[Swan-dev] "route" vs "ondemand"

[Paul Wouters]

On Wed, 3 Jul 2019, D. Hugh Redelmeier wrote:

> | Are you mising up ipsec auto --route with auto=ondemand?
>
> I hypothesized that ipsec.conf: conn: auto=route/ondemand might be the
> same as --route/--ondemand I read the documentation and found that not to
> be the case.  At least for ipsec auto, --ondemand means --up
> plus --route.  So --route and --ondemand are different and possibly
> useful.

--up plus --route makes no sense to me? Since up is add + start?


> No, --route wasn't obsoleted.  Nor is there an obvious reason to
> obsolete it.

In terms of internals, a route is really the ondemand feature.

Perhaps what we should do is change it so that we have

auto=start == ipsec auto --start is conn added, routed and initiated
auto=ondemand == ipsec auto --ondemand is conn added, routed and not initiated
auto=add == auto=add is conn added and not routed nor initiated.

auto=route is an alias for auto=ondemand

This would change the behaviour of ipsec auto --ondemand from "route" to
"add plus route".

Note all "add" operations are "replace" operations, that might do a down
plus delete operation.

> I'm a little hazy about shunts (and too lazy to look it up).  I would
> think that auto=route and --route should install some shunt but
> auto=ondemand and --ondemand should install a TRAP shunt.  That's a
> bit different.  Documentation would perhaps set me straight, if I read it.
> The documentation I did read did not seem complete.

both install a SPD policy to get an ACQUIRE or punch a hole (or insert a drop)

> If the shunt installed by ondemand were "drop", that would make its
> name wrong: negotiation would not be initiated by a packet flow and
> hence this would not be "on demand".  But the name "route" would be OK.

well, the name route would also be bad, there isn't even a route added
unless using KLIPS. A better term would be auto=install to install the
policy, whatever the policy does.

> This stuff is tricky.  We should try to make sure our keywords are not misleading.

The real question is, does changing it now help or make it worse?

Paul