Add the possibility to group attributes by a name and assign these
groups to connections. This allows a more granular configuration of
which client will receive what atrributes.
--batch mode has shown to be buggy in very obscure ways in the first real
life tests. For example a batch file
--del pool1
--replace pool2 --addresses file1
returned the error "/usr/libexec/ipsec/pool: unrecognized option '--lace'"
which was gone after moving the --del behind --replace. With the patch
from below applied everything works like a charm. From the info on the
man page it seem to be unrelated to this problem, though:
A program that scans multiple argument vectors, or
rescans the same vector more than once, and wants to
make use of GNU extensions such as '+' and '-' at the
start of optstring, or changes the value of
POSIXLY_CORRECT between scans, must reinitialize
getopt() by resetting optind to 0, rather than the
traditional value of 1. (Resetting to 0 forces the
invocation of an internal initialization routine that
rechecks POSIXLY_CORRECT and checks for GNU exten-
sions in optstring.)
Signed-off-by: Heiko Hund <[email protected]>
Introduce the --batch command which reads several ipsec pool commands
and their arguments from a file or STDIN. Useful if you need to run
serveral commands atomically from a configuration daemon or likewise.
Signed-off-by: Heiko Hund <[email protected]>
Fix the error return status of the ipsec pool command. Also make --del for
attributes succeed if no --server option was given.
Signed-off-by: Heiko Hund <[email protected]>
Introduce the pool --replace command as an alternative to --add. Also change
the current behavior of allowing duplicate pool names so that, --add with
an existing name fails and --replace removes the existing pool before
adding the new one.
Signed-off-by: Heiko Hund <[email protected]>
Introduce the --addresses option for --add that can be used to add a pool
containing non-contiguous addresses. Additionally it allows to preclaim
certain addresses for certain roadwarrior IDs. See the second chunk of
the patch for a more detailed description.
Signed-off-by: Heiko Hund <[email protected]>
This patch changes the way routes are fetched from the kernel by starter.
The way it's currently done (via /proc) is limited to routes in the
"main" routing table. Routes from the "default" table are never seen by
starter. Starter may miss the default route even if it's set. Thus, default
routes are now read from the "main" and the "default" table.
The way this code behaves if more than one default route is found is slightly
different to before. Instead of bailing out it just chooses the one with the best
metric. I thought this was be a reasonable change.
Heiko Hund