Merge branch 'vyos:equuleus' into equuleus

2 files changed, 30 insertions, 24 deletions

diff --git a/data/templates/openvpn/server.conf.tmpl b/data/templates/openvpn/server.conf.tmpl
index c5d665c0b..c2b0c2ef9 100644
--- a/data/templates/openvpn/server.conf.tmpl
+++ b/data/templates/openvpn/server.conf.tmpl
@@ -7,8 +7,6 @@
 #
 
 verb 3
-user {{ daemon_user }}
-group {{ daemon_group }}
 dev-type {{ device_type }}
 dev {{ ifname }}
 persist-key
@@ -74,6 +72,16 @@ topology {{ server.topology }}
 {%       for subnet in server.subnet %}
 {%         if subnet | is_ipv4 %}
 server {{ subnet | address_from_cidr }} {{ subnet | netmask_from_cidr }} nopool
+{# First ip address is used as gateway. It's allows to use metrics #}
+{%     if server.push_route is defined and server.push_route is not none %}
+{%       for route, route_config in server.push_route.items() %}
+{%         if route | is_ipv4 %}
+push "route {{ route | address_from_cidr }} {{ route | netmask_from_cidr }}{% if route_config.metric is defined %} {{ subnet | first_host_address }} {{ route_config.metric }}{% endif %}"
+{%         elif route | is_ipv6 %}
+push "route-ipv6 {{ route }}"
+{%         endif %}
+{%       endfor %}
+{%     endif %}
 {# OpenVPN assigns the first IP address to its local interface so the pool used #}
 {# in net30 topology - where each client receives a /30 must start from the second subnet #}
 {%           if server.topology is defined and server.topology == 'net30' %}
@@ -106,15 +114,6 @@ management /run/openvpn/openvpn-mgmt-intf unix
 ccd-exclusive
 {%     endif %}
 
-{%     if server.push_route is defined and server.push_route is not none %}
-{%       for route in server.push_route %}
-{%         if route | is_ipv4 %}
-push "route {{ route | address_from_cidr }} {{ route | netmask_from_cidr }}"
-{%         elif route | is_ipv6 %}
-push "route-ipv6 {{ route }}"
-{%         endif %}
-{%       endfor %}
-{%     endif %}
 {%     if server.name_server is defined and server.name_server is not none %}
 {%       for nameserver in server.name_server %}
 {%         if nameserver | is_ipv4 %}
@@ -258,16 +257,3 @@ auth {{ hash }}
 auth-user-pass {{ auth_user_pass_file }}
 auth-retry nointeract
 {% endif %}
-
-{% if openvpn_option is defined and openvpn_option is not none %}
-#
-# Custom options added by user (not validated)
-#
-{%   for option in openvpn_option %}
-{%     for argument in option.split('--') %}
-{%       if argument is defined and argument != '' %}
---{{ argument }}
-{%       endif %}
-{%     endfor %}
-{%   endfor %}
-{% endif %}
diff --git a/data/templates/openvpn/service-override.conf.tmpl b/data/templates/openvpn/service-override.conf.tmpl
new file mode 100644
index 000000000..069bdbd08
--- /dev/null
+++ b/data/templates/openvpn/service-override.conf.tmpl
@@ -0,0 +1,20 @@
+[Service]
+ExecStart=
+ExecStart=/usr/sbin/openvpn --daemon openvpn-%i --config %i.conf --status %i.status 30 --writepid %i.pid
+{%- if openvpn_option is defined and openvpn_option is not none %}
+{%   for option in openvpn_option %}
+{#     Remove the '--' prefix from variable if it is presented #}
+{%     if option.startswith('--') %}
+{%       set option = option.split('--', maxsplit=1)[1] %}
+{%     endif %}
+{#     Workaround to pass '--push' options properly. Previously openvpn accepted this option without values in double-quotes #}
+{#     But now it stopped doing this, so we need to add them for compatibility #}
+{#     HOWEVER! This is a raw option and we do not promise that this or any other trick will work for all the cases. #}
+{#     Using 'openvpn-option' you take all responsibility for compatibility for yourself. #}
+{%     if option.startswith('push') and not (option.startswith('push "') and option.endswith('"')) %}
+{%       set option = 'push \"%s\"'|format(option.split('push ', maxsplit=1)[1]) %}
+{%     endif %}
+ --{{ option }}
+{%-   endfor %}
+{% endif %}
+