applications/luci-app-openvpn/luasrc/model/cbi/openvpn-advanced.lua

   1 -- Copyright 2008 Steven Barth <steven@midlink.org>
   2 -- Licensed to the public under the Apache License 2.0.
   3
   4 require("luci.ip")
   5 require("luci.model.uci")
   6
   7
   8 local knownParams = {
   9         --
  10         --      Widget                  Name                                                    Default(s)                                                                                                              Description     Option(s)
  11         --
  12
  13         { "Service", {
  14                 -- initialisation and daemon options
  15                 { ListValue,    "verb",                                                 { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11 },                                               translate("Set output verbosity") },
  16                 { Flag,                 "mlock",                                                0,                                                                                                                              translate("Disable Paging") },
  17                 { Flag,                 "disable_occ",                                  0,                                                                                                                              translate("Disable options consistency check") },
  18         --      { Value,                "user",                                                 "root",                                                                                                                 translate("Set UID to user") },
  19         --      { Value,                "group",                                                "root",                                                                                                                 translate("Set GID to group") },
  20                 { Value,                "cd",                                                   "/etc/openvpn",                                                                                                 translate("Change to directory before initialization") },
  21                 { Value,                "chroot",                                               "/var/run",                                                                                                             translate("Chroot to directory after initialization") },
  22         --      { Value,                "daemon",                                               "Instance-Name",                                                                                                translate("Daemonize after initialization") },
  23         --      { Value,                "syslog",                                               "Instance-Name",                                                                                                translate("Output to syslog and do not daemonize") },
  24                 { Flag,                 "passtos",                                              0,                                                                                                                              translate("TOS passthrough (applies to IPv4 only)") },
  25         --      { Value,                "inetd",                                                "nowait Instance-Name",                                                                                 translate("Run as an inetd or xinetd server") },
  26                 { Value,                "log",                                                  "/var/log/openvpn.log",                                                                                 translate("Write log to file") },
  27                 { Value,                "log_append",                                   "/var/log/openvpn.log",                                                                                 translate("Append log to file") },
  28                 { Flag,                 "suppress_timestamps",                  0,                                                                                                                              translate("Don't log timestamps") },
  29         --      { Value,                "writepid",                                             "/var/run/openvpn.pid",                                                                                 translate("Write process ID to file") },
  30                 { Value,                "nice",                                                 0,                                                                                                                              translate("Change process priority") },
  31                 { Flag,                 "fast_io",                                              0,                                                                                                                              translate("Optimize TUN/TAP/UDP writes") },
  32                 { Value,                "echo",                                                 "some params echoed to log",                                                                    translate("Echo parameters to log") },
  33                 { ListValue,    "remap_usr1",                                   { "SIGHUP", "SIGTERM" },                                                                                translate("Remap SIGUSR1 signals") },
  34                 { Value,                "status",                                               "/var/run/openvpn.status 5",                                                                    translate("Write status to file every n seconds") },
  35                 { Value,                "status_version",                               { 1, 2 },                                                                                                               translate("Status file format version") },      -- status
  36                 { Value,                "mute",                                                 5,                                                                                                                              translate("Limit repeated log messages") },
  37
  38                 { Value,                "up",                                                   "/usr/bin/ovpn-up",                                                                                             translate("Shell cmd to execute after tun device open") },
  39                 { Value,                "up_delay",                                             5,                                                                                                                              translate("Delay tun/tap open and up script execution") },
  40                 { Value,                "down",                                                 "/usr/bin/ovpn-down",                                                                                   translate("Shell cmd to run after tun device close") },
  41                 { Flag,                 "down_pre",                                             0,                                                                                                                              translate("Call down cmd/script before TUN/TAP close") },
  42                 { Flag,                 "up_restart",                                   0,                                                                                                                              translate("Run up/down scripts for all restarts") },
