1 -- Copyright 2008 Steven Barth <steven@midlink.org>
2 -- Licensed to the public under the Apache License 2.0.
4 local fs = require("nixio.fs")
15 -- initialisation and daemon options
18 { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11 },
19 translate("Set output verbosity") },
23 translate("Disable Paging") },
27 translate("Disable options consistency check") },
31 -- translate("Set UID to user") },
35 -- translate("Set GID to group") },
39 translate("Change to directory before initialization") },
43 translate("Chroot to directory after initialization") },
47 -- translate("Daemonize after initialization") },
51 -- translate("Output to syslog and do not daemonize") },
55 translate("TOS passthrough (applies to IPv4 only)") },
58 -- "nowait Instance-Name",
59 -- translate("Run as an inetd or xinetd server") },
62 "/var/log/openvpn.log",
63 translate("Write log to file") },
66 "/var/log/openvpn.log",
67 translate("Append log to file") },
69 "suppress_timestamps",
71 translate("Don't log timestamps") },
74 -- "/var/run/openvpn.pid",
75 -- translate("Write process ID to file") },
79 translate("Change process priority") },
83 translate("Optimize TUN/TAP/UDP writes") },
86 "some params echoed to log",
87 translate("Echo parameters to log") },
90 { "SIGHUP", "SIGTERM" },
91 translate("Remap SIGUSR1 signals") },
94 "/var/run/openvpn.status 5",
95 translate("Write status to file every n seconds") },
99 translate("Status file format version") }, -- status
103 translate("Limit repeated log messages") },
107 translate("Shell cmd to execute after tun device open") },
111 translate("Delay tun/tap open and up script execution") },
114 "/usr/bin/ovpn-down",
115 translate("Shell cmd to run after tun device close") },
119 translate("Call down cmd/script before TUN/TAP close") },
123 translate("Run up/down scripts for all restarts") },
126 "/usr/bin/ovpn-routeup",
127 translate("Execute shell cmd after routes are added") },
130 "/usr/bin/ovpn-ipchange",
131 translate("Execute shell command on remote ip change"),
135 { "VAR1 value1", "VAR2 value2" },
136 translate("Pass environment variables to script") },
139 "/usr/bin/ovpn-tlsverify",
140 translate("Shell command to verify X509 name") },
143 "/usr/bin/ovpn-clientconnect",
144 translate("Run script cmd on client connection") },
148 translate("Run script cmd on client disconnection") },
151 "/usr/bin/ovpn-learnaddress",
152 translate("Executed in server mode whenever an IPv4 address/route or MAC address is added to OpenVPN's internal routing table") },
154 "auth_user_pass_verify",
155 "/usr/bin/ovpn-userpass via-env",
156 translate("Executed in server mode on new client connections, when the client is still untrusted") },
160 translate("Policy level over usage of external programs and scripts") },
164 translate("Enable a compression algorithm") },
172 translate("Major mode") },
176 translate("Local host name or ip address") },
180 translate("TCP/UDP port # for both local and remote") },
184 translate("TCP/UDP port # for local (default=1194)") },
188 translate("TCP/UDP port # for remote (default=1194)") },
192 translate("Allow remote to change its IP or port") },
196 translate("Do not bind to local address and port") },
200 translate("tun/tap device") },
204 translate("Type of used device") },
208 translate("Use tun/tap device node") },
211 "10.200.200.3 10.200.200.1",
212 translate("Set tun/tap adapter parameters") },
216 translate("Don't actually execute ifconfig") },
220 translate("Don't warn on ifconfig inconsistencies") },
223 "10.123.0.0 255.255.0.0",
224 translate("Add route after establishing connection") },
228 translate("Specify a default gateway for routes") },
232 translate("Delay n seconds after connection") },
236 translate("Don't add routes automatically") },
240 translate("Don't pull routes automatically") },
242 "allow_recursive_routing",
244 translate("Don't drop incoming tun packets with same destination as host") },
247 { "yes", "maybe", "no" },
248 translate("Enable Path MTU discovery") },
252 translate("Empirically measure MTU") },
256 translate("Set TCP/UDP MTU") },
260 translate("Set tun/tap device MTU") },
264 translate("Set tun/tap device overhead") },
268 translate("Enable internal datagram fragmentation"),
273 translate("Set upper bound on TCP MSS"),
278 translate("Set the TCP/UDP send buffer size") },
282 translate("Set the TCP/UDP receive buffer size") },
286 translate("Set tun/tap TX queue length") },
290 translate("Shaping for peer bandwidth") },
294 translate("tun/tap inactivity timeout") },
