Browse Source
openfortivpn: version bump to 1.15.0 and further upgrades
- remove patch that has been included upstream - remove dependence on resolveip - remove hotplug script that is handled by "proto_add_host_dependency" - use openfortivpn default tunnel ip if none specified - add status checking with uclient-fetch Signed-off-by: Aaron Goodman <aaronjg@stanford.edu>lilik-openwrt-22.03
Aaron Goodman
4 years ago
4 changed files with 64 additions and 254 deletions
Unified View
Diff Options
-
+4 -5net/openfortivpn/Makefile
-
+0 -27net/openfortivpn/files/14-openforticlient
-
+60 -40net/openfortivpn/files/openfortivpn.sh
-
+0 -182net/openfortivpn/patches/010-bind-iface.patch
+ 4
- 5
net/openfortivpn/Makefile
View File
+ 0
- 27
net/openfortivpn/files/14-openforticlient
View File
| @ -1,27 +0,0 @@ | |||||
| #!/bin/sh | |||||
| . /lib/functions.sh | |||||
| . /usr/share/libubox/jshn.sh | |||||
| [ "$ACTION" != ifup ] && exit | |||||
| handle_network() | |||||
| { | |||||
| config_get iface $1 iface_name | |||||
| [ $INTERFACE != "$iface" ] && return | |||||
| [ $(config_get $1 proto) != "openfortivpn" ] && return | |||||
| config_get_bool load_on_boot $1 auto | |||||
| [ -n "$load_on_boot" ] && [ "$load_on_boot" -eq 0 ] && return | |||||
| status="$(ifstatus $1)" || continue | |||||
| json_load "$status" | |||||
| json_get_var autostart autostart | |||||
| logger -t "openfortivpnhotplug" "$ACTION on $INTERFACE to bring up $1. Autostart is $autostart" | |||||
| [ "$autostart" -eq 0 ] && { | |||||
| logger -t "openfortivpnhotplug" "auto-start was false. bringing $1 up" | |||||
| ubus call network.interface up "{ \"interface\" : \"$1\" }" | |||||
| } | |||||
| } | |||||
| config_load network | |||||
| config_foreach handle_network interface | |||||
| exit 0 | |||||
+ 60
- 40
net/openfortivpn/files/openfortivpn.sh
View File
+ 0
- 182
net/openfortivpn/patches/010-bind-iface.patch
View File
| @ -1,182 +0,0 @@ | |||||
| --- a/doc/openfortivpn.1.in | |||||
| +++ b/doc/openfortivpn.1.in | |||||
| @@ -12,6 +12,7 @@ openfortivpn \- Client for PPP+SSL VPN t | |||||
| [\fB\-\-otp\-prompt=\fI<prompt>\fR] | |||||
| [\fB\-\-otp\-delay=\fI<delay>\fR] | |||||
| [\fB\-\-realm=\fI<realm>\fR] | |||||
| +[\fB\-\-ifname=\fI<interface>\fR] | |||||
| [\fB\-\-set\-routes=<bool>\fR] | |||||
| [\fB\-\-no\-routes\fR] | |||||
| [\fB\-\-set\-dns=<bool>\fR] | |||||
| @@ -83,6 +84,9 @@ no wait (this is the default). | |||||
| Connect to the specified authentication realm. Defaults to empty, which | |||||
| is usually what you want. | |||||
| .TP | |||||
| +\fB\-\-ifname=\fI<interface>\fR | |||||
| +Bind the connection to the specified network interface. | |||||
| +.TP | |||||
| \fB\-\-set\-routes=\fI<bool>\fR, \fB\-\-no-routes\fR | |||||
| Set if openfortivpn should try to configure IP routes through the VPN when | |||||
| tunnel is up. If used multiple times, the last one takes priority. | |||||
| --- a/src/config.c | |||||
| +++ b/src/config.c | |||||
| @@ -50,6 +50,7 @@ const struct vpn_config invalid_cfg = { | |||||
| .otp_delay = -1, | |||||
| .pinentry = NULL, | |||||
| .realm = {'\0'}, | |||||
| + .iface_name = {'\0'}, | |||||
| .set_routes = -1, | |||||
| .set_dns = -1, | |||||
| .pppd_use_peerdns = -1, | |||||
| @@ -490,6 +491,8 @@ void merge_config(struct vpn_config *dst | |||||
| } | |||||
| if (src->realm[0]) | |||||
| strcpy(dst->realm, src->realm); | |||||
