Exec scripts at sigusr1 and established tunnel

Hello openvpn-developers,

I needed two more places in openvpn where to exec some scripts because I wanted to build a "fail-over" solution between two tuns.

1.) Situation:

  +---------+       tun0 (ISP0)    +---------+
  | BOX 1   +----------------------+ BOX 2   |
  |         |                      |         |
  |         +----------------------+         |
  +---------+       tun1 (ISP1)    +---------+

tun0 is prefered but if tun0 fails tun1 should do
the job.

Linux advanced routing has a usable solution for this:
Two routing tables with one prefered.

Because of this I needed to add/delete routes at this points:

- After the first "answer" from the peer (add route for tun?)
- At a SIGUSR1 == "peer dead" (del route for tun?)

2.) I used following configs:

[BOX1: tun0]

# interface configuration
dev tun0

# Peer connect configuartion
remote 172.16.90.4

# float

persist-tun
persist-key
ping 7
ping-restart 21

# 10.255.253.8 is our local VPN endpoint
# 10.255.253.9 is our remote VPN endpoint
ifconfig 10.255.254.122 10.255.254.121

# TSL-Client
tls-client
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/box1.crt
key /etc/openvpn/certs/box1.key
tls-verify "/usr/local/sbin/verify-cn box2"

# Routen setzen
peerinit /etc/openvpn/scripts/tun0.up
sigusr1 /etc/openvpn/scripts/tun0.down

lport 5006
rport 5007

comp-lzo
#daemon

reneg-sec 600

verb 5

[BOX1: tun1]

# interface configuration
dev tun1

# Peer connect configuartion
remote 172.16.90.4

# float

persist-tun
persist-key
ping 7
ping-restart 21

# 10.255.253.8 is our local VPN endpoint
# 10.255.253.9 is our remote VPN endpoint
ifconfig 10.255.253.122 10.255.253.121

# TSL-Client
tls-client
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/box1.crt
key /etc/openvpn/certs/box1.key
tls-verify "/usr/local/sbin/verify-cn box2"

# Routen setzen
peerinit /etc/openvpn/scripts/tun1.up
sigusr1 /etc/openvpn/scripts/tun1.down

lport 5506
rport 5507

comp-lzo
#daemon

reneg-sec 600

verb 5

[BOX2: tun0]

# interface configuration
dev tun0

# Peer connect configuartion
remote 172.16.90.1

# float

persist-tun
persist-key
ping 7
ping-restart 21

ifconfig 10.255.254.121 10.255.254.122

# TSL-Client
tls-client
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/box2.crt
key /etc/openvpn/certs/box2.key
tls-verify "/usr/local/sbin/verify-cn box1"

# Routen setzen
peerinit /etc/openvpn/scripts/tun0.up
sigusr1 /etc/openvpn/scripts/tun0.down

lport 5007
rport 5006

comp-lzo
#daemon

reneg-sec 600

verb 5

[BOX1: tun1]

# interface configuration
dev tun1

# Peer connect configuartion
remote 172.16.90.1

# float

persist-tun
persist-key
ping 7
ping-restart 21

ifconfig 10.255.253.121 10.255.253.122

# TSL-Client
tls-client
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/box2.crt
key /etc/openvpn/certs/box2.key
tls-verify "/usr/local/sbin/verify-cn box1"

peerinit /etc/openvpn/scripts/tun1.up
sigusr1 /etc/openvpn/scripts/tun1.down

lport 5507
rport 5506

comp-lzo
#daemon

reneg-sec 600

verb 5

4.) Here is the patch:

[PATCH START]
diff -u openvpn-1.3.2/openvpn.c openvpn-1.3.2-droute/openvpn.c

openvpn.c Wed Dec 18 19:18:12 2002 renamed from openvpn.c Mon Oct 21 03:46:52 2002 +9 -0

     }
+   /*
+    * Execute sigusr1 script 
+    */
+  if ( !(signal_received == SIGUSR1 && !options->sigusr1_script ) )
+    {
+     msg (M_INFO, "Executing sigusr1 script %s",options->sigusr1_script);
+     system_check (options->sigusr1_script, "sigusr1 command failed", false);
+    }
+
  done:
   /* pop our garbage collection level */
   gc_free_level (gc_level);

diff -u openvpn-1.3.2/options.c openvpn-1.3.2-droute/options.c

options.c Wed Dec 18 18:52:24 2002 renamed from options.c Sat Oct 19 23:26:11 2002 +13 -0

@@ -316,6 +316,9 @@
   SHOW_STR (writepid);
   SHOW_STR (up_script);
   SHOW_STR (down_script);
+  SHOW_STR (peerinit_script);
+  SHOW_STR (sigusr1_script);
+  SHOW_STR (down_script);
   SHOW_BOOL (daemon);
   SHOW_BOOL (inetd);
   SHOW_INT (nice);

