applications/luci-app-openvpn/luasrc/model/cbi/openvpn-advanced.lua

   1 -- Copyright 2008 Steven Barth <steven@midlink.org>
   2 -- Licensed to the public under the Apache License 2.0.
   3
   4 local fs = require("nixio.fs")
   5
   6 local knownParams = {
   7         --
   8         --Widget
   9         --      Name
  10         --      Default(s)
  11         --      Description
  12         --      Option(s)
  13
  14         { "Service", {
  15         -- initialisation and daemon options
  16                 { ListValue,
  17                         "verb",
  18                         { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11 },
  19                         translate("Set output verbosity") },
  20                 { Flag,
  21                         "mlock",
  22                         0,
  23                         translate("Disable Paging") },
  24                 { Flag,
  25                         "disable_occ",
  26                         0,
  27                         translate("Disable options consistency check") },
  28         --      { Value,
  29         --              "user",
  30         --              "root",
  31         --              translate("Set UID to user") },
  32         --      { Value,
  33         --              "group",
  34         --              "root",
  35         --              translate("Set GID to group") },
  36                 { Value,
  37                         "cd",
  38                         "/etc/openvpn",
  39                         translate("Change to directory before initialization") },
  40                 { Value,
  41                         "chroot",
  42                         "/var/run",
  43                         translate("Chroot to directory after initialization") },
  44         --      { Value,
  45         --              "daemon",
  46         --              "Instance-Name",
  47         --              translate("Daemonize after initialization") },
  48         --      { Value,
  49         --              "syslog",
  50         --              "Instance-Name",
  51         --              translate("Output to syslog and do not daemonize") },
  52                 { Flag,
  53                         "passtos",
  54                         0,
  55                         translate("TOS passthrough (applies to IPv4 only)") },
  56         --      { Value,
  57         --              "inetd",
  58         --              "nowait Instance-Name",
  59         --              translate("Run as an inetd or xinetd server") },
  60                 { Value,
  61                         "log",
  62                         "/var/log/openvpn.log",
  63                         translate("Write log to file") },
  64                 { Value,
  65                         "log_append",
  66                         "/var/log/openvpn.log",
  67                         translate("Append log to file") },
  68                 { Flag,
  69                         "suppress_timestamps",
  70                         0,
  71                         translate("Don't log timestamps") },
  72         --      { Value,
  73         --              "writepid",
  74         --              "/var/run/openvpn.pid",
  75         --              translate("Write process ID to file") },
  76                 { Value,
  77                         "nice",
  78                         0,
  79                         translate("Change process priority") },
  80                 { Flag,
  81                         "fast_io",
  82                         0,
  83                         translate("Optimize TUN/TAP/UDP writes") },
  84                 { Value,
  85                         "echo",
  86                         "some params echoed to log",
  87                         translate("Echo parameters to log") },
  88                 { ListValue,
  89                         "remap_usr1",
  90                         { "SIGHUP", "SIGTERM" },
  91                         translate("Remap SIGUSR1 signals") },
  92                 { Value,
  93                         "status",
  94                         "/var/run/openvpn.status 5",
  95                         translate("Write status to file every n seconds") },
  96                 { Value,
  97                         "status_version",
  98                         { 1, 2 },
  99                         translate("Status file format version") },      -- status
 100                 { Value,
 101                         "mute",
 102                         5,
 103                         translate("Limit repeated log messages") },
 104                 { Value,
 105                         "up",
 106                         "/usr/bin/ovpn-up",
 107                         translate("Shell cmd to execute after tun device open") },
 108                 { Value,
 109                         "up_delay",
 110                         5,
 111                         translate("Delay tun/tap open and up script execution") },
 112                 { Value,
 113                         "down",
 114                         "/usr/bin/ovpn-down",
 115                         translate("Shell cmd to run after tun device close") },
 116                 { Flag,
 117                         "down_pre",
 118                         0,
 119                         translate("Call down cmd/script before TUN/TAP close") },
 120                 { Flag,
 121                         "up_restart",
 122                         0,
 123                         translate("Run up/down scripts for all restarts") },
 124                 { Value,
 125                         "route_up",
 126                         "/usr/bin/ovpn-routeup",
 127                         translate("Execute shell cmd after routes are added") },
 128                 { Value,
 129                         "ipchange",
 130                         "/usr/bin/ovpn-ipchange",
 131                         translate("Execute shell command on remote ip change"),
 132                         { mode="p2p" } },
 133                 { DynamicList,
 134                         "setenv",
 135                         { "VAR1 value1", "VAR2 value2" },
 136                         translate("Pass environment variables to script") },
