Add --route-pre-down/OPENVPN_PLUGIN_ROUTE_PREDOWN script/plug-in hook

This patchs adds a script/plug-in hook which is called right before the network routes are taken down. This is give external processes a possibility to tear down communication over the VPN before the VPN disappears.

One use case can be to mount a networked file system over the VPN via --route-up. And then to unmount this file system via --route-pre-down

---
 init.c           |   21 +++++++++++++++++++--
 openvpn-plugin.h |    3 ++-
 openvpn.8        |    4 ++++
 options.c        |   11 +++++++++++
 options.h        |    1 +
 5 files changed, 37 insertions(+), 3 deletions(-)

index 00e93c9..b8cb84f 100644
@@ -1583,8 +1583,25 @@ do_close_tun (struct context *c, bool force)
 
 	  /* delete any routes we added */
 	  if (c->c1.route_list || c->c1.route_ipv6_list )
-	    delete_routes (c->c1.route_list, c->c1.route_ipv6_list,
-			   c->c1.tuntap, ROUTE_OPTION_FLAGS (&c->options), c->c2.es);
+            {
+              run_up_down (c->options.route_predown_script,
+                           c->plugins,
+                           OPENVPN_PLUGIN_ROUTE_PREDOWN,
+                           tuntap_actual,
+                           NULL,
+                           TUN_MTU_SIZE (&c->c2.frame),
+                           EXPANDED_SIZE (&c->c2.frame),
+                           print_in_addr_t (local, IA_EMPTY_IF_UNDEF, &gc),
+                           print_in_addr_t (remote_netmask, IA_EMPTY_IF_UNDEF, &gc),
+                           "init",
+                           signal_description (c->sig->signal_received,
+                                               c->sig->signal_text),
+                           "route-pre-down",
+                           c->c2.es);
+
+              delete_routes (c->c1.route_list, c->c1.route_ipv6_list,
+                             c->c1.tuntap, ROUTE_OPTION_FLAGS (&c->options), c->c2.es);
+            }
 
 	  /* actually close tun/tap device based on --down-pre flag */
 	  if (!c->options.down_pre)

index 474c910..de54a5a 100644
@@ -108,7 +108,8 @@
 #define OPENVPN_PLUGIN_CLIENT_CONNECT_V2     9
 #define OPENVPN_PLUGIN_TLS_FINAL             10
 #define OPENVPN_PLUGIN_ENABLE_PF             11
-#define OPENVPN_PLUGIN_N                     12
+#define OPENVPN_PLUGIN_ROUTE_PREDOWN         12
+#define OPENVPN_PLUGIN_N                     13
 
 /*
  * Build a mask out of a set of plug-in types.

index 4a86ce7..a6d7567 100644
@@ -5194,6 +5194,10 @@ as defined by the
 option.
 .\"*********************************************************
 .TP
+.B \-\-route-pre-down
+Executed right before the routes are removed.
+.\"*********************************************************
+.TP
 .B \-\-client-disconnect
 Executed in
 .B \-\-mode server

index e7e6565..0fbe368 100644
@@ -216,6 +216,7 @@ static const char usage_message[] =
   "                  be added immediately after tun/tap open.  On Windows, wait\n"
   "                  up to w seconds for TUN/TAP adapter to come up.\n"
   "--route-up cmd  : Execute shell cmd after routes are added.\n"
+  "--route-pre-down cmd  : Execute shell cmd before routes are removed.\n"
   "--route-noexec  : Don't add routes automatically.  Instead pass routes to\n"
   "                  --route-up script using environmental variables.\n"
   "--route-nopull  : When used with --client or --pull, accept options pushed\n"

@@ -2739,6 +2740,8 @@ options_postprocess_filechecks (struct options *options)
                              R_OK|X_OK, "--ipchange script");
   errs |= check_file_access (CHKACC_FILE, options->route_script,
                              R_OK|X_OK, "--route-up script");
+  errs |= check_file_access (CHKACC_FILE, options->route_predown_script,
+                             R_OK|X_OK, "--route-pre-down script");
   errs |= check_file_access (CHKACC_FILE, options->learn_address_script,
                              R_OK|X_OK, "--learn-address script");
 #endif /* P2MP_SERVER */

