From 2c510ff2715400057cbfa49e8909f6c7c9e2ec4e Mon Sep 17 00:00:00 2001
From: Christian Breunig <christian@breunig.cc>
Date: Fri, 30 Oct 2026 17:43:51 +0100
Subject: ipsec: T9542: handle stopped IPsec daemon in op-mode debug and status

With strongswan not running, "show vpn debug" and "show vpn ipsec status"
printed the full swanctl usage text for every call, and the section
headers of "show vpn debug" all appeared at the end of the output.

Both commands now report that the IPsec process is not running and skip
the swanctl calls; the kernel state is still dumped. Section headers are
flushed so they precede their output.
---
 src/op_mode/vpn_ipsec.py | 35 +++++++++++++++++++++++++++++------
 1 file changed, 29 insertions(+), 6 deletions(-)

(limited to 'src')

diff --git a/src/op_mode/vpn_ipsec.py b/src/op_mode/vpn_ipsec.py
index f0a42922c..3c812db7b 100755
--- a/src/op_mode/vpn_ipsec.py
+++ b/src/op_mode/vpn_ipsec.py
@@ -19,8 +19,10 @@ import re
 import argparse
 
 from vyos.utils.process import call
+from vyos.utils.process import is_systemd_service_active
 
 SWANCTL_CONF = '/etc/swanctl/swanctl.conf'
+IPSEC_SERVICE = 'strongswan.service'
 
 
 def get_peer_connections(peer, tunnel, return_all = False):
@@ -38,14 +40,28 @@ def get_peer_connections(peer, tunnel, return_all = False):
     return matches
 
 
+def show_status():
+    if not is_systemd_service_active(IPSEC_SERVICE):
+        print('IPsec process not running')
+        return
+    call('swanctl --stats')
+
+
 def debug_peer(peer, tunnel):
     peer = peer.replace(':', '-')
+    ipsec_running = is_systemd_service_active(IPSEC_SERVICE)
     if not peer or peer == "all":
-        debug_commands = [
-            "swanctl --stats",
-            "swanctl -L",
-            "swanctl -l",
-            "swanctl -P",
+        debug_commands = []
+        if ipsec_running:
+            debug_commands = [
+                "swanctl --stats",
+                "swanctl -L",
+                "swanctl -l",
+                "swanctl -P",
+            ]
+        else:
+            print('IPsec process not running')
+        debug_commands += [
             "ip x sa show",
             "ip x policy show",
             "ip tunnel show",
@@ -55,7 +71,8 @@ def debug_peer(peer, tunnel):
             "ip route show table 220"
         ]
         for debug_cmd in debug_commands:
-            print(f'\n### {debug_cmd} ###')
+            # call() output bypasses our buffer, flush to keep the order
+            print(f'\n### {debug_cmd} ###', flush=True)
             call(debug_cmd)
         return
 
@@ -68,6 +85,10 @@ def debug_peer(peer, tunnel):
         print('Peer not found, aborting')
         return
 
+    if not ipsec_running:
+        print('IPsec process not running')
+        return
+
     call(f'swanctl --list-conns --ike {peer}')
     for conn in conns:
         call(f'swanctl --list-sas --ike {peer} --child {conn}')
@@ -84,3 +105,5 @@ if __name__ == '__main__':
 
     if args.action == "vpn-debug":
         debug_peer(args.name, args.tunnel)
+    elif args.action == "status":
+        show_status()
-- 
cgit v1.2.3