 137                 { Value,
 138                         "tls_verify",
 139                         "/usr/bin/ovpn-tlsverify",
 140                         translate("Shell command to verify X509 name") },
 141                 { Value,
 142                         "client_connect",
 143                         "/usr/bin/ovpn-clientconnect",
 144                         translate("Run script cmd on client connection") },
 145                 { Flag,
 146                         "client_disconnect",
 147                         0,
 148                         translate("Run script cmd on client disconnection") },
 149                 { Value,
 150                         "learn_address",
 151                         "/usr/bin/ovpn-learnaddress",
 152                         translate("Executed in server mode whenever an IPv4 address/route or MAC address is added to OpenVPN's internal routing table") },
 153                 { Value,
 154                         "auth_user_pass_verify",
 155                         "/usr/bin/ovpn-userpass via-env",
 156                         translate("Executed in server mode on new client connections, when the client is still untrusted") },
 157                 { ListValue,
 158                         "script_security",
 159                         { 0, 1, 2, 3 },
 160                         translate("Policy level over usage of external programs and scripts") },
 161                 { ListValue,
 162                         "compress",
 163                         { "lzo", "lz4" },
 164                         translate("Enable a compression algorithm") },
 165         } },
 166
 167         { "Networking", {
 168         -- socket config
 169                 { ListValue,
 170                         "mode",
 171                         { "p2p", "server" },
 172                         translate("Major mode") },
 173                 { Value,
 174                         "local",
 175                         "0.0.0.0",
 176                         translate("Local host name or ip address") },
 177                 { Value,
 178                         "port",
 179                         1194,
 180                         translate("TCP/UDP port # for both local and remote") },
 181                 { Value,
 182                         "lport",
 183                         1194,
 184                         translate("TCP/UDP port # for local (default=1194)") },
 185                 { Value,
 186                         "rport",
 187                         1194,
 188                         translate("TCP/UDP port # for remote (default=1194)") },
 189                 { Flag,
 190                         "float",
 191                         0,
 192                         translate("Allow remote to change its IP or port") },
 193                 { Flag,
 194                         "nobind",
 195                         0,
 196                         translate("Do not bind to local address and port") },
 197                 { Value,
 198                         "dev",
 199                         "tun0",
 200                         translate("tun/tap device") },
 201                 { ListValue,
 202                         "dev_type",
 203                         { "tun", "tap" },
 204                         translate("Type of used device") },
 205                 { Value,
 206                         "dev_node",
 207                         "/dev/net/tun",
 208                         translate("Use tun/tap device node") },
 209                 { Value,
 210                         "ifconfig",
 211                         "10.200.200.3 10.200.200.1",
 212                         translate("Set tun/tap adapter parameters") },
 213                 { Flag,
 214                         "ifconfig_noexec",
 215                         0,
 216                         translate("Don't actually execute ifconfig") },
 217                 { Flag,
 218                         "ifconfig_nowarn",
 219                         0,
 220                         translate("Don't warn on ifconfig inconsistencies") },
 221                 { DynamicList,
 222                         "route",
 223                         "10.123.0.0 255.255.0.0",
 224                         translate("Add route after establishing connection") },
 225                 { Value,
 226                         "route_gateway",
 227                         "10.234.1.1",
 228                         translate("Specify a default gateway for routes") },
 229                 { Value,
 230                         "route_delay",
 231                         0,
 232                         translate("Delay n seconds after connection") },
 233                 { Flag,
 234                         "route_noexec",
 235                         0,
 236                         translate("Don't add routes automatically") },
 237                 { Flag,
 238                         "route_nopull",
 239                         0,
 240                         translate("Don't pull routes automatically") },
 241                 { Flag,
 242                         "allow_recursive_routing",
 243                         0,
 244                         translate("Don't drop incoming tun packets with same destination as host") },
 245                 { ListValue,
 246                         "mtu_disc",
 247                         { "yes", "maybe", "no" },
 248                         translate("Enable Path MTU discovery") },
 249                 { Flag,
 250                         "mtu_test",
 251                         0,
 252                         translate("Empirically measure MTU") },
 253                 { Value,
 254                         "link_mtu",
 255                         1500,
 256                         translate("Set TCP/UDP MTU") },
 257                 { Value,
 258                         "tun_mtu",
 259                         1500,
 260                         translate("Set tun/tap device MTU") },
 261                 { Value,
 262                         "tun_mtu_extra",
 263                         1500,
 264                         translate("Set tun/tap device overhead") },
 265                 { Value,
 266                         "fragment",
