Fix server routes not working in topology subnet with --server

PATCH In review Arne Schwabe 2 participants 5 messages Jul 11, 2014 – Jul 13, 2014

Share & tools

Arne Schwabe

author

2014-07-11 10:47 UTC #0 lore raw

PATCH 1/1 Fix server routes not working in topology subnet with --server

---
 doc/openvpn.8        | 5 ++++-
 src/openvpn/helper.c | 5 ++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

doc/openvpn.8 +4 -1

index 6d4f3cf..d5eeed5 100644
@@ -2704,7 +2704,7 @@ on sufficiently fast hardware.  SSL/TLS authentication must
 be used in this mode.
 .\"*********************************************************
 .TP
-.B \-\-server network netmask
+.B \-\-server network netmask ['nopool']
 A helper directive designed to simplify the configuration
 of OpenVPN's server mode.  This directive will set up an
 OpenVPN server which will allocate addresses to clients

@@ -2739,6 +2739,9 @@ expands as follows:
    if !nopool:
      ifconfig-pool 10.8.0.2 10.8.0.254 255.255.255.0
    push "route-gateway 10.8.0.1"
+   if redirect-gateway unset:
+     redirect-gateway 10.8.0.1
+      
 .in -4
 .ft
 .fi

src/openvpn/helper.c +4 -1

index d9eef03..fb22815 100644
@@ -232,6 +232,7 @@ helper_client_server (struct options *o)
    *   if !nopool: 
    *     ifconfig-pool 10.8.0.2 10.8.0.254 255.255.255.0
    *   push "route-gateway 10.8.0.1"
+   *   route-gateway 10.8.0.1
    */
 
   if (o->server_defined)

@@ -311,8 +312,10 @@ helper_client_server (struct options *o)
 		  ifconfig_pool_verify_range (M_USAGE, o->ifconfig_pool_start, o->ifconfig_pool_end);
 		}
 	      o->ifconfig_pool_netmask = o->server_netmask;
-		  
+
 	      push_option (o, print_opt_route_gateway (o->server_network + 1, &o->gc), M_USAGE);
+	      if (!o->route_default_gateway)
+		o->route_default_gateway = o->ifconfig_local;
 	    }
 	  else
 	    ASSERT (0);

Signature · 1 line

1.8.5.2 (Apple Git-48)

Gert Doering

2014-07-11 12:38 UTC #1 lore raw

Hi,

Quoted 12 lines · Arne Schwabe

doc/openvpn.8 +1 -1

@@ -2704,7 +2704,7 @@ on sufficiently fast hardware.  SSL/TLS authentication must
 be used in this mode.
 .\"*********************************************************
 .TP
-.B \-\-server network netmask
+.B \-\-server network netmask ['nopool']
 A helper directive designed to simplify the configuration
 of OpenVPN's server mode.  This directive will set up an
 OpenVPN server which will allocate addresses to clients

doc/openvpn.8 expands as follows: · line 2744

Quoted 6 lines

doc/openvpn.8 +3 -0

@@ -2739,6 +2739,9 @@ expands as follows:
    if !nopool:
      ifconfig-pool 10.8.0.2 10.8.0.254 255.255.255.0
    push "route-gateway 10.8.0.1"
+   if redirect-gateway unset:
+     redirect-gateway 10.8.0.1
+

Typo here, this needs to be "route-gateway", of course. But the patch itself looks like an elegant way to get this done.

It might not actually *work* on all platforms - windows (tap, ethernet, ARP!) might need this to be set to 10.8.0.2 - well, "anything that is not itself". Which won't be that hard to add either... is this in host format, as in "we can just add +1 to o->ifconfig_local and it will work cross-endian"?

gert

Signature · 4 lines

USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...

Gert Doering

2014-07-13 12:28 UTC #2 lore raw

PATCH 1/1 Fix server routes not working in topology subnet with --server [v3]

In reply to Arne Schwabe

From: Arne Schwabe <[email protected]...>

The IPv4 routing code needs an IPv4 address to point a route to, and in --topology subnet mode, the *server* did not have one set by default.