| + if (src->iface_name[0]) | |||||
| + strcpy(dst->iface_name, src->iface_name); | |||||
| if (src->set_routes != invalid_cfg.set_routes) | |||||
| dst->set_routes = src->set_routes; | |||||
| if (src->set_dns != invalid_cfg.set_dns) | |||||
| --- a/src/config.h | |||||
| +++ b/src/config.h | |||||
| @@ -86,6 +86,7 @@ struct vpn_config { | |||||
| char *otp_prompt; | |||||
| unsigned int otp_delay; | |||||
| char *pinentry; | |||||
| + char iface_name[FIELD_SIZE + 1]; | |||||
| char realm[FIELD_SIZE + 1]; | |||||
| int set_routes; | |||||
| --- a/src/main.c | |||||
| +++ b/src/main.c | |||||
| @@ -51,16 +51,16 @@ | |||||
| " resolver and routes directly.\n" \ | |||||
| " --pppd-ifname=<string> Set the pppd interface name, if supported by pppd.\n" \ | |||||
| " --pppd-ipparam=<string> Provides an extra parameter to the ip-up, ip-pre-up\n" \ | |||||
| -" and ip-down scripts. See man (8) pppd\n" \ | |||||
| +" and ip-down scripts. See man (8) pppd.\n" \ | |||||
| " --pppd-call=<name> Move most pppd options from pppd cmdline to\n" \ | |||||
| " /etc/ppp/peers/<name> and invoke pppd with\n" \ | |||||
| -" 'call <name>'\n" | |||||
| +" 'call <name>'.\n" | |||||
| #elif HAVE_USR_SBIN_PPP | |||||
| #define PPPD_USAGE \ | |||||
| " [--ppp-system=<system>]\n" | |||||
| #define PPPD_HELP \ | |||||
| " --ppp-system=<system> Connect to the specified system as defined in\n" \ | |||||
| -" /etc/ppp/ppp.conf\n" | |||||
| +" /etc/ppp/ppp.conf.\n" | |||||
| #else | |||||
| #error "Neither HAVE_USR_SBIN_PPPD nor HAVE_USR_SBIN_PPP have been defined." | |||||
| #endif | |||||
| @@ -69,7 +69,7 @@ | |||||
| #define RESOLVCONF_USAGE \ | |||||
| "[--use-resolvconf=<0|1>] " | |||||
| #define RESOLVCONF_HELP \ | |||||
| -" --use-resolvconf=[01] If possible use resolvconf to update /etc/resolv.conf\n" | |||||
| +" --use-resolvconf=[01] If possible use resolvconf to update /etc/resolv.conf.\n" | |||||
| #else | |||||
| #define RESOLVCONF_USAGE "" | |||||
| #define RESOLVCONF_HELP "" | |||||
| @@ -77,14 +77,14 @@ | |||||
| #define usage \ | |||||
| "Usage: openfortivpn [<host>[:<port>]] [-u <user>] [-p <pass>]\n" \ | |||||
| -" [--pinentry=<program>]\n" \ | |||||
| -" [--realm=<realm>] [--otp=<otp>] [--otp-delay=<delay>]\n" \ | |||||
| -" [--otp-prompt=<prompt>] [--set-routes=<0|1>]\n" \ | |||||
| +" [--otp=<otp>] [--otp-delay=<delay>] [--otp-prompt=<prompt>]\n" \ | |||||
| +" [--pinentry=<program>] [--realm=<realm>]\n" \ | |||||
| +" [--ifname=<ifname>] [--set-routes=<0|1>]\n" \ | |||||
| " [--half-internet-routes=<0|1>] [--set-dns=<0|1>]\n" \ | |||||
| PPPD_USAGE \ | |||||
| " " RESOLVCONF_USAGE "[--ca-file=<file>]\n" \ | |||||
| " [--user-cert=<file>] [--user-key=<file>]\n" \ | |||||
| -" [--trusted-cert=<digest>] [--use-syslog]\n" \ | |||||
| +" [--use-syslog] [--trusted-cert=<digest>]\n" \ | |||||
| " [--persistent=<interval>] [-c <file>] [-v|-q]\n" \ | |||||
| " openfortivpn --help\n" \ | |||||
| " openfortivpn --version\n" \ | |||||
| @@ -115,10 +115,11 @@ PPPD_USAGE \ | |||||
| " -u <user>, --username=<user> VPN account username.\n" \ | |||||
| " -p <pass>, --password=<pass> VPN account password.\n" \ | |||||
| " -o <otp>, --otp=<otp> One-Time-Password.\n" \ | |||||
| -" --otp-prompt=<prompt> Search for the OTP prompt starting with this string\n" \ | |||||
| +" --otp-prompt=<prompt> Search for the OTP prompt starting with this string.\n" \ | |||||
