312 lines
7.2 KiB
Bash
312 lines
7.2 KiB
Bash
#!/bin/bash
|
|
### BEGIN INIT INFO
|
|
# Provides: ynh-vpnclient
|
|
# Required-Start: $network $remote_fs $syslog slapd
|
|
# Required-Stop: $network $remote_fs $syslog
|
|
# Default-Start: 2 3 4 5
|
|
# Default-Stop: 0 1 6
|
|
# Short-Description: Start VPN client.
|
|
# Description: Start VPN client.
|
|
### END INIT INFO
|
|
|
|
# Functions
|
|
## State functions
|
|
|
|
has_nativeip6() {
|
|
ip -6 route | grep -q default\ via
|
|
}
|
|
|
|
has_hotspot_app() {
|
|
yunohost app list -f hotspot --json | grep -q '"installed": true'
|
|
}
|
|
|
|
has_ip6delegatedprefix() {
|
|
[ "${ynh_ip6_addr}" != none ]
|
|
}
|
|
|
|
is_ip6addr_set() {
|
|
ip address show dev tun0 2> /dev/null | grep -q "${ynh_ip6_addr}/128"
|
|
}
|
|
|
|
is_serverip6route_set() {
|
|
server_ip6=${1}
|
|
|
|
if [ -z "${server_ip6}" ]; then
|
|
false
|
|
else
|
|
ip -6 route | grep -q "${server_ip6}/"
|
|
fi
|
|
}
|
|
|
|
is_openvpn_running() {
|
|
service openvpn status client &> /dev/null
|
|
}
|
|
|
|
is_running() {
|
|
((has_nativeip6 && is_serverip6route_set "${new_server_ip6}") || ! has_nativeip6)\
|
|
&& ((! has_hotspot_app && has_ip6delegatedprefix && is_ip6addr_set) || has_hotspot_app)\
|
|
&& is_openvpn_running
|
|
}
|
|
|
|
## Setters
|
|
|
|
set_ip6addr() {
|
|
ip address add "${ynh_ip6_addr}/128" dev tun0
|
|
}
|
|
|
|
set_serverip6route() {
|
|
server_ip6=${1}
|
|
ip6_gw=${2}
|
|
wired_device=${3}
|
|
|
|
ip route add "${server_ip6}/128" via "${ip6_gw}" dev "${wired_device}"
|
|
}
|
|
|
|
start_openvpn() {
|
|
ip6_gw=${1}
|
|
server_ip6=${2}
|
|
|
|
if [ ! -z "${ip6_gw}" -a ! -z "${server_ip6}" ]; then
|
|
proto=udp6
|
|
[ "${ynh_server_proto}" == tcp ] && proto=tcp6-client
|
|
else
|
|
proto=udp
|
|
[ "${ynh_server_proto}" == tcp ] && proto=tcp-client
|
|
fi
|
|
|
|
cp /etc/openvpn/client.conf{.tpl,}
|
|
|
|
sed "s|<TPL:SERVER_NAME>|${ynh_server_name}|g" -i /etc/openvpn/client.conf
|
|
sed "s|<TPL:SERVER_PORT>|${ynh_server_port}|g" -i /etc/openvpn/client.conf
|
|
sed "s|<TPL:PROTO>|${proto}|g" -i /etc/openvpn/client.conf
|
|
|
|
if [ -e /etc/openvpn/keys/user.key ]; then
|
|
sed 's|^<TPL:CERT_COMMENT>||' -i /etc/openvpn/client.conf
|
|
else
|
|
sed 's|^<TPL:CERT_COMMENT>|;|' -i /etc/openvpn/client.conf
|
|
fi
|
|
|
|
if [[ "${proto}" =~ udp ]]; then
|
|
sed 's|^<TPL:UDP_COMMENT>||' -i /etc/openvpn/client.conf
|
|
else
|
|
sed 's|^<TPL:UDP_COMMENT>|;|' -i /etc/openvpn/client.conf
|
|
fi
|
|
|
|
if [ -z "${ynh_login_user}" ]; then
|
|
sed 's|^<TPL:LOGIN_COMMENT>|;|' -i /etc/openvpn/client.conf
