1 -- Copyright 2014 Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
2 -- Licensed to the public under the Apache License 2.0.
4 local fs = require "nixio.fs"
5 local has_ipv6 = fs.access("/proc/net/ipv6_route")
7 m = Map("ocserv", translate("OpenConnect VPN"))
9 s = m:section(TypedSection, "ocserv", "OpenConnect")
12 s:tab("general", translate("General Settings"))
13 s:tab("ca", translate("CA certificate"))
14 s:tab("template", translate("Edit Template"))
16 local e = s:taboption("general", Flag, "enable", translate("Enable server"))
20 local o_sha = s:taboption("general", DummyValue, "sha_hash", translate("Server's certificate SHA1 hash"),
21 translate("That value should be communicated to the client to verify the server's certificate"))
22 local o_pki = s:taboption("general", DummyValue, "pkid", translate("Server's Public Key ID"),
23 translate("An alternative value to be communicated to the client to verify the server's certificate; this value only depends on the public key"))
25 local fd = io.popen("/usr/bin/certtool -i --infile /etc/ocserv/server-cert.pem", "r")
27 local found_sha = false
28 local found_pki = false
31 local ln = fd:read("*l")
34 elseif ln:match("SHA%-?1 fingerprint:") then
37 local hash = ln:match("([a-f0-9]+)")
38 o_sha.default = hash and hash:upper()
39 complete = complete + 1
41 elseif ln:match("Public Key I[Dd]:") then
44 local hash = ln:match("([a-f0-9]+)")
45 o_pki.default = hash and "sha1:" .. hash:upper()
46 complete = complete + 1
53 function m.on_commit(map)
54 luci.sys.call("/usr/bin/occtl reload >/dev/null 2>&1")
57 function e.write(self, section, value)
59 luci.sys.call("/etc/init.d/ocserv stop >/dev/null 2>&1")
60 luci.sys.call("/etc/init.d/ocserv disable >/dev/null 2>&1")
62 luci.sys.call("/etc/init.d/ocserv enable >/dev/null 2>&1")
63 luci.sys.call("/etc/init.d/ocserv restart >/dev/null 2>&1")
65 Flag.write(self, section, value)
70 o = s:taboption("general", ListValue, "auth", translate("User Authentication"),
71 translate("The authentication method for the users. The simplest is plain with a single username-password pair. Use PAM modules to authenticate using another server (e.g., LDAP, Radius)."))
77 s:taboption("general", Value, "port", translate("Port"),
78 translate("The same UDP and TCP ports will be used"))
79 s:taboption("general", Value, "max_clients", translate("Max clients"))
80 s:taboption("general", Value, "max_same", translate("Max same clients"))
81 s:taboption("general", Value, "dpd", translate("Dead peer detection time (secs)"))
83 local pip = s:taboption("general", Flag, "predictable_ips", translate("Predictable IPs"),
84 translate("The assigned IPs will be selected deterministically"))
87 local compr = s:taboption("general", Flag, "compression", translate("Enable compression"),
88 translate("Enable compression"))
91 local udp = s:taboption("general", Flag, "udp", translate("Enable UDP"),
92 translate("Enable UDP channel support; this must be enabled unless you know what you are doing"))
95 local cisco = s:taboption("general", Flag, "cisco_compat", translate("AnyConnect client compatibility"),
96 translate("Enable support for CISCO AnyConnect clients"))
100 tmpl = s:taboption("template", Value, "_tmpl",
101 translate("Edit the template that is used for generating the ocserv configuration."))
103 tmpl.template = "cbi/tvalue"
106 function tmpl.cfgvalue(self, section)
107 return nixio.fs.readfile("/etc/ocserv/ocserv.conf.template")
110 function tmpl.write(self, section, value)
111 value = value:gsub("\r\n?", "\n")
112 nixio.fs.writefile("/etc/ocserv/ocserv.conf.template", value)
115 ca = s:taboption("ca", Value, "_ca",
116 translate("View the CA certificate used by this server. You will need to save it as 'ca.pem' and import it into the clients."))
118 ca.template = "cbi/tvalue"
121 function ca.cfgvalue(self, section)
122 return nixio.fs.readfile("/etc/ocserv/ca.pem")
125 --[[Networking options]]--
127 local parp = s:taboption("general", Flag, "proxy_arp", translate("Enable proxy arp"),
128 translate("Provide addresses to clients from a subnet of LAN; if enabled the network below must be a subnet of LAN. Note that the first address of the specified subnet will be reserved by ocserv, so it should not be in use. If you have a network in LAN covering 192.168.1.0/24 use 192.168.1.192/26 to reserve the upper 62 addresses."))
131 ipaddr = s:taboption("general", Value, "ipaddr", translate("VPN <abbr title=\"Internet Protocol Version 4\">IPv4</abbr>-Network-Address"),
132 translate("The IPv4 subnet address to provide to clients; this should be some private network different than the LAN addresses unless proxy ARP is enabled. Leave empty to attempt auto-configuration."))
133 ipaddr.datatype = "ip4addr"
134 ipaddr.default = "192.168.100.1"
136 nm = s:taboption("general", Value, "netmask", translate("VPN <abbr title=\"Internet Protocol Version 4\">IPv4</abbr>-Netmask"),
137 translate("The mask of the subnet above."))
138 nm.datatype = "ip4addr"
139 nm.default = "255.255.255.0"
140 nm:value("255.255.255.0")
141 nm:value("255.255.0.0")
142 nm:value("255.0.0.0")
145 ip6addr = s:taboption("general", Value, "ip6addr", translate("VPN <abbr title=\"Internet Protocol Version 6\">IPv6</abbr>-Network-Address"), translate("<abbr title=\"Classless Inter-Domain Routing\">CIDR</abbr>-Notation: address/prefix"),
146 translate("The IPv6 subnet address to provide to clients; leave empty to attempt auto-configuration."))
147 ip6addr.datatype = "ip6addr"
153 s = m:section(TypedSection, "dns", translate("DNS servers"),
154 translate("The DNS servers to be provided to clients; can be either IPv6 or IPv4. Typically you should include the address of this device"))
157 s.template = "cbi/tblsection"
159 s:option(Value, "ip", translate("IP Address")).rmempty = true
160 s.datatype = "ipaddr"
164 s = m:section(TypedSection, "routes", translate("Routing table"),
165 translate("The routing table to be provided to clients; you can mix IPv4 and IPv6 routes, the server will send only the appropriate. Leave empty to set a default route"))
168 s.template = "cbi/tblsection"
170 s:option(Value, "ip", translate("IP Address")).rmempty = true
172 o = s:option(Value, "netmask", translate("Netmask (or IPv6-prefix)"))
173 o.default = "255.255.255.0"
174 o:value("255.255.255.0")
175 o:value("255.255.0.0")