#!/sbin/openrc-run # Copyright 1999-2023 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 VPNDIR=${VPNDIR:-/etc/openvpn} VPN=${SVCNAME#*.} if [ -n "${VPN}" ] && [ ${SVCNAME} != "openvpn" ]; then VPNPID="/run/openvpn.${VPN}.pid" else VPNPID="/run/openvpn.pid" fi VPNCONF="${VPNDIR}/${VPN}.conf" depend() { need localmount net use dns after bootmisc } checkconfig() { # Linux has good dynamic tun/tap creation if [ $(uname -s) = "Linux" ] ; then if [ ! -e /dev/net/tun ]; then if ! modprobe tun ; then eerror "TUN/TAP support is not available" \ "in this kernel" return 1 fi fi if [ -h /dev/net/tun ] && [ -c /dev/misc/net/tun ]; then ebegin "Detected broken /dev/net/tun symlink, fixing..." rm -f /dev/net/tun ln -s /dev/misc/net/tun /dev/net/tun eend $? fi return 0 fi # Other OS's don't, so we rely on a pre-configured interface # per vpn instance local ifname=$(sed -n -e 's/[[:space:]]*dev[[:space:]][[:space:]]*\([^[:space:]]*\).*/\1/p' "${VPNCONF}") if [ -z ${ifname} ] ; then eerror "You need to specify the interface that this openvpn" \ "instance should use" \ "by using the dev option in ${VPNCONF}" return 1 fi if ! ifconfig "${ifname}" >/dev/null 2>/dev/null ; then # Try and create it echo > /dev/"${ifname}" >/dev/null fi if ! ifconfig "${ifname}" >/dev/null 2>/dev/null ; then eerror "${VPNCONF} requires interface ${ifname}" \ "but that does not exist" return 1 fi } start() { # If we are re-called by the openvpn gentoo-up.sh script # then we don't actually want to start openvpn [ "${IN_BACKGROUND}" = "true" ] && return 0 ebegin "Starting ${SVCNAME}" checkconfig || return 1 local args="" reenter=${RE_ENTER:-no} # If the config file does not specify the cd option, we do # But if we specify it, we override the config option which we do not want if ! grep -q "^[ ]*cd[ ].*" "${VPNCONF}" ; then args="${args} --cd ${VPNDIR}" fi # We mark the service as inactive and then start it. # When we get an authenticated packet from the peer then we run our script # which configures our DNS if any and marks us as up. if [ "${DETECT_CLIENT:-yes}" = "yes" ] && \ grep -q "^[ ]*remote[ ].*" "${VPNCONF}" ; then reenter="yes" args="${args} --up-delay --up-restart" args="${args} --script-security 2" args="${args} --up /etc/openvpn/up.sh" args="${args} --down-pre --down /etc/openvpn/down.sh" # Warn about setting scripts as we override them if grep -Eq "^[ ]*(up|down)[ ].*" "${VPNCONF}" ; then ewarn "WARNING: You have defined your own up/down scripts" ewarn "As you're running as a client, we now force Gentoo specific" ewarn "scripts to be run for up and down events." ewarn "These scripts will call /etc/openvpn/${SVCNAME}-{up,down}.sh" ewarn "where you can put your own code." fi # Warn about the inability to change ip/route/dns information when # dropping privs if grep -q "^[ ]*user[ ].*" "${VPNCONF}" ; then ewarn "WARNING: You are dropping root privileges!" ewarn "As such openvpn may not be able to change ip, routing" ewarn "or DNS configuration." fi else # So we're a server. Run as openvpn unless otherwise specified grep -q "^[ ]*user[ ].*" "${VPNCONF}" || args="${args} --user openvpn" grep -q "^[ ]*group[ ].*" "${VPNCONF}" || args="${args} --group openvpn" fi # Ensure that our scripts get the PEER_DNS variable [ -n "${PEER_DNS}" ] && args="${args} --setenv PEER_DNS ${PEER_DNS}" [ "${reenter}" = "yes" ] && mark_service_inactive "${SVCNAME}" start-stop-daemon --start --exec /usr/sbin/openvpn --pidfile "${VPNPID}" \ -- --config "${VPNCONF}" --writepid "${VPNPID}" --daemon \ --setenv SVCNAME "${SVCNAME}" ${args} eend $? "Check your logs to see why startup failed" } stop() { # If we are re-called by the openvpn gentoo-down.sh script # then we don't actually want to stop openvpn if [ "${IN_BACKGROUND}" = "true" ] ; then mark_service_inactive "${SVCNAME}" return 0 fi ebegin "Stopping ${SVCNAME}" start-stop-daemon --stop --quiet \ --exec /usr/sbin/openvpn --pidfile "${VPNPID}" \ -- --config "${VPNCONF}" eend $? } # vim: set ts=4 :