1 -- Copyright 2014 Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
2 -- Licensed to the public under the Apache License 2.0.
4 local fs = require "nixio.fs"
5 local has_ipv6 = fs.access("/proc/net/ipv6_route")
7 m = Map("ocserv", translate("OpenConnect VPN"))
9 s = m:section(TypedSection, "ocserv", "OpenConnect")
12 s:tab("general", translate("General Settings"))
13 s:tab("ca", translate("CA certificate"))
14 s:tab("template", translate("Edit Template"))
16 local e = s:taboption("general", Flag, "enable", translate("Enable server"))
20 local o_sha = s:taboption("general", DummyValue, "sha_hash", translate("Server's certificate SHA1 hash"),
21 translate("That value should be communicated to the client to verify the server's certificate"))
22 local o_pki = s:taboption("general", DummyValue, "pkid", translate("Server's Public Key ID"),
23 translate("An alternative value to be communicated to the client to verify the server's certificate; this value only depends on the public key"))
25 local fd = io.popen("/usr/bin/certtool -i --infile /etc/ocserv/server-cert.pem", "r")
27 local found_sha = false
28 local found_pki = false
31 local ln = fd:read("*l")
34 elseif ln:match("SHA%-?1 fingerprint:") then
37 local hash = ln:match("([a-f0-9]+)")
38 o_sha.default = hash and hash:upper()
39 complete = complete + 1
41 elseif ln:match("Public Key I[Dd]:") then
44 local hash = ln:match("([a-f0-9]+)")
45 o_pki.default = hash and "sha1:" .. hash:upper()
46 complete = complete + 1
53 function m.on_commit(map)
54 luci.sys.call("/usr/bin/occtl reload >/dev/null 2>&1")
57 function e.write(self, section, value)
59 luci.sys.call("/etc/init.d/ocserv stop >/dev/null 2>&1")
60 luci.sys.call("/etc/init.d/ocserv disable >/dev/null 2>&1")
62 luci.sys.call("/etc/init.d/ocserv enable >/dev/null 2>&1")
63 luci.sys.call("/etc/init.d/ocserv restart >/dev/null 2>&1")
65 Flag.write(self, section, value)
70 o = s:taboption("general", ListValue, "auth", translate("User Authentication"),
71 translate("The authentication method for the users. The simplest is plain with a single username-password pair. Use PAM modules to authenticate using another server (e.g., LDAP, Radius)."))
77 s:taboption("general", Value, "port", translate("Port"),
78 translate("The same UDP and TCP ports will be used"))
79 s:taboption("general", Value, "max_clients", translate("Max clients"))
80 s:taboption("general", Value, "max_same", translate("Max same clients"))
81 s:taboption("general", Value, "dpd", translate("Dead peer detection time (secs)"))
83 local pip = s:taboption("general", Flag, "predictable_ips", translate("Predictable IPs"),
84 translate("The assigned IPs will be selected deterministically"))
87 local compr = s:taboption("general", Flag, "compression", translate("Enable compression"),
88 translate("Enable compression"))
91 local udp = s:taboption("general", Flag, "udp", translate("Enable UDP"),
92 translate("Enable UDP channel support; this must be enabled unless you know what you are doing"))
95 local cisco = s:taboption("general", Flag, "cisco_compat", translate("AnyConnect client compatibility"),
96 translate("Enable support for CISCO AnyConnect clients"))
99 ipaddr = s:taboption("general", Value, "ipaddr", translate("VPN <abbr title=\"Internet Protocol Version 4\">IPv4</abbr>-Network-Address"))
100 ipaddr.datatype = "ip4addr"
101 ipaddr.default = "192.168.100.1"
103 nm = s:taboption("general", Value, "netmask", translate("VPN <abbr title=\"Internet Protocol Version 4\">IPv4</abbr>-Netmask"))
104 nm.datatype = "ip4addr"
105 nm.default = "255.255.255.0"
106 nm:value("255.255.255.0")
107 nm:value("255.255.0.0")
108 nm:value("255.0.0.0")
111 ip6addr = s:taboption("general", Value, "ip6addr", translate("VPN <abbr title=\"Internet Protocol Version 6\">IPv6</abbr>-Network-Address"), translate("<abbr title=\"Classless Inter-Domain Routing\">CIDR</abbr>-Notation: address/prefix"))
112 ip6addr.datatype = "ip6addr"
116 tmpl = s:taboption("template", Value, "_tmpl",
117 translate("Edit the template that is used for generating the ocserv configuration."))
119 tmpl.template = "cbi/tvalue"
122 function tmpl.cfgvalue(self, section)
123 return nixio.fs.readfile("/etc/ocserv/ocserv.conf.template")
126 function tmpl.write(self, section, value)
127 value = value:gsub("\r\n?", "\n")
128 nixio.fs.writefile("/etc/ocserv/ocserv.conf.template", value)
131 ca = s:taboption("ca", Value, "_ca",
132 translate("View the CA certificate used by this server. You will need to save it as 'ca.pem' and import it into the clients."))
134 ca.template = "cbi/tvalue"
137 function ca.cfgvalue(self, section)
138 return nixio.fs.readfile("/etc/ocserv/ca.pem")
143 s = m:section(TypedSection, "dns", translate("DNS servers"),
144 translate("The DNS servers to be provided to clients; can be either IPv6 or IPv4"))
147 s.template = "cbi/tblsection"
149 s:option(Value, "ip", translate("IP Address")).rmempty = true
150 s.datatype = "ipaddr"
154 s = m:section(TypedSection, "routes", translate("Routing table"),
155 translate("The routing table to be provided to clients; you can mix IPv4 and IPv6 routes, the server will send only the appropriate. Leave empty to set a default route"))
158 s.template = "cbi/tblsection"
160 s:option(Value, "ip", translate("IP Address")).rmempty = true
162 o = s:option(Value, "netmask", translate("Netmask (or IPv6-prefix)"))
163 o.default = "255.255.255.0"
164 o:value("255.255.255.0")
165 o:value("255.255.0.0")