298 translate("Helper directive to simplify the expression of --ping and --ping-restart in server mode configurations") },
302 translate("Ping remote every n seconds over TCP/UDP port") },
306 translate("Remote ping timeout") },
310 translate("Restart after remote ping timeout") },
314 translate("Only process ping timeouts if routes exist") },
318 translate("Keep tun/tap device open on restart") },
322 translate("Don't re-read key on restart") },
326 translate("Keep local IP address on restart") },
330 translate("Keep remote IP address on restart") },
331 -- management channel
334 "127.0.0.1 31194 /etc/openvpn/mngmt-pwds",
335 translate("Enable management interface on <em>IP</em> <em>port</em>") },
338 "management_query_passwords",
340 translate("Query management channel for private key") },
345 translate("Start OpenVPN in a hibernating state") },
348 "management_log_cache",
350 translate("Number of lines for log file history") },
353 { "net30", "p2p", "subnet" },
354 translate("'net30', 'p2p', or 'subnet'"),
361 "10.200.200.0 255.255.255.0",
362 translate("Configure server mode"),
363 { client="0" }, { client="" } },
366 "10.200.200.1 255.255.255.0 10.200.200.200 10.200.200.250",
367 translate("Configure server bridge"),
368 { client="0" }, { client="" } },
371 { "redirect-gateway" },
372 translate("Push options to peer"),
373 { client="0" }, { client="" } },
377 translate("Don't inherit global push options"),
378 { client="0" }, { client="" } },
382 translate("Client is disabled"),
383 { client="0" }, { client="" } },
386 "10.200.200.100 10.200.200.150 255.255.255.0",
387 translate("Set aside a pool of subnets"),
388 { client="0" }, { client="" } },
390 "ifconfig_pool_persist",
391 "/etc/openvpn/ipp.txt 600",
392 translate("Persist/unpersist ifconfig-pool"),
393 { client="0" }, { client="" } },
396 "10.200.200.1 255.255.255.255",
397 translate("Push an ifconfig option to remote"),
398 { client="0" }, { client="" } },
401 "10.200.200.0 255.255.255.0",
402 translate("Route subnet to client"),
403 { client="0" }, { client="" } },
407 translate("Allow client-to-client traffic"),
408 { client="0" }, { client="" } },
412 translate("Allow multiple clients with same certificate"),
413 { client="0" }, { client="" } },
417 translate("Directory for custom client config files"),
418 { client="0" }, { client="" } },
422 translate("Refuse connection if no custom client config"),
423 { client="0" }, { client="" } },
427 translate("Temporary directory for client-connect return file"),
428 { client="0" }, { client="" } },
432 translate("Set size of real and virtual address hash tables"),
433 { client="0" }, { client="" } },
437 translate("Number of allocated broadcast buffers"),
438 { client="0" }, { client="" } },
442 translate("Maximum number of queued TCP output packets"),
443 { client="0" }, { client="" } },
447 translate("Allowed maximum of connected clients"),
448 { client="0" }, { client="" } },
450 "max_routes_per_client",
452 translate("Allowed maximum of internal"),
453 { client="0" }, { client="" } },
457 translate("Allowed maximum of new connections"),
458 { client="0" }, { client="" } },
460 "username_as_common_name",
462 translate("Use username as common name"),
463 { client="0" }, { client="" } },
467 translate("Configure client mode") },
471 translate("Accept options pushed from server"),
475 "/etc/openvpn/userpass.txt",
476 translate("Authenticate using username/password"),
480 { "none", "nointeract", "interact" },
481 translate("Handling of authentication failures"),
484 "explicit_exit_notify",
486 translate("Send notification to peer on disconnect"),
491 translate("Remote host name or ip address"),
496 translate("Randomly choose remote server"),
500 { "udp", "tcp-client", "tcp-server" },
501 translate("Use protocol"),
506 translate("Connection retry interval"),
507 { proto="tcp-client" }, { client="1" } },
510 "192.168.1.100 8080",
511 translate("Connect to remote host through an HTTP proxy"),
516 translate("Retry indefinitely on HTTP proxy errors"),
519 "http_proxy_timeout",
521 translate("Proxy timeout in seconds"),
525 { "VERSION 1.0", "AGENT OpenVPN/2.0.9" },
526 translate("Set extended HTTP proxy options"),
530 "192.168.1.200 1080",
531 translate("Connect through Socks5 proxy"),
533 -- client && socks_proxy
537 translate("Retry indefinitely on Socks proxy errors"),
542 translate("If hostname resolve fails, retry"),
546 { "", "local", "def1", "local def1" },
547 translate("Automatically redirect default route"),
550 "verify_client_cert",
551 { "none", "optional", "require" },
552 translate("Specify whether the client is required to supply a valid certificate") },
