Merge pull request #437 from fkooman/issue-436

introduce tls_version_min and tls_version_max, add key_direction and …

diff --combined applications/luci-app-openvpn/luasrc/model/cbi/openvpn-advanced.lua
index 1508493,0ed8d45..af515fc
--- 1/applications/luci-app-openvpn/luasrc/model/cbi/openvpn-advanced.lua
--- 2/applications/luci-app-openvpn/luasrc/model/cbi/openvpn-advanced.lua
+++ b/applications/luci-app-openvpn/luasrc/model/cbi/openvpn-advanced.lua
@@@ -48,7 -48,7 +48,7 @@@ local knownParams = 
                { Flag,                 "client_disconnect",                    0,                                                                                                                              translate("Run script cmd on client disconnection") },
                { Value,                "learn_address",                                "/usr/bin/ovpn-learnaddress",                                                                   translate("Executed in server mode whenever an IPv4 address/route or MAC address is added to OpenVPN's internal routing table") },
                { Value,                "auth_user_pass_verify",                "/usr/bin/ovpn-userpass via-env",                                                               translate("Executed in server mode on new client connections, when the client is still untrusted") },
 -              { ListValue,    "script_security",                              { 0, 1, 2, 3 },                                                                                                 translate("Policy level over usage of external programs and scripts"),  {mode="server" } },
 +              { ListValue,    "script_security",                              { 0, 1, 2, 3 },                                                                                                 translate("Policy level over usage of external programs and scripts") },
        } },
  
        { "Networking", {
@@@ -74,7 -74,6 +74,7 @@@
                { Value,                "route_gateway",                                "10.234.1.1",                                                                                                   translate("Specify a default gateway for routes") },
                { Value,                "route_delay",                                  0,                                                                                                                              translate("Delay n seconds after connection") },
                { Flag,                 "route_noexec",                                 0,                                                                                                                              translate("Don't add routes automatically") },
 +              { Flag,                 "route_nopull",                                 0,                                                                                                                              translate("Don't pull routes automatically") },
  
                { ListValue,    "mtu_disc",                                             { "yes", "maybe", "no" },                                                                               translate("Enable Path MTU discovery") },
                { Flag,                 "mtu_test",                                             0,                                                                                                                              translate("Empirically measure MTU") },
@@@ -154,7 -153,7 +154,7 @@@
        } },
  
        { "Cryptography", {
-               { Value,                "secret",                                               "/etc/openvpn/secret.key 1",                                                                    translate("Enable Static Key encryption mode (non-TLS)") },
+               { FileUpload,   "secret",                                               "/etc/openvpn/secret.key",                                                                      translate("Enable Static Key encryption mode (non-TLS)") },
                { Value,                "auth",                                                 "SHA1",                                                                                                                 translate("HMAC authentication for packets") }, -- parse
                { Value,                "cipher",                                               "BF-CBC",                                                                                                               translate("Encryption cipher for packets") }, -- parse
                { Value,                "keysize",                                              1024,                                                                                                                   translate("Size of cipher key") }, -- parse
@@@ -182,13 -181,16 +182,16 @@@
                { Value,                "tran_window",                                  3600,                                                                                                                   translate("Key transition window") },
                { Flag,                 "single_session",                               0,                                                                                                                              translate("Allow only one session") },
                { Flag,                 "tls_exit",                                             0,                                                                                                                              translate("Exit on TLS negotiation failure") },
-               { Value,                "tls_auth",                                             "/etc/openvpn/tlsauth.key 1",                                                                   translate("Additional authentication over TLS") },
+               { Value,                "tls_auth",                                             "/etc/openvpn/tlsauth.key",                                                                     translate("Additional authentication over TLS") },
                --{ Value,              "askpass",                                              "[file]",                                                                                                               translate("Get PEM password from controlling tty before we daemonize") },
                { Flag,                 "auth_nocache",                                 0,                                                                                                                              translate("Don't cache --askpass or --auth-user-pass passwords") },
                { Value,                "tls_remote",                                   "remote_x509_name",                                                                                             translate("Only accept connections from given X509 name") },
                { ListValue,    "ns_cert_type",                                 { "client", "server" },                                                                                 translate("Require explicit designation on certificate") },
                { ListValue,    "remote_cert_tls",                              { "client", "server" },                                                                                 translate("Require explicit key usage on certificate") },
                { Value,                "crl_verify",                                   "/etc/easy-rsa/keys/crl.pem",                                                                   translate("Check peer certificate against a CRL") },
+               { Value,        "tls_version_min",              "1.0",                                                                                                                  translate("The lowest supported TLS version") },
+               { Value,        "tls_version_max",              "1.2",                                                                                                                  translate("The highest supported TLS version") },
+               { Value,        "key_direction",                "1",                                                                                                                    translate("The key direction for 'tls-auth' and 'secret' options") },
        } }
  }
  

diff --combined applications/luci-app-openvpn/luasrc/model/cbi/openvpn-basic.lua
index e75203d,e300f25..8385839
--- 1/applications/luci-app-openvpn/luasrc/model/cbi/openvpn-basic.lua
--- 2/applications/luci-app-openvpn/luasrc/model/cbi/openvpn-basic.lua
+++ b/applications/luci-app-openvpn/luasrc/model/cbi/openvpn-basic.lua
@@@ -24,13 -24,14 +24,14 @@@ local basicParams = 
        { ListValue,"comp_lzo",{"yes","no","adaptive"}, translate("Use fast LZO compression") },
        { Value,"keepalive","10 60", translate("Helper directive to simplify the expression of --ping and --ping-restart in server mode configurations") },
  
 -      { ListValue,"proto",{ "udp", "tcp" }, translate("Use protocol") },
 +      { ListValue,"proto",{ "udp", "udp6", "tcp", "tcp6" }, translate("Use protocol") },
  
        { Flag,"client",0, translate("Configure client mode") },
        { Flag,"client_to_client",0, translate("Allow client-to-client traffic") },
        { DynamicList,"remote","vpnserver.example.org", translate("Remote host name or ip address") },
  
-       { FileUpload,"secret","/etc/openvpn/secret.key 1", translate("Enable Static Key encryption mode (non-TLS)") },
+       { FileUpload,"secret","/etc/openvpn/secret.key", translate("Enable Static Key encryption mode (non-TLS)") },
+       { Value,"key_direction","1", translate("The key direction for 'tls-auth' and 'secret' options") },
        { FileUpload,"pkcs12","/etc/easy-rsa/keys/some-client.pk12", translate("PKCS#12 file containing keys") },
        { FileUpload,"ca","/etc/easy-rsa/keys/ca.crt", translate("Certificate authority") },
        { FileUpload,"dh","/etc/easy-rsa/keys/dh1024.pem", translate("Diffie Hellman parameters") },