mirror of
https://github.com/kiddin9/op-packages.git
synced 2026-10-31 00:55:13 +08:00
🎈 Sync 2026-10-04 14:38:18
This commit is contained in:
github-actions[bot] committed
1 parent
0e6611f767
commit
aba12667c5
88 files changed
+4600
-1458
No files matched your search
@@ -1,41 +0,0 @@
|
||||
|
||||
config openvpn 'myvpn'
|
||||
option enabled '0'
|
||||
option proto 'tcp4'
|
||||
option dev 'tun'
|
||||
option topology 'subnet'
|
||||
option server '10.8.0.0 255.255.255.0'
|
||||
option comp_lzo 'adaptive'
|
||||
option ca '/etc/openvpn/pki/ca.crt'
|
||||
option dh '/etc/openvpn/pki/dh.pem'
|
||||
option cert '/etc/openvpn/pki/server.crt'
|
||||
option key '/etc/openvpn/pki/server.key'
|
||||
option persist_key '1'
|
||||
option persist_tun '1'
|
||||
option max_clients '88'
|
||||
option keepalive '10 120'
|
||||
option verb '3'
|
||||
option status '/var/log/openvpn_status.log'
|
||||
option log '/tmp/openvpn.log'
|
||||
option port '1194'
|
||||
option ddns 'myserver.f3322.net'
|
||||
option auth_user_pass_verify '/etc/openvpn/server/checkpsw.sh via-env'
|
||||
option script_security '3'
|
||||
list push 'route 192.168.9.0 255.255.255.0'
|
||||
list push 'comp-lzo adaptive'
|
||||
list push 'redirect-gateway def1 bypass-dhcp'
|
||||
list push 'dhcp-option DNS 192.168.9.1'
|
||||
|
||||
config openvpn 'client1'
|
||||
option enabled '0'
|
||||
option config '/etc/openvpn/client1.conf'
|
||||
|
||||
config openvpn 'client2'
|
||||
option enabled '0'
|
||||
option config '/etc/openvpn/client2.conf'
|
||||
|
||||
config openvpnpassword 'pwd1'
|
||||
option pwdfile '/etc/openvpn/pass.txt'
|
||||
|
||||
config openvpnpassword 'pwd2'
|
||||
option pwdfile '/etc/openvpn/pass2.txt'
|
||||
@@ -1,10 +0,0 @@
|
||||
set_var EASYRSA_OPENSSL "openssl"
|
||||
set_var EASYRSA_KEY_SIZE 2048
|
||||
set_var EASYRSA_REQ_COUNTRY "lunatickochiya"
|
||||
set_var EASYRSA_REQ_PROVINCE "github"
|
||||
set_var EASYRSA_REQ_CITY "github"
|
||||
set_var EASYRSA_REQ_ORG "github"
|
||||
set_var EASYRSA_REQ_EMAIL "lunatickochiya@github.com"
|
||||
set_var EASYRSA_REQ_OU "github"
|
||||
set_var EASYRSA_CA_EXPIRE 3650
|
||||
set_var EASYRSA_CERT_EXPIRE 3650
|
||||
+5
@@ -0,0 +1,5 @@
|
||||
#!/bin/sh
|
||||
|
||||
case "$ACTION" in
|
||||
ifup|ifupdate) /usr/libexec/openvpn-client-cubic-route update >/dev/null 2>&1 ;;
