Skip to content

Commit 892a3c9

Browse files
kylemannakylemanna
authored
Merge pull request #234 from slamont/master
Add an option for setting different values for keepalive
2 parents d454a20 + a3c96bc commit 892a3c9

File tree

3 files changed

+51
-12
lines changed

3 files changed

+51
-12
lines changed

‎bin/ovpn_genconfig

Lines changed: 23 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -95,10 +95,12 @@ usage() {
9595
echo "optional arguments:"
9696
echo " -2 Enable two factor authentication using Google Authenticator."
9797
echo " -a Authenticate packets with HMAC using the given message digest algorithm (auth)."
98+
echo " -b Disable 'push block-outside-dns'"
9899
echo " -c Enable client-to-client option"
99100
echo " -C A list of allowable TLS ciphers delimited by a colon (cipher)."
100-
echo " -d Disable NAT routing and default route"
101+
echo " -d Disable default route"
101102
echo " -D Do not push dns servers"
103+
echo " -k Set keepalive. Default: '10 60'"
102104
echo " -m Set client MTU"
103105
echo " -N Configure NAT to access external server network"
104106
echo " -t Use TAP device (instead of TUN device)"
@@ -157,19 +159,22 @@ OVPN_NAT=0
157159
OVPN_DNS=1
158160
OVPN_DEVICE="tun"
159161
OVPN_DEVICEN=0
162+
OVPN_KEEPALIVE="10 60"
160163
OVPN_DNS_SERVERS=("8.8.8.8" "8.8.4.4")
161164
TMP_DNS_SERVERS=()
162165
OVPN_TLS_CIPHER=''
163166
OVPN_CIPHER=''
164167
OVPN_AUTH=''
165168
OVPN_EXTRA_CONFIG=''
166169
CUSTOM_ROUTE_CONFIG=''
170+
OVPN_COMP_LZO=0
171+
OVPN_DISABLE_PUSH_BLOCK_DNS=0
167172

168173
# Import defaults if present
169174
[ -r "$OVPN_ENV" ] && source "$OVPN_ENV"
170175

171176
# Parse arguments
172-
while getopts ":a:e:E:C:T:r:s:du:cp:n:DNmf:tz2" opt; do
177+
while getopts ":a:e:E:C:T:r:s:du:bcp:n:k:DNmf:tz2" opt; do
173178
case $opt in
174179
a)
175180
OVPN_AUTH="$OPTARG"
@@ -195,10 +200,14 @@ while getopts ":a:e:E:C:T:r:s:du:cp:n:DNmf:tz2" opt; do
195200
;;
196201
d)
197202
OVPN_DEFROUTE=0
203+
OVPN_DISABLE_PUSH_BLOCK_DNS=1
198204
;;
199205
u)
200206
OVPN_SERVER_URL=$OPTARG
201207
;;
208+
b)
209+
OVPN_DISABLE_PUSH_BLOCK_DNS=1
210+
;;
202211
c)
203212
OVPN_CLIENT_TO_CLIENT=1
204213
;;
@@ -214,6 +223,9 @@ while getopts ":a:e:E:C:T:r:s:du:cp:n:DNmf:tz2" opt; do
214223
N)
215224
OVPN_NAT=1
216225
;;
226+
k)
227+
OVPN_KEEPALIVE="$OPTARG"
228+
;;
217229
m)
218230
OVPN_MTU=$OPTARG
219231
;;
@@ -265,7 +277,7 @@ fi
265277
# Apply defaults
266278
[ -z "$OVPN_PROTO" ] && OVPN_PROTO=udp
267279
[ -z "$OVPN_PORT" ] && OVPN_PORT=1194
268-
[ -z "$CUSTOM_ROUTE_CONFIG" ] && process_route_config "192.168.254.0/24"
280+
[ -z "$CUSTOM_ROUTE_CONFIG" ] && [ "$OVPN_DEFROUTE" == "1" ] && process_route_config "192.168.254.0/24"
269281

270282
# Save extra client config from temp file only if temp file is not empty
271283
if [ -s "$TMP_EXTRA_CLIENT_CONFIGFILE" ]; then
@@ -277,6 +289,7 @@ export OVPN_SERVER_URL OVPN_ENV OVPN_PROTO OVPN_CN OVPN_PORT
277289
export OVPN_CLIENT_TO_CLIENT OVPN_PUSH OVPN_NAT OVPN_DNS OVPN_MTU OVPN_DEVICE
278290
export OVPN_TLS_CIPHER OVPN_CIPHER OVPN_AUTH
279291
export OVPN_COMP_LZO
292+
export OVPN_DISABLE_PUSH_BLOCK_DNS
280293
export OVPN_OTP_AUTH
281294
export OVPN_FRAGMENT
282295
export OVPN_ADDITIONAL_CLIENT_CONFIG
@@ -316,7 +329,7 @@ cert $EASYRSA_PKI/issued/${OVPN_CN}.crt
316329
dh $EASYRSA_PKI/dh.pem
317330
tls-auth $EASYRSA_PKI/ta.key
318331
key-direction 0
319-
keepalive 10 60
332+
keepalive $OVPN_KEEPALIVE
320333
persist-key
321334
persist-tun
322335
@@ -330,15 +343,18 @@ user nobody
330343
group nogroup
331344
EOF
332345

333-
# only block outside dns when we take the default route
334-
[ "$OVPN_DEFROUTE" == "1" ] && process_push_config "block-outside-dns"
346+
if [ "${OVPN_DISABLE_PUSH_BLOCK_DNS}" == "1" ]; then
347+
echo "Disable default push of 'block-outside-dns'"
348+
else
349+
process_push_config "block-outside-dns"
350+
fi
335351

