X-Git-Url: http://git.archive.openwrt.org/?a=blobdiff_plain;f=applications%2Fluci-openvpn%2Fluasrc%2Fmodel%2Fcbi%2Fopenvpn-advanced.lua;h=b44ac2b943a8909580c98b0423e06b3cf4798d13;hb=8e6336170d7c6a79115d5770694b0961386a13b2;hp=8782cce92b8ddaae5906ec4fa1e167359821aae1;hpb=7cb54b6a51aee16fb099f78f569aa18799f71d1f;p=project%2Fluci.git
diff --git a/applications/luci-openvpn/luasrc/model/cbi/openvpn-advanced.lua b/applications/luci-openvpn/luasrc/model/cbi/openvpn-advanced.lua
index 8782cce92..b44ac2b94 100644
--- a/applications/luci-openvpn/luasrc/model/cbi/openvpn-advanced.lua
+++ b/applications/luci-openvpn/luasrc/model/cbi/openvpn-advanced.lua
@@ -13,190 +13,191 @@ $Id$
]]--
require("luci.ip")
+require("luci.model.uci")
local knownParams = {
--
- -- Widget Name Optn. Default(s)
+ -- Widget Name Default(s) Option(s) Description
--
- { "service", {
+ { "Service", {
-- initialisation and daemon options
- { ListValue, "verb", { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11 } },
- { Flag, "mlock", 0 },
- { Flag, "disable_occ", 0 },
- -- { Value, "user", "root" },
- -- { Value, "group", "root" },
- { Value, "cd", "/etc/openvpn" },
- { Value, "chroot", "/var/run" },
- -- { Value, "daemon", "Instance-Name" },
- -- { Value, "syslog", "Instance-Name" },
- { Flag, "passtos", 0 },
- -- { Value, "inetd", "nowait Instance-Name" },
- { Value, "log", "/var/log/openvpn.log" },
- { Value, "log_append", "/var/log/openvpn.log" },
- { Flag, "suppress_timestamps", 0 },
- -- { Value, "writepid", "/var/run/openvpn.pid" },
- { Value, "nice", 0 },
- { Flag, "fast_io", 0 },
- { Value, "echo", "some params echoed to log" },
- { ListValue, "remap_usr1", { "SIGHUP", "SIGTERM" } },
- { Value, "status", "/var/run/openvpn.status 5" },
- { Value, "status_version", { 1, 2 } }, -- status
- { Value, "mute", 5 },
-
- { Value, "up", "/usr/bin/ovpn-up" },
- { Value, "up_delay", 5 },
- { Value, "down", "/usr/bin/ovpn-down" },
- { Flag, "down_pre", 0 },
- { Flag, "up_restart", 0 },
- { Value, "route_up", "/usr/bin/ovpn-routeup" },
- { Value, "ipchange", "/usr/bin/ovpn-ipchange", { mode="p2p" } },
- { DynamicList, "setenv", { "VAR1 value1", "VAR2 value2" } },
- { Value, "tls_verify", "/usr/bin/ovpn-tlsverify" },
- { Value, "client_connect", "/usr/bin/ovpn-clientconnect" },
- { Flag, "client_disconnect", 0 },
- { Value, "learn_address", "/usr/bin/ovpn-learnaddress" },
- { Value, "auth_user_pass_verify", "/usr/bin/ovpn-userpass via-env" },
- { ListValue, "script_security", { 0, 1, 2, 3 }, {mode="server" } },
+ { ListValue, "verb", { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11 }, translate("Set output verbosity") },
+ { Flag, "mlock", 0, translate("Disable Paging") },
+ { Flag, "disable_occ", 0, translate("Disable options consistency check") },
+ -- { Value, "user", "root", translate("Set UID to user") },
+ -- { Value, "group", "root", translate("Set GID to group") },
+ { Value, "cd", "/etc/openvpn", translate("Change to directory before initialization") },
+ { Value, "chroot", "/var/run", translate("Chroot to directory after initialization") },
+ -- { Value, "daemon", "Instance-Name", translate("Daemonize after initialization") },
+ -- { Value, "syslog", "Instance-Name", translate("Output to syslog and do not daemonize") },
+ { Flag, "passtos", 0, translate("TOS passthrough (applies to IPv4 only)") },
+ -- { Value, "inetd", "nowait Instance-Name", translate("Run as an inetd or xinetd server") },
+ { Value, "log", "/var/log/openvpn.log", translate("Write log to file") },
+ { Value, "log_append", "/var/log/openvpn.log", translate("Append log to file") },