|
||||
esac
|
||||
@@ -0,0 +1,29 @@
|
||||
#!/bin/sh /etc/rc.common
|
||||
|
||||
START=89
|
||||
STOP=10
|
||||
USE_PROCD=1
|
||||
|
||||
start_service() {
|
||||
local attempt=0
|
||||
/usr/libexec/openvpn-client-cubic-route enabled || return 0
|
||||
|
||||
# OpenVPN starts at 90. Wait for DNS and the uplink before it connects.
|
||||
while ! /usr/libexec/openvpn-client-cubic-route update; do
|
||||
attempt=$((attempt + 1))
|
||||
[ "$attempt" -lt 12 ] || {
|
||||
logger -t openvpn-client-cubic 'Could not install CUBIC route before OpenVPN startup'
|
||||
return 1
|
||||
}
|
||||
sleep 2
|
||||
done
|
||||
|
||||
procd_open_instance
|
||||
procd_set_param command /usr/libexec/openvpn-client-cubic-route watch
|
||||
procd_set_param respawn 3600 5 -1
|
||||
procd_close_instance
|
||||
}
|
||||
|
||||
stop_service() {
|
||||
/usr/libexec/openvpn-client-cubic-route clear
|
||||
}
|
||||
@@ -1,34 +1,52 @@
|
||||
#!/bin/sh
|
||||
|
||||
|
||||
function rand_str() {
|
||||
rand_str() {
|
||||
(base64 /dev/urandom | tr -dc 'A-Za-z' | head -c $1) 2>/dev/null
|
||||
}
|
||||
|
||||
function rand_str_upper() {
|
||||
rand_str_upper() {
|
||||
(rand_str $1 | tr 'a-z' 'A-Z') 2>/dev/null
|
||||
}
|
||||
|
||||
function rand_str_lower() {
|
||||
rand_str_lower() {
|
||||
(rand_str $1 | tr 'A-Z' 'a-z') 2>/dev/null
|
||||
}
|
||||
|
||||
function rand_easy_rsa_vars() {
|
||||
set_easy_rsa_var() {
|
||||
local name="$1"
|
||||
local value="$2"
|
||||
|
||||
if grep -q "^[[:space:]]*set_var[[:space:]]\+$name[[:space:]]" /etc/easy-rsa/vars; then
|
||||
sed -i "s|^[[:space:]]*set_var[[:space:]]\+$name[[:space:]].*$|set_var $name\t$value|" /etc/easy-rsa/vars
|
||||
else
|
||||
printf 'set_var %s\t%s\n' "$name" "$value" >> /etc/easy-rsa/vars
|
||||
fi
|
||||
}
|
||||
|
||||
init_easy_rsa_vars() {
|
||||
touch /etc/easy-rsa/vars
|
||||
set_easy_rsa_var EASYRSA_OPENSSL '"openssl"'
|
||||
set_easy_rsa_var EASYRSA_KEY_SIZE '2048'
|
||||
set_easy_rsa_var EASYRSA_CA_EXPIRE '3650'
|
||||
set_easy_rsa_var EASYRSA_CERT_EXPIRE '3650'
|
||||
}
|
||||
|
||||
rand_easy_rsa_vars() {
|
||||
local KEY_PROVINCE="$(rand_str_upper 6)"
|
||||
local KEY_CITY="$(rand_str 8)"
|
||||
local KEY_ORG="$(rand_str 8)"
|
||||
local KEY_EMAIL="$(rand_str_lower 8)@$(rand_str_lower 4).$(rand_str_lower 3)"
|
||||
local KEY_OU="$(rand_str 8)"
|
||||
sed -i \
|
||||
-e "s/^[[:space:]]*set_var[[:space:]]\+EASYRSA_REQ_COUNTRY[[:space:]]\+\".*\"$/set_var EASYRSA_REQ_COUNTRY\t\"$KEY_PROVINCE\"/" \
|
||||
-e "s/^[[:space:]]*set_var[[:space:]]\+EASYRSA_REQ_PROVINCE[[:space:]]\+\".*\"$/set_var EASYRSA_REQ_PROVINCE\t\"$KEY_CITY\"/" \
|
||||
