I made some additional code changes to check the Framed-Route format to ensure it complies with the RFC.
/etc/inc/openvpn.auth-user.php
/**
* Convert Framed-Route format to iroute for the CCD file
*/
function FramedRoute($cidr) {
$baseip = substr($cidr,0,strpos($cidr, '/'));
$prefix = substr($cidr, strpos($cidr, '/') + 1) * 1;
$netmask = str_split(str_pad(str_pad('', $prefix, '1'), 32, '0'), 8);
$ipLong = ip2long($baseip);
if ( ( ($ipLong << $prefix) ^ 0) == true ) {
foreach ($netmask as &$element) $element = bindec($element);
return $baseip.' '.join('.', $netmask);
}
}
if (isset($attributes['framed_route'])) {
$iroute = FramedRoute($attributes['framed_route']);
if (!empty($iroute)) {
file_put_contents("{$g['varetc_path']}/openvpn-csc/{$username}", "iroute {$iroute}\n");
syslog(LOG_NOTICE, "user '{$username}' iroute '{$iroute}' created\n");
}
}
I'm creating static openvpn-csc file that could cause issues in the future.
Should I be looking at,
deleting the created openvpn-csc on client disconnect
using the openvpn_resync_csc function
