| #!/sbin/openrc-run |
| # Copyright 1999-2007 Gentoo Foundation |
| # Distributed under the terms of the GNU General Public License v2 |
| |
| VPNDIR=${VPNDIR:-/etc/openvpn} |
| VPN=${SVCNAME#*.} |
| if [ -n "${VPN}" ] && [ ${SVCNAME} != "openvpn" ]; then |
| VPNPID="/var/run/openvpn.${VPN}.pid" |
| else |
| VPNPID="/var/run/openvpn.pid" |
| fi |
| VPNCONF="${VPNDIR}/${VPN}.conf" |
| |
| depend() { |
| need localmount net |
| use dns |
| after bootmisc |
| } |
| |
| checkconfig() { |
| # Linux has good dynamic tun/tap creation |
| if [ $(uname -s) = "Linux" ] ; then |
| if [ ! -e /dev/net/tun ]; then |
| if ! modprobe tun ; then |
| eerror "TUN/TAP support is not available" \ |
| "in this kernel" |
| return 1 |
| fi |
| fi |
| if [ -h /dev/net/tun ] && [ -c /dev/misc/net/tun ]; then |
| ebegin "Detected broken /dev/net/tun symlink, fixing..." |
| rm -f /dev/net/tun |
| ln -s /dev/misc/net/tun /dev/net/tun |
| eend $? |
| fi |
| return 0 |
| fi |
| |
| # Other OS's don't, so we rely on a pre-configured interface |
| # per vpn instance |
| local ifname=$(sed -n -e 's/[[:space:]]*dev[[:space:]][[:space:]]*\([^[:space:]]*\).*/\1/p' "${VPNCONF}") |
| if [ -z ${ifname} ] ; then |
| eerror "You need to specify the interface that this openvpn" \ |
| "instance should use" \ |
| "by using the dev option in ${VPNCONF}" |
| return 1 |
| fi |
| |
| if ! ifconfig "${ifname}" >/dev/null 2>/dev/null ; then |
| # Try and create it |
| echo > /dev/"${ifname}" >/dev/null |
| fi |
| if ! ifconfig "${ifname}" >/dev/null 2>/dev/null ; then |
| eerror "${VPNCONF} requires interface ${ifname}" \ |
| "but that does not exist" |
| return 1 |
| fi |
| } |
| |
| start() { |
| # If we are re-called by the openvpn gentoo-up.sh script |
| # then we don't actually want to start openvpn |
| [ "${IN_BACKGROUND}" = "true" ] && return 0 |
| |
| ebegin "Starting ${SVCNAME}" |
| |
| checkconfig || return 1 |
| |
| local args="" reenter=${RE_ENTER:-no} |
| # If the config file does not specify the cd option, we do |
| # But if we specify it, we override the config option which we do not want |
| if ! grep -q "^[ ]*cd[ ].*" "${VPNCONF}" ; then |
| args="${args} --cd ${VPNDIR}" |
| fi |
| |
| # We mark the service as inactive and then start it. |
| # When we get an authenticated packet from the peer then we run our script |
| # which configures our DNS if any and marks us as up. |
| if [ "${DETECT_CLIENT:-yes}" = "yes" ] && \ |
| grep -q "^[ ]*remote[ ].*" "${VPNCONF}" ; then |
| reenter="yes" |
| args="${args} --up-delay --up-restart" |
| args="${args} --script-security 2" |
| args="${args} --up /etc/openvpn/up.sh" |
| args="${args} --down-pre --down /etc/openvpn/down.sh" |
| |
| # Warn about setting scripts as we override them |
| if grep -Eq "^[ ]*(up|down)[ ].*" "${VPNCONF}" ; then |
| ewarn "WARNING: You have defined your own up/down scripts" |
| ewarn "As you're running as a client, we now force Gentoo specific" |
| ewarn "scripts to be run for up and down events." |
| ewarn "These scripts will call /etc/openvpn/${SVCNAME}-{up,down}.sh" |
| ewarn "where you can put your own code." |
| fi |
| |
| # Warn about the inability to change ip/route/dns information when |
| # dropping privs |
| if grep -q "^[ ]*user[ ].*" "${VPNCONF}" ; then |
| ewarn "WARNING: You are dropping root privileges!" |
| ewarn "As such openvpn may not be able to change ip, routing" |
| ewarn "or DNS configuration." |
| fi |
| else |
| # So we're a server. Run as openvpn unless otherwise specified |
| grep -q "^[ ]*user[ ].*" "${VPNCONF}" || args="${args} --user openvpn" |
| grep -q "^[ ]*group[ ].*" "${VPNCONF}" || args="${args} --group openvpn" |
| fi |
| |
| # Ensure that our scripts get the PEER_DNS variable |
| [ -n "${PEER_DNS}" ] && args="${args} --setenv PEER_DNS ${PEER_DNS}" |
| |
| [ "${reenter}" = "yes" ] && mark_service_inactive "${SVCNAME}" |
| start-stop-daemon --start --exec /usr/sbin/openvpn --pidfile "${VPNPID}" \ |
| -- --config "${VPNCONF}" --writepid "${VPNPID}" --daemon \ |
| --setenv SVCNAME "${SVCNAME}" ${args} |
| eend $? "Check your logs to see why startup failed" |
| } |
| |
| stop() { |
| # If we are re-called by the openvpn gentoo-down.sh script |
| # then we don't actually want to stop openvpn |
| if [ "${IN_BACKGROUND}" = "true" ] ; then |
| mark_service_inactive "${SVCNAME}" |
| return 0 |
| fi |
| |
| ebegin "Stopping ${SVCNAME}" |
| start-stop-daemon --stop --quiet \ |
| --exec /usr/sbin/openvpn --pidfile "${VPNPID}" |
| eend $? |
| } |
| |
| # vim: set ts=4 : |