You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

212 lines
6.9 KiB

11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
  1. #!/bin/sh /etc/rc.common
  2. START=50
  3. USE_PROCD=1
  4. setup_config() {
  5. config_get port $1 port "4443"
  6. config_get max_clients $1 max_clients "8"
  7. config_get max_same $1 max_same "2"
  8. config_get dpd $1 dpd "120"
  9. config_get predictable_ips $1 predictable_ips "1"
  10. config_get compression $1 compression "0"
  11. config_get udp $1 udp "1"
  12. config_get auth $1 auth "plain"
  13. config_get cisco_compat $1 cisco_compat "1"
  14. config_get ipaddr $1 ipaddr ""
  15. config_get netmask $1 netmask ""
  16. config_get ip6addr $1 ip6addr ""
  17. config_get proxy_arp $1 proxy_arp "0"
  18. config_get ping_leases $1 ping_leases "0"
  19. config_get split_dns $1 split_dns "0"
  20. config_get default_domain $1 default_domain ""
  21. # Enable proxy arp, and make sure that ping leases is set to true in that case,
  22. # to prevent conflicts.
  23. if test "$proxy_arp" = 1;then
  24. local ip
  25. # IP address is empty. Auto-configure LAN + VPN.
  26. if test -z "$ipaddr";then
  27. local mask
  28. mask=$(uci get network.lan.netmask)
  29. if test "$mask" = "255.255.255.0";then
  30. uci set dhcp.lan.start=100
  31. uci set dhcp.lan.limit=91
  32. fi
  33. ip=$(uci get network.lan.ipaddr)
  34. ipaddr="$(echo $ip|cut -d . -f1,2,3).192"
  35. netmask="255.255.255.192"
  36. uci set ocserv.config.ipaddr="$ipaddr"
  37. uci set ocserv.config.netmask="$netmask"
  38. uci commit
  39. fi
  40. if test -z "$ip6addr";then
  41. ip6addr=$(uci get network.lan.ip6addr 2>/dev/null)
  42. test -n "$ip6addr" && uci set ocserv.config.ip6addr="$ip6addr"
  43. uci commit
  44. fi
  45. ping_leases=1
  46. test -n "$ipaddr" && sysctl -w "net.ipv4.conf.$(uci get network.lan.ifname).proxy_arp"=1 >/dev/null
  47. test -n "$ip6addr" && sysctl -w "net.ipv6.conf.$(uci get network.lan.ifname).proxy_ndp"=1 >/dev/null
  48. else
  49. test "$ipaddr" = "" && ipaddr="192.168.100.0"
  50. test "$netmask" = "" && ipaddr="255.255.255.0"
  51. fi
  52. enable_default_domain="#"
  53. enable_udp="#"
  54. enable_compression="#"
  55. enable_split_dns="#"
  56. test $predictable_ips = "0" && predictable_ips="false"
  57. test $predictable_ips = "1" && predictable_ips="true"
  58. test $cisco_compat = "0" && cisco_compat="false"
  59. test $cisco_compat = "1" && cisco_compat="true"
  60. test $ping_leases = "0" && ping_leases="false"
  61. test $ping_leases = "1" && ping_leases="true"
  62. test $udp = "1" && enable_udp=""
  63. test $split_dns = "1" && enable_split_dns=""
  64. test $compression = "1" && enable_compression=""
  65. test -z $default_domain && default_domain=$(uci get dhcp.@dnsmasq[0].domain)
  66. test -n $default_domain && enable_default_domain=""
  67. test -z $ip6addr && enable_ipv6="#"
  68. test $auth = "plain" && authsuffix="\[passwd=/var/etc/ocpasswd\]"
  69. dyndns="false"
  70. hostname=`uci show ddns 2>/dev/null|grep domain|head -1|cut -d '=' -f 2`
  71. [ -n "$hostname" ] && dyndns="true"
  72. mkdir -p /var/etc
  73. sed -e "s/|PORT|/$port/g" \
  74. -e "s/|MAX_CLIENTS|/$max_clients/g" \
  75. -e "s/|MAX_SAME|/$max_same/g" \
  76. -e "s/|DPD|/$dpd/g" \
  77. -e "s#|AUTH|#$auth$authsuffix#g" \
  78. -e "s#|DYNDNS|#$dyndns#g" \
  79. -e "s/|PREDICTABLE_IPS|/$predictable_ips/g" \
  80. -e "s/|DEFAULT_DOMAIN|/$default_domain/g" \
  81. -e "s/|ENABLE_DEFAULT_DOMAIN|/$enable_default_domain/g" \
  82. -e "s/|ENABLE_SPLIT_DNS|/$enable_split_dns/g" \
  83. -e "s/|CISCO_COMPAT|/$cisco_compat/g" \
  84. -e "s/|PING_LEASES|/$ping_leases/g" \
  85. -e "s/|UDP|/$enable_udp/g" \
  86. -e "s/|COMPRESSION|/$enable_compression/g" \
  87. -e "s/|IPV4ADDR|/$ipaddr/g" \
  88. -e "s/|NETMASK|/$netmask/g" \
  89. -e "s#|IPV6ADDR|#$ip6addr#g" \
  90. -e "s/|ENABLE_IPV6|/$enable_ipv6/g" \
  91. /etc/ocserv/ocserv.conf.template > /var/etc/ocserv.conf
