linux-ipsec: Pluto command line

Henry reminded me that having Pluto compiled differently with -DDEBUG means that the production version does not get sufficiently tested. There should be only one version of Pluto, with runtime options to modify its behaviour. I've implemented this, which means that Pluto's command line has changed considerably.

Pluto now accepts several optional arguments. For the sake of convention, each keyword may be preceded by - or --, or not.

port      changes the UDP port to which Pluto listens


                      [default is 500]


lockdir    changes directory for the lock file


                      [default is /var/run]


secretsfile     changes the file for authentication secrets


                      [default is /etc/isakmp-secrets]


nofork                disable "daemon fork"


                      [default is to fork]

There are a some of dangling issues.

• should Pluto have a "fork" argument for symmetry with "nofork"?
• The locking code does not do the dance required to work with NFS. Does this matter? If so, can anybody point to a good model to copy? The lock ought to be per-machine (network node), so sharing it with NFS doesn't make a lot of sense to me. Actually, the main purpose of the file was to make the PID available to scripts; locking is an afterthought.
• The "daemon fork" code closes all file descriptors. I've changed it so that it leaves stderr open if Pluto is compiled -DDEBUG (from now on, this should be the normal case). Does leaving stderr open defeat the purpose of the fork? The code uses daemon, if compiled for BSD; I don't know what that does to stderr.

Any thoughts on these would be welcome.

Hugh Redelmeier
hugh@mimosa.com voice: +1 416 482-8253 Received on Sun Aug 9 14:08:17 1998