#!/sbin/runscript
# Copyright 1999-2006 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2

VPNDIR="${VPNDIR:-/etc/openvpn}"
VPN="${SVCNAME#*.}"
if [[ -n ${VPN} && ${SVCNAME} != "openvpn" ]]; then
	VPNPID="/var/run/openvpn.${VPN}.pid"
else
	VPNPID="/var/run/openvpn.pid"
fi
VPNCONF="${VPNDIR}/${VPN}.conf"

depend() {
	need net
	use dns
}

checkconfig() {
	# Linux has good dynamic tun/tap creation
	if [[ $(uname) == "Linux" ]] ; then
		if [[ ! -e /dev/net/tun ]]; then
			if ! modprobe tun ; then
				eerror "TUN/TAP support is not available" \
					"in this kernel"
				return 1
			fi
		fi
		if [[ -h /dev/net/tun && -c /dev/misc/net/tun ]]; then
			ebegin "Detected broken /dev/net/tun symlink, fixing..."
			rm -f /dev/net/tun
			ln -s /dev/misc/net/tun /dev/net/tun
			eend $?
		fi
		return 0
	fi

	# Other OS's don't, so we rely on a pre-configured interface
	# per vpn instance
	local ifname=
	if [[ ! $'\n'$(<"${VPNCONF}") =~ \
	$'\n'"[[:space:]]*dev[[:space:]]*([^[[:space:]]*)" ]] ; then
		eerror "You need to specify the interface that this openvpn" \
			"instance should use" \
			"by using the dev option in ${VPNCONF}"
		return 1
	fi

	ifname="${BASH_REMATCH[1]}"
	if ! ifconfig "${ifname}" &>/dev/null ; then
		# Try and create it
		echo > /dev/"${ifname}" &>/dev/null
	fi
	if ! ifconfig "${ifname}" &>/dev/null ; then
		eerror "${VPNCONF} requires interface ${ifname}" \
			"but that does not exist"
		return 1
	fi
}

start() {
	# If we are re-called by the openvpn gentoo-up.sh script
	# then we don't actually want to start openvpn
	[[ ${IN_BACKGROUND} == "true" ]] && return 0
	
	ebegin "Starting ${SVCNAME}"

	checkconfig || return 1

	local args="" client=false
	# If the config file does not specify the cd option, we do
	# But if we specify it, we override the config option which we do not want
	if ! grep -q "^[ \t]*cd[ \t].*" "${VPNCONF}" ; then
		args="${args} --cd ${VPNDIR}"
	fi
	
	# We mark the service as inactive and then start it.
	# When we get an authenticated packet from the peer then we run our script
	# which configures our DNS if any and marks us as up.
	if grep -q "^[ \t]*remote[ \t].*" "${VPNCONF}" ; then
		client=true
		args="${args} --nobind --up-delay --up-restart"
		args="${args} --up /etc/openvpn/up.sh"
		args="${args} --down-pre --down /etc/openvpn/down.sh"

		# Warn about setting scripts as we override them 
		if grep -Eq "^[ \t]*(up|down)[ \t].*" "${VPNCONF}" ; then
			ewarn "WARNING: You have defined your own up/down scripts"
			ewarn "As you're running as a client, we now force Gentoo specific"
			ewarn "scripts to be run for up and down events."
			ewarn "These scripts will call /etc/openvpn/${SVCNAME}-{up,down}.sh"
			ewarn "where you can put your own code."
		fi

		# Warn about the inability to change ip/route/dns information when
		# dropping privs
		if grep -q "^[ \t]*user[ \t].*" "${VPNCONF}" ; then
			ewarn "WARNING: You are dropping root privileges!"
			ewarn "As such openvpn may not be able to change ip, routing"
			ewarn "or DNS configuration."
		fi
	else
		# So we're a server. Run as openvpn unless otherwise specified
		grep -q "^[ \t]*user[ \t].*" "${VPNCONF}" || args="${args} --user openvpn"
		grep -q "^[ \t]*group[ \t].*" "${VPNCONF}" || args="${args} --group openvpn"
	fi

	if ${client} && [[ $(type -t mark_service_inactive) == "function" ]]  ; then
		mark_service_inactive "${SVCNAME}"
	fi
	start-stop-daemon --start --exec /usr/sbin/openvpn --pidfile "${VPNPID}" \
		-- --config "${VPNCONF}" --writepid "${VPNPID}" --daemon ${args}
	eend $? "Check your logs to see why startup failed"
}

stop() {
	# If we are re-called by the openvpn gentoo-down.sh script
	# then we don't actually want to stop openvpn
	if [[ ${IN_BACKGROUND} == "true" ]] ; then
		[[ $(type -t mark_service_inactive) == "function" ]] \
			&& mark_service_inactive "${SVCNAME}"
		return 0
	fi

	ebegin "Stopping ${SVCNAME}"
	start-stop-daemon --stop --exec /usr/sbin/openvpn --pidfile "${VPNPID}"
	eend $?
}

# vim: set ts=4 :