applications/luci-openvpn/luasrc/model/cbi/openvpn-advanced.lua

   1 --[[
   2 LuCI - Lua Configuration Interface
   3
   4 Copyright 2008 Steven Barth <steven@midlink.org>
   5
   6 Licensed under the Apache License, Version 2.0 (the "License");
   7 you may not use this file except in compliance with the License.
   8 You may obtain a copy of the License at
   9
  10         http://www.apache.org/licenses/LICENSE-2.0
  11
  12 $Id$
  13 ]]--
  14
  15 require("luci.fs")
  16 require("luci.ip")
  17
  18
  19 local knownParams = {
  20         --
  21         -- Widget               Name                                    Optn.   Default(s)
  22         --
  23
  24         { "service", {
  25                 -- initialisation and daemon options
  26                 { ListValue,    "verb",                                         { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11 } },
  27                 { Flag,                 "mlock",                                        0 },
  28                 { Flag,                 "disable_occ",                          0 },
  29         --      { Value,                "user",                                         "root" },
  30         --      { Value,                "group",                                        "root" },
  31                 { Value,                "cd",                                           "/etc/openvpn" },
  32                 { Value,                "chroot",                                       "/var/run" },
  33         --      { Value,                "daemon",                                       "Instance-Name" },
  34         --      { Value,                "syslog",                                       "Instance-Name" },
  35                 { Flag,                 "passtos",                                      0 },
  36         --      { Value,                "inetd",                                        "nowait Instance-Name" },
  37                 { Value,                "log",                                          "/var/log/openvpn.log" },
  38                 { Value,                "log_append",                           "/var/log/openvpn.log" },
  39                 { Flag,                 "suppress_timestamps",          0 },
  40         --      { Value,                "writepid",                                     "/var/run/openvpn.pid" },
  41                 { Value,                "nice",                                         0 },
  42                 { Flag,                 "fast_io",                                      0 },
  43                 { Value,                "echo",                                         "some params echoed to log" },
  44                 { ListValue,            "remap_usr1",                   { "SIGHUP", "SIGTERM" } },
  45                 { Value,                "status",                                       "/var/run/openvpn.status 5" },
  46                 { Value,                "status_version",                       { 1, 2 } },     -- status
  47                 { Value,                "mute",                                         5 },
  48
  49                 { Value,                "up",                                           "/usr/bin/ovpn-up" },
  50                 { Value,                "up_delay",                                     5 },
  51                 { Value,                "down",                                         "/usr/bin/ovpn-down" },
  52                 { Flag,                 "down_pre",                                     0 },
  53                 { Flag,                 "up_restart",                           0 },
  54                 { Value,                "route_up",                                     "/usr/bin/ovpn-routeup" },
  55                 { Value,                "ipchange",                                     "/usr/bin/ovpn-ipchange",       { mode="p2p" } },
  56                 { DynamicList,  "setenv",                                       { "VAR1 value1", "VAR2 value2" } },
  57                 { Value,                "tls_verify",                           "/usr/bin/ovpn-tlsverify" },
  58                 { Value,                "client_connect",                       "/usr/bin/ovpn-clientconnect" },
  59                 { Flag,                 "client_disconnect",            0 },
  60                 { Value,                "learn_address",                        "/usr/bin/ovpn-learnaddress" },
  61                 { Value,                "auth_user_pass_verify",        "/usr/bin/ovpn-userpass via-env" },
  62         } },
  63
  64         { "networking", {
  65                 -- socket config
  66                 { ListValue,    "mode",                         { "p2p", "server" } },
  67                 { Value,                "local",                        "0.0.0.0" },
  68                 { Value,                "port",                         1194 },
