ocserv.init (7033B)
1 #!/bin/sh /etc/rc.common 2 3 START=50 4 USE_PROCD=1 5 6 setup_config() { 7 config_get port $1 port "4443" 8 config_get max_clients $1 max_clients "8" 9 config_get max_same $1 max_same "2" 10 config_get dpd $1 dpd "120" 11 config_get predictable_ips $1 predictable_ips "1" 12 config_get compression $1 compression "0" 13 config_get udp $1 udp "1" 14 config_get auth $1 auth "plain" 15 config_get cisco_compat $1 cisco_compat "1" 16 config_get ipaddr $1 ipaddr "" 17 config_get netmask $1 netmask "" 18 config_get ip6addr $1 ip6addr "" 19 config_get proxy_arp $1 proxy_arp "0" 20 config_get ping_leases $1 ping_leases "0" 21 config_get split_dns $1 split_dns "0" 22 config_get default_domain $1 default_domain "" 23 24 # Enable proxy arp, and make sure that ping leases is set to true in that case, 25 # to prevent conflicts. 26 if test "$proxy_arp" = 1;then 27 local ip 28 # IP address is empty. Auto-configure LAN + VPN. 29 if test -z "$ipaddr";then 30 local mask 31 mask=$(uci get network.lan.netmask) 32 if test "$mask" = "255.255.255.0";then 33 uci set dhcp.lan.start=100 34 uci set dhcp.lan.limit=91 35 fi 36 ip=$(uci get network.lan.ipaddr) 37 ipaddr="$(echo $ip|cut -d . -f1,2,3).192" 38 netmask="255.255.255.192" 39 uci set ocserv.config.ipaddr="$ipaddr" 40 uci set ocserv.config.netmask="$netmask" 41 uci commit 42 fi 43 44 if test -z "$ip6addr";then 45 ip6addr=$(uci get network.lan.ip6addr 2>/dev/null) 46 test -n "$ip6addr" && uci set ocserv.config.ip6addr="$ip6addr" 47 uci commit 48 fi 49 50 ping_leases=1 51 test -n "$ipaddr" && sysctl -w "net.ipv4.conf.$(uci get network.lan.ifname).proxy_arp"=1 >/dev/null 52 test -n "$ip6addr" && sysctl -w "net.ipv6.conf.$(uci get network.lan.ifname).proxy_ndp"=1 >/dev/null 53 else 54 test "$ipaddr" = "" && ipaddr="192.168.100.0" 55 test "$netmask" = "" && ipaddr="255.255.255.0" 56 fi 57 58 enable_default_domain="#" 59 enable_udp="#" 60 enable_compression="#" 61 enable_split_dns="#" 62 test $predictable_ips = "0" && predictable_ips="false" 63 test $predictable_ips = "1" && predictable_ips="true" 64 test $cisco_compat = "0" && cisco_compat="false" 65 test $cisco_compat = "1" && cisco_compat="true" 66 test $ping_leases = "0" && ping_leases="false" 67 test $ping_leases = "1" && ping_leases="true" 68 test $udp = "1" && enable_udp="" 69 test $split_dns = "1" && enable_split_dns="" 70 test $compression = "1" && enable_compression="" 71 72 test -z $default_domain && default_domain=$(uci get dhcp.@dnsmasq[0].domain) 73 test -n $default_domain && enable_default_domain="" 74 test -z $ip6addr && enable_ipv6="#" 75 76 test $auth = "plain" && authsuffix="\[passwd=/var/etc/ocpasswd\]" 77 78 dyndns="false" 79 hostname=`uci show ddns 2>/dev/null|grep domain|head -1|cut -d '=' -f 2` 80 [ -n "$hostname" ] && dyndns="true" 81 82 mkdir -p /var/etc 83 sed -e "s/|PORT|/$port/g" \ 84 -e "s/|MAX_CLIENTS|/$max_clients/g" \ 85 -e "s/|MAX_SAME|/$max_same/g" \ 86 -e "s/|DPD|/$dpd/g" \ 87 -e "s#|AUTH|#$auth$authsuffix#g" \ 88 -e "s#|DYNDNS|#$dyndns#g" \ 89 -e "s/|PREDICTABLE_IPS|/$predictable_ips/g" \ 90 -e "s/|DEFAULT_DOMAIN|/$default_domain/g" \ 91 -e "s/|ENABLE_DEFAULT_DOMAIN|/$enable_default_domain/g" \ 92 -e "s/|ENABLE_SPLIT_DNS|/$enable_split_dns/g" \ 93 -e "s/|CISCO_COMPAT|/$cisco_compat/g" \ 94 -e "s/|PING_LEASES|/$ping_leases/g" \ 95 -e "s/|UDP|/$enable_udp/g" \ 96 -e "s/|COMPRESSION|/$enable_compression/g" \ 97 -e "s/|IPV4ADDR|/$ipaddr/g" \ 98 -e "s/|NETMASK|/$netmask/g" \ 99 -e "s#|IPV6ADDR|#$ip6addr#g" \ 100 -e "s/|ENABLE_IPV6|/$enable_ipv6/g" \ 101 /etc/ocserv/ocserv.conf.template > /var/etc/ocserv.conf 102 103 test -f /etc/ocserv/ocserv.conf.local && cat /etc/ocserv/ocserv.conf.local >> /var/etc/ocserv.conf 104 } 105 106 setup_users() { 107 local name 108 local group 109 local password 110 111 config_get name $1 name 112 config_get group $1 group '*' 113 config_get password $1 password 114 115 [ -z "$name" -o -z "$password" ] && return 116 117 echo "$name:$group:$password" >> /var/etc/ocpasswd 118 } 119 120 setup_routes() { 121 local routes 122 123 config_get ip $1 ip 124 config_get netmask $1 netmask 125 126 [ -z "$ip" -o -z "$netmask" ] && return 127 128 echo "route = $ip/$netmask" >> /var/etc/ocserv.conf 129 } 130 131 setup_dns() { 132 local routes 133 134 config_get ip $1 ip 135 136 [ -z "$ip" ] && return 137 138 echo "dns = $ip" >> /var/etc/ocserv.conf 139 } 140 141 start_service() { 142 local hostname iface 143 144 hostname=`uci show ddns 2>/dev/null|grep domain|head -1|cut -d '=' -f 2` 145 [ -z "$hostname" ] && hostname=`uci get system.@system[0].hostname 2>/dev/null` 146 147 [ -f /etc/config/ocserv-dir/ca-key.pem ] && mv /etc/config/ocserv-dir/ca-key.pem /etc/ocserv/ca-key.pem 148 [ -f /etc/config/ocserv-dir/ca.pem ] && mv /etc/config/ocserv-dir/ca.pem /etc/ocserv/ca.pem 149 [ -f /etc/config/ocserv-dir/server-key.pem ] && mv /etc/config/ocserv-dir/server-key.pem /etc/ocserv/server-key.pem 150 [ -f /etc/config/ocserv-dir/server-cert.pem ] && mv /etc/config/ocserv-dir/server-cert.pem /etc/ocserv/server-cert.pem 151 [ -d /etc/config/ocserv-dir ] && rmdir /etc/config/ocserv-dir 152 153 [ ! -f /etc/ocserv/ca-key.pem ] && [ -x /usr/bin/certtool ] && { 154 logger -t ocserv "Generating CA certificate..." 155 mkdir -p /etc/ocserv/pki/ 156 certtool --bits 2048 --generate-privkey --outfile /etc/ocserv/ca-key.pem >/dev/null 2>&1 157 echo "cn=$hostname CA" >/etc/ocserv/pki/ca.tmpl 158 echo "expiration_days=-1" >>/etc/ocserv/pki/ca.tmpl 159 echo "serial=1" >>/etc/ocserv/pki/ca.tmpl 160 echo "ca" >>/etc/ocserv/pki/ca.tmpl 161 echo "cert_signing_key" >>/etc/ocserv/pki/ca.tmpl 162 163 certtool --template /etc/ocserv/pki/ca.tmpl \ 164 --generate-self-signed --load-privkey /etc/ocserv/ca-key.pem \ 165 --outfile /etc/ocserv/ca.pem >/dev/null 2>&1 166 } 167 168 #generate server certificate/key 169 [ ! -f /etc/ocserv/server-key.pem ] && [ -x /usr/bin/certtool ] && { 170 logger -t ocserv "Generating server certificate..." 171 mkdir -p /etc/ocserv/pki/ 172 certtool --bits 2048 --generate-privkey --outfile /etc/ocserv/server-key.pem >/dev/null 2>&1 173 echo "cn=$hostname" >/etc/ocserv/pki/server.tmpl 174 echo "serial=2" >>/etc/ocserv/pki/server.tmpl 175 echo "expiration_days=-1" >>/etc/ocserv/pki/server.tmpl 176 echo "signing_key" >>/etc/ocserv/pki/server.tmpl 177 echo "encryption_key" >>/etc/ocserv/pki/server.tmpl 178 certtool --template /etc/ocserv/pki/server.tmpl \ 179 --generate-certificate --load-privkey /etc/ocserv/server-key.pem \ 180 --load-ca-certificate /etc/ocserv/ca.pem --load-ca-privkey \ 181 /etc/ocserv/ca-key.pem --outfile /etc/ocserv/server-cert.pem >/dev/null 2>&1 182 } 183 184 [ -f /var/run/ocserv.pid ] || { 185 touch /var/run/ocserv.pid 186 chown ocserv:ocserv /var/run/ocserv.pid 187 } 188 [ -d /var/lib/ocserv ] || { 189 mkdir -m 0755 -p /var/lib/ocserv 190 chmod 0700 /var/lib/ocserv 191 chown ocserv:ocserv /var/lib/ocserv 192 } 193 194 config_load "ocserv" 195 196 rm -f /var/etc/ocserv.conf 197 touch /var/etc/ocserv.conf 198 setup_config config 199 config_foreach setup_routes routes 200 config_foreach setup_dns dns 201 202 rm -f /var/etc/ocpasswd 203 touch /var/etc/ocpasswd 204 chmod 600 /var/etc/ocpasswd 205 config_foreach setup_users ocservusers 206 207 procd_open_instance 208 procd_set_param command /usr/sbin/ocserv -f -c /var/etc/ocserv.conf 209 procd_set_param respawn 210 procd_close_instance 211 } 212