-e "s/^[[:space:]]*set_var[[:space:]]\+EASYRSA_REQ_CITY[[:space:]]\+\".*\"$/set_var EASYRSA_REQ_CITY\t\"$KEY_ORG\"/" \
|
||||
-e "s/^[[:space:]]*set_var[[:space:]]\+EASYRSA_REQ_ORG[[:space:]]\+\".*\"$/set_var EASYRSA_REQ_ORG\t\"$KEY_ORG\"/" \
|
||||
-e "s/^[[:space:]]*set_var[[:space:]]\+EASYRSA_REQ_EMAIL[[:space:]]\+\".*\"$/set_var EASYRSA_REQ_EMAIL\t\"$KEY_EMAIL\"/" \
|
||||
-e "s/^[[:space:]]*set_var[[:space:]]\+EASYRSA_REQ_OU[[:space:]]\+\".*\"$/set_var EASYRSA_REQ_OU\t\"$KEY_OU\"/" \
|
||||
/etc/easy-rsa/vars
|
||||
set_easy_rsa_var EASYRSA_REQ_COUNTRY "\"$KEY_PROVINCE\""
|
||||
set_easy_rsa_var EASYRSA_REQ_PROVINCE "\"$KEY_CITY\""
|
||||
set_easy_rsa_var EASYRSA_REQ_CITY "\"$KEY_ORG\""
|
||||
set_easy_rsa_var EASYRSA_REQ_ORG "\"$KEY_ORG\""
|
||||
set_easy_rsa_var EASYRSA_REQ_EMAIL "\"$KEY_EMAIL\""
|
||||
set_easy_rsa_var EASYRSA_REQ_OU "\"$KEY_OU\""
|
||||
}
|
||||
|
||||
init_easy_rsa_vars
|
||||
rand_easy_rsa_vars
|
||||
|
||||
|
||||
|
||||
+4
@@ -0,0 +1,4 @@
|
||||
#!/bin/sh
|
||||
|
||||
/etc/init.d/openvpn-client-cubic enable
|
||||
exit 0
|
||||
@@ -1,6 +1,70 @@
|
||||
#!/bin/sh
|
||||
|
||||
grep -qv "myvpn" /etc/config/openvpn && grep -q "myvpn" /etc/config/openvpn-opkg && cp -f /etc/config/openvpn-opkg /etc/config/openvpn
|
||||
if ! uci -q get openvpn.myvpn >/dev/null; then
|
||||
uci -q batch <<-EOF >/dev/null
|
||||
set openvpn.myvpn=openvpn
|
||||
set openvpn.myvpn.enabled='0'
|
||||
set openvpn.myvpn.proto='tcp4'
|
||||
set openvpn.myvpn.dev='tun'
|
||||
set openvpn.myvpn.topology='subnet'
|
||||
set openvpn.myvpn.server='10.8.0.0 255.255.255.0'
|
||||
set openvpn.myvpn.comp_lzo='adaptive'
|
||||
set openvpn.myvpn.ca='/etc/openvpn/pki/ca.crt'
|
||||
set openvpn.myvpn.dh='/etc/openvpn/pki/dh.pem'
|
||||
set openvpn.myvpn.cert='/etc/openvpn/pki/server.crt'
|
||||
set openvpn.myvpn.key='/etc/openvpn/pki/server.key'
|
||||
set openvpn.myvpn.persist_key='1'
|
||||
set openvpn.myvpn.persist_tun='1'
|
||||
set openvpn.myvpn.max_clients='88'
|
||||
set openvpn.myvpn.keepalive='10 120'
|
||||
set openvpn.myvpn.verb='3'
|
||||
set openvpn.myvpn.status='/var/log/openvpn_status.log'
|
||||
set openvpn.myvpn.log='/tmp/openvpn.log'
|
||||
set openvpn.myvpn.port='1194'
|
||||
set openvpn.myvpn.ddns='myserver.f3322.net'
|
||||
set openvpn.myvpn.auth_user_pass_verify='/etc/openvpn/server/checkpsw.sh via-env'
|
||||
set openvpn.myvpn.script_security='3'
|
||||
add_list openvpn.myvpn.push='route 192.168.9.0 255.255.255.0'
|
||||
add_list openvpn.myvpn.push='comp-lzo adaptive'
|
||||
add_list openvpn.myvpn.push='redirect-gateway def1 bypass-dhcp'
|
||||
add_list openvpn.myvpn.push='dhcp-option DNS 192.168.9.1'
|
||||
commit openvpn
|
||||
EOF
|
||||
fi
|
||||
|
||||
if ! uci -q get openvpn.client1 >/dev/null; then
|
||||
uci -q batch <<-EOF >/dev/null
|
||||
set openvpn.client1=openvpn
|
||||
set openvpn.client1.enabled='0'
|
||||
set openvpn.client1.config='/etc/openvpn/client1.conf'
|
||||
commit openvpn
|
||||
EOF
|
||||
fi
|
||||
|
||||
if ! uci -q get openvpn.client2 >/dev/null; then
|
||||
uci -q batch <<-EOF >/dev/null
|
||||
set openvpn.client2=openvpn
|
||||
set openvpn.client2.enabled='0'
|
||||
set openvpn.client2.config='/etc/openvpn/client2.conf'
|
||||
commit openvpn
|
||||
EOF
|
||||
fi
|
||||
|
||||
if ! uci -q get openvpn.pwd1 >/dev/null; then
|
||||
uci -q batch <<-EOF >/dev/null
|
||||
set openvpn.pwd1=openvpnpassword
|
||||
set openvpn.pwd1.pwdfile='/etc/openvpn/pass.txt'
|
||||
commit openvpn
|
||||
EOF
|
||||
fi
|
||||
|
||||
if ! uci -q get openvpn.pwd2 >/dev/null; then
|
||||
uci -q batch <<-EOF >/dev/null
|
||||
set openvpn.pwd2=openvpnpassword
|
||||
set openvpn.pwd2.pwdfile='/etc/openvpn/pass2.txt'
|
||||
commit openvpn
|
||||
EOF
|
||||
fi
|
||||
|
||||
openvpn_port="$(uci -q get openvpn.myvpn.port)"
|
||||
[ -z "$openvpn_port" ] && openvpn_port=1194
|
||||
|
||||
+124
@@ -0,0 +1,124 @@
|
||||
#!/bin/sh
|
||||
# Set CUBIC only for opted-in OpenVPN clients' outer TCP destinations.
|
||||
|
||||
umask 077
|
||||
state=${OPENVPN_CLIENT_CUBIC_STATE:-/tmp/openvpn-client-cubic-routes}
|
||||
|
||||
sections() {
|
||||
uci -q show openvpn 2>/dev/null |
|
||||
sed -n 's/^openvpn\.\(client[A-Za-z0-9_-]*\)=openvpn$/\1/p'
|
||||
}
|
||||
|
||||
client_enabled() {
|
||||
[ "$(uci -q get "openvpn.$1.enabled")" = 1 ] &&
|
||||
[ "$(uci -q get "openvpn.$1.tcp_cubic")" = 1 ]
|
||||
}
|
||||
|
||||
has_clients() {
|
||||
for section in $(sections); do
|
||||
client_enabled "$section" && return 0
|
||||
done
|
||||
return 1
|
||||
}
|
||||
|
||||
delete_old_routes() {
|
||||
[ -f "$state" ] || return 0
|
||||
while IFS='|' read -r address via device; do
|
||||
[ -n "$address" ] && [ -n "$device" ] || continue
|
||||
if [ -n "$via" ]; then
|
||||
ip -4 route del "$address/32" via "$via" dev "$device" 2>/dev/null
|
||||
else
|
||||
ip -4 route del "$address/32" dev "$device" 2>/dev/null
|
||||
fi
|
||||
done < "$state"
|
||||
return 0
|
||||
}
|
||||
|
||||
add_route() {
|
||||
local address=$1 route via device
|
||||
route=$(ip -4 route get "$address" 2>/dev/null) || return 1
|
||||
set -- $route
|
||||
while [ "$#" -gt 1 ]; do
|
||||
case "$1" in
|
||||
via) via=$2; shift 2 ;;
|
||||
dev) device=$2; shift 2 ;;
|
||||
*) shift ;;
|
||||
esac
|
||||
done
|
||||
[ -n "$device" ] && [ "$device" != lo ] || return 1
|
||||
if [ -n "$via" ]; then
|
||||
ip -4 route replace "$address/32" via "$via" dev "$device" congctl cubic || return 1
