From 1d839e6da61e7ce8eca949111ab41e59744d5e1e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ermal=20LU=C3=87I?= <eri@pfsense.org>
Date: Sat, 18 Apr 2015 10:34:46 +0200
Subject: Implement make bofre break feature avaliable on strongswan 5.3.0
 useful for IKEv2. Fixes #4626

---
 usr/local/www/vpn_ipsec_settings.php | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

(limited to 'usr/local')

diff --git a/usr/local/www/vpn_ipsec_settings.php b/usr/local/www/vpn_ipsec_settings.php
index 7c21817..aab4f47 100644
--- a/usr/local/www/vpn_ipsec_settings.php
+++ b/usr/local/www/vpn_ipsec_settings.php
@@ -46,6 +46,7 @@ foreach ($ipsec_loglevels as $lkey => $ldescr) {
 		$pconfig["ipsec_{$lkey}"] = $config['ipsec']["ipsec_{$lkey}"];
 }
 $pconfig['unityplugin'] = isset($config['ipsec']['unityplugin']);
+$pconfig['makebeforebreak'] = isset($config['ipsec']['makebeforebreak']);
 $pconfig['noshuntlaninterfaces'] = isset($config['ipsec']['noshuntlaninterfaces']);
 $pconfig['compression'] = isset($config['ipsec']['compression']);
 $pconfig['enableinterfacesuse'] = isset($config['ipsec']['enableinterfacesuse']);
@@ -156,6 +157,12 @@ if ($_POST) {
 			unset($config['ipsec']['unityplugin']);
 		}
 
+		if($_POST['makebeforebreak'] == "yes") {
+			$config['ipsec']['makebeforebreak'] = true;
+		} elseif (isset($config['ipsec']['makebeforebreak'])) {
+			unset($config['ipsec']['makebeforebreak']);
+		}
+
 		if($_POST['noshuntlaninterfaces'] == "yes") {
 			$config['ipsec']['noshuntlaninterfaces'] = true;
 		} elseif (isset($config['ipsec']['noshuntlaninterfaces'])) {
@@ -356,6 +363,17 @@ function maxmss_checked(obj) {
 						</td>
 					</tr>
 					<tr>
+						<td width="22%" valign="top" class="vncell"><?=gettext("Make before Break"); ?></td>
+						<td width="78%" class="vtable">
+							<input name="makebeforebreak" type="checkbox" id="makebeforebreak" value="yes" <?php if ($pconfig['makebeforebreak'] == true) echo "checked=\"checked\""; ?> />
+							<strong><?=gettext("Initiate IKEv2 reauthentication with a make-before-break"); ?></strong>
+							<br />
+							<?=gettext("instead of a break-before-make scheme. Make-before-break uses overlapping IKE and CHILD_SA during reauthentication " .
+								"by first recreating all new SAs before deleting the old ones. This behavior can be beneficial to avoid connectivity gaps " .
+								"during reauthentication, but requires support for overlapping SAs by the peer.");?>
+						</td>
+					</tr>
+					<tr>
 						<td width="22%" valign="top" class="vncell"><?=gettext("Auto-exclude LAN address"); ?></td>
 						<td width="78%" class="vtable">
 							<input name="noshuntlaninterfaces" type="checkbox" id="noshuntlaninterfaces" value="yes" <?php if (!$pconfig['noshuntlaninterfaces'] == true) echo "checked=\"checked\""; ?> />
-- 
cgit v1.1