  69                 { Value,                "lport",                        1194 },
  70                 { Value,                "rport",                        1194 },
  71                 { Flag,                 "float",                        0 },
  72                 { Flag,                 "nobind",                       0 },
  73
  74                 { Value,                "dev",                          "tun0" },
  75                 { ListValue,    "dev_type",                     { "tun", "tap" } },
  76                 { Value,                "dev_node",                     "/dev/net/tun" },
  77                 { Flag,                 "tun_ipv6",                     0 },
  78
  79                 { Value,                "ifconfig",                     "10.200.200.3 10.200.200.1" },
  80                 { Flag,                 "ifconfig_noexec",              0 },
  81                 { Flag,                 "ifconfig_nowarn",              0 },
  82
  83                 { DynamicList,  "route",                        "10.123.0.0 255.255.0.0" },
  84                 { Value,                "route_gateway",                "10.234.1.1" },
  85                 { Value,                "route_delay",                  0 },
  86                 { Flag,                 "route_noexec",                 0 },
  87
  88                 { ListValue,    "mtu_disc",                     { "yes", "maybe", "no" } },
  89                 { Flag,                 "mtu_test",                     0 },
  90                 { Flag,                 "comp_lzo",                     0 },
  91                 { Flag,                 "comp_noadept",                 0,              { comp_lzo=1 } },
  92                 { Value,                "link_mtu",                     1500 },
  93                 { Value,                "tun_mtu",                      1500 },
  94                 { Value,                "tun_mtu_extra",                1500 },
  95                 { Value,                "fragment",                     1500,   { proto="udp" } },
  96                 { Value,                "mssfix",                       1500,   { proto="udp" } },
  97                 { Value,                "sndbuf",                       65536 },
  98                 { Value,                "rcvbuf",                       65536 },
  99                 { Value,                "txqueuelen",                   100 },
 100                 { Value,                "shaper",                       10240 },
 101
 102                 { Value,                "inactive",                     240 },
 103                 { Value,                "keepalive",                    "10 60" },
 104                 { Value,                "ping",                         30 },
 105                 { Value,                "ping_exit",                    120 },
 106                 { Value,                "ping_restart",                 60 },
 107                 { Flag,                 "ping_timer_rem",               0 },
 108
 109                 { Flag,                 "persist_tun",                  0 },
 110                 { Flag,                 "persist_key",                  0 },
 111                 { Flag,                 "persist_local_ip",             0 },
 112                 { Flag,                 "persist_remote_ip",            0 },
 113
 114                 -- management channel
 115                 { Value,                "management",                   "127.0.0.1 31194 /etc/openvpn/mngmt-pwds" },
 116                 { Flag,                 "management_query_passwords",   0 },    -- management
 117                 { Flag,                 "management_hold",              0 },    -- management
 118                 { Flag,                 "management_log_cache",         100 },  -- management
 119         } },
 120
 121         { "vpn", {
 122                 { Value,                "server",                                       "10.200.200.0 255.255.255.0", { server_mode="1" } },
 123                 { Value,                "server_bridge",                        "10.200.200.1 255.255.255.0 10.200.200.200 10.200.200.250", { server_mode="1" } },
 124                 { DynamicList,  "push",                                         { "redirect-gateway", "comp-lzo" }, { server_mode="1" } },
 125                 { Flag,                 "push_reset",                           0, { server_mode="1" } },
 126                 { Flag,                 "disable",                                      0, { server_mode="1" } },
 127                 { Value,                "ifconfig_pool",                        "10.200.200.100 10.200.200.150 255.255.255.0", { server_mode="1" } },
 128                 { Value,                "ifconfig_pool_persist",        "/etc/openvpn/ipp.txt 600", { server_mode="1" } },
 129                 { Flag,                 "ifconfig_pool_linear",         0, { server_mode="1" } },