  43                 { Value,                "route_up",                                             "/usr/bin/ovpn-routeup",                                                                                translate("Execute shell cmd after routes are added") },
  44                 { Value,                "ipchange",                                             "/usr/bin/ovpn-ipchange",                                                                               translate("Execute shell command on remote ip change"), { mode="p2p" } },
  45                 { DynamicList,  "setenv",                                               { "VAR1 value1", "VAR2 value2" },                                                               translate("Pass environment variables to script") },
  46                 { Value,                "tls_verify",                                   "/usr/bin/ovpn-tlsverify",                                                                              translate("Shell command to verify X509 name") },
  47                 { Value,                "client_connect",                               "/usr/bin/ovpn-clientconnect",                                                                  translate("Run script cmd on client connection") },
  48                 { Flag,                 "client_disconnect",                    0,                                                                                                                              translate("Run script cmd on client disconnection") },
  49                 { Value,                "learn_address",                                "/usr/bin/ovpn-learnaddress",                                                                   translate("Executed in server mode whenever an IPv4 address/route or MAC address is added to OpenVPN's internal routing table") },
  50                 { Value,                "auth_user_pass_verify",                "/usr/bin/ovpn-userpass via-env",                                                               translate("Executed in server mode on new client connections, when the client is still untrusted") },
  51                 { ListValue,    "script_security",                              { 0, 1, 2, 3 },                                                                                                 translate("Policy level over usage of external programs and scripts") },
  52         } },
  53
  54         { "Networking", {
  55                 -- socket config
  56                 { ListValue,    "mode",                                                 { "p2p", "server" },                                                                                    translate("Major mode") },
  57                 { Value,                "local",                                                "0.0.0.0",                                                                                                              translate("Local host name or ip address") },
  58                 { Value,                "port",                                                 1194,                                                                                                                   translate("TCP/UDP port # for both local and remote") },
  59                 { Value,                "lport",                                                1194,                                                                                                                   translate("TCP/UDP port # for local (default=1194)") },
  60                 { Value,                "rport",                                                1194,                                                                                                                   translate("TCP/UDP port # for remote (default=1194)") },
  61                 { Flag,                 "float",                                                0,                                                                                                                              translate("Allow remote to change its IP or port") },
  62                 { Flag,                 "nobind",                                               0,                                                                                                                              translate("Do not bind to local address and port") },
  63
  64                 { Value,                "dev",                                                  "tun0",                                                                                                                 translate("tun/tap device") },
  65                 { ListValue,    "dev_type",                                             { "tun", "tap" },                                                                                               translate("Type of used device") },
  66                 { Value,                "dev_node",                                             "/dev/net/tun",                                                                                                 translate("Use tun/tap device node") },
  67                 { Flag,                 "tun_ipv6",                                             0,                                                                                                                              translate("Make tun device IPv6 capable") },
  68
  69                 { Value,                "ifconfig",                                             "10.200.200.3 10.200.200.1",                                                                    translate("Set tun/tap adapter parameters") },
  70                 { Flag,                 "ifconfig_noexec",                              0,                                                                                                                              translate("Don't actually execute ifconfig") },
  71                 { Flag,                 "ifconfig_nowarn",                              0,                                                                                                                              translate("Don't warn on ifconfig inconsistencies") },
  72
  73                 { DynamicList,  "route",                                                "10.123.0.0 255.255.0.0",                                                                               translate("Add route after establishing connection") },
  74                 { Value,                "route_gateway",                                "10.234.1.1",                                                                                                   translate("Specify a default gateway for routes") },
  75                 { Value,                "route_delay",                                  0,                                                                                                                              translate("Delay n seconds after connection") },
  76                 { Flag,                 "route_noexec",                                 0,                                                                                                                              translate("Don't add routes automatically") },
  77                 { Flag,                 "route_nopull",                                 0,                                                                                                                              translate("Don't pull routes automatically") },
