packages/net/openvpn/files, branch master

openvpn: add missing host routes

2026-05-22T04:11:38Z

Maintainer: Alexandru Ardelean ping @feckert First of all big thanks to all involved devs, porting this to proto is not a minor task and besides some small quirks it is working well. (Not all that happy with the use of a default route instead of /1 routes, because you loose internet if the tunnel goes down but that is just me nitpicking) However I had problems with default routing as the host routes to the server endpoint were missing. I tracked it down to code in the `openvpn-hotplug` script and made some changes and in my testing it appears to work now. As a bonus I also added code for a future implementation of the `nohostroute` option. Problem: The host routes were created by just using route setup this however does not work. Solution: using `proto_add_host_dependency` seems the better solution. Furthermore the correct guard for IPv6 seems to be `net_gateway_ipv6` instead of `route_ipv6_gateway` however even the correct guard is only working if ipv6 source routing is disabled on wan6, so perhaps we should consider removing the guard entirely. For now I left it in place with a warning. I have tested it on X86 running master build from 5 days ago, both for IPv4 and IPv6 Please have a look and consider implementing. Thanks Signed-off-by: Erik Conijn

openvpn: handler: refine netifd routing and config

2026-04-17T06:48:33Z

Introduce a new `ipv6` proto option for OpenVPN netifd integration and export it to the hotplug environment. IPv6 remains enabled by default, but can now be explicitly disabled per instance. Update the hotplug helper to apply IPv6 addresses and routes only when IPv6 is enabled, allowing cleaner IPv4-only tunnel deployments. Also improve route handling by: - ignoring invalid default gateway values (0.0.0.0 / ::) - replacing fixed `seq` loops with shell-safe while loops - keeping trusted peer host routes conditional on valid gateways Signed-off-by: Chen Minqiang

openvpn: fix quoting and deprecated option filtering

2026-03-27T13:56:22Z

This patch fixes two issues in the netifd protocol script: 1. Fix logic error in deprecated option filtering: Previously, ${f%%:*} was called before checking for the deprecated flag (:d). This stripped the suffix and made the check [ "${f#*:}" = "d" ] always fail. The cleaning of $f is now deferred until after this check. 2. Improve parameter quoting for specific options: - Adds single quotes to --push and --push-remove parameters to handle spaces (e.g., "route 10.0.0.0 255.255.255.0"). - Unifies quoting for 'file' type options to improve shell safety. - Refactors the build logic using a case statement for better extensibility. Signed-off-by: Chen Minqiang

openvpn: handle netifd setup in hotplug script

2026-03-21T13:47:47Z

- Process 'up'/'down' events to manage interface status. - Add IPv4/IPv6 addresses and routes via netifd-proto. - Parse DNS/search domains from foreign options. - Convert netmasks and CIDR strings with new helpers. - Apply MTU settings from OpenVPN environment. Signed-off-by: Chen Minqiang

openvpn: cleanup and fix netifd proto script logic

2026-03-21T13:47:47Z

- Default to '--ifconfig-noexec' and '--route-noexec' to allow hotplug script to handle IP and routing configuration. - Only append '--auth-user-pass-verify' if the option is explicitly configured to avoid unexpected authentication requirements. - Fix missing retrieval of 'auth_user_pass', 'askpass', and 'tls_verify'. - Remove redundant '--config' parameter (managed by option_builder). - Simplify 'script_security' assignment logic. Signed-off-by: Chen Minqiang

openvpn: change tmp-dir to /tmp

2026-03-15T06:45:36Z

This allows openvpn to create any temp files after user or group change at exec time. Signed-off-by: Paul Donald

openvpn: change file/path types

2026-03-15T06:45:36Z

move file and path type values to FILE type params so they are better handled with quoting, in case paths contain spaces. Remove duplicate 'extra_certs'. Signed-off-by: Paul Donald

openvpn: proto handler; write params to config file

2026-03-15T06:45:36Z

writing the command line to a config file avoids formatting pitfalls for the command line. Signed-off-by: Paul Donald

openvpn: proto handler; trim white-space from append

2026-03-15T06:45:36Z

'append' inserts white-space by default (3rd parameter) Signed-off-by: Paul Donald

openvpn: shell proto script improvements

2026-03-15T06:45:36Z

add mode server hook scripts hotplug handling Signed-off-by: Paul Donald