Skip to content

Commit ee8fbc8

Browse files
ptpt52ptpt52
committed
openvpn: improve netifd integration and implement hotplug logic
This commit enhances the OpenVPN protocol handler to allow netifd to manage interface addressing and routing, ensuring correct status reporting in LuCI and ubus. These changes fix the "pending" interface status issue by ensuring the tunnel device ($dev) is properly registered with netifd. Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
1 parent 6ecd26c commit ee8fbc8

2 files changed

Lines changed: 113 additions & 7 deletions

File tree

‎net/openvpn/files/lib/netifd/proto/openvpn.sh‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,6 @@ proto_openvpn_setup() {
129129
append exec_params "--status /var/run/openvpn.$config.status"
130130
append exec_params "--syslog openvpn_$config"
131131
append exec_params "--tmp-dir /tmp"
132-
[ -n "$config_file" ] && append exec_params "--config \"$config_file\""
133132

134133
json_get_var ALLOW_DEPRECATED allow_deprecated
135134
[ -z "$ALLOW_DEPRECATED" ] && ALLOW_DEPRECATED=0
@@ -144,7 +143,7 @@ proto_openvpn_setup() {
144143

145144
proto_add_dynamic_defaults
146145

147-
json_get_vars username password cert_password
146+
json_get_vars auth_user_pass askpass username password cert_password
148147

149148
mkdir -p /var/run
150149
# combine into --askpass:
@@ -174,9 +173,7 @@ proto_openvpn_setup() {
174173

175174
# Check 'script_security' option
176175
json_get_var script_security script_security
177-
[ -z "$script_security" ] && {
178-
script_security=3
179-
}
176+
[ -z "$script_security" ] && script_security=3
180177

181178
# Add default hotplug handling if 'script_security' option is equal '3'
182179
if [ "$script_security" -eq '3' ]; then
@@ -194,6 +191,11 @@ proto_openvpn_setup() {
194191
json_get_vars up down route_up route_pre_down
195192
json_get_vars tls_crypt_v2_verify mode learn_address client_connect
196193
json_get_vars client_crresponse client_disconnect auth_user_pass_verify
194+
195+
json_get_vars ifconfig_noexec route_noexec
196+
[ -z "$ifconfig_noexec" ] && append exec_params "--ifconfig-noexec"
197+
[ -z "$route_noexec" ] && append exec_params "--route-noexec"
198+
197199
append exec_params "--up '/usr/libexec/openvpn-hotplug'"
198200
[ -n "$up" ] && append exec_params "--setenv user_up '$up'"
199201

@@ -218,8 +220,11 @@ proto_openvpn_setup() {
218220
[ -n "$client_crresponse" ] && append exec_params "--setenv user_client_crresponse '$client_crresponse'"
219221
append exec_params "--client-disconnect '/usr/libexec/openvpn-hotplug'"
220222
[ -n "$client_disconnect" ] && append exec_params "--setenv user_client_disconnect '$client_disconnect'"
221-
append exec_params "--auth-user-pass-verify '/usr/libexec/openvpn-hotplug' via-file"
222-
[ -n "$auth_user_pass_verify" ] && append exec_params "--setenv user_auth_user_pass_verify '$auth_user_pass_verify'"
223+
224+
[ -n "$auth_user_pass_verify" ] && {
225+
append exec_params "--auth-user-pass-verify '/usr/libexec/openvpn-hotplug' via-file"
226+
append exec_params "--setenv user_auth_user_pass_verify '$auth_user_pass_verify'"
227+
}
223228
}
224229

225230
json_get_vars client tls_client tls_server
@@ -231,6 +236,7 @@ proto_openvpn_setup() {
231236

232237
if [ "$tls_client" = 1 ] || [ "$tls_server" = 1 ]; then
233238
append exec_params "--tls-verify '/usr/libexec/openvpn-hotplug'"
239+
json_get_var tls_verify tls_verify
234240
[ -n "$tls_verify" ] && append exec_params "--setenv user_tls_verify '$tls_verify'"
235241
fi
236242
else

‎net/openvpn/files/usr/libexec/openvpn-hotplug‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,106 @@
1010
exit
1111
}
1212

