Am 14.09.20 um 03:23 schrieb Rafael Gava: > Hello guys, > > A couple years ago I submitted this patch which allows the user to set > the 'client-ip' as a convenient way to use the leased IP address > received from OpenVPN server in NAT configuration. For example: > > client-nat snat client-ip 255.255.255.255 172.20.1.15 > > , where 'client-ip' string is replaced with the leased IP address > received from OpenVPN server. > > At that time, it was NACKED due to the fact that I was using both > client-ip and localhost strings. So, it's changed now and I'd like to > re-submit it again for appreciation.
The patch is not easy to apply since it seems to be copy&pasted inline
and not as attachment or via git-send-email and my git does not like it
at all and quits with 'Patch is empty.' Even after copying and pasting
the patch manually I get:
error: corrupt patch at line 21
> diff --git a/src/openvpn/clinat.c b/src/openvpn/clinat.c
> old mode 100644
> new mode 100755
> index b08fd54..865b0e2
> --- a/src/openvpn/clinat.c
> +++ b/src/openvpn/clinat.c
> @@ -128,12 +128,16 @@ add_client_nat_to_option_list(struct
> client_nat_option_list *dest,
> msg(msglevel, "client-nat: type must be 'snat' or 'dnat'");
> return;
> }
> -
> - e.network = getaddr(0, network, 0, &ok, NULL);
> - if (!ok)
> + if (network && !strcmp(network, "client-ip"))
> {
> - msg(msglevel, "client-nat: bad network: %s", network);
> - return;
> + e.network = 0xFFFFFFFF;
I am not happy about abusing 255.255.255.255 with any netmask as a
standin for localhost. Is there any need to have any other netmask than
/32 for client-ip? And if we are using a network for the IP I would
rather use a special IP from the 127/8 block with a define here. Or
maybe even add new flag like CN_SNAT_CLIENT_IP/CN_DNAT_CLIENT_IP that
get replaced with the real information later.
> + } else {
> + e.network = getaddr(0, network, 0, &ok, NULL);
> + if (!ok)
> + {
> + msg(msglevel, "client-nat: bad network: %s", network);
> + return;
> + }
> }
> e.netmask = getaddr(0, netmask, 0, &ok, NULL);
> if (!ok)
> @@ -276,3 +280,34 @@ client_nat_transform(const struct
> client_nat_option_list *list,
> }
> }
> }
> +
> +/*
> +* Replaces the client-ip token with the IP received from OpenVPN Server
> +*/
> +bool
> +update_client_ip_nat(struct client_nat_option_list *dest, in_addr_t
> local_ip)
> +{
> + int i;
> + bool ret = false;
> +
Please use C99 inline declaration, i.e. move the int i into the for loop.
> + if (!dest)
> + return ret;
> +
> + for (i=0; i <= dest->n; i++)
> + {
> + struct client_nat_entry *nat_entry = &dest->entries[i];
> + if (nat_entry && nat_entry->network == 0xFFFFFFFF)
> + {
> + struct in_addr addr;
> +
> + nat_entry->network = ntohl(local_ip);
> + addr.s_addr = nat_entry->network;
> + char *dot_ip = inet_ntoa(addr);
> +
> + msg (M_INFO, "Updating NAT table client-ip to: %s", dot_ip);
Logging this always with M_INFO feel excessive.
Arne
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Openvpn-devel mailing list Openvpn-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-devel