  78
  79                 { ListValue,    "mtu_disc",                                             { "yes", "maybe", "no" },                                                                               translate("Enable Path MTU discovery") },
  80                 { Flag,                 "mtu_test",                                             0,                                                                                                                              translate("Empirically measure MTU") },
  81                 { ListValue,                    "comp_lzo",                             { "yes", "no", "adaptive" },                                                                                                                            translate("Use fast LZO compression") },
  82                 { Flag,                 "comp_noadapt",                                 0,                                                                                                                              translate("Don't use adaptive lzo compression"),        { comp_lzo=1 } },
  83                 { Value,                "link_mtu",                                             1500,                                                                                                                   translate("Set TCP/UDP MTU") },
  84                 { Value,                "tun_mtu",                                              1500,                                                                                                                   translate("Set tun/tap device MTU") },
  85                 { Value,                "tun_mtu_extra",                                1500,                                                                                                                   translate("Set tun/tap device overhead") },
  86                 { Value,                "fragment",                                             1500,                                                                                                                   translate("Enable internal datagram fragmentation"),    { proto="udp" } },
  87                 { Value,                "mssfix",                                               1500,                                                                                                                   translate("Set upper bound on TCP MSS"),        { proto="udp" } },
  88                 { Value,                "sndbuf",                                               65536,                                                                                                                  translate("Set the TCP/UDP send buffer size") },
  89                 { Value,                "rcvbuf",                                               65536,                                                                                                                  translate("Set the TCP/UDP receive buffer size") },
  90                 { Value,                "txqueuelen",                                   100,                                                                                                                    translate("Set tun/tap TX queue length") },
  91                 { Value,                "shaper",                                               10240,                                                                                                                  translate("Shaping for peer bandwidth") },
  92
  93                 { Value,                "inactive",                                             240,                                                                                                                    translate("tun/tap inactivity timeout") },
  94                 { Value,                "keepalive",                                    "10 60",                                                                                                                translate("Helper directive to simplify the expression of --ping and --ping-restart in server mode configurations") },
  95                 { Value,                "ping",                                                 30,                                                                                                                             translate("Ping remote every n seconds over TCP/UDP port") },
  96                 { Value,                "ping_exit",                                    120,                                                                                                                    translate("Remote ping timeout") },
  97                 { Value,                "ping_restart",                                 60,                                                                                                                             translate("Restart after remote ping timeout") },
  98                 { Flag,                 "ping_timer_rem",                               0,                                                                                                                              translate("Only process ping timeouts if routes exist") },
  99
 100                 { Flag,                 "persist_tun",                                  0,                                                                                                                              translate("Keep tun/tap device open on restart") },
 101                 { Flag,                 "persist_key",                                  0,                                                                                                                              translate("Don't re-read key on restart") },
 102                 { Flag,                 "persist_local_ip",                             0,                                                                                                                              translate("Keep local IP address on restart") },
 103                 { Flag,                 "persist_remote_ip",                    0,                                                                                                                              translate("Keep remote IP address on restart") },
 104
 105                 -- management channel
 106                 { Value,                "management",                                   "127.0.0.1 31194 /etc/openvpn/mngmt-pwds",                                              translate("Enable management interface on <em>IP</em> <em>port</em>") },
 107                 { Flag,                 "management_query_passwords",   0,                                                                                                                              translate("Query management channel for private key") },        -- management
 108                 { Flag,                 "management_hold",                              0,                                                                                                                              translate("Start OpenVPN in a hibernating state") },    -- management
 109                 { Value,                "management_log_cache",                 100,                                                                                                                    translate("Number of lines for log file history") },    -- management