|
||||
else
|
||||
ip -4 route replace "$address/32" dev "$device" congctl cubic || return 1
|
||||
fi
|
||||
printf '%s|%s|%s\n' "$address" "$via" "$device" >> "$new_state"
|
||||
}
|
||||
|
||||
update_routes() {
|
||||
local section conf host addresses address failed=0 desired new_state
|
||||
desired=$(mktemp /tmp/openvpn-client-cubic-desired.XXXXXX) || return 1
|
||||
new_state=$(mktemp /tmp/openvpn-client-cubic-state.XXXXXX) || {
|
||||
rm -f "$desired"
|
||||
return 1
|
||||
}
|
||||
|
||||
for section in $(sections); do
|
||||
client_enabled "$section" || continue
|
||||
conf=$(uci -q get "openvpn.$section.config")
|
||||
if [ ! -r "$conf" ]; then
|
||||
logger -t openvpn-client-cubic "Cannot read config for $section"
|
||||
failed=1
|
||||
continue
|
||||
fi
|
||||
# An outer TCP congestion controller has no effect on UDP clients.
|
||||
grep -Eiq '^[[:space:]]*proto[[:space:]]+tcp' "$conf" || continue
|
||||
for host in $(awk '$1 == "remote" { gsub(/["\047]/, "", $2); print $2 }' "$conf"); do
|
||||
case "$host" in
|
||||
''|*[!0-9.]*) addresses=$(resolveip -4 -t 5 "$host" 2>/dev/null) ;;
|
||||
*) addresses=$host ;;
|
||||
esac
|
||||
if [ -z "$addresses" ]; then
|
||||
logger -t openvpn-client-cubic "Cannot resolve $host for $section"
|
||||
failed=1
|
||||
continue
|
||||
fi
|
||||
for address in $addresses; do
|
||||
case "$address" in
|
||||
*[!0-9.]*|'') continue ;;
|
||||
esac
|
||||
printf '%s\n' "$address" >> "$desired"
|
||||
done
|
||||
done
|
||||
done
|
||||
|
||||
if [ "$failed" -ne 0 ]; then
|
||||
rm -f "$desired" "$new_state"
|
||||
return 1
|
||||
fi
|
||||
|
||||
delete_old_routes
|
||||
sort -u "$desired" | while IFS= read -r address; do
|
||||
[ -n "$address" ] || continue
|
||||
add_route "$address" || exit 1
|
||||
done
|
||||
failed=$?
|
||||
rm -f "$desired"
|
||||
if [ "$failed" -eq 0 ]; then
|
||||
mv -f "$new_state" "$state"
|
||||
else
|
||||
rm -f "$new_state"
|
||||
fi
|
||||
return "$failed"
|
||||
}
|
||||
|
||||
case "$1" in
|
||||
enabled) has_clients ;;
|
||||
update) update_routes ;;
|
||||
clear) delete_old_routes; rm -f "$state" ;;
|
||||
watch)
|
||||
while sleep 300; do
|
||||
update_routes || logger -t openvpn-client-cubic 'Could not refresh CUBIC routes'
|
||||
done
|
||||
;;
|
||||
*) echo "Usage: $0 {enabled|update|clear|watch}" >&2; exit 2 ;;
|
||||
esac
|
||||
-11
@@ -1,11 +0,0 @@
|
||||
{
|
||||
"luci-app-openvpn-server-client": {
|
||||
"description": "Grant UCI access for luci-app-openvpn-server-client",
|
||||
"read": {
|
||||
"uci": [ "openvpn" ]
|
||||
},
|
||||
"write": {
|
||||
"uci": [ "openvpn" ]
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user