Re: [gentoo-dev] Init Scripts

[James Yonan]

Marko Mikulicic <marko@××××.org> said:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> James Yonan wrote:
> | Marko,
> |
> | It's an interesting approach, though it requires that you gentooize the
> | openvpn config files, therefore breaking the ability to move the
> config files
> | across platforms.
> |
> | I'm not sure if the init script you provided is just something you
> wrote for
> | personal use, or if you are making an argument that it (or the style it
> | embodies) should be officially incorporated as the Gentoo Init Script for
> | OpenVPN.  If it is the latter, then I must take this opportunity to
> argue :)
>
> Yes, the script was for personal use. I was not so happy with it to
> propose it as standard.
> However there is a little reasion for that design choice:
> routing must be implemented in a separate script pointed by the "up" keyword
> in the config file. This script must contain a full route command and
> must have an execute bit
> set and I personally don't like redundant information. Also I didn't
> find a way to use only one
> routing script for all tunnels because netmask information is not passed
> by openvpn to the script.

Which netmask are you referring to?  The TUN/TAP device?  The
internet-connected public interface?  OpenVPN actually knows nothing of
netmasks, except for 255.255.255.255 which is used by the --ifconfig option to
configure a virtual tun adapter, so it's not clear what should be passed. 
There's also the fact that --up can pass user-specified parameters to the
script, which might be a way of generalizing the route script, so that only
one would be necessary for a set of tunnels.

> ~ So the real reasion was: the openvpn config file is not so good as it
> seems, or better said,
> is not even a config file, is simply a text-file cmdline wrapper.

Every openvpn option can be expressed on either the command line or a config
file.  The idea is that there is no reason to create yet another config file
metalanguage for openvpn, when you can do arbitrarily complex run-time
derivations of options by invoking openvpn from a shell script, and putting
options on the command line.  For that reason, openvpn config files are simple
and flat (with the exception that multiple config files can be placed on the
command line, and config files can include other config files).  Having said
that, any command line smarts would need to go in the init.d file.  Perhaps
the /etc/conf.d/openvpn file just has global command line options.  

James

> ~ That said, and agreeing on your argumentations, I think it would be
> better, from a practical point of view,
> ~ to put one file for each tunnel in /etc/openvpn as you say, and
> a) put optianally a second file, say /etc/openvpn/tunnelname.route,
> which will be parsed
> from the /etc/init.d/openvpn and it will apply routing.
> or
> b) put a specially formatted comment ("#@route blabla") in the .conf
> file and do the same as above
>
> | # Location of openvpn binary
> | openvpn=/usr/local/sbin/openvpn
> |
> | # PID directory
> | piddir=/var/run/openvpn
> |
> | # Our working directory (.conf files should be here)
> | work=/etc/openvpn
> this things should go in conf.d/xyz or
> it maybe something like
> $work = ${work:-/etc/openvpn}
> ?
> in other words: if the conf.d/xyz file gets lost should the script
> use it's builtin default, while allowing the user to override them in
> conf.d,
> or should the script strictly depend on the existence of the conf.d/xyz
> file ?
>
> |     for c in `/bin/ls *.conf 2>/dev/null`; do
> is there a reason for not using "for c in *.conf; do" ?
>
> yours,
> Marko
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.2 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
> iD8DBQE+/h1+j0pLiOk7oZoRAi4wAJ0YTZZYZXdvqWlKdbLNHCaq9EDixQCgiTQU
> fdBaun+yOFup2iMWAWdh1sE=
> =Fbx1
> -----END PGP SIGNATURE-----
>



-- 




--
gentoo-dev@g.o mailing list