 110                 { ListValue,    "topology",                                             { "net30", "p2p", "subnet" },                                                                   translate("'net30', 'p2p', or 'subnet'"),       {dev_type="tun" } },
 111         } },
 112
 113         { "VPN", {
 114                 { Value,                "server",                                               "10.200.200.0 255.255.255.0",                                                                   translate("Configure server mode"),     { server_mode="1" } },
 115                 { Value,                "server_bridge",                                "10.200.200.1 255.255.255.0 10.200.200.200 10.200.200.250",             translate("Configure server bridge"),   { server_mode="1" } },
 116                 { DynamicList,  "push",                                                 { "redirect-gateway", "comp-lzo" },                                                             translate("Push options to peer"),      { server_mode="1" } },
 117                 { Flag,                 "push_reset",                                   0,                                                                                                                              translate("Don't inherit global push options"), { server_mode="1" } },
 118                 { Flag,                 "disable",                                              0,                                                                                                                              translate("Client is disabled"),        { server_mode="1" } },
 119                 { Value,                "ifconfig_pool",                                "10.200.200.100 10.200.200.150 255.255.255.0",                                  translate("Set aside a pool of subnets"),       { server_mode="1" } },
 120                 { Value,                "ifconfig_pool_persist",                "/etc/openvpn/ipp.txt 600",                                                                             translate("Persist/unpersist ifconfig-pool"),   { server_mode="1" } },
 121 --              { Flag,                 "ifconfig_pool_linear",                 0,                                                                                                                              translate("Use individual addresses rather than /30 subnets"),  { server_mode="1" } }, -- deprecated and replaced by --topology p2p
 122                 { Value,                "ifconfig_push",                                "10.200.200.1 255.255.255.255",                                                                 translate("Push an ifconfig option to remote"), { server_mode="1" } },
 123                 { Value,                "iroute",                                               "10.200.200.0 255.255.255.0",                                                                   translate("Route subnet to client"),    { server_mode="1" } },
 124                 { Flag,                 "client_to_client",                             0,                                                                                                                              translate("Allow client-to-client traffic"),    { server_mode="1" } },
 125                 { Flag,                 "duplicate_cn",                                 0,                                                                                                                              translate("Allow multiple clients with same certificate"),      { server_mode="1" } },
 126                 { Value,                "client_config_dir",                    "/etc/openvpn/ccd",                                                                                             translate("Directory for custom client config files"),  { server_mode="1" } },
 127                 { Flag,                 "ccd_exclusive",                                0,                                                                                                                              translate("Refuse connection if no custom client config"),      { server_mode="1" } },
 128                 { Value,                "tmp_dir",                                              "/var/run/openvpn",                                                                                             translate("Temporary directory for client-connect return file"),        { server_mode="1" } },
 129                 { Value,                "hash_size",                                    "256 256",                                                                                                              translate("Set size of real and virtual address hash tables"),  { server_mode="1" } },
 130                 { Value,                "bcast_buffers",                                256,                                                                                                                    translate("Number of allocated broadcast buffers"),     { server_mode="1" } },
 131                 { Value,                "tcp_queue_limit",                              64,                                                                                                                             translate("Maximum number of queued TCP output packets"),       { server_mode="1" } },
 132                 { Value,                "max_clients",                                  10,                                                                                                                             translate("Allowed maximum of connected clients"),      { server_mode="1" } },
 133                 { Value,                "max_routes_per_client",                256,                                                                                                                    translate("Allowed maximum of internal"),       { server_mode="1" } },
 134                 { Value,                "connect_freq",                                 "3 10",                                                                                                                 translate("Allowed maximum of new connections"),        { server_mode="1" } },
 135                 { Flag,                 "client_cert_not_required",             0,                                                                                                                              translate("Don't require client certificate"),  { server_mode="1" } },
 136                 { Flag,                 "username_as_common_name",              0,                                                                                                                              translate("Use username as common name"),       { server_mode="1" } },
 137                 { Flag,                 "client",                                               0,                                                                                                                              translate("Configure client mode"),     { server_mode="0" }, { server_mode="" } },
 138                 { Flag,                 "pull",                                                 0,                                                                                                                              translate("Accept options pushed from server"), { client="1" } },
 139                 { Value,                "auth_user_pass",                               "/etc/openvpn/userpass.txt",                                                                    translate("Authenticate using username/password"),      { client="1" } },
 140                 { ListValue,    "auth_retry",                                   { "none", "nointeract", "interact" },                                                   translate("Handling of authentication failures"),       { client="1" } },
 141                 { Value,                "explicit_exit_notify",                 1,                                                                                                                              translate("Send notification to peer on disconnect"),   { client="1" } },
 142                 { DynamicList,  "remote",                                               "1.2.3.4",                                                                                                              translate("Remote host name or ip address"),    { client="1" } },
 143                 { Flag,                 "remote_random",                                1,                                                                                                                              translate("Randomly choose remote server"),     { client="1" } },
 144                 { ListValue,    "proto",                                                { "udp", "tcp-client", "tcp-server" },                                                  translate("Use protocol"),      { client="1" } },
 145                 { Value,                "connect_retry",                                5,                                                                                                                              translate("Connection retry interval"), { proto="tcp-client" }, { client="1" } },
 146                 { Value,                "http_proxy",                                   "192.168.1.100 8080",                                                                                   translate("Connect to remote host through an HTTP proxy"),      { client="1" } },
 147                 { Flag,                 "http_proxy_retry",                             0,                                                                                                                              translate("Retry indefinitely on HTTP proxy errors"),   { client="1" } },
 148                 { Value,                "http_proxy_timeout",                   5,                                                                                                                              translate("Proxy timeout in seconds"),  { client="1" } },
 149                 { DynamicList,  "http_proxy_option",                    { "VERSION 1.0", "AGENT OpenVPN/2.0.9" },                                               translate("Set extended HTTP proxy options"),   { client="1" } },
 150                 { Value,                "socks_proxy",                                  "192.168.1.200 1080",                                                                                   translate("Connect through Socks5 proxy"),      { client="1" } },
 151                 { Value,                "socks_proxy_retry",                    5,                                                                                                                              translate("Retry indefinitely on Socks proxy errors"),  { client="1" } },       -- client && socks_proxy
 152                 { Value,                "resolv_retry",                                 "infinite",                                                                                                             translate("If hostname resolve fails, retry"),  { client="1" } },
 153                 { ListValue,    "redirect_gateway",                             { "", "local", "def1", "local def1" },                                                  translate("Automatically redirect default route"),      { client="1" } },
 154         } },
 155
 156         { "Cryptography", {
 157                 { Value,                "secret",                                               "/etc/openvpn/secret.key 1",                                                                    translate("Enable Static Key encryption mode (non-TLS)") },
 158                 { Value,                "auth",                                                 "SHA1",                                                                                                                 translate("HMAC authentication for packets") }, -- parse
 159                 { Value,                "cipher",                                               "BF-CBC",                                                                                                               translate("Encryption cipher for packets") }, -- parse
 160                 { Value,                "keysize",                                              1024,                                                                                                                   translate("Size of cipher key") }, -- parse
 161                 { Value,                "engine",                                               "dynamic",                                                                                                              translate("Enable OpenSSL hardware crypto engines") }, -- parse
 162                 { Flag,                 "no_replay",                                    0,                                                                                                                              translate("Disable replay protection") },
 163                 { Value,                "replay_window",                                "64 15",                                                                                                                translate("Replay protection sliding window size") },
 164                 { Flag,                 "mute_replay_warnings",                 0,                                                                                                                              translate("Silence the output of replay warnings") },
 165                 { Value,                "replay_persist",                               "/var/run/openvpn-replay-state",                                                                translate("Persist replay-protection state") },
 166                 { Flag,                 "no_iv",                                                0,                                                                                                                              translate("Disable cipher initialisation vector") },
 167                 { Flag,                 "tls_server",                                   0,                                                                                                                              translate("Enable TLS and assume server role"), { tls_client="" }, { tls_client="0" } },
 168                 { Flag,                 "tls_client",                                   0,                                                                                                                              translate("Enable TLS and assume client role"), { tls_server="" }, { tls_server="0" } },
 169                 { FileUpload,   "ca",                                                   "/etc/easy-rsa/keys/ca.crt",                                                                    translate("Certificate authority") },
 170                 { FileUpload,   "dh",                                                   "/etc/easy-rsa/keys/dh1024.pem",                                                                translate("Diffie Hellman parameters") },
