webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-15 21:43:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fixed several bugs in vpn-watch script.

Browse Source 
The counter was pending between 0 and 1 and not going up to 9.

If ipsec whack is returning and empty page we do not need to check
if the remoteip has changed because the tunnel is not up.

If ipsec is restarted the counter can be reset.

All these facts causes that on low powered system the tunnels are
intable if you have a lot of them. But we need to check if the
convergation timer is okay because with these bugs the tunnels
were minutly restarted and with correct handling after 10.
This commit is contained in:
Christian Schmidt
2011-01-21 17:52:32 +01:00
parent b18bad8a19
commit bb893dcd86
3 changed files with 16 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
config/rootfiles/core/45/filelists/files
View File

@@ -7,4 +7,5 @@ srv/web/ipfire/cgi-bin/proxy.cgi
srv/web/ipfire/cgi-bin/vpnmain.cgi
usr/sbin/updxlrator
var/ipfire/outgoing/bin/outgoingfw.pl
srv/web/ipfire/cgi-bin/logs.cgi/firewalllog.dat
srv/web/ipfire/cgi-bin/logs.cgi/firewalllog.dat
usr/local/bin/vpn-watch

4
config/rootfiles/core/45/update.sh
View File

@@ -28,6 +28,8 @@
#Stop services
echo Stopping Proxy
/etc/init.d/squid stop 2>/dev/null
echo Stopping vpn-watch
killall vpn-watch
#
#Extract files
@@ -39,6 +41,8 @@ echo Starting Proxy
/etc/init.d/squid start 2>/dev/null
echo Rewriting Outgoing FW Rules
/var/ipfire/outgoing/bin/outgoingfw.pl
echo Starting vpn-watch
/usr/local/bin/vpn-watch &
#
#Update Language cache

15
src/scripts/vpn-watch
View File

@@ -1,6 +1,6 @@
#!/usr/bin/perl
##################################################
##### VPN-Watch.pl Version 0.5 #####
##### VPN-Watch.pl Version 0.6 #####
##################################################
# #
# VPN-Watch is part of the IPFire Firewall #
@@ -32,7 +32,7 @@ while ( $i == 0){
$round++;
# Reset roundcounter after 10 min. To do established check.
if ($round > 9) { $round=0 }
if ($round > 9) { $round==0 }
if (open(FILE, "<${General::swroot}/vpn/config")) { @vpnsettings = <FILE>;
close(FILE);
@@ -55,17 +55,22 @@ foreach (@vpnsettings){
my $remoteip = `/usr/bin/ping -c 1 $remotehostname 2>/dev/null | head -n1 | awk '{print \$3}' | tr -d '()' | tr -d ':'`;chomp($remoteip);
if ($remoteip eq ""){next;if ($debug){logger("Unable to resolve $remotehostname.");}}
my $ipmatch= `echo "$status" | grep '$remoteip' | grep '$settings[2]'`;
my $established= `echo "$status" | grep '$settings[2]' | grep 'erouted;'`;
my $established= `echo "$status" | grep '$settings[2]' | grep 'erouted;'`;
if ( $ipmatch eq '' ){
if ( $ipmatch eq '' && $status ne ''){
logger("Remote IP for host $remotehostname($remoteip) has changed, restarting ipsec.");
system("/usr/local/bin/ipsecctrl S $settings[0]");
$round=0;
last; #all connections will reloaded
#remove this if ipsecctrl can restart single con again
}
if ( ($round = 0) && ($established eq '')) {
if ($debug){logger("Round=".$round." and established=".$established);}
if ( ($round == 0) && ($established eq '')) {
logger("Connection to $remotehostname($remoteip) not erouted, restarting ipsec.");
system("/usr/local/bin/ipsecctrl S $settings[0]");
$round=0;
last; #all connections will reloaded
#remove this if ipsecctrl can restart single con again