T5872: fix ipsec dhclient exit hook

(cherry picked from commit cd8ef21f280f726955f537132e3fab2bcb3c286f)

3 files changed, 11 insertions, 20 deletions

diff --git a/data/templates/ipsec/swanctl/peer.j2 b/data/templates/ipsec/swanctl/peer.j2
index 58f0199fa..f38691884 100644
--- a/data/templates/ipsec/swanctl/peer.j2
+++ b/data/templates/ipsec/swanctl/peer.j2
@@ -8,7 +8,7 @@
 {% if peer_conf.virtual_address is vyos_defined %}
         vips = {{ peer_conf.virtual_address | join(', ') }}
 {% endif %}
-        local_addrs = {{ peer_conf.local_address if peer_conf.local_address != 'any' else '%any' }} # dhcp:{{ peer_conf.dhcp_interface if 'dhcp_interface' in peer_conf else 'no' }}
+        local_addrs = {{ peer_conf.local_address if peer_conf.local_address != 'any' else '%any' }} # dhcp:{{ peer_conf.dhcp_interface if 'dhcp_interface' in peer_conf else 'no' }} reset:{{ name }}
         remote_addrs = {{ peer_conf.remote_address | join(",") if peer_conf.remote_address is vyos_defined and 'any' not in peer_conf.remote_address else '%any' }}
 {% if peer_conf.authentication.mode is vyos_defined('x509') %}
         send_cert = always
diff --git a/data/templates/ipsec/swanctl/remote_access.j2 b/data/templates/ipsec/swanctl/remote_access.j2
index af7f2994e..d1d6d2478 100644
--- a/data/templates/ipsec/swanctl/remote_access.j2
+++ b/data/templates/ipsec/swanctl/remote_access.j2
@@ -4,7 +4,7 @@
 {% set esp = esp_group[rw_conf.esp_group] %}
     ra-{{ name }} {
         remote_addrs = %any
-        local_addrs = {{ rw_conf.local_address if rw_conf.local_address is not vyos_defined('any') else '%any' }} # dhcp:{{ rw_conf.dhcp_interface if rw_conf.dhcp_interface is vyos_defined else 'no' }}
+        local_addrs = {{ rw_conf.local_address if rw_conf.local_address is not vyos_defined('any') else '%any' }} # dhcp:{{ rw_conf.dhcp_interface if rw_conf.dhcp_interface is vyos_defined else 'no' }} reset:ra-{{ name }}
         proposals = {{ ike_group[rw_conf.ike_group] | get_esp_ike_cipher | join(',') }}
         version = {{ ike.key_exchange[4:] if ike.key_exchange is vyos_defined else "0" }}
         send_certreq = no
diff --git a/src/etc/dhcp/dhclient-exit-hooks.d/99-ipsec-dhclient-hook b/src/etc/dhcp/dhclient-exit-hooks.d/99-ipsec-dhclient-hook
index e6edc1ac3..4dc52c6db 100755
--- a/src/etc/dhcp/dhclient-exit-hooks.d/99-ipsec-dhclient-hook
+++ b/src/etc/dhcp/dhclient-exit-hooks.d/99-ipsec-dhclient-hook
@@ -43,39 +43,30 @@ from vyos.utils.file import write_file
 
 SWANCTL_CONF="/etc/swanctl/swanctl.conf"
 
-def ipsec_down(ip_address):
-    # This prevents the need to restart ipsec and kill all active connections, only the stale connection is closed
-    status = cmd('sudo ipsec statusall')
-    connection_name = None
-    for line in status.split("\n"):
-        if line.find(ip_address) > 0:
-            regex_match = re.search(r'(peer_[^:\[]+)', line)
-            if regex_match:
-                connection_name = regex_match[1]
-                break
-    if connection_name:
-        call(f'sudo ipsec down {connection_name}')
-
 if __name__ == '__main__':
     interface = os.getenv('interface')
     new_ip = os.getenv('new_ip_address')
     old_ip = os.getenv('old_ip_address')
 
     if os.path.exists(SWANCTL_CONF):
-        conf_lines = read_file(SWANCTL_CONF)
+        conf_lines = read_file(SWANCTL_CONF).split("\n")
         found = False
+        reset_conns = set()
         to_match = f'# dhcp:{interface}'
 
         for i, line in enumerate(conf_lines):
             if line.find(to_match) > 0:
                 conf_lines[i] = line.replace(old_ip, new_ip)
                 found = True
+                regex_match = re.search(r'#.* reset:([-_a-zA-Z0-9|@]+)', line)
+                if regex_match:
+                   connection_name = regex_match[1]
+                   reset_conns.add(connection_name)
 
         if found:
-            write_file(SWANCTL_CONF, conf_lines)
-            ipsec_down(old_ip)
-            call('sudo ipsec rereadall')
-            call('sudo ipsec reload')
+            write_file(SWANCTL_CONF, "\n".join(conf_lines))
+            for connection_name in reset_conns:
+                call(f'sudo swanctl -t -i {connection_name}')
             call('sudo swanctl -q')
 
     exit(0)