update 2026-09-24 16:56:26

liep/luci-app-openvpn-server/root/usr/share/openvpn-server/script/auth_verify.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+
+CONFIG="luci-app-openvpn-server"
+OVPN_PATH=/var/etc/openvpn-server
+LOG_FILE=${OVPN_PATH}/client.log
+AUTH_FILE=${OVPN_PATH}/auth
+TIME="$(date "+%Y-%m-%d %H:%M:%S")"
+
+IP=${untrusted_ip}
+
+CORRECT_PASSWORD=$(awk '!/^;/&&!/^#/&&$1=="'${username}'"{print $2;exit}' ${AUTH_FILE})
+if [ "${CORRECT_PASSWORD}" = "" ]; then 
+	echo "${TIME}: ${username}/${IP} Fail authentication. input password=\"${password}\"." >> ${LOG_FILE}
+	exit 1
+fi
+
+if [ "${password}" = "${CORRECT_PASSWORD}" ]; then 
+	echo "${TIME}: ${username}/${IP} Successful authentication." >> ${LOG_FILE}
+	exit 0
+fi
+
+echo "${TIME}: ${username}/${IP} Fail authentication. input password=\"${password}\"." >> ${LOG_FILE}
+exit 1

liep/luci-app-openvpn-server/root/usr/share/openvpn-server/script/ca_renew.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+
+DIR=$(cd "$(dirname "$0")";pwd)
+LOCK_FILE=/var/lock/ca_renew.lock
+
+lock() {
+	if [ -s ${LOCK_FILE} ]; then
+		SPID=$(cat ${LOCK_FILE})
+		if [ -e /proc/${SPID}/status ]; then
+			exit 1
+		fi
+		cat /dev/null > ${LOCK_FILE}
+	fi
+	echo $$ > ${LOCK_FILE}
+}
+
+unlock() {
+	rm -rf ${LOCK_FILE}
+}
+
+lock
+cd /tmp
+echo yes | easyrsa init-pki
+echo CA | easyrsa build-ca nopass
+easyrsa gen-dh
+echo yes | easyrsa build-server-full server nopass
+cp -f /tmp/pki/dh.pem /usr/share/openvpn-server/dh.pem
+cp -f /tmp/pki/ca.crt /usr/share/openvpn-server/ca.crt
+cp -f /tmp/pki/issued/server.crt /usr/share/openvpn-server/server.crt
+cp -f /tmp/pki/private/server.key /usr/share/openvpn-server/server.key
+rm -rf /tmp/pki
+cd ${DIR}
+/etc/init.d/luci-app-openvpn-server restart
+unlock

liep/luci-app-openvpn-server/root/usr/share/openvpn-server/script/client_connect.sh

@@ -0,0 +1,47 @@
+#!/bin/sh
+
+CONFIG="luci-app-openvpn-server"
+OVPN_PATH=/var/etc/openvpn-server
+LOG_FILE=${OVPN_PATH}/client.log
+SESSION_PATH=${OVPN_PATH}/session
+TIME="$(date "+%Y-%m-%d %H:%M:%S")"
+
+mkdir -p ${SESSION_PATH}
+
+REMOTE_IP=${trusted_ip}
+[ -n "${trusted_ip6}" ] && REMOTE_IP=${trusted_ip6}
+
+cat <<-EOF > ${SESSION_PATH}/${common_name}
+	{
+	    "common_name": "${common_name}",
+	    "time_ascii": "${time_ascii}",
+	    "trusted_ip": "${trusted_ip}",
+	    "trusted_ip6": "${trusted_ip6}",
+	    "trusted_port": "${trusted_port}",
+	    "ifconfig_pool_remote_ip": "${ifconfig_pool_remote_ip}",
+	    "time_ascii": "${time_ascii}",
+	    "remote_ip": "${REMOTE_IP}",
+	    "login_time": "${TIME}"
+	}
+EOF
+
+echo "${TIME}: ${common_name}/${REMOTE_IP} online." >> ${LOG_FILE}
+
+cfgid=$(uci show ${CONFIG} | grep "@users" | grep "\.username='${common_name}'" | cut -d '.' -sf 2)
+[ -n "$cfgid" ] && {
+	routes=$(uci -q get ${CONFIG}.${cfgid}.routes)
+	[ -n "$routes" ] && {
+		for route in ${routes}; do
+			route add -net ${route} gw ${ifconfig_pool_remote_ip} >/dev/null 2>&1
+		done
+		#echo "${TIME}: ${common_name}/${REMOTE_IP} add route." >> ${LOG_FILE}
+	}
+}
+
+#可根据登录的账号自定义脚本，如组网、日志、限速、权限等特殊待遇。
+SCRIPT="/usr/share/openvpn-server/script/client_connect/${common_name}"
+[ -s "$SCRIPT" ] && {
+	[ ! -x "$SCRIPT" ] && chmod 0755 "$SCRIPT"
+	"$SCRIPT" "$@"
+}
+exit 0