+ { Flag, "suppress_timestamps", 0, translate("Don't log timestamps") },
+ -- { Value, "writepid", "/var/run/openvpn.pid", translate("Write process ID to file") },
+ { Value, "nice", 0, translate("Change process priority") },
+ { Flag, "fast_io", 0, translate("Optimize TUN/TAP/UDP writes") },
+ { Value, "echo", "some params echoed to log", translate("Echo parameters to log") },
+ { ListValue, "remap_usr1", { "SIGHUP", "SIGTERM" }, translate("Remap SIGUSR1 signals") },
+ { Value, "status", "/var/run/openvpn.status 5", translate("Write status to file every n seconds") },
+ { Value, "status_version", { 1, 2 }, translate("Status file format version") }, -- status
+ { Value, "mute", 5, translate("Limit repeated log messages") },
+
+ { Value, "up", "/usr/bin/ovpn-up", translate("Shell cmd to execute after tun device open") },
+ { Value, "up_delay", 5, translate("Delay tun/tap open and up script execution") },
+ { Value, "down", "/usr/bin/ovpn-down", translate("Shell cmd to run after tun device close") },
+ { Flag, "down_pre", 0, translate("Call down cmd/script before TUN/TAP close") },
+ { Flag, "up_restart", 0, translate("Run up/down scripts for all restarts") },
+ { Value, "route_up", "/usr/bin/ovpn-routeup", translate("Execute shell cmd after routes are added") },
+ { Value, "ipchange", "/usr/bin/ovpn-ipchange", { mode="p2p" }, translate("Execute shell command on remote ip change") },
+ { DynamicList, "setenv", { "VAR1 value1", "VAR2 value2" }, translate("Pass environment variables to script") },
+ { Value, "tls_verify", "/usr/bin/ovpn-tlsverify", translate("Shell command to verify X509 name") },
+ { Value, "client_connect", "/usr/bin/ovpn-clientconnect", translate("Run script cmd on client connection") },
+ { Flag, "client_disconnect", 0, translate("Run script cmd on client disconnection") },
+ { Value, "learn_address", "/usr/bin/ovpn-learnaddress", translate("Executed in server mode whenever an IPv4 address/route or MAC address is added to OpenVPN's internal routing table") },
+ { Value, "auth_user_pass_verify", "/usr/bin/ovpn-userpass via-env", translate("Executed in server mode on new client connections, when the client is still untrusted") },
+ { ListValue, "script_security", { 0, 1, 2, 3 }, {mode="server" }, translate("Policy level over usage of external programs and scripts") },
} },
- { "networking", {
+ { "Networking", {
-- socket config
- { ListValue, "mode", { "p2p", "server" } },
- { Value, "local", "0.0.0.0" },
- { Value, "port", 1194 },
- { Value, "lport", 1194 },
- { Value, "rport", 1194 },
- { Flag, "float", 0 },
- { Flag, "nobind", 0 },
-
- { Value, "dev", "tun0" },
- { ListValue, "dev_type", { "tun", "tap" } },
- { Value, "dev_node", "/dev/net/tun" },
- { Flag, "tun_ipv6", 0 },
-
- { Value, "ifconfig", "10.200.200.3 10.200.200.1" },
- { Flag, "ifconfig_noexec", 0 },
- { Flag, "ifconfig_nowarn", 0 },
-
- { DynamicList, "route", "10.123.0.0 255.255.0.0" },
- { Value, "route_gateway", "10.234.1.1" },
- { Value, "route_delay", 0 },
- { Flag, "route_noexec", 0 },
-
- { ListValue, "mtu_disc", { "yes", "maybe", "no" } },
- { Flag, "mtu_test", 0 },
- { Flag, "comp_lzo", 0 },
- { Flag, "comp_noadept", 0, { comp_lzo=1 } },
- { Value, "link_mtu", 1500 },
- { Value, "tun_mtu", 1500 },
- { Value, "tun_mtu_extra", 1500 },
- { Value, "fragment", 1500, { proto="udp" } },
- { Value, "mssfix", 1500, { proto="udp" } },
- { Value, "sndbuf", 65536 },
- { Value, "rcvbuf", 65536 },
- { Value, "txqueuelen", 100 },
- { Value, "shaper", 10240 },
-
- { Value, "inactive", 240 },
- { Value, "keepalive", "10 60" },
- { Value, "ping", 30 },