 130                 { Value,                "ifconfig_push",                        "10.200.200.1 255.255.255.255", { server_mode="1" } },
 131                 { Value,                "iroute",                                       "10.200.200.0 255.255.255.0", { server_mode="1" } },
 132                 { Flag,                 "client_to_client",                     0, { server_mode="1" } },
 133                 { Flag,                 "duplicate_cn",                         0, { server_mode="1" } },
 134                 { Value,                "client_config_dir",            "/etc/openvpn/ccd", { server_mode="1" } },
 135                 { Flag,                 "ccd_exclusive",                        0, { server_mode="1" } },
 136                 { Value,                "tmp_dir",                                      "/var/run/openvpn", { server_mode="1" } },
 137                 { Value,                "hash_size",                            "256 256", { server_mode="1" } },
 138                 { Value,                "bcast_buffers",                        256, { server_mode="1" } },
 139                 { Value,                "tcp_queue_limit",                      64, { server_mode="1" } },
 140                 { Value,                "max_clients",                          10, { server_mode="1" } },
 141                 { Value,                "max_routes_per_client",        256, { server_mode="1" } },
 142                 { Value,                "connect_freq",                         "3 10", { server_mode="1" } },
 143                 { Flag,                 "client_cert_not_required",     0, { server_mode="1" } },
 144                 { Flag,                 "username_as_common_name",      0, { server_mode="1" } },
 145                 { Flag,                 "client",                                       0, { server_mode="0" }, { server_mode="" } },
 146                 { Flag,                 "pull",                                         0, { client="1" } },
 147                 { Value,                "auth_user_pass",                       "/etc/openvpn/userpass.txt", { client="1" } },
 148                 { ListValue,    "auth_retry",                           { "none", "nointeract", "interact" }, { client="1" } },
 149                 { Value,                "explicit_exit_notify",         1, { client="1" } },
 150                 { DynamicList,  "remote",                                       "1.2.3.4", { client="1" } },            -- client
 151                 { Flag,                 "remote_random",                        1, { client="1" } },                            -- client
 152                 { ListValue,    "proto",                                        { "udp", "tcp-client", "tcp-server" }, { client="1" } },
 153                 { Value,                "connect_retry",                        5,      { proto="tcp-client" }, { client="1" } },                               -- client && proto=tcp-client
 154                 { Value,                "http_proxy_server",            "192.168.1.100 8080", { client="1" } }, -- client
 155                 { Flag,                 "http_proxy_retry",                     0, { client="1" } },                            -- client && http_proxy_server
 156                 { Value,                "http_proxy_timeout",           5, { client="1" } },                            -- client && http_proxy_server
 157                 { DynamicList,  "http_proxy_option",            { "VERSION 1.0", "AGENT OpenVPN/2.0.9" }, { client="1" } },     -- client && http_proxy_server
 158                 { Value,                "socks_proxy_server",           "192.168.1.200 1080", { client="1" } }, -- client
 159                 { Value,                "socks_proxy_retry",            5, { client="1" } },                                    -- client && socks_proxy_server
 160                 { Value,                "resolv_retry",                         "infinite", { client="1" } },                   -- client
 161                 { ListValue,    "redirect_gateway",                     { "", "local", "def1", "local def1" }, { client="1" } }, -- client
 162         } },
 163
 164         { "cryptography", {
 165                 { Value,                "secret",                               "/etc/openvpn/secret.key 1" },
 166                 { Value,                "auth",                                 "SHA1" }, -- parse
 167                 { Value,                "cipher",                               "BF-CBC" }, -- parse
 168                 { Value,                "keysize",                              1024 }, -- parse
 169                 { Value,                "engine",                               "dynamic" }, -- parse
 170                 { Flag,                 "no_replay",                    0 },
 171                 { Value,                "replay_window",                "64 15" },
 172                 { Flag,                 "mute_replay_warnings", 0 },
