From 0dc0b8e582b9c7d82c9f5a863921e73b6acd90b5 Mon Sep 17 00:00:00 2001 From: Jo-Philipp Wich Date: Wed, 5 Aug 2020 09:25:41 +0200 Subject: [PATCH] openvpn: fix arguments passing to wrapped up and down scripts With the introduction of the generic OpenVPN hotplug mechanism, wrapped --up and --down scripts got the wrong amount and order of arguments passed, breaking existing configurations and functionality. Fix this issue by passing the same amount of arguments in the same expected order as if the scripts were executed by the OpenVPN daemon directly. Ref: https://github.com/openwrt/openwrt/pull/1596#issuecomment-668935156 Fixes: 8fe9940db6 ("openvpn: add generic hotplug mechanism") Signed-off-by: Jo-Philipp Wich --- package/network/services/openvpn/Makefile | 7 +- .../files/etc/hotplug.d/openvpn/01-user | 18 +--- .../openvpn/files/lib/functions/openvpn.sh | 16 ++++ .../services/openvpn/files/openvpn.config | 83 +++++++++++++++++-- .../services/openvpn/files/openvpn.init | 37 ++++++++- 5 files changed, 137 insertions(+), 24 deletions(-) create mode 100644 package/network/services/openvpn/files/lib/functions/openvpn.sh diff --git a/package/network/services/openvpn/Makefile b/package/network/services/openvpn/Makefile index f1170bbd37..9482e9ce39 100644 --- a/package/network/services/openvpn/Makefile +++ b/package/network/services/openvpn/Makefile @@ -10,7 +10,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=openvpn PKG_VERSION:=2.4.9 -PKG_RELEASE:=2 +PKG_RELEASE:=4 PKG_SOURCE_URL:=\ https://build.openvpn.net/downloads/releases/ \ @@ -112,6 +112,7 @@ define Package/openvpn-$(BUILD_VARIANT)/install $(1)/etc/init.d \ $(1)/etc/config \ $(1)/etc/openvpn \ + $(1)/lib/functions \ $(1)/lib/upgrade/keep.d \ $(1)/usr/libexec \ $(1)/etc/hotplug.d/openvpn @@ -128,6 +129,10 @@ define Package/openvpn-$(BUILD_VARIANT)/install files/usr/libexec/openvpn-hotplug \ $(1)/usr/libexec/openvpn-hotplug + $(INSTALL_DATA) \ + files/lib/functions/openvpn.sh \ + $(1)/lib/functions/openvpn.sh + $(INSTALL_DATA) \ files/etc/hotplug.d/openvpn/01-user \ $(1)/etc/hotplug.d/openvpn/01-user diff --git a/package/network/services/openvpn/files/etc/hotplug.d/openvpn/01-user b/package/network/services/openvpn/files/etc/hotplug.d/openvpn/01-user index 6d45f0b7c6..f93823e5c5 100644 --- a/package/network/services/openvpn/files/etc/hotplug.d/openvpn/01-user +++ b/package/network/services/openvpn/files/etc/hotplug.d/openvpn/01-user @@ -1,17 +1,6 @@ #!/bin/sh -get_option() { - local variable="$1" - local option="$2" - - local value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+(([^ \t\\]|\\.)+)[ \t]*$/\1/p' "$config" | tail -n1 | sed -re 's/\\(.)/\1/g')" - [ -n "$value" ] || value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+'"'([^']+)'"'[ \t]*$/\1/p' "$config" | tail -n1)" - [ -n "$value" ] || value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+"(([^"\\]|\\.)+)"[ \t]*$/\1/p' "$config" | tail -n1 | sed -re 's/\\(.)/\1/g')" - [ -n "$value" ] || return 1 - - export -n "$variable=$value" - return 0 -} +. /lib/functions/openvpn.sh [ -e "/etc/openvpn.user" ] && { env -i ACTION="$ACTION" INSTANCE="$INSTANCE" \ @@ -23,8 +12,9 @@ get_option() { # Wrap user defined scripts on up/down events case "$ACTION" in up|down) - if get_option command "$ACTION"; then - exec /bin/sh -c "$command $ACTION $INSTANCE $*" + if get_openvpn_option "$config" command "$ACTION"; then + shift + exec /bin/sh -c "$command $*" fi ;; esac diff --git a/package/network/services/openvpn/files/lib/functions/openvpn.sh b/package/network/services/openvpn/files/lib/functions/openvpn.sh new file mode 100644 index 0000000000..83fb1bb453 --- /dev/null +++ b/package/network/services/openvpn/files/lib/functions/openvpn.sh @@ -0,0 +1,16 @@ +#!