- { Value, "ping_exit", 120 },
- { Value, "ping_restart", 60 },
- { Flag, "ping_timer_rem", 0 },
-
- { Flag, "persist_tun", 0 },
- { Flag, "persist_key", 0 },
- { Flag, "persist_local_ip", 0 },
- { Flag, "persist_remote_ip", 0 },
+ { ListValue, "mode", { "p2p", "server" }, translate("Major mode") },
+ { Value, "local", "0.0.0.0", translate("Local host name or ip address") },
+ { Value, "port", 1194, translate("TCP/UDP port # for both local and remote") },
+ { Value, "lport", 1194, translate("TCP/UDP port # for local (default=1194)") },
+ { Value, "rport", 1194, translate("TCP/UDP port # for remote (default=1194)") },
+ { Flag, "float", 0, translate("Allow remote to change its IP or port") },
+ { Flag, "nobind", 0, translate("Do not bind to local address and port") },
+
+ { Value, "dev", "tun0", translate("tun/tap device") },
+ { ListValue, "dev_type", { "tun", "tap" }, translate("Type of used device") },
+ { Value, "dev_node", "/dev/net/tun", translate("Use tun/tap device node") },
+ { Flag, "tun_ipv6", 0, translate("Make tun device IPv6 capable") },
+
+ { Value, "ifconfig", "10.200.200.3 10.200.200.1", translate("Set tun/tap adapter parameters") },
+ { Flag, "ifconfig_noexec", 0, translate("Don't actually execute ifconfig") },
+ { Flag, "ifconfig_nowarn", 0, translate("Don't warn on ifconfig inconsistencies") },
+
+ { DynamicList, "route", "10.123.0.0 255.255.0.0", translate("Add route after establishing connection") },
+ { Value, "route_gateway", "10.234.1.1", translate("Specify a default gateway for routes") },
+ { Value, "route_delay", 0, translate("Delay n seconds after connection") },
+ { Flag, "route_noexec", 0, translate("Don't add routes automatically") },
+
+ { ListValue, "mtu_disc", { "yes", "maybe", "no" }, translate("Enable Path MTU discovery") },
+ { Flag, "mtu_test", 0, translate("Empirically measure MTU") },
+ { Flag, "comp_lzo", 0, translate("Use fast LZO compression") },
+ { Flag, "comp_noadapt", 0, { comp_lzo=1 }, translate("Don't use adaptive lzo compression") },
+ { Value, "link_mtu", 1500, translate("Set TCP/UDP MTU") },
+ { Value, "tun_mtu", 1500, translate("Set tun/tap device MTU") },
+ { Value, "tun_mtu_extra", 1500, translate("Set tun/tap device overhead") },
+ { Value, "fragment", 1500, { proto="udp" }, translate("Enable internal datagram fragmentation") },
+ { Value, "mssfix", 1500, { proto="udp" }, translate("Set upper bound on TCP MSS") },
+ { Value, "sndbuf", 65536, translate("Set the TCP/UDP send buffer size") },
+ { Value, "rcvbuf", 65536, translate("Set the TCP/UDP receive buffer size") },
+ { Value, "txqueuelen", 100, translate("Set tun/tap TX queue length") },
+ { Value, "shaper", 10240, translate("Shaping for peer bandwidth") },
+
+ { Value, "inactive", 240, translate("tun/tap inactivity timeout") },
+ { Value, "keepalive", "10 60", translate("Helper directive to simplify the expression of --ping and --ping-restart in server mode configurations") },
+ { Value, "ping", 30, translate("Ping remote every n seconds over TCP/UDP port") },
+ { Value, "ping_exit", 120, translate("Remote ping timeout") },
+ { Value, "ping_restart", 60, translate("Restart after remote ping timeout") },
+ { Flag, "ping_timer_rem", 0, translate("Only process ping timeouts if routes exist") },
+
+ { Flag, "persist_tun", 0, translate("Keep tun/tap device open on restart") },
+ { Flag, "persist_key", 0, translate("Don't re-read key on restart") },
+ { Flag, "persist_local_ip", 0, translate("Keep local IP address on restart") },
+ { Flag, "persist_remote_ip", 0, translate("Keep remote IP address on restart") },
-- management channel
- { Value, "management", "127.0.0.1 31194 /etc/openvpn/mngmt-pwds" },
- { Flag, "management_query_passwords", 0 }, -- management
- { Flag, "management_hold", 0 }, -- management
- { Value, "management_log_cache", 100 }, -- management
- { ListValue, "topology", { "net30", "p2p", "subnet" }, {dev_type="tun" } },
+ { Value, "management", "127.0.0.1 31194 /etc/openvpn/mngmt-pwds", translate("Enable management interface on IP port") },
+ { Flag, "management_query_passwords", 0, translate("Query management channel for private key") }, -- management
+ { Flag, "management_hold", 0, translate("Start OpenVPN in a hibernating state") }, -- management
+ { Value, "management_log_cache", 100, translate("Number of lines for log file history") }, -- management
+ { ListValue, "topology", { "net30", "p2p", "subnet" }, {dev_type="tun" }, translate("'net30', 'p2p', or 'subnet'") },
} },
- { "vpn", {
- { Value, "server", "10.200.200.0 255.255.255.0", { server_mode="1" } },
- { Value, "server_bridge", "10.200.200.1 255.255.255.0 10.200.200.200 10.200.200.250", { server_mode="1" } },
- { DynamicList, "push", { "redirect-gateway", "comp-lzo" }, { server_mode="1" } },
- { Flag, "push_reset", 0, { server_mode="1" } },
- { Flag, "disable", 0, { server_mode="1" } },
- { Value, "ifconfig_pool", "10.200.200.100 10.200.200.150 255.255.255.0", { server_mode="1" } },
- { Value, "ifconfig_pool_persist", "/etc/openvpn/ipp.txt 600", { server_mode="1" } },
- { Flag, "ifconfig_pool_linear", 0, { server_mode="1" } },
- { Value, "ifconfig_push", "10.200.200.1 255.255.255.255", { server_mode="1" } },
- { Value, "iroute", "10.200.200.0 255.255.255.0", { server_mode="1" } },
- { Flag, "client_to_client", 0, { server_mode="1" } },
- { Flag, "duplicate_cn", 0, { server_mode="1" } },
- { Value, "client_config_dir", "/etc/openvpn/ccd", { server_mode="1" } },
- { Flag, "ccd_exclusive", 0, { server_mode="1" } },
- { Value, "tmp_dir", "/var/run/openvpn", { server_mode="1" } },
- { Value, "hash_size", "256 256", { server_mode="1" } },
- { Value, "bcast_buffers", 256, { server_mode="1" } },
- { Value, "tcp_queue_limit", 64, { server_mode="1" } },
- { Value, "max_clients", 10, { server_mode="1" } },
- { Value, "max_routes_per_client", 256, { server_mode="1" } },
- { Value, "connect_freq", "3 10", { server_mode="1" } },
- { Flag, "client_cert_not_required", 0, { server_mode="1" } },
- { Flag, "username_as_common_name", 0, { server_mode="1" } },
- { Flag, "client", 0, { server_mode="0" }, { server_mode="" } },
- { Flag, "pull", 0, { client="1" } },
- { Value, "auth_user_pass", "/etc/openvpn/userpass.txt", { client="1" } },
- { ListValue, "auth_retry", { "none", "nointeract", "interact" }, { client="1" } },
- { Value, "explicit_exit_notify", 1, { client="1" } },
- { DynamicList, "remote", "1.2.3.4", { client="1" } }, -- client
- { Flag, "remote_random", 1, { client="1" } }, -- client
- { ListValue, "proto", { "udp", "tcp-client", "tcp-server" }, { client="1" } },
- { Value, "connect_retry", 5, { proto="tcp-client" }, { client="1" } }, -- client && proto=tcp-client
- { Value, "http_proxy_server", "192.168.1.100 8080", { client="1" } }, -- client
- { Flag, "http_proxy_retry", 0, { client="1" } }, -- client && http_proxy_server
- { Value, "http_proxy_timeout", 5, { client="1" } }, -- client && http_proxy_server
- { DynamicList, "http_proxy_option", { "VERSION 1.0", "AGENT OpenVPN/2.0.9" }, { client="1" } }, -- client && http_proxy_server
- { Value, "socks_proxy_server", "192.168.1.200 1080", { client="1" } }, -- client
- { Value, "socks_proxy_retry", 5, { client="1" } }, -- client && socks_proxy_server
- { Value, "resolv_retry", "infinite", { client="1" } }, -- client
- { ListValue, "redirect_gateway", { "", "local", "def1", "local def1" }, { client="1" } }, -- client
+ { "VPN", {
+ { Value, "server", "10.200.200.0 255.255.255.0", { server_mode="1" }, translate("Configure server mode") },
+ { Value, "server_bridge", "10.200.200.1 255.255.255.0 10.200.200.200 10.200.200.250", { server_mode="1" }, translate("Configure server bridge") },
+ { DynamicList, "push", { "redirect-gateway", "comp-lzo" }, { server_mode="1" }, translate("Push options to peer") },
+ { Flag, "push_reset", 0, { server_mode="1" }, translate("Don't inherit global push options") },
+ { Flag, "disable", 0, { server_mode="1" }, translate("Client is disabled") },
+ { Value, "ifconfig_pool", "10.200.200.100 10.200.200.150 255.255.255.0", { server_mode="1" }, translate("Set aside a pool of subnets") },
+ { Value, "ifconfig_pool_persist", "/etc/openvpn/ipp.txt 600", { server_mode="1" }, translate("Persist/unpersist ifconfig-pool") },
+-- { Flag, "ifconfig_pool_linear", 0, { server_mode="1" }, translate("Use individual addresses rather than /30 subnets") }, -- deprecated and replaced by --topology p2p
+ { Value, "ifconfig_push", "10.200.200.1 255.255.255.255", { server_mode="1" }, translate("Push an ifconfig option to remote") },
+ { Value, "iroute", "10.200.200.0 255.255.255.0", { server_mode="1" }, translate("Route subnet to client") },
+ { Flag, "client_to_client", 0, { server_mode="1" }, translate("Allow client-to-client traffic") },
+ { Flag, "duplicate_cn", 0, { server_mode="1" }, translate("Allow multiple clients with same certificate") },
+ { Value, "client_config_dir", "/etc/openvpn/ccd", { server_mode="1" }, translate("Directory for custom client config files") },
+ { Flag, "ccd_exclusive", 0, { server_mode="1" }, translate("Refuse connection if no custom client config") },
+ { Value, "tmp_dir", "/var/run/openvpn", { server_mode="1" }, translate("Temporary directory for client-connect return file") },
+ { Value, "hash_size", "256 256", { server_mode="1" }, translate("Set size of real and virtual address hash tables") },
+ { Value, "bcast_buffers", 256, { server_mode="1" }, translate("Number of allocated broadcast buffers") },
+ { Value, "tcp_queue_limit", 64, { server_mode="1" }, translate("Maximum number of queued TCP output packets") },
+ { Value, "max_clients", 10, { server_mode="1" }, translate("Allowed maximum of connected clients") },
+ { Value, "max_routes_per_client", 256, { server_mode="1" }, translate("Allowed maximum of internal") },
+ { Value, "connect_freq", "3 10", { server_mode="1" }, translate("Allowed maximum of new connections") },
+ { Flag, "client_cert_not_required", 0, { server_mode="1" }, translate("Don't require client certificate") },
+ { Flag, "username_as_common_name", 0, { server_mode="1" }, translate("Use username as common name") },
+ { Flag, "client", 0, { server_mode="0" }, { server_mode="" }, translate("Configure client mode") },
+ { Flag, "pull", 0, { client="1" }, translate("Accept options pushed from server") },
+ { Value, "auth_user_pass", "/etc/openvpn/userpass.txt", { client="1" }, translate("Authenticate using username/password") },
+ { ListValue, "auth_retry", { "none", "nointeract", "interact" }, { client="1" }, translate("Handling of authentication failures") },
+ { Value, "explicit_exit_notify", 1, { client="1" }, translate("Send notification to peer on disconnect") },
+ { DynamicList, "remote", "1.2.3.4", { client="1" }, translate("Remote host name or ip address") }, -- client
+ { Flag, "remote_random", 1, { client="1" }, translate("Randomly choose remote server") }, -- client
+ { ListValue, "proto", { "udp", "tcp-client", "tcp-server" }, { client="1" }, translate("Use protocol") },
+ { Value, "connect_retry", 5, { proto="tcp-client" }, { client="1" }, translate("Connection retry interval") }, -- client && proto=tcp-client
+ { Value, "http_proxy", "192.168.1.100 8080", { client="1" }, translate("Connect to remote host through an HTTP proxy") }, -- client
+ { Flag, "http_proxy_retry", 0, { client="1" }, translate("Retry indefinitely on HTTP proxy errors") }, -- client && http_proxy
+ { Value, "http_proxy_timeout", 5, { client="1" }, translate("Proxy timeout in seconds") }, -- client && http_proxy
+ { DynamicList, "http_proxy_option", { "VERSION 1.0", "AGENT OpenVPN/2.0.9" }, { client="1" }, translate("Set extended HTTP proxy options") }, -- client && http_proxy
+ { Value, "socks_proxy", "192.168.1.200 1080", { client="1" }, translate("Connect through Socks5 proxy") }, -- client
+ { Value, "socks_proxy_retry", 5, { client="1" }, translate("Retry indefinitely on Socks proxy errors") }, -- client && socks_proxy
+ { Value, "resolv_retry", "infinite", { client="1" }, translate("If hostname resolve fails, retry") }, -- client
+ { ListValue, "redirect_gateway", { "", "local", "def1", "local def1" }, { client="1" }, translate("Automatically redirect default route") }, -- client
} },
- { "cryptography", {
- { Value, "secret", "/etc/openvpn/secret.key 1" },
- { Value, "auth", "SHA1" }, -- parse
- { Value, "cipher", "BF-CBC" }, -- parse
- { Value, "keysize", 1024 }, -- parse
- { Value, "engine", "dynamic" }, -- parse
- { Flag, "no_replay", 0 },
- { Value, "replay_window", "64 15" },
- { Flag, "mute_replay_warnings", 0 },
- { Value, "replay_persist", "/var/run/openvpn-replay-state" },
- { Flag, "no_iv", 0 },
- { Flag, "tls_server", 0, { tls_client="" }, { tls_client="0" } },
- { Flag, "tls_client", 0, { tls_server="" }, { tls_server="0" } },
- { FileUpload, "ca", "/etc/easy-rsa/keys/ca.crt" },
- { FileUpload, "dh", "/etc/easy-rsa/keys/dh1024.pem" },
- { FileUpload, "cert", "/etc/easy-rsa/keys/some-client.crt" },
- { FileUpload, "key", "/etc/easy-rsa/keys/some-client.key" },
- { FileUpload, "pkcs12", "/etc/easy-rsa/keys/some-client.pk12" },
- { ListValue, "key_method", { 1, 2 } },
- { Value, "tls_cipher", "DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:RC4-SHA:RC4-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC4-MD5" },
- { Value, "tls_timeout", 2 },
- { Value, "reneg_bytes", 1024 },
- { Value, "reneg_pkts", 100 },
- { Value, "reneg_sec", 3600 },
- { Value, "hand_window", 60 },
- { Value, "tran_window", 3600 },
- { Flag, "single_session", 0 },
- { Flag, "tls_exit", 0 },
- { Value, "tls_auth", "/etc/openvpn/tlsauth.key 1" },
- --{ Value, "askpass", "[file]" },
- { Flag, "auth_nocache", 0 },
- { Value, "tls_remote", "remote_x509_name" },
- { ListValue, "ns_cert_type", { "client", "server" } },
- { ListValue, "remote_cert_tls", { "client", "server" } },
- { Value, "crl_verify", "/etc/easy-rsa/keys/crl.pem" },
+ { "Cryptography", {
+ { Value, "secret", "/etc/openvpn/secret.key 1", translate("Enable Static Key encryption mode (non-TLS)") },
+ { Value, "auth", "SHA1", translate("HMAC authentication for packets") }, -- parse
+ { Value, "cipher", "BF-CBC", translate("Encryption cipher for packets") }, -- parse
+ { Value, "keysize", 1024, translate("Size of cipher key") }, -- parse
+ { Value, "engine", "dynamic", translate("Enable OpenSSL hardware crypto engines") }, -- parse
+ { Flag, "no_replay", 0, translate("Disable replay protection") },
+ { Value, "replay_window", "64 15", translate("Replay protection sliding window size") },
+ { Flag, "mute_replay_warnings", 0, translate("Silence the output of replay warnings") },
+ { Value, "replay_persist", "/var/run/openvpn-replay-state", translate("Persist replay-protection state") },
+ { Flag, "no_iv", 0, translate("Disable cipher initialisation vector") },
+ { Flag, "tls_server", 0, { tls_client="" }, { tls_client="0" }, translate("Enable TLS and assume server role") },
+ { Flag, "tls_client", 0, { tls_server="" }, { tls_server="0" }, translate("Enable TLS and assume client role") },
+ { FileUpload, "ca", "/etc/easy-rsa/keys/ca.crt", translate("Certificate authority") },
+ { FileUpload, "dh", "/etc/easy-rsa/keys/dh1024.pem", translate("Diffie Hellman parameters") },
+ { FileUpload, "cert", "/etc/easy-rsa/keys/some-client.crt", translate("Local certificate") },
+ { FileUpload, "key", "/etc/easy-rsa/keys/some-client.key", translate("Local private key") },
+ { FileUpload, "pkcs12", "/etc/easy-rsa/keys/some-client.pk12", translate("PKCS#12 file containing keys") },
+ { ListValue, "key_method", { 1, 2 }, translate("Enable TLS and assume client role") },
+ { Value, "tls_cipher", "DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:RC4-SHA:RC4-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC4-MD5", translate("TLS cipher") },
+ { Value, "tls_timeout", 2, translate("Retransmit timeout on TLS control channel") },
+ { Value, "reneg_bytes", 1024, translate("Renegotiate data chan. key after bytes") },
+ { Value, "reneg_pkts", 100, translate("Renegotiate data chan. key after packets") },
+ { Value, "reneg_sec", 3600, translate("Renegotiate data chan. key after seconds") },
+ { Value, "hand_window", 60, translate("Timeframe for key exchange") },
+ { Value, "tran_window", 3600, translate("Key transition window") },
+ { Flag, "single_session", 0, translate("Allow only one session") },
+ { Flag, "tls_exit", 0, translate("Exit on TLS negotiation failure") },
+ { Value, "tls_auth", "/etc/openvpn/tlsauth.key 1", translate("Additional authentication over TLS") },
+ --{ Value, "askpass", "[file]", translate("Get PEM password from controlling tty before we daemonize") },
+ { Flag, "auth_nocache", 0, translate("Don't cache --askpass or --auth-user-pass passwords") },
+ { Value, "tls_remote", "remote_x509_name", translate("Only accept connections from given X509 name") },
+ { ListValue, "ns_cert_type", { "client", "server" }, translate("Require explicit designation on certificate") },
+ { ListValue, "remote_cert_tls", { "client", "server" }, translate("Require explicit key usage on certificate") },
+ { Value, "crl_verify", "/etc/easy-rsa/keys/crl.pem", translate("Check peer certificate against a CRL") },
} }
}
@@ -210,7 +211,7 @@ local p = m:section( SimpleSection )
p.template = "openvpn/pageswitch"
p.mode = "advanced"
p.instance = arg[1]
-p.category = arg[2] or "service"
+p.category = arg[2] or "Service"
for _, c in ipairs(knownParams) do
cts[#cts+1] = c[1]
@@ -222,11 +223,10 @@ p.categories = cts
local s = m:section(
NamedSection, arg[1], "openvpn",
- translate("openvpn_%s" % arg[2]),
- translate("openvpn_%s_desc" % arg[2])
+ translate("%s" % arg[2])
)
-s.title = translate("openvpn_%s" % arg[2])
+s.title = translate("%s" % arg[2])
s.addremove = false
s.anonymous = true
@@ -234,8 +234,7 @@ s.anonymous = true
for _, option in ipairs(params) do
local o = s:option(
option[1], option[2],
- translate("openvpn_param_%s" % option[2]),
- translate("openvpn_param_%s_desc" % option[2])
+ option[2], option[4]
)
if option[1] == DummyValue then