#!/bin/sh . /lib/functions.sh . /lib/functions/network.sh . ../netifd-proto.sh init_proto "$@" IPv4_REGEX="((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)" append_args() { while [ $# -gt 0 ]; do append cmdline "'${1//\'/\'\\\'\'}'" shift done } proto_openfortivpn_init_config() { proto_config_add_string "peeraddr" proto_config_add_int "port" proto_config_add_string "tunlink" proto_config_add_string "local_ip" proto_config_add_string "username" proto_config_add_string "password" proto_config_add_int "persist_int" proto_config_add_string "trusted_cert" proto_config_add_string "remote_status_check" no_device=1 available=1 } proto_openfortivpn_setup() { local config="$1" local msg ifname ip server_ips pwfile callfile local peeraddr port tunlink local_ip username password persist_int \ trusted_cert remote_status_check json_get_vars host peeraddr port tunlink local_ip username password persist_int \ trusted_cert remote_status_check ifname="vpn-$config" [ -n "$tunlink" ] && { network_get_device iface_device_name "$tunlink" network_is_up "$tunlink" || { msg="$tunlink is not up $iface_device_name" logger -t "openfortivpn" "$config: $msg" proto_notify_error "$config" "$msg" proto_block_restart "$config" exit 1 } } if echo "$peeraddr" | grep -q -E "$IPv4_REGEX"; then server_ips="$peeraddr" elif command -v resolveip >/dev/null ; then server_ips="$(resolveip -4 -t 10 "$peeraddr")" || { msg="$config: failed to resolve server ip for $peeraddr" logger -t "openfortivpn" "$msg" sleep 10 proto_notify_error "$config" "$msg" proto_setup_failed "$config" exit 1 } else logger -t "openfortivpn" "resolveip not present, could not resolve $peeraddr" fi [ "$remote_status_check" = "curl" ] && { curl -k --head -s --connect-timeout 10 ${tunlink:+--interface} "$iface_device_name" "https://$peeraddr" > /dev/null || { msg="failed to reach https://$peeraddr${tunlink:+ on $iface_device_name}" logger -t "openfortivpn" "$config: $msg" sleep 10 proto_notify_error "$config" "$msg" proto_setup_failed "$config" exit 1 } } [ "$remote_status_check" = "ping" ] && { ping ${tunlink:+-I} "$iface_device_name" -c 1 -w 10 "$peeraddr" > /dev/null 2>&1 || { msg="$config: failed to ping $peeraddr on $iface_device_name" logger -t "openfortvpn" "$config: $msg" sleep 10 proto_notify_error "$config" "$msg" proto_setup_failed "$config" exit 1 } } if [ -n "$server_ips" ]; then for ip in $server_ips; do logger -p 6 -t "openfortivpn" "$config: adding host dependency for $ip on $tunlink at $config" proto_add_host_dependency "$config" "$ip" "$tunlink" done fi # uclient-fetch cannot bind to interface, so perform check after adding host dependency [ "$remote_status_check" = "fetch" ] && { uclient-fetch --no-check-certificate -q -s --timeout=10 "https://$peeraddr" > /dev/null 2>&1 || { msg="$config: failed to reach ${server_ip:-$peeraddr} on $iface_device_name" logger -t "openfortvpn" "$config: $msg" sleep 10 proto_notify_error "$config" "$msg" proto_setup_failed "$config" exit 1 } } [ -n "$port" ] && port=":$port" append_args "$peeraddr$port" --pppd-ifname="$ifname" --use-syslog -c /dev/null append_args "--set-dns=0" append_args "--no-routes" append_args "--pppd-use-peerdns=1" [ -n "$tunlink" ] && { append_args "--ifname=$iface_device_name" } [ -n "$persist_int" ] && append_args "--persistent=$persist_int" [ -n "$trusted_cert" ] && append_args "--trusted-cert=$trusted_cert" [ -n "$username" ] && append_args -u "$username" [ -n "$password" ] && { umask 077 mkdir -p '/var/etc/openfortivpn' pwfile="/var/etc/openfortivpn/$config.passwd" echo "$password" > "$pwfile" } [ -n "$local_ip" ] || local_ip=192.0.2.1 [ -e '/etc/ppp/peers' ] || mkdir -p '/etc/ppp/peers' [ -e '/etc/ppp/peers/openfortivpn' ] || { ln -s -T '/var/etc/openfortivpn/peers' '/etc/ppp/peers/openfortivpn' 2> /dev/null mkdir -p '/var/etc/openfortivpn/peers' } [ -f /etc/openfortivpn/user-cert-$config.pem ] && append_args "--user-cert=/etc/openfortivpn/user-cert-$config.pem" [ -f /etc/openfortivpn/user-key-$config.pem ] && append_args "--user-key=/etc/openfortivpn/user-key-$config.pem" [ -f /etc/openfortivpn/ca-$config.pem ] && append_args "--ca-file=/etc/openfortivpn/ca-$config.pem" callfile="/var/etc/openfortivpn/peers/$config" echo "115200 :$local_ip noipdefault noaccomp noauth default-asyncmap nopcomp receive-all nodetach ipparam $config lcp-max-configure 40 ip-up-script /lib/netifd/openfortivpn-ppp-up ip-down-script /lib/netifd/ppp-down mru 1354" > "$callfile" append_args "--pppd-call=openfortivpn/$config" logger -p 6 -t openfortivpn "$config: executing 'openfortivpn $cmdline'" eval "proto_run_command '$config' /usr/sbin/openfortivpn-wrapper '$pwfile' '$config' $cmdline" } proto_openfortivpn_teardown() { local config="$1" pwfile="/var/etc/openfortivpn/$config.passwd" callfile="/var/etc/openfortivpn/peers/$config" rm -f "$pwfile" rm -f "$callfile" proto_kill_command "$config" 2 } add_protocol openfortivpn