services: openvpn: Allow client to pull DNS settings from server.

* gnu/services/vpn.scm (pull-dns?): New variable.
(serialize-pull-dns): New variable.
(make-up-down-config-options): New variable.
(make-script-security-cli-options): New variable.
(openvpn-client-configuration)[pull-dns?]: New field.
(openvpn-config-file): Serialize that field.
(openvpn-shepherd-service): Pass `--script-security' option to daemon.

Change-Id: I1141dd0b9bf5956f13cf1552c2718b0a7035fa86

1 files changed, 35 insertions, 4 deletions

diff --git a/gnu/services/vpn.scm b/gnu/services/vpn.scm
index 8e90032c93..71ab5bda1c 100644
--- a/gnu/services/vpn.scm
+++ b/gnu/services/vpn.scm
@@ -173,6 +173,27 @@
       (format #t "resolv-retry infinite\n")
       #f))
 
+(define pull-dns? boolean?)
+(define serialize-pull-dns empty-serializer)
+
+(define (make-up-down-config-options config)
+  (if (and (openvpn-client-configuration? config)
+           (openvpn-client-configuration-pull-dns? config))
+
+      #~(let ((openvpn #$(openvpn-client-configuration-openvpn config)))
+          (format #f "\
+up ~a/etc/openvpn/client.up
+down ~a/etc/openvpn/client.down
+" openvpn openvpn))
+
+      ""))
+
+(define (make-script-security-cli-options config)
+  (if (and (openvpn-client-configuration? config)
+           (openvpn-client-configuration-pull-dns? config))
+      '("--script-security" "2")
+      '()))
+
 (define (serialize-tls-auth role location)
   (if location
       (serialize-field 'tls-auth
@@ -398,7 +419,11 @@ would be added to the store and readable by any user.")
 
    (remote
     (openvpn-remote-list '())
-    "A list of remote servers to connect to."))
+    "A list of remote servers to connect to.")
+
+  (pull-dns?
+   (pull-dns #f)
+   "Install resolv.conf entries pulled from the server."))
   ;; server-specific configuration
   ((tls-auth
     (tls-auth-server #f)
@@ -481,7 +506,9 @@ is truncated and rewritten every minute.")
                              ('server (display
                                        (string-append "client-config-dir "
                                                       #$ccd-dir "\n") port))
-                             ('client (display "" port)))))))))
+                             ('client (display #$(make-up-down-config-options
+                                                  config)
+                                               port)))))))))
 
 (define (openvpn-shepherd-service role)
   (lambda (config)
@@ -496,7 +523,11 @@ is truncated and rewritten every minute.")
                      config))
            (log-file (match role
                        ('server "/var/log/openvpn-server.log")
-                       ('client "/var/log/openvpn-client.log"))))
+                       ('client "/var/log/openvpn-client.log")))
+           (script-sec-opts (match role
+                              ('server '())
+                              ('client (make-script-security-cli-options
+                                        config)))))
       (list (shepherd-service
              (documentation (string-append "Run the OpenVPN "
                                            (match role
@@ -510,7 +541,7 @@ is truncated and rewritten every minute.")
              (start #~(make-forkexec-constructor
                        (list (string-append #$openvpn "/sbin/openvpn")
                              "--writepid" #$pid-file "--config" #$config-file
-                             "--daemon")
+                             #$@script-sec-opts "--daemon")
                        #:pid-file #$pid-file
                        #:log-file #$log-file))
              (stop #~(make-kill-destructor)))))))