So we now just default --route-gateway to the next address right after the server address - the specific address doesn't matter, as the correct next-hop will not be resolved by the host OS but by the OpenVPN daemon. All that is needed is "it's in the subnet routed to the tun interface".

Using the server address itself would work on unix, but doesn't work with the Windows TAP driver (as it does not spoof ARP responses for itself).

Signed-off-by Arne Schwabe <[email protected]...>

Signed-off-by Gert Doering <[email protected]...>

---
 doc/openvpn.8        | 5 ++++-
 src/openvpn/helper.c | 6 +++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

doc/openvpn.8 +4 -1

index 6d4f3cf..90d6eb0 100644
@@ -2704,7 +2704,7 @@ on sufficiently fast hardware.  SSL/TLS authentication must
 be used in this mode.
 .\"*********************************************************
 .TP
-.B \-\-server network netmask
+.B \-\-server network netmask ['nopool']
 A helper directive designed to simplify the configuration
 of OpenVPN's server mode.  This directive will set up an
 OpenVPN server which will allocate addresses to clients

@@ -2739,6 +2739,9 @@ expands as follows:
    if !nopool:
      ifconfig-pool 10.8.0.2 10.8.0.254 255.255.255.0
    push "route-gateway 10.8.0.1"
+   if route-gateway unset:
+     route-gateway 10.8.0.2
+      
 .in -4
 .ft
 .fi

src/openvpn/helper.c +5 -1

index d9eef03..0ed0b2b 100644
@@ -232,6 +232,8 @@ helper_client_server (struct options *o)
    *   if !nopool: 
    *     ifconfig-pool 10.8.0.2 10.8.0.254 255.255.255.0
    *   push "route-gateway 10.8.0.1"
+   *   if route-gateway unset:
+   *     route-gateway 10.8.0.2
    */
 
   if (o->server_defined)

@@ -311,8 +313,10 @@ helper_client_server (struct options *o)
 		  ifconfig_pool_verify_range (M_USAGE, o->ifconfig_pool_start, o->ifconfig_pool_end);
 		}
 	      o->ifconfig_pool_netmask = o->server_netmask;
-		  
+
 	      push_option (o, print_opt_route_gateway (o->server_network + 1, &o->gc), M_USAGE);
+	      if (!o->route_default_gateway)
+		o->route_default_gateway = print_in_addr_t (o->server_network + 2, 0, &o->gc);
 	    }
 	  else
 	    ASSERT (0);

Signature · 1 line

1.8.3.2

Arne Schwabe

author

2014-07-13 13:43 UTC #3 lore raw

Re: [Openvpn-devel] [PATCH] Fix server routes not working in topology subnet with --server [v3]

Quoted 5 lines · Gert Doering

From: Arne Schwabe <[email protected]...>
The IPv4 routing code needs an IPv4 address to point a route to, and in --topology subnet mode, the *server* did not have one set by default.

Quoted 9 lines

So we now just default --route-gateway to the next address right after the server address - the specific address doesn't matter, as the correct next-hop will not be resolved by the host OS but by the OpenVPN daemon. All that is needed is "it's in the subnet routed to the tun interface".
Using the server address itself would work on unix, but doesn't work with the Windows TAP driver (as it does not spoof ARP responses for itself).

ACK.

Arne

Gert Doering

2014-07-13 13:56 UTC #4 lore raw

[Openvpn-devel] [PATCH applied] Re: Fix server routes not working in topology subnet with --server [v3]

In reply to Gert Doering

Your patch has been applied to the master and release/2.3 branch.

commit 4cc6a2595947a0e2f13b37637899bfc50f8509aa (master) commit 3a3da8ddd3f395f9b2bc64f84cb549d99e7c6dbd (release/2.3)

Author: Arne Schwabe
Date:   Sun Jul 13 14:28:47 2014 +0200

     Fix server routes not working in topology subnet with --server [v3]

     Signed-off-by: Arne Schwabe <[email protected]...>
     Signed-off-by: Gert Doering <[email protected]...>
     Acked-by: Arne Schwabe <[email protected]...>
     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/8904

--
kind regards,

Gert Doering