 171                 { FileUpload,   "cert",                                                 "/etc/easy-rsa/keys/some-client.crt",                                                   translate("Local certificate") },
 172                 { FileUpload,   "key",                                                  "/etc/easy-rsa/keys/some-client.key",                                                   translate("Local private key") },
 173                 { FileUpload,   "pkcs12",                                               "/etc/easy-rsa/keys/some-client.pk12",                                                  translate("PKCS#12 file containing keys") },
 174                 { ListValue,    "key_method",                                   { 1, 2 },                                                                                                               translate("Enable TLS and assume client role") },
 175                 { Value,                "tls_cipher",                                   "DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:RC4-SHA:RC4-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC4-MD5",
 176                                                                                                                                                                                                                                                 translate("TLS cipher") },
 177                 { Value,                "tls_timeout",                                  2,                                                                                                                              translate("Retransmit timeout on TLS control channel") },
 178                 { Value,                "reneg_bytes",                                  1024,                                                                                                                   translate("Renegotiate data chan. key after bytes") },
 179                 { Value,                "reneg_pkts",                                   100,                                                                                                                    translate("Renegotiate data chan. key after packets") },
 180                 { Value,                "reneg_sec",                                    3600,                                                                                                                   translate("Renegotiate data chan. key after seconds") },
 181                 { Value,                "hand_window",                                  60,                                                                                                                             translate("Timeframe for key exchange") },
 182                 { Value,                "tran_window",                                  3600,                                                                                                                   translate("Key transition window") },
 183                 { Flag,                 "single_session",                               0,                                                                                                                              translate("Allow only one session") },
 184                 { Flag,                 "tls_exit",                                             0,                                                                                                                              translate("Exit on TLS negotiation failure") },
 185                 { Value,                "tls_auth",                                             "/etc/openvpn/tlsauth.key 1",                                                                   translate("Additional authentication over TLS") },
 186                 --{ Value,              "askpass",                                              "[file]",                                                                                                               translate("Get PEM password from controlling tty before we daemonize") },
 187                 { Flag,                 "auth_nocache",                                 0,                                                                                                                              translate("Don't cache --askpass or --auth-user-pass passwords") },
 188                 { Value,                "tls_remote",                                   "remote_x509_name",                                                                                             translate("Only accept connections from given X509 name") },
 189                 { ListValue,    "ns_cert_type",                                 { "client", "server" },                                                                                 translate("Require explicit designation on certificate") },
 190                 { ListValue,    "remote_cert_tls",                              { "client", "server" },                                                                                 translate("Require explicit key usage on certificate") },
 191                 { Value,                "crl_verify",                                   "/etc/easy-rsa/keys/crl.pem",                                                                   translate("Check peer certificate against a CRL") },
 192         } }
 193 }
 194
 195
 196 local cts = { }
 197 local params = { }
 198
 199 local m = Map("openvpn")
 200 local p = m:section( SimpleSection )
 201
 202 p.template = "openvpn/pageswitch"
 203 p.mode     = "advanced"
 204 p.instance = arg[1]
 205 p.category = arg[2] or "Service"
 206
 207 for _, c in ipairs(knownParams) do
 208         cts[#cts+1] = c[1]
 209         if c[1] == p.category then params = c[2] end
 210 end
 211
 212 p.categories = cts
 213
 214
 215 local s = m:section(
 216         NamedSection, arg[1], "openvpn",
 217         translate("%s" % arg[2])
 218 )
 219
 220 s.title     = translate("%s" % arg[2])
 221 s.addremove = false
 222 s.anonymous = true
 223
 224
 225 for _, option in ipairs(params) do
 226         local o = s:option(
 227                 option[1], option[2],
 228                 option[2], option[4]
 229         )
 230
 231         if option[1] == DummyValue then
 232                 o.value = option[3]
 233         else
 234                 if option[1] == DynamicList then
 235                         o.cast = nil
 236                         function o.cfgvalue(...)
 237                                 local val = AbstractValue.cfgvalue(...)
 238                                 return ( val and type(val) ~= "table" ) and { val } or val
 239                         end
 240                 end
 241
 242                 o.optional = true
 243
 244                 if type(option[3]) == "table" then
 245                         if o.optional then o:value("", "-- remove --") end
 246                         for _, v in ipairs(option[3]) do
 247                                 v = tostring(v)
 248                                 o:value(v)
 249                         end
 250                         o.default = tostring(option[3][1])
 251                 else
 252                         o.default = tostring(option[3])
 253                 end
 254         end
 255
 256         for i=5,#option do
 257                 if type(option[i]) == "table" then
 258                         o:depends(option[i])
 259                 end
 260         end
 261 end
 262
 263 return m