|
|
else
|
|
sed 's|^<TPL:LOGIN_COMMENT>||' -i /etc/openvpn/client.conf
|
|
fi
|
|
|
|
service openvpn start client
|
|
}
|
|
|
|
## Unsetters
|
|
|
|
unset_ip6addr() {
|
|
ip address delete "${ynh_ip6_addr}/128" dev tun0
|
|
}
|
|
|
|
unset_serverip6route() {
|
|
server_ip6=${1}
|
|
ip6_gw=${2}
|
|
wired_device=${3}
|
|
|
|
ip route delete "${server_ip6}/128" via "${ip6_gw}" dev "${wired_device}"
|
|
}
|
|
|
|
stop_openvpn() {
|
|
service openvpn stop
|
|
}
|
|
|
|
## Tools
|
|
|
|
moulinette_get() {
|
|
var=${1}
|
|
|
|
value=$(yunohost app setting vpnclient "${var}")
|
|
|
|
if [[ "${value}" =~ "An instance is already running" ]]; then
|
|
echo "${value}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "${value}"
|
|
}
|
|
|
|
moulinette_set() {
|
|
var=${1}
|
|
value=${2}
|
|
|
|
msg=$(yunohost app setting vpnclient "${var}" -v "${value}")
|
|
|
|
if [ ! $? -eq 0 ]; then
|
|
echo "${msg}" >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
# Check configuration consistency
|
|
|
|
if [[ ! "${1}" =~ stop ]]; then
|
|
if [ ! -e /etc/openvpn/keys/ca-server.crt ]; then
|
|
echo "DISABLED SERVICE: You need a CA server (you can add it through the web admin)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
find /etc/openvpn/keys/ -empty -name credentials &> /dev/null
|
|
if [ $? -eq 0 -a ! -e /etc/openvpn/keys/user.key ]; then
|
|
echo "DISABLED SERVICE: You need either a client certificate, either a username, or both (you can add one through the web admin)" >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
# Variables
|
|
|
|
echo -n "Retrieving Yunohost settings... "
|
|
|
|
ynh_server_name=$(moulinette_get server_name)
|
|
ynh_server_port=$(moulinette_get server_port)
|
|
ynh_server_proto=$(moulinette_get server_proto)
|
|
ynh_ip6_addr=$(moulinette_get ip6_addr)
|
|
ynh_login_user=$(moulinette_get login_user)
|
|
|
|
old_ip6_gw=$(moulinette_get ip6_gw)
|
|
old_wired_device=$(moulinette_get wired_device)
|
|
old_server_ip6=$(moulinette_get server_ip6)
|
|
|
|
new_ip6_gw=$(ip -6 route | grep default\ via | awk '{ print $3 }')
|
|
new_wired_device=$(ip route | awk '/default via/ { print $NF; }')
|
|
new_server_ip6=$(host "${ynh_server_name}" | awk '/IPv6/ { print $NF; }')
|
|
|
|
if [ -z "${new_server_ip6}" ]; then
|
|
new_server_ip6=$(host "${ynh_server_name}" 80.67.188.188 | awk '/IPv6/ { print $NF; }')
|
|
fi
|
|
|
|
echo "OK"
|
|
|
|
# Script
|
|
|
|
case "${1}" in
|
|
start)
|
|
if is_running; then
|
|
echo "Already started"
|
|
else
|
|
echo "Starting..."