/bin/sh + +get_openvpn_option() { + local config="$1" + local variable="$2" + local option="$3" + + local value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+(([^ \t\\]|\\.)+)[ \t]*$/\1/p' "$config" | tail -n1 | sed -re 's/\\(.)/\1/g')" + [ -n "$value" ] || value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+'"'([^']+)'"'[ \t]*$/\1/p' "$config" | tail -n1)" + [ -n "$value" ] || value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+"(([^"\\]|\\.)+)"[ \t]*$/\1/p' "$config" | tail -n1 | sed -re 's/\\(.)/\1/g')" + [ -n "$value" ] || return 1 + + export -n "$variable=$value" + return 0 +} + diff --git a/package/network/services/openvpn/files/openvpn.config b/package/network/services/openvpn/files/openvpn.config index 1fd846f558..3de1881e35 100644 --- a/package/network/services/openvpn/files/openvpn.config +++ b/package/network/services/openvpn/files/openvpn.config @@ -77,10 +77,10 @@ config openvpn sample_server # Diffie hellman parameters. # Generate your own with: - # openssl dhparam -out dh1024.pem 1024 + # openssl dhparam -out dh2048.pem 2048 # Substitute 2048 for 1024 if you are using - # 2048 bit keys. - option dh /etc/openvpn/dh1024.pem + # 1024 bit keys. + option dh /etc/openvpn/dh2048.pem # Configure server mode and supply a VPN subnet # for OpenVPN to draw client addresses from. @@ -228,10 +228,52 @@ config openvpn sample_server # This file is secret: # option tls_auth "/etc/openvpn/ta.key 0" + # For additional privacy, a shared secret key + # can be used for both authentication (as in tls_auth) + # and encryption of the TLS control channel. + # + # Generate a shared secret with: + # openvpn --genkey --secret ta.key + # + # The server and each client must have + # a copy of this key. + # + # tls_auth and tls_crypt should NOT + # be combined, as tls_crypt implies tls_auth. + # Use EITHER tls_crypt, tls_auth, or neither option. +# option tls_crypt "/etc/openvpn/ta.key" + + # Set the minimum required TLS protocol version + # for all connections. + # + # Require at least TLS 1.1 +# option tls_version_min "1.1" + # Require at least TLS 1.2 +# option tls_version_min "1.2" + # Require TLS 1.2, or the highest version supported + # on the system +# option tls_version_min "1.2 'or-highest'" + + # OpenVPN versions 2.4 and later will attempt to + # automatically negotiate the most secure cipher + # between the client and server, regardless of a + # configured "option cipher" (see below). + # Automatic negotiation is recommended. + # + # Uncomment this option to disable this behavior, + # and force all OpenVPN peers to use the configured + # cipher option instead (not recommended). +# option ncp_disable + # Select a cryptographic cipher. # This config item must be copied to # the client config file as well. - # Blowfish (default): + # + # To see all supported ciphers, run: + # openvpn --show-ciphers + # + # Blowfish (default for backwards compatibility, + # but not recommended due to weaknesses): # option cipher BF-CBC # AES: # option cipher AES-128-CBC @@ -241,11 +283,16 @@ config openvpn sample_server # Enable compression on the VPN link. # If you enable it here, you must also # enable it in the client config file. + # + # Compression is not recommended, as compression and + # encryption in combination can weaken the security + # of the connection. + # # LZ4 requires OpenVPN 2.4+ client and server # option compress lz4 # LZO