 267                         1500,
 268                         translate("Enable internal datagram fragmentation"),
 269                         { proto="udp" } },
 270                 { Value,
 271                         "mssfix",
 272                         1500,
 273                         translate("Set upper bound on TCP MSS"),
 274                         { proto="udp" } },
 275                 { Value,
 276                         "sndbuf",
 277                         65536,
 278                         translate("Set the TCP/UDP send buffer size") },
 279                 { Value,
 280                         "rcvbuf",
 281                         65536,
 282                         translate("Set the TCP/UDP receive buffer size") },
 283                 { Value,
 284                         "txqueuelen",
 285                         100,
 286                         translate("Set tun/tap TX queue length") },
 287                 { Value,
 288                         "shaper",
 289                         10240,
 290                         translate("Shaping for peer bandwidth") },
 291                 { Value,
 292                         "inactive",
 293                         240,
 294                         translate("tun/tap inactivity timeout") },
 295                 { Value,
 296                         "keepalive",
 297                         "10 60",
 298                         translate("Helper directive to simplify the expression of --ping and --ping-restart in server mode configurations") },
 299                 { Value,
 300                         "ping",
 301                         30,
 302                         translate("Ping remote every n seconds over TCP/UDP port") },
 303                 { Value,
 304                         "ping_exit",
 305                         120,
 306                         translate("Remote ping timeout") },
 307                 { Value,
 308                         "ping_restart",
 309                         60,
 310                         translate("Restart after remote ping timeout") },
 311                 { Flag,
 312                         "ping_timer_rem",
 313                         0,
 314                         translate("Only process ping timeouts if routes exist") },
 315                 { Flag,
 316                         "persist_tun",
 317                         0,
 318                         translate("Keep tun/tap device open on restart") },
 319                 { Flag,
 320                         "persist_key",
 321                         0,
 322                         translate("Don't re-read key on restart") },
 323                 { Flag,
 324                         "persist_local_ip",
 325                         0,
 326                         translate("Keep local IP address on restart") },
 327                 { Flag,
 328                         "persist_remote_ip",
 329                         0,
 330                         translate("Keep remote IP address on restart") },
 331         -- management channel
 332                 { Value,
 333                         "management",
 334                         "127.0.0.1 31194 /etc/openvpn/mngmt-pwds",
 335                         translate("Enable management interface on <em>IP</em> <em>port</em>") },
 336         -- management
 337                 { Flag,
 338                         "management_query_passwords",
 339                         0,
 340                         translate("Query management channel for private key") },
 341         -- management
 342                 { Flag,
 343                         "management_hold",
 344                         0,
 345                         translate("Start OpenVPN in a hibernating state") },
 346         -- management
 347                 { Value,
 348                         "management_log_cache",
 349                         100,
 350                         translate("Number of lines for log file history") },
 351                 { ListValue,
 352                         "topology",
 353                         { "net30", "p2p", "subnet" },
 354                         translate("'net30', 'p2p', or 'subnet'"),
 355                         {dev_type="tun" } },
 356         } },
 357
 358         { "VPN", {
 359                 { Value,
 360                         "server",
 361                         "10.200.200.0 255.255.255.0",
 362                         translate("Configure server mode"),
 363                         { client="0" }, { client="" } },
 364                 { Value,
 365                         "server_bridge",
 366                         "10.200.200.1 255.255.255.0 10.200.200.200 10.200.200.250",
 367                         translate("Configure server bridge"),
 368                         { client="0" }, { client="" } },
 369                 { DynamicList,
 370                         "push",
 371                         { "redirect-gateway" },
 372                         translate("Push options to peer"),
 373                         { client="0" }, { client="" } },
 374                 { Flag,
 375                         "push_reset",
 376                         0,
 377                         translate("Don't inherit global push options"),
 378                         { client="0" }, { client="" } },
 379                 { Flag,
 380                         "disable",
 381                         0,
 382                         translate("Client is disabled"),
 383                         { client="0" }, { client="" } },
 384                 { Value,
 385                         "ifconfig_pool",
 386                         "10.200.200.100 10.200.200.150 255.255.255.0",
 387                         translate("Set aside a pool of subnets"),
 388                         { client="0" }, { client="" } },
 389                 { Value,
 390                         "ifconfig_pool_persist",
 391                         "/etc/openvpn/ipp.txt 600",
 392                         translate("Persist/unpersist ifconfig-pool"),
 393                         { client="0" }, { client="" } },
 394                 { Value,
 395                         "ifconfig_push",
 396                         "10.200.200.1 255.255.255.255",
