Re: [Users] temporary wild-side problems cause long-term conn problems

Stephen J. Bevan wrote:

 > If I had been given boxes running IPsec over multiple
 > interfaces then I'd have written some scripts that only took the
 > affected connections down and ensured that the eroutes/routes were
 > clean.  This is all possible without requiring any more cooperation
 > from FreeS/WAN,

OK.

 >  though cooperation might well make it simpler
 > (i.e. require less use of awk/sed to munge the eroute and routes to
 > find the ones affected).

Simpler indeed.  Writing such scripts from
scratch would require understand the syntax
and a good bit of the semantics of ipsec.conf.

 > A dhcpcd script isn't *the* solution to all address problems, it is
 > *a* solution the the DHCP problem.  In the case of PCMCIA cards then
 > the appropriate ifup script gets called when it goes up/down and so
 > hooks can be put in there to prod FreeS/WAN.

In fact if you adopt that approach, multiple types
of hooks appear necessary, since dhcpcd does not
call ifup or ifdown;  apparently it does the re-routing
itself.  See below.

 > I don't think that anyone would argue that getting the information
 > sooner rather than later is better.  However, unless the intent is
 > that FreeS/WAN mandates that dhclient be used then the DHCP issue is
 > out of FreeS/WAN's hands.  The best they could do would be to
 > distribute some scripts that that did something useful for each
 > possible DHCP client.

There may be cleverer ways than that to get the
information sooner rather than later.  For starters,
one could imagine using rtnetlink(7).  This is,
after all, its intended purpose: passing routing
information between kernel and userland.

Those who are allergic to writing C code could
catch events sooner rather than later by using
something like:
	tcpdump -nli eth0 less 1
and reacting if/when it exits due to a read error,
as it will if the interface is pulled out of its
socket or downed by the DHCP client daemon.

To summarize, in script-land I see a way to do it
using three hooks:
  -- in ifup, to catch some "up" events
  -- in dhcpcd-eth0.exe, to catch other "up" events
  -- the i/o error trick, to catch "down" events
although other solutions are certainly possible.

 >   However, anyone can do that right now, it
 > doesn't have to come from FreeS/WAN.

Maybe not quite "anyone", if you want it done
right.  I suspect that as of yesterday hardly
"anyone" even knew that it was necessary to write
such scripts.  Hence my multiple pleas for more
documentation of these issues.

 > IMHO the best way to make FreeS/WAN do
 > those things is to implement them and offer them to FreeS/WAN (or pay
 > someone else to do them, I'm available for contracts :-)  Even if
 > FreeS/WAN don't pick it up Ken might and include it in Super
 > FreeS/WAN.

Except that the project has a strict policy against
"picking up" code written by US citizens and/or on US
soil.  So until the policy changes, I will continue
doing as I have done since before the first FreeS/WAN
release, namely making very specific suggestions on
how things "could" be improved.