summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorChristian Poessinger <christian@poessinger.com>2020-04-20 21:21:36 +0200
committerGitHub <noreply@github.com>2020-04-20 21:21:36 +0200
commit3dfcc251b929d253867714694cac58158eecc036 (patch)
tree3c6f44181d897283a1e03ec5261b24bf4700523d
parenta972177723c523e1b2fc41fc6e4c37e8ae96e3c2 (diff)
parentfc46751976c17da34aedc591bff737c1090f2704 (diff)
downloadvyos-1x-3dfcc251b929d253867714694cac58158eecc036.tar.gz
vyos-1x-3dfcc251b929d253867714694cac58158eecc036.zip
Merge pull request #361 from jjakob/openvpn-ipv6-proto-fix
openvpn: T2339: fix for IPv4 local-host addresses
-rw-r--r--data/templates/openvpn/server.conf.tmpl2
-rwxr-xr-xsrc/conf_mode/interfaces-openvpn.py20
2 files changed, 20 insertions, 2 deletions
diff --git a/data/templates/openvpn/server.conf.tmpl b/data/templates/openvpn/server.conf.tmpl
index 396888c0f..75ab602f8 100644
--- a/data/templates/openvpn/server.conf.tmpl
+++ b/data/templates/openvpn/server.conf.tmpl
@@ -18,7 +18,7 @@ dev {{ intf }}
persist-key
iproute /usr/libexec/vyos/system/unpriv-ip
-proto {% if 'tcp-active' in protocol -%}tcp6-client{% elif 'tcp-passive' in protocol -%}tcp6-server{% else %}udp6{% endif %}
+proto {{ protocol_real }}
{%- if local_host %}
local {{ local_host }}
diff --git a/src/conf_mode/interfaces-openvpn.py b/src/conf_mode/interfaces-openvpn.py
index a5ff3007b..708ac8f91 100755
--- a/src/conf_mode/interfaces-openvpn.py
+++ b/src/conf_mode/interfaces-openvpn.py
@@ -28,7 +28,7 @@ from vyos.config import Config
from vyos.ifconfig import VTunIf
from vyos.template import render
from vyos.util import call, chown, chmod_600, chmod_755
-from vyos.validate import is_addr_assigned, is_bridge_member
+from vyos.validate import is_addr_assigned, is_bridge_member, is_ipv4
from vyos import ConfigError
user = 'openvpn'
@@ -67,6 +67,7 @@ default_config_data = {
'options': [],
'persistent_tunnel': False,
'protocol': 'udp',
+ 'protocol_real': '',
'redirect_gateway': '',
'remote_address': [],
'remote_host': [],
@@ -557,6 +558,23 @@ def get_config():
if openvpn['mode'] == 'server' and not openvpn['server_topology']:
openvpn['server_topology'] = 'net30'
+ # Convert protocol to real protocol used by openvpn.
+ # To make openvpn listen on both IPv4 and IPv6 we must use *6 protocols
+ # (https://community.openvpn.net/openvpn/ticket/360), unless local is IPv4
+ # in which case it must use the standard protocols.
+ # Note: this will break openvpn if IPv6 is disabled on the system.
+ # This currently isn't supported, a check can be added in the future.
+ if openvpn['protocol'] == 'tcp-active':
+ openvpn['protocol_real'] = 'tcp6-client'
+ elif openvpn['protocol'] == 'tcp-passive':
+ openvpn['protocol_real'] = 'tcp6-server'
+ else:
+ openvpn['protocol_real'] = 'udp6'
+
+ if is_ipv4(openvpn['local_host']):
+ # takes out the '6'
+ openvpn['protocol_real'] = openvpn['protocol_real'][:3] + openvpn['protocol_real'][4:]
+
# Set defaults where necessary.
# If any of the input parameters are wrong,
# this will return False and no defaults will be set.