|
|
|
|
# Run openvpn
|
|
if ! is_openvpn_running; then
|
|
echo "Run openvpn"
|
|
|
|
start_openvpn "${new_ip6_gw}" "${new_server_ip6}"
|
|
|
|
if [ ! $? -eq 0 ]; then
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
# Check old state of the server ipv6 route
|
|
if [ ! -z "${old_server_ip6}" -a ! -z "${old_ip6_gw}" -a ! -z "${old_wired_device}"\
|
|
-a \( "${new_server_ip6}" != "${old_server_ip6}" -o "${new_ip6_gw}" != "${old_ip6_gw}"\
|
|
-o "${new_wired_device}" != "${old_wired_device}" \) ]\
|
|
&& is_serverip6route_set "${old_server_ip6}"; then
|
|
|
|
unset_serverip6route "${old_server_ip6}" "${old_ip6_gw}" "${old_wired_device}"
|
|
fi
|
|
|
|
# Set the new server ipv6 route
|
|
if has_nativeip6 && ! is_serverip6route_set "${new_server_ip6}"; then
|
|
echo "Set IPv6 server route"
|
|
set_serverip6route "${new_server_ip6}" "${new_ip6_gw}" "${new_wired_device}"
|
|
fi
|
|
|
|
# Set the ipv6 address
|
|
if ! has_hotspot_app && has_ip6delegatedprefix && ! is_ip6addr_set; then
|
|
echo "Set IPv6 address"
|
|
|
|
false || while [ $? -ne 0 ]; do
|
|
sleep 1
|
|
ip link show dev tun0 &> /dev/null
|
|
done
|
|
|
|
set_ip6addr
|
|
fi
|
|
fi
|
|
|
|
# Update dynamic settings
|
|
moulinette_set server_ip6 "${new_server_ip6}"
|
|
moulinette_set ip6_gw "${new_ip6_gw}"
|
|
moulinette_set wired_device "${new_wired_device}"
|
|
;;
|
|
litestop)
|
|
litestop=1
|
|
;&
|
|
stop)
|
|
echo "Stopping..."
|
|
|
|
if ! has_hotspot_app && has_ip6delegatedprefix && is_ip6addr_set; then
|
|
echo "Unset IPv6 address"
|
|
unset_ip6addr
|
|
fi
|
|
|
|
if is_serverip6route_set "${old_server_ip6}"; then
|
|
echo "Unset IPv6 server route"
|
|
unset_serverip6route "${old_server_ip6}" "${old_ip6_gw}" "${old_wired_device}"
|
|
fi
|
|
|
|
if is_openvpn_running; then
|
|
echo "Stop openvpn"
|
|
stop_openvpn
|
|
fi
|
|
|
|
if [ -z "${litestop}" ]; then
|
|
yunohost app list -f hotspot --json | grep -q '"installed": true'
|
|
if [ $? -eq 0 ]; then
|
|
service ynh-hotspot start
|
|
fi
|
|
fi
|
|
;;
|
|
status)
|
|
exitcode=0
|
|
|
|
if has_ip6delegatedprefix; then
|
|
if ! has_hotspot_app; then
|
|
if is_ip6addr_set; then
|
|
echo "IPv6 address is correctly set"
|
|
else
|
|
echo "IPv6 address is NOT set"
|
|
exitcode=1
|
|
fi
|
|
else
|
|
echo "Hotspot app detected"
|
|
fi
|
|
fi
|
|
|
|
if has_nativeip6; then
|
|
if is_serverip6route_set "${new_server_ip6}"; then
|
|
echo "IPv6 server route is correctly set"
|
|
else
|
|
echo "IPv6 server route is NOT set"
|
|
exitcode=1
|
|
fi
|
|
else
|
|
echo "No native IPv6 detected"
|
|
fi
|
|
|
|
if is_openvpn_running; then
|
|
echo "Openvpn is running"
|
|
else
|
|
echo "Openvpn is NOT running"
|
|
exitcode=1
|
|
fi
|
|
|
|
exit ${exitcode}
|
|
;;
|
|
*)
|
|
echo "Usage: $0 {start|stop|litestop|status}"
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
exit 0
|