mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3183 from znerol/feature/master/register-openvpn-cn

Browse Source
This commit is contained in:
Steve Beaver 2017-11-29 12:05:21 -05:00
commit 2dbc276d27
4 changed files with 95 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/etc/inc/openvpn.inc
View File

@ -832,6 +832,17 @@ function openvpn_reconfigure($mode, $settings) {
break;
}
}
if ($settings['dev_mode'] === 'tun' && isset($config['unbound']['enable']) && isset($config['unbound']['regovpnclients'])) {
switch($settings['mode']) {
case 'server_tls':
case 'server_tls_user':
$domain = !empty($settings['dns_domain']) ? $settings['dns_domain'] : $config['system']['domain'];
if (is_domain($domain)) {
$conf .= "learn-address \"/usr/local/sbin/openvpn.learn-address.sh $domain\"\n";
}
break;
}
}
/*
* When binding specific address, wait cases where interface is in

11
src/etc/inc/unbound.inc
View File

@ -267,6 +267,15 @@ EOF;
$verbosity = isset($unboundcfg['log_verbosity']) ? $unboundcfg['log_verbosity'] : 1;
$use_caps = isset($unboundcfg['use_caps']) ? "yes" : "no";
if (isset($unboundcfg['regovpnclients'])) {
$openvpn_clients_conf .=<<<EOD
# OpenVPN client entries
include: {$g['unbound_chroot_path']}{$cfgsubdir}/openvpn.*.conf
EOD;
} else {
$openvpn_clients_conf = '';
}
// Set up forwarding if it is configured
if (isset($unboundcfg['forwarding'])) {
$dnsservers = array();
@ -378,6 +387,8 @@ include: {$g['unbound_chroot_path']}{$cfgsubdir}/host_entries.conf
# dhcp lease entries
include: {$g['unbound_chroot_path']}{$cfgsubdir}/dhcpleases_entries.conf
{$openvpn_clients_conf}
# Domain overrides
include: {$g['unbound_chroot_path']}{$cfgsubdir}/domainoverrides.conf
{$forward_conf}

60
src/usr/local/sbin/openvpn.learn-address.sh Executable file
View File

@ -0,0 +1,60 @@
#!/bin/sh
# openvpn learn-address script maintaining DNS entries of connected clients in
# unbound config.
DOMAIN="${1}"
OP="${2}"
IP="${3}"
CN="${4}"
DIR="/var/unbound"
PIDFILE="/var/run/unbound.pid"
if [ -n "${IP}" -a "$(/usr/bin/basename ${IP})" = "${IP}" ]; then
CONF="${DIR}/openvpn.client.${IP}.conf"
case "${OP}" in
add|update)
TMPCONF=$(/usr/bin/mktemp "${CONF}.XXXXXX")
TMPSRV=$(/usr/bin/mktemp "${CONF}.XXXXXX")
if [ -f "${TMPCONF}" -a -f "${TMPSRV}" ]; then
# Remove all configs which mention the FQDN
/usr/bin/grep -l -null "^local-data: \"${CN}.${DOMAIN} A " ${DIR}/openvpn.client.*.conf | /usr/bin/xargs -0 /bin/rm
/bin/test -f "${CONF}" && /bin/rm "${CONF}"
# Add new local-data entry.
(
echo "local-data-ptr: \"${IP} ${CN}.${DOMAIN}\"" &&
echo "local-data: \"${CN}.${DOMAIN} A ${IP}\"" &&
echo "local-data: \"${CN} A ${IP}\""
) > "${TMPCONF}"
# Check syntax, install configuration and restart unbound.
(
echo "server:" &&
echo "chroot: ${DIR}" &&
echo "directory: ${DIR}" &&
echo "include: ${TMPCONF}"
) > "${TMPSRV}"
/bin/chmod 644 "${TMPCONF}" "${TMPSRV}"
/usr/local/sbin/unbound-checkconf "${TMPSRV}" && /bin/mv "${TMPCONF}" "${CONF}"
/bin/pkill -HUP -F "${PIDFILE}"
fi
/bin/test -f "${TMPCONF}" && /bin/rm "${TMPCONF}"
/bin/test -f "${TMPSRV}" && /bin/rm "${TMPSRV}"
;;
delete)
# CN is not set on delete.
/bin/test -f "${CONF}" && /bin/rm "${CONF}" && /bin/pkill -HUP -F "${PIDFILE}"
;;
esac
fi
exit 0

13
src/usr/local/www/services_unbound.php
View File

@ -65,6 +65,9 @@ if (isset($a_unboundcfg['regdhcp'])) {
if (isset($a_unboundcfg['regdhcpstatic'])) {
$pconfig['regdhcpstatic'] = true;
}
if (isset($a_unboundcfg['regovpnclients'])) {
$pconfig['regovpnclients'] = true;
}
$pconfig['port'] = $a_unboundcfg['port'];
$pconfig['custom_options'] = base64_decode($a_unboundcfg['custom_options']);
@ -183,6 +186,7 @@ if ($_POST['save']) {
$a_unboundcfg['forwarding'] = isset($pconfig['forwarding']);
$a_unboundcfg['regdhcp'] = isset($pconfig['regdhcp']);
$a_unboundcfg['regdhcpstatic'] = isset($pconfig['regdhcpstatic']);
$a_unboundcfg['regovpnclients'] = isset($pconfig['regovpnclients']);
$a_unboundcfg['active_interface'] = $pconfig['active_interface'];
$a_unboundcfg['outgoing_interface'] = $pconfig['outgoing_interface'];
$a_unboundcfg['system_domain_local_zone_type'] = $pconfig['system_domain_local_zone_type'];
@ -350,6 +354,14 @@ $section->addInput(new Form_Checkbox(
))->setHelp('If this option is set, then DHCP static mappings will be registered in the DNS Resolver, so that their name can be resolved. '.
'The domain in %1$sSystem &gt; General Setup%2$s should also be set to the proper value.','<a href="system.php">','</a>');
$section->addInput(new Form_Checkbox(
'regovpnclients',
'OpenVPN Clients',
'Register connected OpenVPN clients in the DNS Resolver',
$pconfig['regovpnclients']
))->setHelp(sprintf('If this option is set, then the common name (CN) of connected OpenVPN clients will be registered in the DNS Resolver, so that their name can be resolved. This only works for OpenVPN servers (Remote Access SSL/TLS) operating in "tun" mode. '.
'The domain in %sSystem: General Setup%s should also be set to the proper value.','<a href="system.php">','</a>'));
$btnadv = new Form_Button(
'btnadvcustom',
'Custom options',
@ -412,6 +424,7 @@ events.push(function() {
hideCheckbox('forwarding', hide);
hideCheckbox('regdhcp', hide);
hideCheckbox('regdhcpstatic', hide);
hideCheckbox('regovpnclients', hide);
hideInput('btnadvcustom', hide);
hideInput('custom_options', hide || !showadvcustom);
}