net/ocserv/files/ocserv.init

   1 #!/bin/sh /etc/rc.common
   2
   3 SERVICE_USE_PID=1
   4
   5 START=50
   6
   7 setup_config() {
   8         config_get port         $1 port "4443"
   9         config_get max_clients  $1 max_clients "8"
  10         config_get max_same     $1 max_same "2"
  11         config_get dpd          $1 dpd "120"
  12         config_get predictable_ips  $1 predictable_ips "1"
  13         config_get udp          $1 udp "1"
  14         config_get auth         $1 auth "plain"
  15         config_get cisco_compat $1 cisco_compat "1"
  16         config_get ipaddr       $1 ipaddr "192.168.100.0"
  17         config_get netmask      $1 netmask "255.255.255.0"
  18         config_get ip6addr      $1 ip6addr ""
  19
  20         test $predictable_ips = "0" && predictable_ips="false"
  21         test $predictable_ips = "1" && predictable_ips="true"
  22         test $cisco_compat = "0" && cisco_compat="false"
  23         test $cisco_compat = "1" && cisco_compat="true"
  24         test $udp = "0" && udp="#"
  25         test $udp = "1" && udp=""
  26         test -z $ip6addr && enable_ipv6="#"
  27
  28         ipv6_addr=`echo $ip6addr|cut -d '/' -f 1`
  29         ipv6_prefix=`echo $ip6addr|cut -d '/' -f 2`
  30
  31         test $auth = "plain" && authsuffix="\[/var/etc/ocpasswd\]"
  32
  33         dyndns="false"
  34         hostname=`uci show ddns|grep domain|head -1|cut -d '=' -f 2`
  35         [ -n "$hostname" ] && dyndns="true"
  36
  37         mkdir -p /var/etc
  38         sed -e "s/|PORT|/$port/g" \
  39             -e "s/|MAX_CLIENTS|/$max_clients/g" \
  40             -e "s/|MAX_SAME|/$max_same/g" \
  41             -e "s/|DPD|/$dpd/g" \
  42             -e "s#|AUTH|#$auth$authsuffix#g" \
  43             -e "s#|DYNDNS|#$dyndns#g" \
  44             -e "s/|PREDICTABLE_IPS|/$predictable_ips/g" \
  45             -e "s/|CISCO_COMPAT|/$cisco_compat/g" \
  46             -e "s/|UDP|/$udp/g" \
  47             -e "s/|IPV4ADDR|/$ipaddr/g" \
  48             -e "s/|NETMASK|/$netmask/g" \
  49             -e "s/|IPV6ADDR|/$ipv6_addr/g" \
  50             -e "s/|IPV6PREFIX|/$ipv6_prefix/g" \
  51             -e "s/|ENABLE_IPV6|/$enable_ipv6/g" \
  52             /etc/ocserv/ocserv.conf.template > /var/etc/ocserv.conf
  53 }
  54
  55 setup_users() {
  56         local name
  57         local group
  58         local password
  59
  60         config_get name $1 name
  61         config_get group $1 group
  62         config_get password $1 password
  63
  64         [ -z "$group" ] && group='*'
  65         [ -z "$name" -o -z "$password" ] && return
  66
  67         echo "$name:$group:$password" >> /var/etc/ocpasswd
  68 }
  69
  70 setup_routes() {
  71         local routes
  72
  73         config_get ip $1 ip
  74         config_get netmask $1 netmask
  75
  76         [ -z "$ip" -o -z "$netmask" ] && return
  77
  78         echo "route = $ip/$netmask" >> /var/etc/ocserv.conf
  79 }
  80
  81 setup_dns() {
  82         local routes
  83
  84         config_get ip $1 ip
  85
  86         [ -z "$ip" ] && return
  87
  88         echo "dns = $ip" >> /var/etc/ocserv.conf
  89 }
  90
  91 start() {
  92         local hostname iface
  93
  94         user_exists ocserv 72 || user_add ocserv 72 72 /var/lib/ocserv
  95         group_exists ocserv 72 || group_add ocserv 72
  96
  97         hostname=`uci show ddns|grep domain|head -1|cut -d '=' -f 2`
  98         [ -z "$hostname" ] && hostname=`uci get system.@system[0].hostname`
  99
 100         [ ! -f /etc/ocserv/ca-key.pem ] && [ -x /usr/bin/certtool ] && {
 101                 logger -t ocserv "Generating CA certificate..."