| " --otp-delay=<delay> Wait <delay> seconds before sending the OTP.\n" \ | |||||
| -" --pinentry=<program> Use the program to supply a secret instead of asking for it\n" \ | |||||
| +" --pinentry=<program> Use the program to supply a secret instead of asking for it.\n" \ | |||||
| " --realm=<realm> Use specified authentication realm.\n" \ | |||||
| +" --ifname=<interface> Bind to interface.\n" \ | |||||
| " --set-routes=[01] Set if openfortivpn should configure routes\n" \ | |||||
| " when tunnel is up.\n" \ | |||||
| " --no-routes Do not configure routes, same as --set-routes=0.\n" \ | |||||
| @@ -127,7 +128,7 @@ PPPD_USAGE \ | |||||
| " --set-dns=[01] Set if openfortivpn should add DNS name servers\n" \ | |||||
| " and domain search list in /etc/resolv.conf.\n" \ | |||||
| " If installed resolvconf is used for the update.\n" \ | |||||
| -" --no-dns Do not reconfigure DNS, same as --set-dns=0\n" \ | |||||
| +" --no-dns Do not reconfigure DNS, same as --set-dns=0.\n" \ | |||||
| " --ca-file=<file> Use specified PEM-encoded certificate bundle\n" \ | |||||
| " instead of system-wide store to verify the gateway\n" \ | |||||
| " certificate.\n" \ | |||||
| @@ -199,6 +200,7 @@ int main(int argc, char **argv) | |||||
| .otp_delay = 0, | |||||
| .pinentry = NULL, | |||||
| .realm = {'\0'}, | |||||
| + .iface_name = {'\0'}, | |||||
| .set_routes = 1, | |||||
| .set_dns = 1, | |||||
| .use_syslog = 0, | |||||
| @@ -245,6 +247,7 @@ int main(int argc, char **argv) | |||||
| {"otp", required_argument, NULL, 'o'}, | |||||
| {"otp-prompt", required_argument, NULL, 0}, | |||||
| {"otp-delay", required_argument, NULL, 0}, | |||||
| + {"ifname", required_argument, NULL, 0}, | |||||
| {"set-routes", required_argument, NULL, 0}, | |||||
| {"no-routes", no_argument, &cli_cfg.set_routes, 0}, | |||||
| {"half-internet-routes", required_argument, NULL, 0}, | |||||
| @@ -427,6 +430,12 @@ int main(int argc, char **argv) | |||||
| break; | |||||
| } | |||||
| if (strcmp(long_options[option_index].name, | |||||
| + "ifname") == 0) { | |||||
| + strncpy(cli_cfg.iface_name, optarg, FIELD_SIZE); | |||||
| + cli_cfg.iface_name[FIELD_SIZE] = '\0'; | |||||
| + break; | |||||
| + } | |||||
| + if (strcmp(long_options[option_index].name, | |||||
| "set-routes") == 0) { | |||||
| int set_routes = strtob(optarg); | |||||
| --- a/src/tunnel.c | |||||
| +++ b/src/tunnel.c | |||||
| @@ -523,12 +523,28 @@ static int tcp_connect(struct tunnel *tu | |||||
| int ret, handle; | |||||
| struct sockaddr_in server; | |||||
| char *env_proxy; | |||||
| + const int iface_len = strnlen(tunnel->config->iface_name, IFNAMSIZ); | |||||
| handle = socket(AF_INET, SOCK_STREAM, 0); | |||||
| + | |||||
| if (handle == -1) { | |||||
| log_error("socket: %s\n", strerror(errno)); | |||||
| goto err_socket; | |||||
| } | |||||
| + if (iface_len == IFNAMSIZ) { | |||||
| + log_error("socket: Too long iface name"); | |||||
| + goto err_socket; | |||||
| + } | |||||
| + if (iface_len > 0) { | |||||
| + ret = setsockopt(handle, SOL_SOCKET, SO_BINDTODEVICE, | |||||
| + tunnel->config->iface_name, iface_len); | |||||
| + if (ret) { | |||||
| + log_error("socket: setting interface name failed with error: %d", | |||||
| + errno); | |||||
| + goto err_socket; | |||||
| + } | |||||
| + } | |||||
| + | |||||
| env_proxy = getenv("https_proxy"); | |||||
| if (env_proxy == NULL) | |||||
| env_proxy = getenv("HTTPS_PROXY"); | |||||