[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 32280102d774eb3b19c423efbd40145f2e524427

[Michael Tremer <git@ipfire.org>]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  32280102d774eb3b19c423efbd40145f2e524427 (commit)
       via  c3936b58dd71806c561d38ff326af732fcae54dd (commit)
       via  21f50e457e90a65127476b1ccee262cf535e95aa (commit)
      from  24ad6f00b5c69f1ba882e0b11c6aee3ce8e2b619 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 32280102d774eb3b19c423efbd40145f2e524427
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Tue Dec 2 16:27:20 2025 +0000

    core200: Ship and apply OpenVPN RW changes
    
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit c3936b58dd71806c561d38ff326af732fcae54dd
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Tue Dec 2 17:20:46 2025 +0100

    ovpnmain.cgi: Push auth-token only to clients that use OTP
    
    This is mainly a cosmetic change as some clients complain about
    importing this option as it is supposed to be "push-only".
    
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit 21f50e457e90a65127476b1ccee262cf535e95aa
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Tue Dec 2 12:43:39 2025 +0100

    ovpnmain.cgi: Push the MTU to the clients
    
    This is supported for clients >= 2.6 and will grant us some extra
    flexibility if this value needs to be changed.
    
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 config/rootfiles/core/200/filelists/files |  1 +
 config/rootfiles/core/200/update.sh       |  4 ++++
 html/cgi-bin/ovpnmain.cgi                 | 12 ++++++++----
 3 files changed, 13 insertions(+), 4 deletions(-)

Difference in files:
diff --git a/config/rootfiles/core/200/filelists/files b/config/rootfiles/core/200/filelists/files
index e69de29bb..f7a8b3297 100644
--- a/config/rootfiles/core/200/filelists/files
+++ b/config/rootfiles/core/200/filelists/files
@@ -0,0 +1 @@
+srv/web/ipfire/cgi-bin/ovpnmain.cgi
diff --git a/config/rootfiles/core/200/update.sh b/config/rootfiles/core/200/update.sh
index 6dba91fce..7d00047b1 100644
--- a/config/rootfiles/core/200/update.sh
+++ b/config/rootfiles/core/200/update.sh
@@ -69,8 +69,12 @@ ldconfig
 # Apply SSH configuration
 /usr/local/bin/sshctrl
 
+# Update the OpenVPN configuration
+sudo -u nobody /srv/web/ipfire/cgi-bin/ovpnmain.cgi
+
 # Start services
 /etc/init.d/unbound restart
+/etc/init.d/openvpn-rw restart
 
 # Build initial ramdisks (for intel-microcode)
 dracut --regenerate-all --force
diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi
index ec86a218b..dd4f98246 100644
--- a/html/cgi-bin/ovpnmain.cgi
+++ b/html/cgi-bin/ovpnmain.cgi
@@ -265,7 +265,10 @@ sub writeserverconf {
     my $subnetmask = &Network::get_netmask($vpnsettings{'DOVPN_SUBNET'});
 
     print CONF "server $netaddress $subnetmask\n";
+
+    # Set the MTU and push it to the clients
     print CONF "tun-mtu $vpnsettings{'DMTU'}\n";
+    print CONF "push \"tun-mtu $vpnsettings{'DMTU'}\"\n";
 
 	# Write custom routes
     if ($vpnsettings{'ROUTES_PUSH'} ne '') {
@@ -624,6 +627,11 @@ sub write_ccd_configs() {
 		# Write a header
 		print CONF "# OpenVPN Client Configuration File\n\n";
 
+		# Push the auth-token if the client is using OTP
+		if ($conns{$key}[43] eq 'on') {
+			print CONF "push \"auth-token TOTP\"\n\n";
+		}
+
 		# Fetch the allocated IP address (if any)
 		my $pool    = $conns{$key}[32];
 		my $address = $conns{$key}[33];
@@ -2436,9 +2444,6 @@ END
 		print "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\n";
 		print "proto $vpnsettings{'DPROTOCOL'}\n";
 
-		# Configure the MTU of the tunnel interface
-		print "tun-mtu $vpnsettings{'DMTU'}\n";
-
 		# Ask the client to verify the server certificate
 		if (&is_cert_rfc3280_compliant("${General::swroot}/ovpn/certs/servercert.pem")) {
 			print "remote-cert-tls server\n";
@@ -2465,7 +2470,6 @@ END
 		# Set a fake user name for authentication
 		print "auth-user-pass\n";
 		print "auth-token-user USER\n";
-		print "auth-token TOTP\n";
 
 		# If the server is asking for TOTP this needs to happen interactively
 		print "auth-retry interact\n";


hooks/post-receive
--
IPFire 2.x development tree