Bug #2922: vpn_ipsec_force_reload() needs to be skipped when not really needed - pfSense - pfSense bugtracker

Actions

Copy link

Bug #2922

closed

vpn_ipsec_force_reload() needs to be skipped when not really needed

Added by Jim Pingle over 11 years ago. Updated about 11 years ago.

Status:

Resolved

Priority:

Normal

Assignee:

Renato Botelho

Category:

IPsec

Target version:

2.1

Start date:

04/02/2013

Due date:

% Done:

100%

Estimated time:

Plus Target Version:

Release Notes:

Affected Version:

2.1

Affected Architecture:

Description

vpn_ipsec_force_reload() gets run from /etc/rc.newwanip but it's done no matter what interface goes up/down. vpn_ipsec_force_reload() should be passed an interface parameter, and then it should check all defined tunnels. If there is no enabled tunnel on the interface generating the event, then IPsec should NOT be reloaded. Otherwise a flapping interface that is not using IPsec can cause IPsec to be repeatedly reloaded, leading to it being difficult or impossible to use effectively.

Using vpn_ipsec_force_reload() without any parameters should still reload unconditionally.