  92. test -f /etc/ocserv/ocserv.conf.local && cat /etc/ocserv/ocserv.conf.local >> /var/etc/ocserv.conf
  93. }
  94. setup_users() {
  95. local name
  96. local group
  97. local password
  98. config_get name $1 name
  99. config_get group $1 group '*'
  100. config_get password $1 password
  101. [ -z "$name" -o -z "$password" ] && return
  102. echo "$name:$group:$password" >> /var/etc/ocpasswd
  103. }
  104. setup_routes() {
  105. local routes
  106. config_get ip $1 ip
  107. config_get netmask $1 netmask
  108. [ -z "$ip" -o -z "$netmask" ] && return
  109. echo "route = $ip/$netmask" >> /var/etc/ocserv.conf
  110. }
  111. setup_dns() {
  112. local routes
  113. config_get ip $1 ip
  114. [ -z "$ip" ] && return
  115. echo "dns = $ip" >> /var/etc/ocserv.conf
  116. }
  117. start_service() {
  118. local hostname iface
  119. hostname=`uci show ddns 2>/dev/null|grep domain|head -1|cut -d '=' -f 2`
  120. [ -z "$hostname" ] && hostname=`uci get system.@system[0].hostname 2>/dev/null`
  121. [ -f /etc/config/ocserv-dir/ca-key.pem ] && mv /etc/config/ocserv-dir/ca-key.pem /etc/ocserv/ca-key.pem
  122. [ -f /etc/config/ocserv-dir/ca.pem ] && mv /etc/config/ocserv-dir/ca.pem /etc/ocserv/ca.pem
  123. [ -f /etc/config/ocserv-dir/server-key.pem ] && mv /etc/config/ocserv-dir/server-key.pem /etc/ocserv/server-key.pem
  124. [ -f /etc/config/ocserv-dir/server-cert.pem ] && mv /etc/config/ocserv-dir/server-cert.pem /etc/ocserv/server-cert.pem
  125. [ -d /etc/config/ocserv-dir ] && rmdir /etc/config/ocserv-dir
  126. [ ! -f /etc/ocserv/ca-key.pem ] && [ -x /usr/bin/certtool ] && {
  127. logger -t ocserv "Generating CA certificate..."
  128. mkdir -p /etc/ocserv/pki/
  129. certtool --bits 2048 --generate-privkey --outfile /etc/ocserv/ca-key.pem >/dev/null 2>&1
  130. echo "cn=$hostname CA" >/etc/ocserv/pki/ca.tmpl
  131. echo "expiration_days=-1" >>/etc/ocserv/pki/ca.tmpl
  132. echo "serial=1" >>/etc/ocserv/pki/ca.tmpl
  133. echo "ca" >>/etc/ocserv/pki/ca.tmpl
  134. echo "cert_signing_key" >>/etc/ocserv/pki/ca.tmpl
  135. certtool --template /etc/ocserv/pki/ca.tmpl \
  136. --generate-self-signed --load-privkey /etc/ocserv/ca-key.pem \
  137. --outfile /etc/ocserv/ca.pem >/dev/null 2>&1
  138. }
  139. #generate server certificate/key
  140. [ ! -f /etc/ocserv/server-key.pem ] && [ -x /usr/bin/certtool ] && {
  141. logger -t ocserv "Generating server certificate..."
  142. mkdir -p /etc/ocserv/pki/
  143. certtool --bits 2048 --generate-privkey --outfile /etc/ocserv/server-key.pem >/dev/null 2>&1
  144. echo "cn=$hostname" >/etc/ocserv/pki/server.tmpl
  145. echo "serial=2" >>/etc/ocserv/pki/server.tmpl
  146. echo "expiration_days=-1" >>/etc/ocserv/pki/server.tmpl
  147. echo "signing_key" >>/etc/ocserv/pki/server.tmpl
  148. echo "encryption_key" >>/etc/ocserv/pki/server.tmpl
  149. certtool --template /etc/ocserv/pki/server.tmpl \
  150. --generate-certificate --load-privkey /etc/ocserv/server-key.pem \
  151. --load-ca-certificate /etc/ocserv/ca.pem --load-ca-privkey \
  152. /etc/ocserv/ca-key.pem --outfile /etc/ocserv/server-cert.pem >/dev/null 2>&1
  153. }
  154. [ -f /var/run/ocserv.pid ] || {
  155. touch /var/run/ocserv.pid
  156. chown ocserv:ocserv /var/run/ocserv.pid
  157. }
  158. [ -d /var/lib/ocserv ] || {
  159. mkdir -m 0755 -p /var/lib/ocserv
  160. chmod 0700 /var/lib/ocserv
  161. chown ocserv:ocserv /var/lib/ocserv
  162. }
  163. config_load "ocserv"
  164. rm -f /var/etc/ocserv.conf
  165. touch /var/etc/ocserv.conf
  166. setup_config config
  167. config_foreach setup_routes routes
  168. config_foreach setup_dns dns
  169. rm -f /var/etc/ocpasswd
  170. touch /var/etc/ocpasswd
  171. chmod 600 /var/etc/ocpasswd
  172. config_foreach setup_users ocservusers
  173. procd_open_instance
  174. procd_set_param command /usr/sbin/ocserv -f -c /var/etc/ocserv.conf
  175. procd_set_param respawn
  176. procd_close_instance
  177. }