From: Michael Tremer <michael.tremer@ipfire.org>
Date: Fri, 24 Mar 2017 12:24:42 +0000 (+0100)
Subject: ipsec: Do not reject connections in on-demand mode
X-Git-Tag: v2.19-core110^2~19
X-Git-Url: http://git.ipfire.org/?p=people%2Fpmueller%2Fipfire-2.x.git;a=commitdiff_plain;h=cda384a280b11461f4114faf4c86c8589df15eb0

ipsec: Do not reject connections in on-demand mode

When an on-demand VPN connection is not up, the packets will
traverse the firewall and be rejected by the IPSECBLOCK chain
which will cause that an ICMP error message will be sent to
the client. If that does not happen and the packet is being
silently dropped, the client will retransmit and by then
the VPN connection will hopefully be up.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---

diff --git a/config/firewall/ipsec-block b/config/firewall/ipsec-block
index 9fa8e1a466..96682b8943 100644
--- a/config/firewall/ipsec-block
+++ b/config/firewall/ipsec-block
@@ -23,23 +23,43 @@ VPN_CONFIG="/var/ipfire/vpn/config"
 
 block_subnet() {
 	local subnet="${1}"
+	local action="${2}"
 
 	# Don't block a wildcard subnet
 	if [ "${subnet}" = "0.0.0.0/0" ] || [ "${subnet}" = "0.0.0.0/0.0.0.0" ]; then
 		return 0
 	fi
 
-	iptables -A IPSECBLOCK -d "${subnet}" -j REJECT --reject-with icmp-net-unreachable
+	case "${action}" in
+		reject)
+			iptables -A IPSECBLOCK -d "${subnet}" -j REJECT --reject-with icmp-net-unreachable
+			;;
+		drop)
+			iptables -A IPSECBLOCK -d "${subnet}" -j DROP
+			;;
+		*)
+			return 1
+			;;
+	esac
+
+	return 0
 }
 
 block_ipsec() {
 	# Flush all exists rules
 	iptables -F IPSECBLOCK
 
-	local id status name lefthost type ctype unknown1 unknown2 unknown3
-	local leftsubnets unknown4 righthost rightsubnets rest
-	while IFS="," read -r id status name lefthost type ctype unkown1 unknown2 unknown3 \
-			leftsubnets unknown4 righthost rightsubnets rest; do
+	local action
+
+	local vars="id status name lefthost type ctype x1 x2 x3 leftsubnets"
+	vars="${vars} x4 righthost rightsubnets x5 x6 x7 x8 x9 x10 x11 x12"
+	vars="${vars} x13 x14 x15 x16 x17 x18 x19 x20 x21 proto x22 x23 x24"
+	vars="${vars} route rest"
+
+	# Register local variables
+	local ${vars}
+
+	while IFS="," read -r ${vars}; do
 		# Check if the connection is enabled
 		[ "${status}" = "on" ] || continue
 
@@ -49,9 +69,18 @@ block_ipsec() {
 		# Split multiple subnets
 		rightsubnets="${rightsubnets//\|/ }"
 
+		case "${route}" in
+			route)
+				action="drop"
+				;;
+			*)
+				action="reject"
+				;;
+		esac
+
 		local rightsubnet
 		for rightsubnet in ${rightsubnets}; do
-			block_subnet "${rightsubnet}"
+			block_subnet "${rightsubnet}" "${action}"
 		done
 	done < "${VPN_CONFIG}"
 }
diff --git a/config/rootfiles/core/110/filelists/files b/config/rootfiles/core/110/filelists/files
index 5816027100..c6d15d637c 100644
--- a/config/rootfiles/core/110/filelists/files
+++ b/config/rootfiles/core/110/filelists/files
@@ -13,6 +13,7 @@ srv/web/ipfire/cgi-bin/vpnmain.cgi
 srv/web/ipfire/html/themes/darkdos/include/style.css
 srv/web/ipfire/html/themes/ipfire/include/css/style.css
 srv/web/ipfire/html/themes/maniac/include/style.css
+usr/lib/firewall/ipsec-block
 usr/lib/libssp.so.0
 usr/lib/libssp.so.0.0.0
 usr/local/bin/xt_geoip_update