summaryrefslogtreecommitdiff
path: root/src/etc/ipsec.d/vti-up-down
diff options
context:
space:
mode:
authorChristian Breunig <christian@breunig.cc>2023-12-02 21:05:20 +0100
committerMergify <37929162+mergify[bot]@users.noreply.github.com>2023-12-03 14:26:42 +0000
commitf11f41d01a9e03fe11a12812fe3b481bd53826c1 (patch)
tree2a70ffa747fdc1138be0cdb484565eecbb16104f /src/etc/ipsec.d/vti-up-down
parent085010a43e8993bee68eb11e832b4c59e1f742fe (diff)
downloadvyos-1x-f11f41d01a9e03fe11a12812fe3b481bd53826c1.tar.gz
vyos-1x-f11f41d01a9e03fe11a12812fe3b481bd53826c1.zip
vti: T5769: restore interface settings on down -> up event
On VTI interface link down the link-local IPv6 address is removed. As soon as the IPSec tunnel is online again, vti-up-down helper is called which only places the interface in up state using iproute2 command sudo ip link set vti0 up This does not restore the IPv6 LL address. Instead use vyos.ifconfig to properly re-initialize the VTI interface using the generic update() method. (cherry picked from commit d90ca4415bed8ce99c854243dca3036e76497270)
Diffstat (limited to 'src/etc/ipsec.d/vti-up-down')
-rwxr-xr-xsrc/etc/ipsec.d/vti-up-down21
1 files changed, 11 insertions, 10 deletions
diff --git a/src/etc/ipsec.d/vti-up-down b/src/etc/ipsec.d/vti-up-down
index 9eb6fac48..441b316c2 100755
--- a/src/etc/ipsec.d/vti-up-down
+++ b/src/etc/ipsec.d/vti-up-down
@@ -1,6 +1,6 @@
#!/usr/bin/env python3
#
-# Copyright (C) 2021 VyOS maintainers and contributors
+# Copyright (C) 2021-2023 VyOS maintainers and contributors
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2 or later as
@@ -13,8 +13,9 @@
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
-## Script called up strongswan to bring the vti interface up/down based on the state of the IPSec tunnel.
-## Called as vti_up_down vti_intf_name
+
+# Script called up strongswan to bring the VTI interface up/down based on
+# the state of the IPSec tunnel. Called as vti_up_down vti_intf_name
import os
import sys
@@ -25,9 +26,10 @@ from syslog import LOG_PID
from syslog import LOG_INFO
from vyos.configquery import ConfigTreeQuery
+from vyos.configdict import get_interface_dict
+from vyos.ifconfig import VTIIf
from vyos.utils.process import call
from vyos.utils.network import get_interface_config
-from vyos.utils.network import get_interface_address
if __name__ == '__main__':
verb = os.getenv('PLUTO_VERB')
@@ -48,14 +50,13 @@ if __name__ == '__main__':
vti_link_up = (vti_link['operstate'] != 'DOWN' if 'operstate' in vti_link else False)
- config = ConfigTreeQuery()
- vti_dict = config.get_config_dict(['interfaces', 'vti', interface],
- get_first_key=True)
-
if verb in ['up-client', 'up-host']:
if not vti_link_up:
- if 'disable' not in vti_dict:
- call(f'sudo ip link set {interface} up')
+ conf = ConfigTreeQuery()
+ _, vti = get_interface_dict(conf.config, ['interfaces', 'vti'], interface)
+ if 'disable' not in vti:
+ tmp = VTIIf(interface)
+ tmp.update(vti)
else:
syslog(f'Interface {interface} is admin down ...')
elif verb in ['down-client', 'down-host']: