feat(ns-openvpn): log VPN auth events

Add structured syslog audit lines to the local and remote
OpenVPN authentication helpers plus the connection and
disconnection hooks.

These events provide stable input for victoria-logs queries so the
audit report can identify OpenVPN authentication results and VPN
session lifecycle activity without scraping fragile free-form log
messages.

Assisted-by: Copilot:gpt-5.4

Author: gsanchietti

packages/ns-openvpn/files/80-save-connection

@@ -9,6 +9,7 @@ import re
 import os
 import sys
 import sqlite3
+import syslog
 from euci import EUci
 from nethsec import users
 
@@ -37,6 +38,8 @@ instance = re.sub(r'^openvpn-|\.conf$', '', config_path)
 virtual_ip_addr = os.environ.get("ifconfig_pool_remote_ip")
 uci = EUci()
 
+syslog.openlog("openvpn-connect", syslog.LOG_PID, syslog.LOG_AUTHPRIV)
+
 # The OpenVPN server sets the virtual IP address of the client in the environment variable ifconfig_pool_remote_ip,
 # still this value is not reliable in case of an IP reservation.
 try:
@@ -63,6 +66,10 @@ try:
     start_time = int(os.environ.get('time_unix'))
 
     c.execute("INSERT INTO connections (common_name, virtual_ip_addr, remote_ip_addr, start_time) VALUES (?, ?, ?, ?)", (common_name, virtual_ip_addr, remote_ip_addr, start_time))
+    syslog.syslog(
+        syslog.LOG_INFO,
+        f"event=connect instance={instance} user={common_name} remote_ip={remote_ip_addr} virtual_ip={virtual_ip_addr} start_time={start_time}"
+    )
 
     conn.commit()
     conn.close()

packages/ns-openvpn/files/80-save-disconnection

@@ -8,6 +8,7 @@
 import os
 import sys
 import sqlite3
+import syslog
 from euci import EUci
 from nethsec import users
 
@@ -20,6 +21,9 @@ def get_db_path(u, instance):
 uci = EUci()
 conn = sqlite3.connect(get_db_path(uci, sys.argv[1]))
 c = conn.cursor()
+instance = sys.argv[1]
+
+syslog.openlog("openvpn-disconnect", syslog.LOG_PID, syslog.LOG_AUTHPRIV)
 
 env = os.environ
 common_name = env.get('common_name')
@@ -29,6 +33,8 @@ start_time = int(env.get('time_unix', '0'))
 duration = int(env.get('time_duration', '0'))
 bytes_received = int(env.get('bytes_received', '0'))
 bytes_sent = int(env.get('bytes_sent', '0'))
+virtual_ip_addr = env.get('ifconfig_pool_remote_ip', '')
+remote_ip_addr = env.get('untrusted_ip', '')
 
 # Update connection data
 c.execute("UPDATE connections SET duration=?, bytes_received=?, bytes_sent=? WHERE common_name=? and start_time=?", (duration, bytes_received, bytes_sent, common_name, start_time))
@@ -47,8 +53,6 @@ if c.rowcount == 0:
         pass
 
     if enabled:
-        virtual_ip_addr = env.get('ifconfig_pool_remote_ip', '')
-        remote_ip_addr = env.get('untrusted_ip', '')
         c.execute(
             "INSERT INTO connections (common_name, virtual_ip_addr, remote_ip_addr, start_time, duration, bytes_received, bytes_sent) "
             "VALUES (?, ?, ?, ?, ?, ?, ?)",
@@ -57,4 +61,8 @@ if c.rowcount == 0:
 
 conn.commit()
 conn.close()
+syslog.syslog(
+    syslog.LOG_INFO,
+    f"event=disconnect instance={instance} user={common_name} remote_ip={remote_ip_addr} virtual_ip={virtual_ip_addr} start_time={start_time} duration={duration} bytes_received={bytes_received} bytes_sent={bytes_sent}"
+)
 sys.exit(0)

packages/ns-openvpn/files/openvpn-local-auth

@@ -12,6 +12,7 @@
 
 import os
 import re
+import syslog
 import sys
 from euci import EUci
 from nethsec import users
@@ -21,29 +22,46 @@ password = os.environ.get("password")
 config_path = os.environ.get("config")
 
 instance = re.sub(r'^openvpn-|\.conf$', '', config_path)
+remote_ip = os.environ.get("untrusted_ip", "unknown")
+
+syslog.openlog("openvpn-auth", syslog.LOG_PID, syslog.LOG_AUTHPRIV)
+
+
+def audit(outcome, reason=None):
+    message = f"event=auth outcome={outcome} instance={instance} user={username} remote_ip={remote_ip}"
+    if reason:
+        message = f"{message} reason={reason}"
+    priority = syslog.LOG_INFO if outcome == "success" else syslog.LOG_WARNING
+    syslog.syslog(priority, message)
 
 uci = EUci()
 try:
     db = uci.get("openvpn", instance, "ns_user_db")
 except:
     # user db not set
+    audit("failure", "user_db_not_set")
     sys.exit(5)
 
 user = users.get_user_by_name(uci, username, db)
 if user is None:
     # user not found
+    audit("failure", "user_not_found")
     sys.exit(4)
 
 if not "openvpn_enabled" in user or user["openvpn_enabled"] != "1":
     # user not enabled
+    audit("failure", "user_disabled")
     sys.exit(3)
 
 if "password" not in user:
     # password not set
+    audit("failure", "password_not_set")
     sys.exit(2)
 
 if users.check_password(password, user["password"]):
+    audit("success")
     sys.exit(0)
 else:
     # password do not match
+    audit("failure", "password_mismatch")
     sys.exit(1)

packages/ns-openvpn/files/openvpn-remote-auth

@@ -13,6 +13,7 @@
 import re
 import os
 import sys
+import syslog
 import subprocess
 from euci import EUci
 from nethsec import users
@@ -21,11 +22,21 @@ def debug(msg):
     if os.environ.get("debug", False):
         print(f'[DEBUG] {msg}', file=sys.stderr)
 
+
+def audit(outcome, reason=None):
+    message = f"event=auth outcome={outcome} instance={instance} user={username} remote_ip={remote_ip}"
+    if reason:
+        message = f"{message} reason={reason}"
+    priority = syslog.LOG_INFO if outcome == "success" else syslog.LOG_WARNING
+    syslog.syslog(priority, message)
+
 username = os.environ.get("username")
 password = os.environ.get("password")
 config_path = os.environ.get("config")
+remote_ip = os.environ.get("untrusted_ip", "unknown")
 
 instance = re.sub(r'^openvpn-|\.conf$', '', config_path)
+syslog.openlog("openvpn-auth", syslog.LOG_PID, syslog.LOG_AUTHPRIV)
 debug(f"Instance: {instance}")
 
 ldap = {}
@@ -36,6 +47,7 @@ try:
 except:
     # user db not set or not found
     debug("Error: user db not found")
+    audit("failure", "user_db_not_found")
     sys.exit(5)
 
 debug(f"Username: {username}")
@@ -45,11 +57,13 @@ debug(f"User: {user}")
 if user is None:
     # user not found
     debug(f"Error: user '{user}' not found")
+    audit("failure", "user_not_found")
     sys.exit(4)
 
 if not "openvpn_enabled" in user or user["openvpn_enabled"] != "1":
     # user not enabled
     debug(f"Error: user '{user}' disabled")
+    audit("failure", "user_disabled")
     sys.exit(3)
 
 uri = ldap.get("uri", "")
@@ -64,6 +78,7 @@ user_bind_dn = ldap.get("user_bind_dn")
 if not uri or not base_dn:
     # no info to connect ldap db
     debug(f"Error: invalid LDAP URI or base DN")
+    audit("failure", "invalid_ldap_configuration")
     sys.exit(2)
 
 if user_bind_dn:
@@ -94,7 +109,9 @@ debug(f"Command: LDAPTLS_REQCERT={tls_reqcert} " + " ".join(ldapsearch_command))
 try:
     subprocess.run(ldapsearch_command, env=env, check=True, capture_output=True)
     debug("Success")
+    audit("success")
     sys.exit(0)
 except Exception as e:
     print(e, file=sys.stderr)
+    audit("failure", "ldap_authentication_failed")
     sys.exit(1)