From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4cPkhz0D5yz2xWj for ; Sun, 14 Sep 2025 10:21:23 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4cPkhy75gDz2xMw for ; Sun, 14 Sep 2025 10:21:22 +0000 (UTC) Received: from people01.haj.ipfire.org (people01.haj.ipfire.org [172.28.1.161]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "people01.haj.ipfire.org", Issuer "E8" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4cPkhy3ZgYz3Xp for ; Sun, 14 Sep 2025 10:21:22 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1757845282; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=FGYeQhaT862rNRjs/AloabxygKprHOSD4tp/0k3HuNs=; b=D8k886t9oq0T2L+TfUa4spLnRc8f/ParzpxAunwonodJo8M9OlB53CSa1dNJHJ7AtelAev yFbo0Zh79UjPscCg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1757845282; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=FGYeQhaT862rNRjs/AloabxygKprHOSD4tp/0k3HuNs=; b=AW1gFQ6Xf4Ad7e96gMSd9pF8t8lBflJWiAFd7NMB49vgbO7/EqJYatswBV8mwzQumcHqZ6 uwXE5QJRWb0uIF9GgHwy4o5WX7URwfxYGG1+urhD7nCT5IYGG8SX/1LviUHRNSv/vZNYYj Gh4WmB2PxOtXxINxpcv50Iqp6RRBdhTdT/l17sfR9DduJL138wdUFjRK4uyE9+YxHiKuin im/AoKk8yhuHtnm1F1jOi+zX9++1+sXSvZuBoOTCfrb2gsje15Ov9rqzVxE/WAHRIzcu9D NMKLf0xAa++ax+yh19C/OkngLQtDSolIEnspb33nJKbWL7yh1VUL3cI/I8bhew== Received: by people01.haj.ipfire.org (Postfix, from userid 1000) id 4cPkhy2tDJz2xcB; Sun, 14 Sep 2025 10:21:22 +0000 (UTC) To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, next, updated. f0a4f19ca13c6faaa4f446eb085e801473eb5d88 X-Git-Refname: refs/heads/next X-Git-Reftype: branch X-Git-Oldrev: fbe50152d997049cdcdb71b38baf989c5a119a1a X-Git-Newrev: f0a4f19ca13c6faaa4f446eb085e801473eb5d88 Message-Id: <4cPkhy2tDJz2xcB@people01.haj.ipfire.org> Date: Sun, 14 Sep 2025 10:21:22 +0000 (UTC) From: Michael Tremer Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via f0a4f19ca13c6faaa4f446eb085e801473eb5d88 (commit) via 54944268e729c8939a49a3e9536f5ad85ce9c2b8 (commit) via 771afe5726c4faef8efeea7e569b7537ed78c9aa (commit) via 6b486bac32699ba9d7f8abc5a4201e5a8a4fec41 (commit) from fbe50152d997049cdcdb71b38baf989c5a119a1a (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit f0a4f19ca13c6faaa4f446eb085e801473eb5d88 Merge: fbe50152d 54944268e Author: Michael Tremer Date: Sun Sep 14 10:21:17 2025 +0000 Merge branch 'master' into next ----------------------------------------------------------------------- Summary of changes: html/cgi-bin/ovpnmain.cgi | 44 +++++++++++++++++++++++++++++++++----------- 1 file changed, 33 insertions(+), 11 deletions(-) Difference in files: diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index ccf46fb02..2dc4ae18d 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -605,7 +605,6 @@ sub write_ccd_configs() { foreach my $key (keys %conns) { my $name = $conns{$key}[1]; my $type = $conns{$key}[3]; - my $gateway = ""; # Skip anything that isn't a host connection next unless ($type eq "host"); @@ -637,12 +636,34 @@ sub write_ccd_configs() { # The gateway is always the first address in the network # (this is needed to push any routes below) - $gateway = &Network::find_next_ip_address($netaddr, 1); + my $gateway = &Network::find_next_ip_address($netaddr, 1); if (defined $address && defined $network && defined $netmask) { print CONF "# Allocated IP address from $pool\n"; - print CONF "ifconfig-push ${address} ${netmask}\n\n"; + print CONF "ifconfig-push ${address} ${netmask}\n"; + } + + # Push the first address of the static pool as the gateway. + # Withtout this pushed, the client will receive the first IP address + # of the dynamic pool which will cause problems later on: + # Any additional routes won't be able to reach the dynamic gateway + # but pushing a host route is not possible, because the OpenVPN client + # does not seem to understand how a layer 3 VPN works. + if (defined $gateway) { + print CONF "push \"route-gateway ${gateway}\"\n"; } + + # Add a host route for the dynamic pool gateway so that + # the firewall can reach the client without needing to assign + # the gateway IP address of the static pool to the tun interface. + $netaddr = &Network::get_netaddress($vpnsettings{'DOVPN_SUBNET'}); + $gateway = &Network::find_next_ip_address($netaddr, 1); + if (defined $gateway) { + print CONF "push \"route ${gateway} 255.255.255.255\"\n"; + } + + # End the block + print CONF "\n"; } # Redirect Gateway? @@ -714,7 +735,7 @@ sub write_ccd_configs() { next; } - print CONF "push \"route $netaddress $netmask $gateway\"\n"; + print CONF "push \"route $netaddress $netmask\"\n"; } # Newline @@ -924,23 +945,24 @@ sub check_ccdconf sub read_routepushfile($) { my $hash = shift; - # Don't read the legacy file if we already have a value - if ($hash->{'ROUTES_PUSH'} ne "") { - unlink($routes_push_file); - # This is some legacy code that reads the routes file if it is still present - } elsif (-e "$routes_push_file") { - delete $hash->{'ROUTES_PUSH'}; - + if (-e "$routes_push_file") { my @routes = (); open(FILE,"$routes_push_file"); while () { + chomp; push(@routes, $_); } close(FILE); $hash->{'ROUTES_PUSH'} = join("|", @routes); + + # Write the settings + &writesettings(); + + # Unlink the legacy file + unlink($routes_push_file); } } hooks/post-receive -- IPFire 2.x development tree