ipsec: VTI keys are static now and don't need to be updated

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/src/functions/functions.ip-tunnel b/src/functions/functions.ip-tunnel
index 797a2934f633d6e1b5282e5fc755fb119641635b..32f7f5a8a76b3c32a0e2431abb71b3d64baa1534 100644 (file)
--- a/src/functions/functions.ip-tunnel
+++ b/src/functions/functions.ip-tunnel
@@ -250,58 +250,3 @@ ip_tunnel_change() {
        # Run ip command
        cmd ip link change dev "${device}" type "${type}" ${cmd_args}
 }
-
-ip_tunnel_change_keys() {
-       local device="${1}"
-       shift
-
-       if ! isset device; then
-               error "No device given"
-               return ${EXIT_ERROR}
-       fi
-
-       local ikey
-       local okey
-
-       while [ $# -gt 0 ]; do
-               case "${1}" in
-                       --ikey=*)
-                               ikey="$(cli_get_val ${1})"
-                               ;;
-                       --okey=*)
-                               okey="$(cli_get_val ${1})"
-                               ;;
-                       *)
-                               error "Invalid argument: ${1}"
-                               return ${EXIT_ERROR}
-                               ;;
-               esac
-               shift
-       done
-
-       if ! isset ikey || ! isset okey; then
-               error "You need to set --ikey= and --okey="
-               return ${EXIT_ERROR}
-       fi
-
-       if ! device_exists "${device}"; then
-               error "No such device: ${device}"
-               return ${EXIT_ERROR}
-       fi
-
-       # Determine the device type
-       local type="$(device_tunnel_get_type ${device})"
-
-       if ! isoneof "type" vti vti6; then
-               log ERROR "Device type '${type}' is invalid"
-               return ${EXIT_ERROR}
-       fi
-
-       if ! cmd ip link change dev "${device}" \
-               type "${type}" ikey "${ikey}" okey "${okey}"; then
-               log ERROR "Could not change keys of device ${device}"
-               return ${EXIT_ERROR}
-       fi
-
-       return ${EXIT_OK}
-}

diff --git a/src/helpers/ipsec-updown b/src/helpers/ipsec-updown
index 1e6c69551110fe8fc27e7e6815da03a0c1aa40ce..41a4daeffdd75d3feffe95cb3d4b36e78b396fd7 100644 (file)
--- a/src/helpers/ipsec-updown
+++ b/src/helpers/ipsec-updown
@@ -61,16 +61,10 @@ case "${PLUTO_VERB}" in
                        fi
 
                        # Update peer and local address
-                       if ! ip_tunnel_change "${ZONE}" --remote="${PLUTO_PEER}" --local="${PLUTO_ME}"; then
+                       if ! ip_tunnel_change "${ZONE}" \
+                                       --remote="${PLUTO_PEER}" --local="${PLUTO_ME}"; then
                                return ${EXIT_ERROR}
                        fi
-
-                       # Set keys for VTI devices
-                       if device_is_vti6 "${ZONE}" || device_is_vti "${ZONE}"; then
-                               ip_tunnel_change_keys "${ZONE}" \
-                                       --ikey="${PLUTO_MARK_IN%/*}" \
-                                       --okey="${PLUTO_MARK_OUT%/*}"
-                       fi
                fi
 
                #Get sources IP for routes