liep/luci-app-openvpn-server/root/usr/share/openvpn-server/script/client_disconnect.sh

@@ -0,0 +1,33 @@
+#!/bin/sh
+
+CONFIG="luci-app-openvpn-server"
+OVPN_PATH=/var/etc/openvpn-server
+LOG_FILE=${OVPN_PATH}/client.log
+SESSION_PATH=${OVPN_PATH}/session
+TIME="$(date "+%Y-%m-%d %H:%M:%S")"
+
+REMOTE_IP=${trusted_ip}
+[ -n "${trusted_ip6}" ] && REMOTE_IP=${trusted_ip6}
+
+rm -f ${SESSION_PATH}/${common_name}
+
+echo "${TIME}: ${common_name}/${REMOTE_IP} offline." >> ${LOG_FILE}
+
+cfgid=$(uci show ${CONFIG} | grep "@users" | grep "\.username='${common_name}'" | cut -d '.' -sf 2)
+[ -n "$cfgid" ] && {
+	routes=$(uci -q get ${CONFIG}.${cfgid}.routes)
+	[ -n "$routes" ] && {
+		for route in ${routes}; do
+			route del -net ${route} gw ${ifconfig_pool_remote_ip} >/dev/null 2>&1
+		done
+		#echo "${TIME}: ${common_name}/${REMOTE_IP} del route." >> ${LOG_FILE}
+	}
+}
+
+#可根据退出的账号自定义脚本，如静态路由表，组网等。
+SCRIPT="/usr/share/openvpn-server/script/client_disconnect/${common_name}"
+[ -s "$SCRIPT" ] && {
+	[ ! -x "$SCRIPT" ] && chmod 0755 "$SCRIPT"
+	"$SCRIPT" "$@"
+}
+exit 0

liep/luci-app-openvpn-server/root/usr/share/openvpn-server/script/down.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+
+uci -q batch <<-EOF >/dev/null
+	delete network.ovpn_server
+	commit network
+EOF
+
+ifup ovpn_server >/dev/null 2>&1
+ifdown ovpn_server >/dev/null 2>&1

liep/luci-app-openvpn-server/root/usr/share/openvpn-server/script/gen_client_config.sh

@@ -0,0 +1,24 @@
+#!/bin/sh
+
+CONFIG="luci-app-openvpn-server"
+
+port=$(uci -q get ${CONFIG}.server.port || echo "1194")
+proto=$(uci -q get ${CONFIG}.server.proto || echo "udp")
+ddns=$(uci -q get ${CONFIG}.server.ddns || echo "example.com")
+
+cat <<-EOF > /tmp/openvpn.ovpn
+	client
+	dev tun
+	proto ${proto}
+	remote ${ddns} ${port}
+	resolv-retry infinite
+	nobind
+	persist-key
+	persist-tun
+	auth-user-pass
+	comp-lzo
+	verb 3
+	<ca>
+	$(cat /usr/share/openvpn-server/ca.crt)
+	</ca>
+EOF

liep/luci-app-openvpn-server/root/usr/share/openvpn-server/script/up.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+
+uci -q batch <<-EOF >/dev/null
+	delete network.ovpn_server
+	set network.ovpn_server=interface
+	set network.ovpn_server.ifname="${dev}"
+	set network.ovpn_server.device="${dev}"
+	set network.ovpn_server.proto="static"
+	set network.ovpn_server.ipaddr="${ifconfig_local}"
+	set network.ovpn_server.netmask="${ifconfig_netmask}"
+	commit network
+	
+	set firewall.ovpn_server.network="ovpn_server"
+	commit firewall
+EOF
+
+ifdown ovpn_server >/dev/null 2>&1
+ifup ovpn_server >/dev/null 2>&1