Re: [PATCH] OpenVPN: Add to update and exclude

[Michael Tremer <michael.tremer@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 2388 bytes --]

Hi,

This patch is for Core Update 144, but I am not sure if we can ship it with this.

The update will contain the OpenSSL update that is announced for Tuesday and I would like to be able to release it as soon as possible.

I am not sure what the risk is with this patch delaying that release, so I will let Arne decide.

See below for more...

> On 17 Apr 2020, at 17:34, Erik Kapfer <ummeegge(a)ipfire.org> wrote:
> 
> Since some OpenVPN updates did not apply, the service will be stopped before the update to prevent 'Text file busy' and start up again.

Normally this should to be a problem. Tar is normally able to replace any binary, even if it is just running.

We definitely need to restart OpenVPN to take advantage of the new version.

> 
> Signed-off-by: Erik Kapfer <ummeegge(a)ipfire.org>
> ---
> config/rootfiles/core/144/exclude   |  1 +
> config/rootfiles/core/144/update.sh | 12 ++++++++++++
> 2 files changed, 13 insertions(+)
> 
> diff --git a/config/rootfiles/core/144/exclude b/config/rootfiles/core/144/exclude
> index b22159878..ba1b646e6 100644
> --- a/config/rootfiles/core/144/exclude
> +++ b/config/rootfiles/core/144/exclude
> @@ -24,5 +24,6 @@ var/lib/alternatives
> var/log/cache
> var/log/dhcpcd.log
> var/log/messages
> +var/ipfire/ovpn
> var/state/dhcp/dhcpd.leases
> var/updatecache
> diff --git a/config/rootfiles/core/144/update.sh b/config/rootfiles/core/144/update.sh
> index 6a9c51931..81a6c626e 100644
> --- a/config/rootfiles/core/144/update.sh
> +++ b/config/rootfiles/core/144/update.sh
> @@ -47,6 +47,15 @@ done
> # Remove files
> 
> # Stop services
> +# Stop OpenVPN server if it runs
> +if pgrep openvpn -fl | grep 'server.conf' >/dev/null 2>&1; then
> +	/usr/local/bin/openvpnctrl -k
> +fi
> +
> +# Stop OpenVPN N2N if it runs
> +if pgrep openvpn -fl | grep 'n2nconf' >/dev/null 2>&1; then
> +	/usr/local/bin/openvpnctrl -kn2n
> +fi

Interesting way to stop it. Can we not call openvpnctrl regardless, because it won’t matter if the daemon wasn’t running at all.

> # Extract files
> extract_files
> @@ -55,6 +64,9 @@ extract_files
> ldconfig
> 
> # Start services
> +# Start OpenVPN again
> +/usr/local/bin/openvpnctrl -s
> +/usr/local/bin/openvpnctrl -sn2n
> 
> # Update Language cache
> /usr/local/bin/update-lang-cache
> — 
> 2.20.1
> 

Best,
-Michael