How to use connection to server in down script?

mafo

Hi,

I'd like to have the client run a script on the server via ssh just before the client terminates. But when the down script executes (with down-pre set), the connection does not seem to be available anymore. Neither ssh nor ping can contact the server.

I'm using OpenVPN 2.3.4 for a bridged client on OpenWrt 14.07. The client's configuration is (sorry for strange order of entries, the config is generated from an OpenWrt configuration file):

client
down-pre
nobind
persist-key
persist-tun
pull
tls-client
up-delay
ca /etc/openvpn/ca.crt
cert /etc/openvpn/client.crt
comp-lzo no
dev tap
ipchange /usr/sbin/openvpn_info_handler
keepalive 10 60
key /etc/openvpn/client.key
mute 5
ns-cert-type server
proto udp
remote forkel.dynvpn.de 29878
resolv-retry infinite
route-delay 10
route-up /usr/sbin/openvpn_info_handler
script-security 2
status /tmp/openvpn-status.log
tls-verify /usr/sbin/openvpn_info_handler
verb 3
down /usr/sbin/openvpn_client_handler
up /usr/sbin/openvpn_client_handler

Any way to achieve this or just a bad idea?

Thanks in advance,
mafo

mafo

May be a subject line like "Can't use tunnel to server in client's down script" would have been a little catchier. But I'm still hopeful someone can help me...

In a client's down script, I would like to use ssh to run a script on the server that manages a client database (FQDN, IP address). But it seems the tunnel is already closed when the down script is run. The option down-pre is set on the client.

May be I could use a learn-address script on the server instead. Actually, this would even cover the case that the connection to the client is lost unexpectedly. But because its a bridging server, the arguments to 'learn-address delete' is a MAC address. And I haven't figured out yet how to relate that MAC address to the client's IP address in the database.

Traffic

The Manual wrote--down
Executed after TCP/UDP and TUN/TAP close.

https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR

mafo

True, but on the same manual page it says

The Manual wrote--down-pre
Call --down cmd/script before, rather than after, TUN/TAP close.

Nevertheless, the tunnel does not seem to be available anymmore.

Traffic

Hmm .. my apologies .. I overlooked your --down-pre usage :oops:

On testing I can confirm your findings ..

Test:

client.conf:

# down-pre-test
down-pre
down dpt
script-security 2
client
nobind
verb 4
remote ...

Script dpt:

#!/bin/bash
LOG=dpt.log
echo :: down-pre-test > $LOG
echo :: $(date) >> $LOG
ping 10.101.103.222 -c 10 >> $LOG
echo :: $(date) >> $LOG

dpt.log:

:: down-pre-test
:: Sat Dec 20 13:34:50 GMT 2014
PING 10.101.103.222 (10.101.103.222) 56(84) bytes of data.

--- 10.101.103.222 ping statistics ---
10 packets transmitted, 0 received, 100% packet loss, time 9019ms

:: Sat Dec 20 13:35:09 GMT 2014

client.log:

Sat Dec 20 13:34:16 2014 us=559312 Current Parameter Settings:

Sat Dec 20 13:34:16 2014 us=570584 up_script = '[UNDEF]'
Sat Dec 20 13:34:16 2014 us=570655 down_script = 'dpt'
Sat Dec 20 13:34:16 2014 us=570725 down_pre = ENABLED

Sat Dec 20 13:34:16 2014 us=586595 OpenVPN 2.3.6 i486-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Dec 1 2014
Sat Dec 20 13:34:16 2014 us=586781 library versions: OpenSSL 1.0.1e 11 Feb 2013, LZO 2.06

Sat Dec 20 13:34:16 2014 us=588501 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

Sat Dec 20 13:34:19 2014 us=292218 [...] Peer Connection Initiated with [AF_INET]x.x.x.x:1194
Sat Dec 20 13:34:21 2014 us=295924 SENT CONTROL [...]: 'PUSH_REQUEST' (status=1)
Sat Dec 20 13:34:21 2014 us=305851 PUSH: Received control message: 'PUSH_REPLY,...
Sat Dec 20 13:34:21 2014 us=307814 OPTIONS IMPORT: timers and/or timeouts modified
Sat Dec 20 13:34:21 2014 us=307938 OPTIONS IMPORT: explicit notify parm(s) modified
Sat Dec 20 13:34:21 2014 us=308044 OPTIONS IMPORT: LZO parms modified
Sat Dec 20 13:34:21 2014 us=308153 OPTIONS IMPORT: --ifconfig/up options modified
Sat Dec 20 13:34:21 2014 us=308344 OPTIONS IMPORT: route options modified
Sat Dec 20 13:34:21 2014 us=308445 OPTIONS IMPORT: route-related options modified
Sat Dec 20 13:34:21 2014 us=323141 TUN/TAP device tun0 opened
Sat Dec 20 13:34:21 2014 us=323359 TUN/TAP TX queue length set to 100
Sat Dec 20 13:34:21 2014 us=323504 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat Dec 20 13:34:21 2014 us=323667 /sbin/ifconfig tun0 10.101.103.76 netmask 255.255.255.0 mtu 1500 broadcast 10.101.103.255
Sat Dec 20 13:34:21 2014 us=362903 /sbin/route add ...
Sat Dec 20 13:34:21 2014 us=469794 Initialization Sequence Completed

Sat Dec 20 13:34:47 2014 us=157445 event_wait : Interrupted system call (code=4)
Sat Dec 20 13:34:47 2014 us=157654 SIGTERM received, sending exit notification to peer
Sat Dec 20 13:34:50 2014 us=283149 TCP/UDP: Closing socket

Sat Dec 20 13:34:50 2014 us=283484 /sbin/route del ...
Sat Dec 20 13:34:50 2014 us=327783 dpt tun0 1500 1558 10.101.103.76 255.255.255.0 init
Sat Dec 20 13:35:09 2014 us=441230 Closing TUN/TAP interface
Sat Dec 20 13:35:09 2014 us=441847 /sbin/ifconfig tun0 0.0.0.0
Sat Dec 20 13:35:09 2014 us=469699 SIGTERM[soft,exit-with-notification] received, process exiting

As you can see, the socket is closed; the script is executed and then the TUN/TAP interface is closed ...

I do not think it is a bug as the script is executed before the device is closed.

However, I cannot see the point to --down-pre executing the script after the socket is closed .. perhaps somebody can elaborate ?

mafo

Well, thanks a lot for constructing a test case and documenting the problem! This information is much better than what I had provided. 😉