From 483e0b3327918719fb38dbdd9b6fb755aecce2eb Mon Sep 17 00:00:00 2001
From: Daniil Baturin <daniil@vyos.io>
Date: Fri, 23 Jul 2021 23:43:03 -0500
Subject: T3697: return an empty dict when IPsec isn't fully configured to
 avoid trying to wait for a daemon that shouldn't even be running.

---
 src/conf_mode/ipsec-settings.py | 26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)

(limited to 'src/conf_mode/ipsec-settings.py')

diff --git a/src/conf_mode/ipsec-settings.py b/src/conf_mode/ipsec-settings.py
index b02f3bcb0..ce313d9a0 100755
--- a/src/conf_mode/ipsec-settings.py
+++ b/src/conf_mode/ipsec-settings.py
@@ -46,6 +46,14 @@ def get_config(config=None):
         config = config
     else:
         config = Config()
+
+    # IPsec isn't configured enough to warrant starting StrongSWAN for it,
+    # it's just some incomplete or leftover options.
+    if config.exists("vpn ipsec site-to-site peer") or \
+       config.exists("vpn ipsec profile") or \
+       config.exists("vpn l2tp remote-access ipsec-settings"):
+        return {}
+
     data = {"install_routes": "yes"}
 
     if config.exists("vpn ipsec options disable-route-autoinstall"):
@@ -204,6 +212,10 @@ def generate(data):
 
 def restart_ipsec():
     try:
+        # Restart the IPsec daemon when it's running.
+        # Since it's started by the legacy ipsec.pl in VyOS 1.3,
+        # there's a chance that this script will run before charon is up,
+        # so we can't assume it's running and have to check and wait if needed.
         wait_for_file_write_complete(charon_pidfile,
           pre_hook=(lambda: call('ipsec restart >&/dev/null')),
           timeout=10)
@@ -214,22 +226,18 @@ def restart_ipsec():
     except OSError:
         raise ConfigError('VPN configuration error: IPSec process did not start.')
 
-def apply(data, config):
-    if config.exists("vpn ipsec site-to-site peer") or \
-       config.exists("vpn ipsec profile") or \
-       config.exists("vpn l2tp remote-access ipsec-settings"):
-        # Restart IPSec daemon
+def apply(data):
+    if data:
         restart_ipsec()
     else:
-        print()
+        print("Note: the IPsec process will not start until you configure some tunnels, profiles, or L2TP/IPsec settings")
 
 if __name__ == '__main__':
     try:
-        vyos_config = Config()
-        c = get_config(vyos_config)
+        c = get_config()
         verify(c)
         generate(c)
-        apply(c, vyos_config)
+        apply(c)
     except ConfigError as e:
         print(e)
         exit(1)
-- 
cgit v1.2.3