allanger/container-openvpn
1
0
Fork 0
Code Issues 4 Pull Requests Actions Packages Projects Releases Activity

ovpn: Convert from servername -> server_url

Browse Source 
* Previously the server name cached the common name generated during
  init and assumed always 1194/udp.
* The new configuration allows for users to pass in a url in a new form
  that allows the protocol to be specified as well as the port.
* Example: udp://vpn.example.com:1194
* Try to be backwards compatible.
This commit is contained in:
Kyle Manna 2014-06-30 22:43:00 -07:00
parent 507f27a9e0
commit 34eca5b96f
3 changed files with 43 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
bin/ovpn_genconfig
View File

@ -1,4 +1,4 @@
#!/bin/sh #!/bin/bash
# #
# Generate OpenVPN configs # Generate OpenVPN configs
@ -6,14 +6,21 @@
set -ex set -ex
servername=$(cat "$OPENVPN/servername" 2> /dev/null) server_url=$1
cn=${1-$servername} [ -z "$server_url" ] && server_url=$(cat "$OPENVPN/server_url" 2> /dev/null)
if [ -z "$cn" ]; then if [[ "$server_url" =~ ^((udp|tcp)://)?([0-9a-zA-Z\.]+)(:([0-9]+))?$ ]]; then
proto=${BASH_REMATCH[2]};
port=${BASH_REMATCH[5]};
else
echo "Common name not specified" echo "Common name not specified"
exit 1 exit 1
fi fi
# Apply defaults
[ -z "$proto" ] && proto=1194
[ -z "$port" ] && port=udp
conf=$OPENVPN/udp1194.conf conf=$OPENVPN/udp1194.conf
if [ -f "$conf" ]; then if [ -f "$conf" ]; then
bak=$conf.$(date +%s).bak bak=$conf.$(date +%s).bak
@ -40,8 +47,8 @@ push "dhcp-option DNS 8.8.8.8"
client-config-dir $OPENVPN/ccd client-config-dir $OPENVPN/ccd
route 192.168.254.0 255.255.255.0 route 192.168.254.0 255.255.255.0
proto udp proto $proto
port 1194 port $port
dev tun1194 dev tun1194
status /tmp/openvpn-status-1194.log status /tmp/openvpn-status-1194.log
EOF EOF

23
bin/ovpn_getclient
View File

@ -1,4 +1,4 @@
#!/bin/sh #!/bin/bash
# #
# Get an OpenVPN client configuration file # Get an OpenVPN client configuration file
@ -6,19 +6,30 @@
set -ex set -ex
cn=$1 if [ -s "$OPENVPN/server_url" ]; then
server_url=$(cat "$OPENVPN/server_url" 2> /dev/null)
else
# TODO Backwards compatible, need to throw away eventually
server_url=$(cat "$OPENVPN/servername" 2> /dev/null)
fi
if [ -z "$cn" ]; then if [[ "$server_url" =~ ^((udp|tcp)://)?([0-9a-zA-Z\.]+)(:([0-9]+))?$ ]]; then
proto=${BASH_REMATCH[2]};
servername=${BASH_REMATCH[3]};
port=${BASH_REMATCH[5]};
else
echo "Common name not specified" echo "Common name not specified"
exit 1 exit 1
fi fi
# Apply defaults
[ -z "$proto" ] && proto=1194
[ -z "$port" ] && port=udp
if [ ! -f "$EASYRSA_PKI/private/$cn.key" ]; then if [ ! -f "$EASYRSA_PKI/private/$cn.key" ]; then
easyrsa build-server-full $cn nopass easyrsa build-server-full $cn nopass
fi fi
servername=$(cat $OPENVPN/servername)
cat <<EOF cat <<EOF
client client
nobind nobind
@ -44,6 +55,6 @@ $(cat $EASYRSA_PKI/ta.key)
key-direction 1 key-direction 1
<connection> <connection>
remote $servername 1194 udp remote $servername $port $proto
</connection> </connection>
EOF EOF

17
bin/ovpn_init
View File

@ -1,4 +1,4 @@
#!/bin/sh #!/bin/bash
# #
# Initialize the PKI and OpenVPN configs # Initialize the PKI and OpenVPN configs
@ -6,13 +6,22 @@
set -ex set -ex
cn=$1 server_url=$1
if [ -z "$cn" ]; then # Server name is in the form "udp://vpn.example.com:1194"
if [[ "$server_url" =~ ^((udp|tcp)://)?([0-9a-zA-Z\.]+)(:([0-9]+))?$ ]]; then
proto=${BASH_REMATCH[2]};
cn=${BASH_REMATCH[3]};
port=${BASH_REMATCH[5]};
else
echo "Common name not specified" echo "Common name not specified"
exit 1 exit 1
fi fi
# Apply defaults
[ -z "$proto" ] && proto=1194
[ -z "$port" ] && port=udp
# Specify "nopass" as arg[2] to make the CA insecure # Specify "nopass" as arg[2] to make the CA insecure
nopass=$2 nopass=$2
@ -37,7 +46,7 @@ openvpn --genkey --secret $OPENVPN/pki/ta.key
# [ -n "$ptr" ] && cn=$ptr || cn=$ip4 # [ -n "$ptr" ] && cn=$ptr || cn=$ip4
#fi #fi
echo "$cn" > $OPENVPN/servername echo "$server_url" > $OPENVPN/server_url
# For a server key with a password, manually init; this is autopilot # For a server key with a password, manually init; this is autopilot
easyrsa build-server-full $cn nopass easyrsa build-server-full $cn nopass