is compatible with most OpenVPN versions # (set "compress lzo" on 2.4+ clients, and "comp-lzo yes" on older clients) - option compress lzo +# option compress lzo # The maximum number of concurrently connected # clients we want to allow. @@ -371,7 +418,7 @@ config openvpn sample_client option key /etc/openvpn/client.key # Verify server certificate by checking - # that the certicate has the nsCertType + # that the certicate has the key usage # field set to "server". This is an # important precaution to protect against # a potential attack discussed here: @@ -381,12 +428,27 @@ config openvpn sample_client # your server certificates with the nsCertType # field set to "server". The build_key_server # script in the easy_rsa folder will do this. -# option ns_cert_type server +# option remote_cert_tls server # If a tls_auth key is used on the server # then every client must also have the key. # option tls_auth "/etc/openvpn/ta.key 1" + # If a tls_crypt key is used on the server + # every client must also have the key. +# option tls_crypt "/etc/openvpn/ta.key" + + # Set the minimum required TLS protocol version + # for all connections. + # + # Require at least TLS 1.1 +# option tls_version_min "1.1" + # Require at least TLS 1.2 +# option tls_version_min "1.2" + # Require TLS 1.2, or the highest version supported + # on the system +# option tls_version_min "1.2 'or-highest'" + # Select a cryptographic cipher. # If the cipher option is used on the server # then you must also specify it here. @@ -395,10 +457,15 @@ config openvpn sample_client # Enable compression on the VPN link. # Don't enable this unless it is also # enabled in the server config file. + # + # Compression is not recommended, as compression and + # encryption in combination can weaken the security + # of the connection. + # # LZ4 requires OpenVPN 2.4+ on server and client # option compress lz4 # LZO is compatible with most OpenVPN versions - option compress lzo +# option compress lzo # Set log file verbosity. option verb 3 diff --git a/package/network/services/openvpn/files/openvpn.init b/package/network/services/openvpn/files/openvpn.init index a560b89ff2..a454eb4ba0 100644 --- a/package/network/services/openvpn/files/openvpn.init +++ b/package/network/services/openvpn/files/openvpn.init @@ -69,6 +69,40 @@ section_enabled() { [ $enable -gt 0 ] || [ $enabled -gt 0 ] } +openvpn_get_dev() { + local dev dev_type + local name="$1" + local conf="$2" + + # Do override only for configurations with config_file + config_get config_file "$name" config + [ -n "$config_file" ] || return + + # Check there is someething to override + config_get dev "$name" dev + config_get dev_type "$name" dev_type + [ -n "$dev" ] || return + + # If there is a no dev_type, try to guess it + if [ -z "$dev_type" ]; then + . /lib/functions/openvpn.sh + + local odev odev_type + get_openvpn_option "$conf" odev dev + get_openvpn_option "$conf" odev_type dev-type + [ -n "$odev_type" ] || odev_type="$odev" + + case "$odev_type" in + tun*) dev_type="tun" ;; + tap*) dev_type="tap" ;; + *) return;; + esac + fi + + # Return overrides + echo "--dev-type $dev_type --dev $dev" +} + openvpn_add_instance() { local name="$1" local dir="$2" @@ -83,7 +117,8 @@ openvpn_add_instance() { --config "$conf" \ --up "/usr/libexec/openvpn-hotplug up $name" \ --down "/usr/libexec/openvpn-hotplug down $name" \ - --script-security "${security:-2}" + --script-security "${security:-2}" \ + $(openvpn_get_dev "$name" "$conf") procd_set_param file "$dir/$conf" procd_set_param term_timeout 15 procd_set_param respawn