336352
[ -n "$OVPN_TLS_CIPHER" ] && echo "tls-cipher $OVPN_TLS_CIPHER" >> "$conf"
337353
[ -n "$OVPN_CIPHER" ] && echo "cipher $OVPN_CIPHER" >> "$conf"
338354
[ -n "$OVPN_AUTH" ] && echo "auth $OVPN_AUTH" >> "$conf"
339355

340356
[ -n "${OVPN_CLIENT_TO_CLIENT:-}" ] && echo "client-to-client" >> "$conf"
341-
[ -n "${OVPN_COMP_LZO:-}" ] && echo "comp-lzo" >> "$conf"
357+
[ "$OVPN_COMP_LZO" == "1" ] && echo "comp-lzo" >> "$conf"
342358

343359
[ -n "${OVPN_FRAGMENT:-}" ] && echo "fragment $OVPN_FRAGMENT" >> "$conf"
344360

‎bin/ovpn_getclient

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -97,12 +97,12 @@ tls-auth ta.key 1
9797
echo "auth-nocache"
9898
fi
9999

100-
if [ -n "$OVPN_COMP_LZO" ]; then
100+
if [ "$OVPN_COMP_LZO" == "1" ]; then
101101
echo "comp-lzo"
102102
fi
103103

104104
if [ -n "$OVPN_OTP_AUTH" ]; then
105-
echo reneg-sec 0
105+
echo reneg-sec 0
106106
fi
107107
}
108108

@@ -124,9 +124,9 @@ case "$parm" in
124124
get_client_config "combined" > "$dir/${cn}-combined.ovpn"
125125
;;
126126
*)
127-
echo "This script can produce the client configuration in to formats:" >&2
127+
echo "This script can produce the client configuration in two formats:" >&2
128128
echo " 1. combined (default): All needed configuration and cryptographic material is in one file (Use \"combined-save\" to write the configuration file in the same path as the separated parameter does)." >&2
129129
echo " 2. separated: Separated files." >&2
130-
echo "Please specific one of those options as second parameter." >&2
130+
echo "Please specify one of those options as second parameter." >&2
131131
;;
132132
esac

‎test/tests/conf_options/container.sh

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ max-clients 10
1313
EOF
1414

1515
SERV_IP=$(ip -4 -o addr show scope global | awk '{print $4}' | sed -e 's:/.*::' | head -n1)
16-
ovpn_genconfig -u udp://$SERV_IP -f 1400 -e "$MULTILINE_EXTRA_SERVER_CONF" -e 'duplicate-cn' -e 'topology subnet' -p 'route 172.22.22.0 255.255.255.0'
16+
ovpn_genconfig -u udp://$SERV_IP -f 1400 -k '60 300' -e "$MULTILINE_EXTRA_SERVER_CONF" -e 'duplicate-cn' -e 'topology subnet' -p 'route 172.22.22.0 255.255.255.0'
1717

1818
#
1919
# grep for config lines from openvpn.conf
@@ -65,6 +65,11 @@ CONFIG_MATCH_DEFAULT_DNS_1=$(busybox grep 'push dhcp-option DNS 8.8.8.8' /etc/op
6565
CONFIG_REQUIRED_DEFAULT_DNS_2="^push dhcp-option DNS 8.8.4.4"
6666
CONFIG_MATCH_DEFAULT_DNS_2=$(busybox grep 'push dhcp-option DNS 8.8.4.4' /etc/openvpn/openvpn.conf)
6767

68+
## Test for keepalive
69+
# 11. keepalive config
70+
CONFIG_REQUIRED_KEEPALIVE="^keepalive 60 300"
71+
CONFIG_MATCH_KEEPALIVE=$(busybox grep keepalive /etc/openvpn/openvpn.conf)
72+
6873

6974
#
7075
# Tests
@@ -148,6 +153,13 @@ else
148153
abort "==> Config match not found: $CONFIG_REQUIRED_DEFAULT_DNS_2 != $CONFIG_MATCH_DEFAULT_DNS_2"
149154
fi
150155

156+
if [[ $CONFIG_MATCH_KEEPALIVE =~ $CONFIG_REQUIRED_KEEPALIVE ]]
157+
then
158+
echo "==> Config match found: $CONFIG_REQUIRED_KEEPALIVE == $CONFIG_MATCH_KEEPALIVE"
159+
else
160+
abort "==> Config match not found: $CONFIG_REQUIRED_KEEPALIVE != $CONFIG_MATCH_KEEPALIVE"
161+
fi
162+
151163
SERV_IP=$(ip -4 -o addr show scope global | awk '{print $4}' | sed -e 's:/.*::' | head -n1)
152164
ovpn_genconfig -u udp://$SERV_IP -r "172.33.33.0/24" -r "172.34.34.0/24"
153165

@@ -171,6 +183,17 @@ else
171183
abort "==> Config match not found: $CONFIG_REQUIRED_ROUTE_2 != $CONFIG_MATCH_ROUTE_2"
172184
fi
173185

186+
SERV_IP=$(ip -4 -o addr show scope global | awk '{print $4}' | sed -e 's:/.*::' | head -n1)
187+
ovpn_genconfig -u udp://$SERV_IP -b
188+
189+
if busybox grep -v 'block-outside-dns' /etc/openvpn/openvpn.conf
190+
then
191+
echo "==> Config '-b' Succesfully remove the 'block-outside-dns' option"
192+
else
193+
abort "==> Config '-b' given, but 'block-outside-dns' option is still present in configuration"
194+
fi
195+
196+
174197
# Test generated client config
175198

176199
# gen udp client with tcp fallback

0 commit comments

Comments
 (0)