VPN: OpenVPN: Instances (MVC) - #6584
Merged
Merged
Conversation
…ntroduced for IPsec in 23.1. Since we likely can't easily migrate the old cruft, we better focus on offering the correct options for openvpn following upstream documentation. o add boilerplate o implement a solution to keep vpnid's unique so device creation for legacy and mvc can function in similar ways. o add some of the main "helper" options for clients and servers o Implement certificate logic, selecting a certificate also implies an authority (which we validate) o hook CRL generation into the exising openvpn_refresh_crls() event o attach already refactored authentication to new MVC as well, OpenVPN->getInstanceById() is responsible for feeding the data needed during authentication and overwrite generation. o when in client mode and in need for a username+password combination, flush these to file and link in "auth-user-pass" o routes (remote) and push routes (local), combine IPv4 and IPv6 for ease of administration, o keep alive [push] ping-[restart] defined as seperate fields for validation o add various "push" to client options in Miscellaneous section o add "auth-gen-token" lifetime for #6135 o allow selection of redirect-gateway type for #6220 o move tls-auth/crypt into separate static keys objects (tab in instances page) o hook existing events (ovpn_event.py) and make sure they locate the server using getServerById() when needed o use getInstanceById in openvpn_prepare() to return both legacy as MVC device configuration o add ovpn_service_control.php for service control [stop|start|restart|configure] and glue this in openvpn_services() via configd o change openvpn_interfaces() to use isEnabled() method on the model to query if any (legacy/mvc) instances are enabled o move openvpn_config() from openvpn.inc to widget and extend with MVC instances o extend ovpn_status.py to parse "instance-" sockets as well, since the filename doesn't explain the role, we're using the status call to figure out the use. uuid's are keys in this case o server_id type to str in kill_session.py so we can match either legacy or mvc sockets o hook ExportController to OpenVPN model using getInstanceById() to glue the Client Export utility to both components o extend connection status with mvc sessions (descriptions)
fichtner
reviewed
May 31, 2023
fichtner
reviewed
May 31, 2023
| <servers> | ||
| <server type="ArrayField"> | ||
| <vpnid type="IntegerField"> | ||
| <vpnid type="TextField"> |
fichtner
reviewed
May 31, 2023
| </description> | ||
| </Instance> | ||
| </Instances> | ||
| <StaticKeys> |
Member
There was a problem hiding this comment.
this feature might be removed from openvpn in the near future
fichtner
reviewed
May 31, 2023
fichtner
reviewed
May 31, 2023
| @@ -0,0 +1,183 @@ | |||
| #!/usr/local/bin/php | |||
Member
There was a problem hiding this comment.
this script looks a bit convoluted (new/different start,stop,etc) but you probably meant to extract bootstrap/setup code from legacy side
Member
Author
There was a problem hiding this comment.
yes, I don't want to mangle the existing hooks as this will likely lead to more noise and the "configure" action is required to cleanly apply pending changes (adding the start/[re]start doesn't increase the boilerplate)
Co-authored-by: Franco Fichtner <franco@opnsense.org>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
VPN: OpenVPN: Instances - add new module using the same approach as introduced for IPsec in 23.1. Since we likely can't easily migrate the old cruft, we better focus on offering the correct options for openvpn following upstream documentation.
OpenVPN->usedVPNIds())getInstanceById,isEnabled)OpenVPN->getInstanceById()is responsible for feeding the data needed during authentication and overwrite generation.getInstanceByIdin openvpn_prepare() to return both legacy as MVC device configurationopenvpn_interfaces()to useisEnabled()method on the model to query if any (legacy/mvc) instances are enabledopenvpn_config()fromopenvpn.incto widget and extend with MVC instancesovpn_status.pyto parse "instance-" sockets as well, since the filename doesn't explain the role, we're using the status call to figure out the use. uuid's are keys in this caseExportControllertoOpenVPNmodel usinggetInstanceById()to glue the Client Export utility to both componentsWhich should almost complete the new module, things still on the todo list:
CARPfor client type instances (stop/start?)