summaryrefslogtreecommitdiff
path: root/src/etc/dhcp/dhclient-exit-hooks.d/99-ipsec-dhclient-hook
diff options
context:
space:
mode:
authorLucas Christian <lucas@lucasec.com>2024-02-08 22:04:16 -0800
committerLucas Christian <lucas@lucasec.com>2024-03-10 11:40:23 -0700
commitcd8ef21f280f726955f537132e3fab2bcb3c286f (patch)
tree41c8a313e08b35ea58c292ea519fb72e1ddc5281 /src/etc/dhcp/dhclient-exit-hooks.d/99-ipsec-dhclient-hook
parentf7834324d3d9edd7e161e7f2f3868452997c9c81 (diff)
downloadvyos-1x-cd8ef21f280f726955f537132e3fab2bcb3c286f.tar.gz
vyos-1x-cd8ef21f280f726955f537132e3fab2bcb3c286f.zip
T5872: fix ipsec dhclient exit hook
Diffstat (limited to 'src/etc/dhcp/dhclient-exit-hooks.d/99-ipsec-dhclient-hook')
-rwxr-xr-xsrc/etc/dhcp/dhclient-exit-hooks.d/99-ipsec-dhclient-hook27
1 files changed, 9 insertions, 18 deletions
diff --git a/src/etc/dhcp/dhclient-exit-hooks.d/99-ipsec-dhclient-hook b/src/etc/dhcp/dhclient-exit-hooks.d/99-ipsec-dhclient-hook
index e6edc1ac3..4dc52c6db 100755
--- a/src/etc/dhcp/dhclient-exit-hooks.d/99-ipsec-dhclient-hook
+++ b/src/etc/dhcp/dhclient-exit-hooks.d/99-ipsec-dhclient-hook
@@ -43,39 +43,30 @@ from vyos.utils.file import write_file
SWANCTL_CONF="/etc/swanctl/swanctl.conf"
-def ipsec_down(ip_address):
- # This prevents the need to restart ipsec and kill all active connections, only the stale connection is closed
- status = cmd('sudo ipsec statusall')
- connection_name = None
- for line in status.split("\n"):
- if line.find(ip_address) > 0:
- regex_match = re.search(r'(peer_[^:\[]+)', line)
- if regex_match:
- connection_name = regex_match[1]
- break
- if connection_name:
- call(f'sudo ipsec down {connection_name}')
-
if __name__ == '__main__':
interface = os.getenv('interface')
new_ip = os.getenv('new_ip_address')
old_ip = os.getenv('old_ip_address')
if os.path.exists(SWANCTL_CONF):
- conf_lines = read_file(SWANCTL_CONF)
+ conf_lines = read_file(SWANCTL_CONF).split("\n")
found = False
+ reset_conns = set()
to_match = f'# dhcp:{interface}'
for i, line in enumerate(conf_lines):
if line.find(to_match) > 0:
conf_lines[i] = line.replace(old_ip, new_ip)
found = True
+ regex_match = re.search(r'#.* reset:([-_a-zA-Z0-9|@]+)', line)
+ if regex_match:
+ connection_name = regex_match[1]
+ reset_conns.add(connection_name)
if found:
- write_file(SWANCTL_CONF, conf_lines)
- ipsec_down(old_ip)
- call('sudo ipsec rereadall')
- call('sudo ipsec reload')
+ write_file(SWANCTL_CONF, "\n".join(conf_lines))
+ for connection_name in reset_conns:
+ call(f'sudo swanctl -t -i {connection_name}')
call('sudo swanctl -q')
exit(0)