Commit Graph

11 Commits

Author SHA1 Message Date
Ivan Pavlov 808f67d615 openvpn: fix ipchange hotplug event
In f8a8b71e26 openvpn introduced new hotplug events.
For server config, ipchange hotplug event produces an error.
So, make ipchange hotplug event for client only

Fixes https://github.com/openwrt/packages/issues/21200

Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
2023-06-09 14:46:03 +03:00
Michal Hrusecky f8a8b71e26 openvpn: Add more hotplug events
OpenVPN supports more hooks than just 'up' and 'down'. Especially
reacting to 'route-up' and 'route-pre-down' events could be important.
When routing table changes, it can make sense to adapt firewall, run
some tests or change even more routes. This change passes those events
to hotplug, so it is easy to react to them without changing
configuration files provided by VPN provider.

Signed-off-by: Michal Hrusecky <michal.hrusecky@turris.com>
2023-05-20 12:58:33 +03:00
Martin Schiller 5ce5220eb2 openvpn: add possibility to set param "compress" without algorithm
In some situations you need to set the compress param without an
algorithm. Compression will be turned off, but the packet framing for
compression will still be enabled, allowing a different setting to be
pushed later.

As it is not possible to have options with optional values at the
moment, I've introduced a pseudo value "frames_only" which will be
removed in the init script.

Signed-off-by: Martin Schiller <ms@dev.tdt.de>
2022-10-31 14:22:17 +01:00
Nguyen Quang Minh 2a86c465bc openvpn: add OpenVPN option push-peer-info
This will allow the server to know more info about the client like
HWADDR, very useful for managing IoT devices.

See: https://www.mankier.com/8/openvpn#--push-peer-info

Signed-off-by: Nguyen Quang Minh <minhnq31@fpt.com.vn>
2021-09-01 14:18:06 -07:00
Etienne Champetier 03c3c92496 openvpn: enable LZO support by default for OpenSSL variant
User that don't control both OpenVPN client and server
might still need LZO support, so keep it enable by default for at least
OpenSSL variant.

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
2021-07-12 23:47:12 -04:00
Jo-Philipp Wich 7f065a94bb openvpn: fix invoking user up & down commands from hotplug wrapper
This commit adds a number of fixes to the OpenVPN up/down hotplug command
wrapper which currently fails to actually invoke user defined up and down
commands for uci configurations not using external native configurations.

 - Use the `--setenv` to pass the user configured `up` and `down` commands
   as `user_up` and `user_down` environment variables respectively

 - Instead of attempting to scrape the `up` and `down` settings from the
   (possibly generated) native OpenVPN configuration in
   `/etc/hotplug.d/openvpn/01-user`, read them from the respective
   environment variables instead

 - Fix parsing of native configuration values in `get_openvpn_option()`;
   first try to parse a given setting as single quoted value, then as
   double quoted and finally as non-quoted, potentially white-space
   escaped one. This ensures that `up '/bin/foo'` is interpreted as
   `/bin/foo` and not `'/bin/foo'`

Ref: https://forum.openwrt.org/t/openvpn-up-down-configuration-ignored/91126
Supersedes: #15121, #15284
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2021-04-01 07:20:03 -04:00
Alexander Egorenkov 5789faab67 openvpn: add OpenVPN option server-poll-timeout
See https://www.mankier.com/8/openvpn#--server-poll-timeout

Signed-off-by: Alexander Egorenkov <egorenar-dev@posteo.net>
2021-03-22 11:50:09 -07:00
Michal Hrusecky 0830dfa41c
openvpn: Support username and password options
Some VPN providers require username and password for client to connect.
This commit adds an option to specify username, password and
cert_password directly in uci config which then gets expanded during
start of openpvn client.

Signed-off-by: Michal Hrusecky <michal.hrusecky@turris.com>
2020-12-11 17:07:53 +01:00
Magnus Kroken e4376793b4
openvpn: disable LZO support by default
OpenVPN recommends disabling compression, as it may weaken the security
of the connection. For users who need compression, we build with LZ4
support by default. LZO in OpenVPN pulls in liblzo at approx. 32 kB.

OpenWrt users will no longer be able to connect to OpenVPN peers that
require LZO compression, unless they build the OpenVPN package themselves.

Signed-off-by: Magnus Kroken <mkroken@gmail.com>
2020-12-01 13:04:38 -08:00
Magnus Kroken 2e55fc8b2d
openvpn: update to 2.5.0
New features:
* Per client tls-crypt keys
* ChaCha20-Poly1305 can be used to encrypt the data channel
* Routes are added/removed via Netlink instead of ifconfig/route
  (unless iproute2 support is enabled).
* VLAN support when using a TAP device

Significant changes:
* Server support can no longer be disabled.
* Crypto support can no longer be disabled, remove nossl variant.
* Blowfish (BF-CBC) is no longer implicitly the default cipher.
  OpenVPN peers prior to 2.4, or peers with data cipher negotiation
  disabled, will not be able to connect to a 2.5 peer unless
  option data_fallback_ciphers is set on the 2.5 peer and it contains a
  cipher supported by the client.

Signed-off-by: Magnus Kroken <mkroken@gmail.com>
2020-12-01 13:03:51 -08:00
Rosen Penev 4434915571
openvpn: import from base
Signed-off-by: Rosen Penev <rosenp@gmail.com>
2020-12-01 12:37:37 -08:00