@@ -5217,6 +5220,14 @@ add_option (struct options *options,
       warn_multiple_script (options->route_script, "route-up");
       options->route_script = p[1];
     }
+  else if (streq (p[0], "route-pre-down") && p[1])
+    {
+      VERIFY_PERMISSION (OPT_P_SCRIPT);
+      if (!no_more_than_n_args (msglevel, p, 2, NM_QUOTE_HINT))
+	goto err;
+      warn_multiple_script (options->route_predown_script, "route-pre-down");
+      options->route_predown_script = p[1];
+    }
   else if (streq (p[0], "route-noexec"))
     {
       VERIFY_PERMISSION (OPT_P_SCRIPT);

index 03fd197..831d4f6 100644
@@ -360,6 +360,7 @@ struct options
 
   /* route management */
   const char *route_script;
+  const char *route_predown_script;
   const char *route_default_gateway;
   int route_default_metric;
   bool route_noexec;

1.7.4.4

Hi,

I can see the use case :-) - and the code looks straightforward to me, so ACK ("I assume that you have an automated test module for that"... :) )

gert

USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...

Hi.

This is great. Two comments:

1. Is the man page (i.e., the page shown at
http://openvpn.net/index.php/open-source/documentation/manuals/openvpn-22.html)
part of the source code repository? If so, shouldn't patches that change the interface include appropriate changes to the man page? If not, wouldn't that be a good idea?

2. Can this be used to release a DHCP lease? That would be wonderful!

Hi,

It is...

... and so does the patch. At least my copy of it had a section starting with

index 4a86ce7..a6d7567 100644

Sure, just add a script that signals the dhcp client...

gert

USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...

My apologies. I didn't connect that part of the patch with the man page.

However, it looks the patch only adds an entry for the _script_ to the "Script Order of Execution" section.

The description of the _option_ that sets up the script to be executed, the "--route-pre-down" option, that appears in the patch for options.c only affects the usage message, not the man page. I think that description (or something similar) should also be included in the man page (i.e., in openvpn.8).

Also, it might help to clarify that the script is called before anything at all is done about the disconnection (which I assume is true). In other words, that the route teardown is the first step in the disconnection process. But if that's covered elsewhere I apologize (again!).

And maybe the copyright notice in openvpn.8 should be updated, too?

Sorry to be a pest if I am still off base.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I'm sorry, but I'm kind of lost in what the issue is. But that might be me being blinded by knowing these code paths.

For me it's pretty obvious from the option name what happens at which time. I see now that --route-up is actually described twice, while I only added this simple explanation on the second place (in the "SCRIPTING AND ENVIRONMENTAL VARIABLES") section.

Having that said, I'm not overly enthusiastic about the current openvpn man page. I find it difficult to navigate in, some parts are well written, some bad, quite some options are lacking - and some of the documentation is to some degree duplicated. We did have a request before the 2.2 release, if some people could go through the documentation and see if something could be improved and we put up this wiki page [1] with options which are undocumented. One guy showed up with patches, which we're all very grateful to.

Another thing is that developers are not good documentation writers. We know the code too well, and what is "bloody obvious" for us might be completely hidden for normal deadly users. I don't blame those users, as I can understand that it might not be obvious when you don't see the bigger picture, especially from a code perspective.

[1] <https://community.openvpn.net/openvpn/wiki/ManPageUpdatesFor2.2>

Yeah, I didn't care about that, as the man page will (hopefully!) get more updates before the next release. Maybe we'll add a complete copyright patch fixing it more places if needed.

Nah, no feedback is a pest. Or useless complaints without any useful information. What you brought up is pretty much valuable feedback ... and if it even results in more man page patches coming in, it'll be even more worth than gold to us :)

So I'm hoping for man page patches now .......... *hint*hint* ;-)

kind regards,

David Sommerseth

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk8hkbwACgkQDC186MBRfrpI5wCeJRpa1JgN7990Bl6DFOMEOUnv u8QAn1Zdj0Cky7iQWrsXuzBc4MGwV+I+
=ctF+
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Applied to master branches in -testing and -stable git trees.

commit 415421c24ac5b62d59fb8f03076521cba6f126cc

Author: David Sommerseth <[email protected]...>
Date:   Tue Jan 24 12:32:46 2012 +0100

    Add --route-pre-down/OPENVPN_PLUGIN_ROUTE_PREDOWN script/plug-in hook

    Signed-off-by: David Sommerseth <[email protected]...>
    Acked-by: Gert Doering <[email protected]...>

kind regards,

David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk8icUYACgkQDC186MBRfrpD5ACdGr+2MpwXfzQyuBEp7i13KZsE uZUAn2aIU78ovn6c0AC+8MgIm5QnAMhg
=2Oqk
-----END PGP SIGNATURE-----