558 "/etc/openvpn/secret.key",
559 translate("Enable Static Key encryption mode (non-TLS)") },
564 translate("HMAC authentication for packets") },
613 translate("Encryption cipher for packets") },
618 translate("Size of cipher key") },
623 translate("Enable OpenSSL hardware crypto engines") },
627 translate("Replay protection sliding window size") },
629 "mute_replay_warnings",
631 translate("Silence the output of replay warnings") },
634 "/var/run/openvpn-replay-state",
635 translate("Persist replay-protection state") },
639 translate("Enable TLS and assume server role"),
640 { tls_client="" }, { tls_client="0" } },
644 translate("Enable TLS and assume client role"),
645 { tls_server="" }, { tls_server="0" } },
648 "/etc/easy-rsa/keys/ca.crt",
649 translate("Certificate authority") },
652 "/etc/easy-rsa/keys/dh1024.pem",
653 translate("Diffie Hellman parameters") },
656 "/etc/easy-rsa/keys/some-client.crt",
657 translate("Local certificate") },
660 "/etc/easy-rsa/keys/some-client.key",
661 translate("Local private key") },
664 "/etc/easy-rsa/keys/some-client.pk12",
665 translate("PKCS#12 file containing keys") },
669 translate("Enable TLS and assume client role") },
672 "DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:RC4-SHA:RC4-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC4-MD5",
673 translate("TLS cipher") },
677 translate("Retransmit timeout on TLS control channel") },
681 translate("Renegotiate data chan. key after bytes") },
685 translate("Renegotiate data chan. key after packets") },
689 translate("Renegotiate data chan. key after seconds") },
693 translate("Timeframe for key exchange") },
697 translate("Key transition window") },
701 translate("Allow only one session") },
705 translate("Exit on TLS negotiation failure") },
708 "/etc/openvpn/tlsauth.key",
709 translate("Additional authentication over TLS") },
712 "/etc/openvpn/tlscrypt.key",
713 translate("Encrypt and authenticate all control channel packets with the key") },
717 -- translate("Get PEM password from controlling tty before we daemonize") },
721 translate("Don't cache --askpass or --auth-user-pass passwords") },
725 translate("Only accept connections from given X509 name") },
728 { "client", "server" },
729 translate("Require explicit designation on certificate") },
732 { "client", "server" },
733 translate("Require explicit key usage on certificate") },
736 "/etc/easy-rsa/keys/crl.pem",
737 translate("Check peer certificate against a CRL") },
741 translate("The lowest supported TLS version") },
745 translate("The highest supported TLS version") },
749 translate("The key direction for 'tls-auth' and 'secret' options") },
753 translate("This completely disables cipher negotiation") },
756 "AES-256-GCM:AES-128-GCM",
757 translate("Restrict the allowed ciphers to be negotiated") },
765 local m = Map("openvpn")
766 m.redirect = luci.dispatcher.build_url("admin", "services", "openvpn")
767 m.apply_on_parse = true
769 local p = m:section( SimpleSection )
770 p.template = "openvpn/pageswitch"
773 p.category = arg[2] or "Service"
775 for _, c in ipairs(knownParams) do
777 if c[1] == p.category then params = c[2] end
784 NamedSection, arg[1], "openvpn",
785 translate("%s" % arg[2])
788 s.title = translate("%s" % arg[2])
793 for _, option in ipairs(params) do
795 option[1], option[2],
801 if option[1] == DummyValue then
803 elseif option[1] == FileUpload then
805 function o.cfgvalue(self, section)
806 local cfg_val = AbstractValue.cfgvalue(self, section)
813 function o.formvalue(self, section)
814 local sel_val = AbstractValue.formvalue(self, section)
815 local txt_val = luci.http.formvalue("cbid."..self.map.config.."."..section.."."..self.option..".textbox")
817 if sel_val and sel_val ~= "" then
821 if txt_val and txt_val ~= "" then
826 function o.remove(self, section)
827 local cfg_val = AbstractValue.cfgvalue(self, section)
828 local txt_val = luci.http.formvalue("cbid."..self.map.config.."."..section.."."..self.option..".textbox")
830 if cfg_val and fs.access(cfg_val) and txt_val == "" then
833 return AbstractValue.remove(self, section)
835 elseif option[1] == Flag then
838 if option[1] == DynamicList then
839 function o.cfgvalue(...)
840 local val = AbstractValue.cfgvalue(...)
841 return ( val and type(val) ~= "table" ) and { val } or val
845 if type(option[3]) == "table" then
846 if o.optional then o:value("", "-- remove --") end
847 for _, v in ipairs(option[3]) do
851 o.default = tostring(option[3][1])
853 o.default = tostring(option[3])
858 if type(option[i]) == "table" then