Revision 58c58dcf
Added by Chris Buechler over 10 years ago
| usr/local/www/vpn_ipsec_settings.php | ||
|---|---|---|
| 41 | 41 |
require_once("ipsec.inc");
|
| 42 | 42 |
require_once("vpn.inc");
|
| 43 | 43 |
|
| 44 |
$pconfig['preferoldsa_enable'] = isset($config['ipsec']['preferoldsa']); |
|
| 45 | 44 |
foreach ($ipsec_loglevels as $lkey => $ldescr) {
|
| 46 | 45 |
if (!empty($config['ipsec']["ipsec_{$lkey}"]))
|
| 47 | 46 |
$pconfig["ipsec_{$lkey}"] = $config['ipsec']["ipsec_{$lkey}"];
|
| ... | ... | |
| 115 | 114 |
|
| 116 | 115 |
if (!$input_errors) {
|
| 117 | 116 |
|
| 118 |
if($_POST['preferoldsa_enable'] == "yes") |
|
| 119 |
$config['ipsec']['preferoldsa'] = true; |
|
| 120 |
elseif (isset($config['ipsec']['preferoldsa'])) |
|
| 121 |
unset($config['ipsec']['preferoldsa']); |
|
| 122 |
|
|
| 123 | 117 |
if (is_array($config['ipsec'])) {
|
| 124 | 118 |
foreach ($ipsec_loglevels as $lkey => $ldescr) {
|
| 125 | 119 |
if (empty($_POST["ipsec_{$lkey}"])) {
|
| ... | ... | |
| 182 | 176 |
else |
| 183 | 177 |
$savemsg = gettext($retval); |
| 184 | 178 |
|
| 185 |
vpn_ipsec_configure_preferoldsa(); |
|
| 186 | 179 |
vpn_ipsec_configure($needsrestart); |
| 187 | 180 |
vpn_ipsec_configure_loglevels(); |
| 188 | 181 |
|
| ... | ... | |
| 242 | 235 |
<tr> |
| 243 | 236 |
<td colspan="2" valign="top" class="listtopic"><?=gettext("IPsec Advanced Settings"); ?></td>
|
| 244 | 237 |
</tr> |
| 245 |
<tr> |
|
| 246 |
<td width="22%" valign="top" class="vncell"><?=gettext("Security Associations"); ?></td>
|
|
| 247 |
<td width="78%" class="vtable"> |
|
| 248 |
<input name="preferoldsa_enable" type="checkbox" id="preferoldsa_enable" value="yes" <?php if ($pconfig['preferoldsa_enable']) echo "checked=\"checked\""; ?> /> |
|
| 249 |
<strong><?=gettext("Prefer older IPsec SAs"); ?></strong>
|
|
| 250 |
<br /> |
|
| 251 |
<?=gettext("By default, if several SAs match, the newest one is " .
|
|
| 252 |
"preferred if it's at least 30 seconds old. Select this " . |
|
| 253 |
"option to always prefer old SAs over new ones."); ?> |
|
| 254 |
</td> |
|
| 255 |
</tr> |
|
| 256 | 238 |
<tr> |
| 257 | 239 |
<td width="22%" valign="top" class="vncell"><?=gettext("IPsec Debug"); ?></td>
|
| 258 | 240 |
<td width="78%" class="vtable"> |
Also available in: Unified diff
Remove "Prefer old SA" option, and ignore it in all existing configurations. Breaks things in many cases with strongSwan. For the very rare circumstances where this is actually desirable, it's just a sysctl that can be set in tunables.