 102                 mkdir -p /etc/ocserv/pki/
 103                 certtool --bits 2048 --generate-privkey --outfile /etc/ocserv/ca-key.pem >/dev/null 2>&1
 104                 echo "cn=$hostname CA" >/etc/ocserv/pki/ca.tmpl
 105                 echo "expiration_days=-1" >>/etc/ocserv/pki/ca.tmpl
 106                 echo "serial=1" >>/etc/ocserv/pki/ca.tmpl
 107                 echo "ca" >>/etc/ocserv/pki/ca.tmpl
 108                 echo "cert_signing_key" >>/etc/ocserv/pki/ca.tmpl
 109
 110                 certtool --template /etc/ocserv/pki/ca.tmpl \
 111                         --generate-self-signed --load-privkey /etc/ocserv/ca-key.pem \
 112                         --outfile /etc/ocserv/ca.pem >/dev/null 2>&1
 113         }
 114
 115         #generate server certificate/key
 116         [ ! -f /etc/ocserv/server-key.pem ] && [ -x /usr/bin/certtool ] && {
 117                 logger -t ocserv "Generating server certificate..."
 118                 mkdir -p /etc/ocserv/pki/
 119                 certtool --bits 2048 --generate-privkey --outfile /etc/ocserv/server-key.pem >/dev/null 2>&1
 120                 echo "cn=$hostname" >/etc/ocserv/pki/server.tmpl
 121                 echo "serial=2" >>/etc/ocserv/pki/server.tmpl
 122                 echo "expiration_days=-1" >>/etc/ocserv/pki/server.tmpl
 123                 echo "signing_key" >>/etc/ocserv/pki/server.tmpl
 124                 echo "encryption_key" >>/etc/ocserv/pki/server.tmpl
 125                 certtool --template /etc/ocserv/pki/server.tmpl \
 126                         --generate-certificate --load-privkey /etc/ocserv/server-key.pem \
 127                         --load-ca-certificate /etc/ocserv/ca.pem --load-ca-privkey \
 128                         /etc/ocserv/ca-key.pem --outfile /etc/ocserv/server-cert.pem >/dev/null 2>&1
 129         }
 130
 131         [ -f /var/run/ocserv.pid ] || {
 132                 touch /var/run/ocserv.pid
 133                 chown ocserv:ocserv /var/run/ocserv.pid
 134         }
 135         [ -d /var/lib/ocserv ] || {
 136                 mkdir -m 0755 -p /var/lib/ocserv
 137                 chmod 0700 /var/lib/ocserv
 138                 chown ocserv:ocserv /var/lib/ocserv
 139         }
 140
 141         config_load "ocserv"
 142
 143         rm -f /var/etc/ocserv.conf
 144         touch /var/etc/ocserv.conf
 145         setup_config config
 146         config_foreach setup_routes routes
 147         config_foreach setup_dns dns
 148
 149         rm -f /var/etc/ocpasswd
 150         touch /var/etc/ocpasswd
 151         chmod 600 /var/etc/ocpasswd
 152         config_foreach setup_users ocservusers
 153
 154         service_start /usr/sbin/ocserv -c /var/etc/ocserv.conf
 155 }
 156
 157 stop() {
 158         service_stop /usr/sbin/ocserv
 159 }
 160
 161 reload() {
 162         rm -f /var/etc/ocpasswd
 163         touch /var/etc/ocpasswd
 164         chmod 600 /var/etc/ocpasswd
 165         config_foreach setup_users ocservusers
 166
 167         /usr/bin/occtl show status >/dev/null 2>&1
 168         if test $? != 0;then
 169                 start
 170         else
 171                 /usr/bin/occtl reload
 172         fi
 173 }