@@ -726,6 +729,16 @@
     {
       ++i;
       options->down_script = p2;
+    }
+  else if (streq(p1, "peerinit") && p2) 
+    {
+      ++i;
+      options->peerinit_script = p2;
+    }
+  else if (streq(p1, "sigusr1") && p2) 
+    {
+      ++i;
+      options->sigusr1_script = p2;
     }
   else if (streq (p1, "daemon"))
     {

diff -u openvpn-1.3.2/options.h openvpn-1.3.2-droute/options.h

options.h Wed Dec 18 18:25:46 2002 renamed from options.h Sat Oct 19 22:25:46 2002 +2 -0

@@ -87,6 +87,8 @@
   const char *writepid;
   const char *up_script;
   const char *down_script;
+  const char *peerinit_script;
+  const char *sigusr1_script;
   bool daemon;
   bool inetd;
   int nice;

diff -u openvpn-1.3.2/socket.c openvpn-1.3.2-droute/socket.c

socket.c Wed Dec 18 18:56:18 2002 renamed from socket.c Sat Oct 19 23:23:19 2002 +2 -0

@@ -105,6 +105,7 @@
                 bool inetd,
                 struct udp_socket_addr *usa,
                 const char *ipchange_command,
+                const char *peerinit_command,
                 int resolve_retry_seconds)
 {
   CLEAR (*sock);

@@ -112,6 +113,7 @@
   sock->remote_float = remote_float;
   sock->addr = usa;
   sock->ipchange_command = ipchange_command;
+  sock->peerinit_command = peerinit_command;
 
   /* were we started by inetd or xinetd? */
   if (inetd)

socket.c Wed Dec 18 18:56:18 2002 renamed from socket.c Sat Oct 19 23:23:19 2002 +9 -0

+
+             buf_set_write (&out, command, sizeof (command));
+             buf_printf (&out, "%s %s",
+                         sock->peerinit_command,
+                         print_sockaddr_ex (&usa->actual, true, " "));
+             msg (D_TLS_DEBUG, "executing ip-change command: %s", command);
+             system_check (command, "peerinit command failed", false);
+            }
+
          if (sock->ipchange_command)
            {
              char command[256];

diff -u openvpn-1.3.2/socket.h openvpn-1.3.2-droute/socket.h

socket.h Wed Dec 18 18:49:01 2002 renamed from socket.h Sat Oct 19 23:26:10 2002 +2 -0

@@ -42,6 +42,7 @@
   bool remote_float;
   struct udp_socket_addr *addr;
   const char *ipchange_command;
+  const char *peerinit_command;
   int sd;                      /* file descriptor for socket */
 };
 

@@ -56,6 +57,7 @@
                 bool inetd,
                 struct udp_socket_addr *addr,
                 const char *ipchange_command,
+                 const char *peerinit_command,
                 int resolve_retry_seconds);
 
 void

[PATCH START]

5.) If it is interesting for you, James, you are free to clean the
code and fix the documentation and merge it in your branch. Just write a Creditline in the changelog. ;-)

6.) Feel free to ask, if you have some questions.

bye
richard

Signature · 19 lines

Richard Mueller     mailto:[email protected]...  Fon: +49 9171 896287
Teamix GmbH         http://www.teamix.de       Fax: +49 9171 896286

PGP Public Key      http://www.teamix.net/pgp/rm_public_key_2048
Fingerprint:        ea 50 21 6c a5 39 e9 03 a6 59 af e3 c5 1f 63 8e

Networks - Consulting - Training - Software Development - eCommerce



-------------------------------------------------------
This SF.NET email is sponsored by: Order your Holiday Geek Presents Now!
Green Lasers, Hip Geek T-Shirts, Remote Control Tanks, Caffeinated Soap,
MP3 Players,  XBox Games,  Flying Saucers,  WebCams,  Smart Putty.
T H I N K G E E K . C O M       http://www.thinkgeek.com/sf/
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

Hello James,

Thursday, December 19, 2002, 3:59:16 PM, you wrote:

JY> * How is --peerinit different from --ipchange? Good question. None. sh*t Please see below. :)

JY> * Shouldn't
JY> if ( !(signal_received == SIGUSR1 && !options->sigusr1_script ) )
JY> ...
JY> be
JY> if (signal_received == SIGUSR1 && options->sigusr1_script)
JY> ...
JY> ?
d*mn. yes. this is the sprit of "cut'n'paste" coding. Think I pasted the condition some lines above.

I wrote it short afer visiting "Lord of the Rings II" and a 18h workday without any coffee (I am allergic).

So sorry for the bad code, I won't do it again. ;-( I took the conclusion for me:

$ patch && test && sleep && test && submit

JY> The failover idea is interesting.
It works quite good in my enviroment here (even better after fixing the patch ;) ).

- If openvpn is stopped on both sides, the alternative route is taken immediateley.

- If the link between the two tun-endpoints breaks it takes as long

The prefered route is taken immediateley when the tunnel returns.

Best regards and sorry again for the bad code,

Richard Mueller