 173                 { Value,                "replay_persist",               "/var/run/openvpn-replay-state" },
 174                 { Flag,                 "no_iv",                                0 },
 175                 { Flag,                 "tls_server",                   0, { tls_client="" }, { tls_client="0" } },
 176                 { Flag,                 "tls_client",                   0, { tls_server="" }, { tls_server="0" } },
 177                 { FileUpload,   "ca",                                   "/etc/easy-rsa/keys/ca.crt" },
 178                 { FileUpload,   "dh",                                   "/etc/easy-rsa/keys/dh1024.pem" },
 179                 { FileUpload,   "cert",                                 "/etc/easy-rsa/keys/some-client.crt" },
 180                 { FileUpload,   "key",                                  "/etc/easy-rsa/keys/some-client.key" },
 181                 { FileUpload,   "pkcs12",                               "/etc/easy-rsa/keys/some-client.pk12" },
 182                 { ListValue,    "key_method",                   { 1, 2 } },
 183                 { Value,                "tls_cipher",                   "DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:RC4-SHA:RC4-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC4-MD5" },
 184                 { Value,                "tls_timeout",                  2 },
 185                 { Value,                "reneg_bytes",                  1024 },
 186                 { Value,                "reneg_pkts",                   100 },
 187                 { Value,                "reneg_sec",                    3600 },
 188                 { Value,                "hand_window",                  60 },
 189                 { Value,                "tran_window",                  3600 },
 190                 { Flag,                 "single_session",               0 },
 191                 { Flag,                 "tls_exit",                             0 },
 192                 { Value,                "tls_auth",                             "/etc/openvpn/tlsauth.key 1" },
 193                 --{ Value,              "askpass",                              "[file]" },
 194                 { Flag,                 "auth_nocache",                 0 },
 195                 { Value,                "tls_remote",                   "remote_x509_name" },
 196                 { ListValue,    "ns_cert_type",                 { "client", "server" } },
 197                 { ListValue,    "remote_cert_tls",              { "client", "server" } },
 198                 { Value,                "crl_verify",                   "/etc/easy-rsa/keys/crl.pem" },
 199         } }
 200 }
 201
 202
 203 local cts = { }
 204 local params = { }
 205
 206 local m = Map("openvpn")
 207 local p = m:section( SimpleSection )
 208
 209 p.template = "openvpn/pageswitch"
 210 p.mode     = "advanced"
 211 p.instance = arg[1]
 212 p.category = arg[2] or "service"
 213
 214 for _, c in ipairs(knownParams) do
 215         cts[#cts+1] = c[1]
 216         if c[1] == p.category then params = c[2] end
 217 end
 218
 219 p.categories = cts
 220
 221
 222 local s = m:section(
 223         NamedSection, arg[1], "openvpn",
 224         translate("openvpn_%s" % arg[2]),
 225         translate("openvpn_%s_desc" % arg[2])
 226 )
 227
 228 s.title     = translate("openvpn_%s" % arg[2])
 229 s.addremove = false
 230 s.anonymous = true
 231
 232
 233 for _, option in ipairs(params) do
 234         local o = s:option(
 235                 option[1], option[2],
 236                 translate("openvpn_param_%s" % option[2]),
 237                 translate("openvpn_param_%s_desc" % option[2])
 238         )
 239
 240         if option[1] == DummyValue then
 241                 o.value = option[3]
 242         else
 243                 if option[1] == DynamicList then
 244                         o.cast = nil
 245                         function o.cfgvalue(...)
 246                                 local val = AbstractValue.cfgvalue(...)
 247                                 return ( val and type(val) ~= "table" ) and { val } or val
 248                         end
 249                 end
 250
 251                 o.optional = true
 252
 253                 if type(option[3]) == "table" then
 254                         if o.optional then o:value("", "-- remove --") end
 255                         for _, v in ipairs(option[3]) do
 256                                 v = tostring(v)
 257                                 o:value(v)
 258                         end
 259                         o.default = tostring(option[3][1])
 260                 else
 261                         o.default = tostring(option[3])
 262                 end
 263         end
 264
 265         for i=5,#option do
 266                 if type(option[i]) == "table" then
 267                         o:depends(option[i])
 268                 end
 269         end
 270 end
 271
 272 return m