnenabled) {
@@ -2283,6 +2290,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                $cgiparams{'DPD_TIMEOUT'}               = $confighash{$cgiparams{'KEY'}}[30];
                $cgiparams{'DPD_DELAY'}                 = $confighash{$cgiparams{'KEY'}}[31];
                $cgiparams{'FORCE_MOBIKE'}              = $confighash{$cgiparams{'KEY'}}[32];
+               $cgiparams{'START_ACTION'}              = $confighash{$cgiparams{'KEY'}}[33];
 
                if (!$cgiparams{'DPD_DELAY'}) {
                        $cgiparams{'DPD_DELAY'} = 30;
@@ -2291,6 +2299,10 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                if (!$cgiparams{'DPD_TIMEOUT'}) {
                        $cgiparams{'DPD_TIMEOUT'} = 120;
                }
+
+               if (!$cgiparams{'START_ACTION'}) {
+                       $cgiparams{'START_ACTION'} = "start";
+               }
        }
 
        ADVANCED_ERROR:
@@ -2387,6 +2399,10 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
        $selected{'DPD_ACTION'}{'none'} = '';
        $selected{'DPD_ACTION'}{$cgiparams{'DPD_ACTION'}} = "selected='selected'";
 
+       $selected{'START_ACTION'}{'route'} = '';
+       $selected{'START_ACTION'}{'start'} = '';
+       $selected{'START_ACTION'}{$cgiparams{'START_ACTION'}} = "selected='selected'";
+
        &Header::showhttpheaders();
        &Header::openpage($Lang::tr{'ipsec'}, 1, '');
        &Header::openbigbox('100%', 'left', '', $errormessage);
@@ -2406,7 +2422,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
        }
 
        &Header::openbox('100%', 'left', "$Lang::tr{'advanced'}:");
-       print <<EOF
+       print <<EOF;
        <form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'>
        <input type='hidden' name='ADVANCED' value='yes' />
        <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
@@ -2599,9 +2615,16 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                                IKE+ESP: $Lang::tr{'use only proposed settings'}
                        </label>
                </td>
+               <td>
+                       <label>$Lang::tr{'vpn start action'}</label>
+                       <select name="START_ACTION">
+                               <option value="route" $selected{'START_ACTION'}{'route'}>$Lang::tr{'vpn start action route'}</option>
+                               <option value="start" $selected{'START_ACTION'}{'start'}>$Lang::tr{'vpn start action start'}</option>
+                       </select>
+               </td>
        </tr>
        <tr>
-               <td>
+               <td colspan="2">
                        <label>
                                <input type='checkbox' name='PFS' $checked{'PFS'} />
                                $Lang::tr{'pfs yes no'}
@@ -2609,7 +2632,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                </td>
        </tr>
        <tr>
-               <td>
+               <td colspan="2">
                        <label>
                                <input type='checkbox' name='COMPRESSION' $checked{'COMPRESSION'} />
                                $Lang::tr{'vpn payload compression'}
@@ -2617,20 +2640,16 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                </td>
        </tr>
        <tr>
-               <td>
+               <td colspan="2">
                        <label>
                                <input type='checkbox' name='FORCE_MOBIKE' $checked{'FORCE_MOBIKE'} />
                                $Lang::tr{'vpn force mobike'}
                        </label>
                </td>
        </tr>
-EOF
-;
-
-       print <<EOF;
        <tr>
-               <td align='left' colspan='1'><img src='/blob.gif' align='top' alt='*' />&nbsp;$Lang::tr{'required field'}</td>
-               <td align='right' colspan='2'>
+               <td align='left'><img src='/blob.gif' align='top' alt='*' />&nbsp;$Lang::tr{'required field'}</td>
+               <td align='right'>
                        <input type='submit' name='ACTION' value='$Lang::tr{'save'}' />
                        <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' />
                </td>

diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl
index 54f3ae1a79daa6e56f69f18ecef077fdbf68ffa1..867bff7ebee9ab38ab3bf9226417e37d129b4cd8 100644 (file)
--- a/langs/de/cgi-bin/de.pl
+++ b/langs/de/cgi-bin/de.pl
@@ -2618,6 +2618,9 @@
 'vpn payload compression' => 'Datennutzlast-Kompression aushandeln',
 'vpn red name' => 'Öffentliche IP oder FQDN für das rote Interface oder <%defaultroute>',
 'vpn remote id' => 'Remote ID',
+'vpn start action' => 'Startaktion',
+'vpn start action route' => 'On Demand',
+'vpn start action start' => 'Immer An',
 'vpn statistic n2n' => 'OpenVPN-Netz-zu-Netz-Statistik',
 'vpn statistic rw' => 'OpenVPN-Roadwarrior-Statistik',
 'vpn subjectaltname' => 'Subjekt Alternativer Name',

diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl
index a04d994d6274c75ab9fd837009d281717dd6f4c7..5333c13b52b504bcad8fc52d8c16a955aabb8c16 100644 (file)
--- a/langs/en/cgi-bin/en.pl
+++ b/langs/en/cgi-bin/en.pl
@@ -2663,6 +2663,9 @@
 'vpn payload compression' => 'Negotiate payload compression',
 'vpn red name' => 'Public IP or FQDN for RED interface or <%defaultroute>',
 'vpn remote id' => 'Remote ID',
+'vpn start action' => 'Start Action',
+'vpn start action route' => 'On Demand',
+'vpn start action start' => 'Always On',
 'vpn statistic n2n' => 'OpenVPN Net-to-Net Statistics',
 'vpn statistic rw' => 'OpenVPN Roadwarrior Statistics',
 'vpn subjectaltname' => 'Subject Alt Name',