[S] Change in openvpn[master]: Enable per-socket bind_dev via --local

Attention is currently required from: flichtenheld, its_Giaan, plaisthos.

Hello flichtenheld, plaisthos, 

I'd like you to reexamine a change. Please visit

    http://gerrit.openvpn.net/c/openvpn/+/1625?usp=email

to look at the new patch set (#4).

The following approvals got outdated and were removed:
Code-Review-1 by flichtenheld


Change subject: Enable per-socket bind_dev via --local
......................................................................

Enable per-socket bind_dev via --local

A bind device can now be specified within a
--local statement allowing to bind
different sockets to different devices.

While at it, improved the man-section for
--local.

Change-Id: I6319c951327a9b994ffae0ba35270b0887455203
Signed-off-by: Gianmarco De Gregori <[email protected]>
---
M doc/man-sections/link-options.rst
M doc/man-sections/vpn-network-options.rst
M src/openvpn/options.c
M src/openvpn/options.h
M src/openvpn/socket.c
5 files changed, 31 insertions(+), 5 deletions(-)


  git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/25/1625/4

diff --git a/doc/man-sections/link-options.rst b/doc/man-sections/link-options.rst
index edda1ca..1dcaba1 100644
--- a/doc/man-sections/link-options.rst
+++ b/doc/man-sections/link-options.rst
@@ -111,12 +111,19 @@
   Valid syntax:
   ::
 
-     local host|* [port] [protocol]
+     local host|* [port] [protocol] [bind device]
 
   Local host name or IP address and port for bind. If specified, OpenVPN will bind
   to this address. If unspecified, OpenVPN will bind to all interfaces.
   '*' can be used as hostname and means 'any host' (OpenVPN will listen on what
   is returned by the OS).
+
+  Optional arguments override the corresponding default options:
+
+  - ``port`` overrides ``--lport``.
+  - ``protocol`` overrides ``--proto``.
+  - ``bind device`` overrides ``--bind-dev``.
+
   On a client, or in point-to-point mode, this can only be specified once (1 socket).
 
   On an OpenVPN setup running as ``--server``, this can be specified multiple times
diff --git a/doc/man-sections/vpn-network-options.rst b/doc/man-sections/vpn-network-options.rst
index 33ebedb..f43382f 100644
--- a/doc/man-sections/vpn-network-options.rst
+++ b/doc/man-sections/vpn-network-options.rst
@@ -6,8 +6,10 @@
 routing.
 
 --bind-dev device
-  (Linux only) Set ``device`` to bind the server socket to a
+  (Linux only) Set ``device`` to bind all the server sockets to a
   `Virtual Routing and Forwarding`_ device
+  The default set by this option can be overridden on a per-socket basis
+  by specifying a bind device argument via ``--local``.
 
 --block-ipv6
   On the client, instead of sending IPv6 packets over the VPN tunnel, all
diff --git a/src/openvpn/options.c b/src/openvpn/options.c
index 70af6d2..63db6db 100644
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
@@ -128,10 +128,12 @@
     "--version       : Show copyright and version information.\n"
     "\n"
     "Tunnel Options:\n"
-    "--local host|* [port]: Local host name or IP address and port for bind.\n"
+    "--local host|* [port] [protocol] [bind-dev]: Local host name or IP address and port for bind.\n"
     "                        If specified, OpenVPN will bindto this address. If unspecified,\n"
     "                        OpenVPN will bind to all interfaces. '*' can be used as hostname\n"
     "                        and means 'any host' (OpenVPN will listen on what is returned by the OS).\n"
+    "                        The optional arguments correspond to existing options: ``port`` to ``--lport``,\n"
+    "                        ``protocol`` to ``--proto``, and ``bind device`` to --bind-dev``.\n"
     "                        On a client, or in point-to-point mode, this can only be specified once (1 socket).\n"
     "                        On an OpenVPN setup running as ``--server``, this can be specified multiple times\n"
     "                        to open multiple listening sockets on different addresses and/or different ports.\n"
@@ -3830,6 +3832,7 @@
         ASSERT(e);
         e->port = o->ce.local_port;
         e->proto = o->ce.proto;
+        e->bind_dev = o->bind_dev;
     }
 
     /* use the same listen list for every outgoing connection */
@@ -5972,7 +5975,7 @@
         VERIFY_PERMISSION(OPT_P_UP);
         options->ifconfig_nowarn = true;
     }
-    else if (streq(p[0], "local") && p[1] && !p[4])
+    else if (streq(p[0], "local") && p[1] && !p[5])
     {
         struct local_entry *e;
 
@@ -5998,6 +6001,17 @@
         {
             e->proto = ascii2proto(p[3]);
         }
+#if defined(TARGET_LINUX)
+        if (p[4])
+        {
+            e->bind_dev = p[4];
+        }
+#else
+        if (p[4])
+        {
+            msg(M_WARN, "Note: bind_dev is ignored on non-Linux systems");
+        }
+#endif
     }
     else if (streq(p[0], "remote-random") && !p[1])
     {
diff --git a/src/openvpn/options.h b/src/openvpn/options.h
index a111cf8..c9f61d1 100644
--- a/src/openvpn/options.h
+++ b/src/openvpn/options.h
@@ -101,6 +101,7 @@
     const char *local;
     const char *port;
     int proto;
+    const char *bind_dev;
 };
 
 struct connection_entry
diff --git a/src/openvpn/socket.c b/src/openvpn/socket.c
index 624ce4f..018d12d 100644
--- a/src/openvpn/socket.c
+++ b/src/openvpn/socket.c
@@ -1349,6 +1349,7 @@
     const char *host = o->ce.local_list->array[sock_index]->local;
     const char *port = o->ce.local_list->array[sock_index]->port;
     int proto = o->ce.local_list->array[sock_index]->proto;
+    const char *bind_dev = o->ce.local_list->array[sock_index]->bind_dev;
     const char *remote_host = o->ce.remote;
     const char *remote_port = o->ce.remote_port;
 
@@ -1409,7 +1410,8 @@
 #endif
 
     sock->mark = o->mark;
-    sock->bind_dev = o->bind_dev;
+    /* bind_dev from local_list will trump the global option */
+    sock->bind_dev = bind_dev ? bind_dev : o->bind_dev;
     sock->info.proto = proto;
     sock->info.af = o->ce.af;
     sock->info.remote_float = o->ce.remote_float;

-- 
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1625?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: newpatchset
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I6319c951327a9b994ffae0ba35270b0887455203
Gerrit-Change-Number: 1625
Gerrit-PatchSet: 4
Gerrit-Owner: its_Giaan <[email protected]>
Gerrit-Reviewer: flichtenheld <[email protected]>
Gerrit-Reviewer: plaisthos <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: plaisthos <[email protected]>
Gerrit-Attention: its_Giaan <[email protected]>
Gerrit-Attention: flichtenheld <[email protected]>

_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel