main/openvpn: multiple changes like ipv6 and new initd

added ipv6 patch from: http://www.greenie.net/ipv6/openvpn.html
move easy-rsa into subpkg and depend on openssl
update init.d and conf.d from latest gentoo release
added up/down scripts from latest gentoo release

ref #618

1 files changed, 96 insertions, 26 deletions

diff --git a/main/openvpn/openvpn.initd b/main/openvpn/openvpn.initd
index 7e0e3eb9e..e7bcd1491 100644
--- a/main/openvpn/openvpn.initd
+++ b/main/openvpn/openvpn.initd
@@ -2,9 +2,9 @@
 # Copyright 1999-2007 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
 
-VPNDIR="/etc/openvpn"
-VPN="${SVCNAME#*.}"
-if [ -n "${VPN}" ] && [ "${SVCNAME}" != "openvpn" ]; then
+VPNDIR=${VPNDIR:-/etc/openvpn}
+VPN=${SVCNAME#*.}
+if [ -n "${VPN}" ] && [ ${SVCNAME} != "openvpn" ]; then
 	VPNPID="/var/run/openvpn.${VPN}.pid"
 else
 	VPNPID="/var/run/openvpn.pid"
@@ -13,51 +13,121 @@ VPNCONF="${VPNDIR}/${VPN}.conf"
 
 depend() {
 	need localmount net
-	before netmount
-	after bootmisc firewall
+	use dns
+	after bootmisc
 }
 
-checktundevice() {
-	if [ ! -e /dev/net/tun ]; then
-		if ! modprobe tun ; then
-			eerror "TUN/TAP support is not available in this kernel"
-			return 1
+checkconfig() {
+	# Linux has good dynamic tun/tap creation
+	if [ $(uname -s) = "Linux" ] ; then
+		if [ ! -e /dev/net/tun ]; then
+			if ! modprobe tun ; then
+				eerror "TUN/TAP support is not available" \
+					"in this kernel"
+				return 1
+			fi
 		fi
+		if [ -h /dev/net/tun ] && [ -c /dev/misc/net/tun ]; then
+			ebegin "Detected broken /dev/net/tun symlink, fixing..."
+			rm -f /dev/net/tun
+			ln -s /dev/misc/net/tun /dev/net/tun
+			eend $?
+		fi
+		return 0
 	fi
-	if [ -h /dev/net/tun ] && [ -c /dev/misc/net/tun ]; then
-		ebegin "Detected broken /dev/net/tun symlink, fixing..."
-		rm -f /dev/net/tun
-		ln -s /dev/misc/net/tun /dev/net/tun
-		eend $?
+
+	# Other OS's don't, so we rely on a pre-configured interface
+	# per vpn instance
+	local ifname=$(sed -n -e 's/[[:space:]]*dev[[:space:]][[:space:]]*\([^[:space:]]*\).*/\1/p' "${VPNCONF}")
+	if [ -z ${ifname} ] ; then
+		eerror "You need to specify the interface that this openvpn" \
+			"instance should use" \
+			"by using the dev option in ${VPNCONF}"
+		return 1
+	fi
+
+	if ! ifconfig "${ifname}" >/dev/null 2>/dev/null ; then
+		# Try and create it
+		echo > /dev/"${ifname}" >/dev/null
+	fi
+	if ! ifconfig "${ifname}" >/dev/null 2>/dev/null ; then
+		eerror "${VPNCONF} requires interface ${ifname}" \
+			"but that does not exist"
+		return 1
 	fi
 }
 
 start() {
+	# If we are re-called by the openvpn gentoo-up.sh script
+	# then we don't actually want to start openvpn
+	[ "${IN_BACKGROUND}" = "true" ] && return 0
+	
 	ebegin "Starting ${SVCNAME}"
 
-	checktundevice || return 1
-
-	if [ ! -e "${VPNCONF}" ]; then
-		eend 1 "${VPNCONF} does not exist"
-		return 1
-	fi
+	checkconfig || return 1
 
-	local args=""
+	local args="" reenter=${RE_ENTER:-no}
 	# If the config file does not specify the cd option, we do
 	# But if we specify it, we override the config option which we do not want
-	if ! grep -q "^[ \t]*cd[ \t].*" "${VPNCONF}" ; then
+	if ! grep -q "^[ 	]*cd[ 	].*" "${VPNCONF}" ; then
 		args="${args} --cd ${VPNDIR}"
 	fi
+	
+	# We mark the service as inactive and then start it.
+	# When we get an authenticated packet from the peer then we run our script
+	# which configures our DNS if any and marks us as up.
+	if [ "${DETECT_CLIENT:-yes}" = "yes" ] && \
+	grep -q "^[ 	]*remote[ 	].*" "${VPNCONF}" ; then
+		reenter="yes"
+		args="${args} --up-delay --up-restart"
+		args="${args} --script-security 2"
+		args="${args} --up /etc/openvpn/up.sh"
+		args="${args} --down-pre --down /etc/openvpn/down.sh"
+
+		# Warn about setting scripts as we override them
+		if grep -Eq "^[ 	]*(up|down)[ 	].*" "${VPNCONF}" ; then
+			ewarn "WARNING: You have defined your own up/down scripts"
+			ewarn "As you're running as a client, we now force Alpine specific"
+			ewarn "scripts to be run for up and down events."
+			ewarn "These scripts will call /etc/openvpn/${SVCNAME}-{up,down}.sh"
+			ewarn "where you can put your own code."
+		fi
 
+		# Warn about the inability to change ip/route/dns information when
+		# dropping privs
+		if grep -q "^[ 	]*user[ 	].*" "${VPNCONF}" ; then
+			ewarn "WARNING: You are dropping root privileges!"
+			ewarn "As such openvpn may not be able to change ip, routing"
+			ewarn "or DNS configuration."
+		fi
+	else
+		# So we're a server. Run as openvpn unless otherwise specified
+		grep -q "^[ 	]*user[ 	].*" "${VPNCONF}" || args="${args} --user openvpn"
+		grep -q "^[ 	]*group[ 	].*" "${VPNCONF}" || args="${args} --group openvpn"
+	fi
+
+	# Ensure that our scripts get the PEER_DNS variable
+	[ -n "${PEER_DNS}" ] && args="${args} --setenv PEER_DNS ${PEER_DNS}"
+
+	[ "${reenter}" = "yes" ] && mark_service_inactive "${SVCNAME}"
 	start-stop-daemon --start --exec /usr/sbin/openvpn --pidfile "${VPNPID}" \
-		-- --config "${VPNCONF}" --writepid "${VPNPID}" --daemon ${args}
+		-- --config "${VPNCONF}" --writepid "${VPNPID}" --daemon \
+		--setenv SVCNAME "${SVCNAME}" ${args}
 	eend $? "Check your logs to see why startup failed"
 }
 
 stop() {
+	# If we are re-called by the openvpn gentoo-down.sh script
+	# then we don't actually want to stop openvpn
+	if [ "${IN_BACKGROUND}" = "true" ] ; then
+		mark_service_inactive "${SVCNAME}"
+		return 0
+	fi
+
 	ebegin "Stopping ${SVCNAME}"
-	start-stop-daemon --stop --exec /usr/sbin/openvpn --pidfile "${VPNPID}"
+	start-stop-daemon --stop --quiet \
+		--exec /usr/sbin/openvpn --pidfile "${VPNPID}"
 	eend $?
 }
 
-# vim: ts=4
+# vim: set ts=4 :