13+
. /lib/functions.sh
14+
. /lib/netifd/netifd-proto.sh
15+
16+
mask2prefix() {
17+
local mask="$1"
18+
local n=0
19+
local IFS=.
20+
for o in $mask; do
21+
case $o in
22+
255) n=$((n+8)) ;;
23+
254) n=$((n+7)) ;;
24+
252) n=$((n+6)) ;;
25+
248) n=$((n+5)) ;;
26+
240) n=$((n+4)) ;;
27+
224) n=$((n+3)) ;;
28+
192) n=$((n+2)) ;;
29+
128) n=$((n+1)) ;;
30+
0) break ;;
31+
*) break ;;
32+
esac
33+
done
34+
echo "$n"
35+
}
36+
37+
parse_cidr6() {
38+
local val="$1"
39+
local def_plen="$2"
40+
local addr="${val%/*}"
41+
local plen="${val#*/}"
42+
[ "$addr" = "$plen" ] && plen="$def_plen"
43+
echo "$addr $plen"
44+
}
45+
46+
case "$script_type" in
47+
up)
48+
proto_init_update "$dev" 1
49+
50+
[ -n "$ifconfig_local" ] && proto_add_ipv4_address "$ifconfig_local" "${ifconfig_netmask:-255.255.255.255}"
51+
52+
[ -n "$trusted_ip" ] && [ -n "$route_net_gateway" ] && {
53+
proto_add_ipv4_route "$trusted_ip" 32 "$route_net_gateway"
54+
}
55+
56+
[ -n "$route_vpn_gateway" ] && proto_add_ipv4_route "0.0.0.0" 0 "$route_vpn_gateway"
57+
58+
for i in $(seq 1 32); do
59+
eval "net=\$route_network_$i mask=\$route_netmask_$i gw=\$route_gateway_$i"
60+
[ -z "$net" ] && break
61+
62+
plen=$(mask2prefix "$mask")
63+
proto_add_ipv4_route "$net" "$plen" "$gw"
64+
done
65+
66+
if [ -n "$ifconfig_ipv6_local" ]; then
67+
read -r v6addr v6plen <<-EOF
68+
$(parse_cidr6 "$ifconfig_ipv6_local" "${ifconfig_ipv6_netbits:-128}")
69+
EOF
70+
proto_add_ipv6_address "$v6addr" "$v6plen"
71+
fi
72+
73+
[ -n "$trusted_ip6" ] && [ -n "$route_ipv6_gateway" ] && {
74+
proto_add_ipv6_route "$trusted_ip6" 128 "$route_ipv6_gateway"
75+
}
76+
77+
[ -n "$ifconfig_ipv6_remote" ] && proto_add_ipv6_route "::" 0 "$ifconfig_ipv6_remote"
78+
79+
for i in $(seq 1 32); do
80+
eval "net=\$route_ipv6_network_$i gw=\$route_ipv6_gateway_$i"
81+
[ -z "$net" ] && break
82+
83+
read -r v6net v6plen <<-EOF
84+
$(parse_cidr6 "$net" 128)
85+
EOF
86+
proto_add_ipv6_route "$v6net" "$v6plen" "$gw"
87+
done
88+
89+
[ -n "$tun_mtu" ] && json_add_int mtu "$tun_mtu"
90+
91+
for i in $(seq 1 32); do
92+
eval "option=\$foreign_option_$i"
93+
[ -z "$option" ] && break
94+
95+
set -- $option
96+
[ "$1" != "dhcp-option" ] && continue
97+
98+
case "$2" in
99+
DNS) proto_add_dns_server "$3" ;;
100+
DOMAIN*) proto_add_dns_search "$3" ;; # Matches DOMAIN and DOMAIN-SEARCH
101+
esac
102+
done
103+
104+
proto_send_update "$INTERFACE"
105+
;;
106+
107+
down)
108+
proto_init_update "$dev" 0
109+
proto_send_update "$INTERFACE"
110+
;;
111+
esac
112+
13113
ACTION="$script_type"
14114
INSTANCE="$INTERFACE"
15115

0 commit comments

Comments
 (0)