 397                         translate("Push an ifconfig option to remote"),
 398                         { client="0" }, { client="" } },
 399                 { Value,
 400                         "iroute",
 401                         "10.200.200.0 255.255.255.0",
 402                         translate("Route subnet to client"),
 403                         { client="0" }, { client="" } },
 404                 { Flag,
 405                         "client_to_client",
 406                         0,
 407                         translate("Allow client-to-client traffic"),
 408                         { client="0" }, { client="" } },
 409                 { Flag,
 410                         "duplicate_cn",
 411                         0,
 412                         translate("Allow multiple clients with same certificate"),
 413                         { client="0" }, { client="" } },
 414                 { Value,
 415                         "client_config_dir",
 416                         "/etc/openvpn/ccd",
 417                         translate("Directory for custom client config files"),
 418                         { client="0" }, { client="" } },
 419                 { Flag,
 420                         "ccd_exclusive",
 421                         0,
 422                         translate("Refuse connection if no custom client config"),
 423                         { client="0" }, { client="" } },
 424                 { Value,
 425                         "tmp_dir",
 426                         "/var/run/openvpn",
 427                         translate("Temporary directory for client-connect return file"),
 428                         { client="0" }, { client="" } },
 429                 { Value,
 430                         "hash_size",
 431                         "256 256",
 432                         translate("Set size of real and virtual address hash tables"),
 433                         { client="0" }, { client="" } },
 434                 { Value,
 435                         "bcast_buffers",
 436                         256,
 437                         translate("Number of allocated broadcast buffers"),
 438                         { client="0" }, { client="" } },
 439                 { Value,
 440                         "tcp_queue_limit",
 441                         64,
 442                         translate("Maximum number of queued TCP output packets"),
 443                         { client="0" }, { client="" } },
 444                 { Value,
 445                         "max_clients",
 446                         10,
 447                         translate("Allowed maximum of connected clients"),
 448                         { client="0" }, { client="" } },
 449                 { Value,
 450                         "max_routes_per_client",
 451                         256,
 452                         translate("Allowed maximum of internal"),
 453                         { client="0" }, { client="" } },
 454                 { Value,
 455                         "connect_freq",
 456                         "3 10",
 457                         translate("Allowed maximum of new connections"),
 458                         { client="0" }, { client="" } },
 459                 { Flag,
 460                         "username_as_common_name",
 461                         0,
 462                         translate("Use username as common name"),
 463                         { client="0" }, { client="" } },
 464                 { Flag,
 465                         "client",
 466                         0,
 467                         translate("Configure client mode") },
 468                 { Flag,
 469                         "pull",
 470                         0,
 471                         translate("Accept options pushed from server"),
 472                         { client="1" } },
 473                 { FileUpload,
 474                         "auth_user_pass",
 475                         "/etc/openvpn/userpass.txt",
 476                         translate("Authenticate using username/password"),
 477                         { client="1" } },
 478                 { ListValue,
 479                         "auth_retry",
 480                         { "none", "nointeract", "interact" },
 481                         translate("Handling of authentication failures"),
 482                         { client="1" } },
 483                 { Value,
 484                         "explicit_exit_notify",
 485                         1,
 486                         translate("Send notification to peer on disconnect"),
 487                         { client="1" } },
 488                 { DynamicList,
 489                         "remote",
 490                         "1.2.3.4",
 491                         translate("Remote host name or ip address"),
 492                         { client="1" } },
 493                 { Flag,
 494                         "remote_random",
 495                         0,
 496                         translate("Randomly choose remote server"),
 497                         { client="1" } },
 498                 { ListValue,
 499                         "proto",
 500                         { "udp", "tcp-client", "tcp-server" },
 501                         translate("Use protocol"),
 502                         { client="1" } },
 503                 { Value,
 504                         "connect_retry",
 505                         5,
 506                         translate("Connection retry interval"),
 507                         { proto="tcp-client" }, { client="1" } },
 508                 { Value,
 509                         "http_proxy",
 510                         "192.168.1.100 8080",
 511                         translate("Connect to remote host through an HTTP proxy"),
 512                         { client="1" } },
 513                 { Flag,
 514                         "http_proxy_retry",
 515                         0,
 516                         translate("Retry indefinitely on HTTP proxy errors"),
 517                         { client="1" } },
 518                 { Value,
 519                         "http_proxy_timeout",
 520                         5,
 521                         translate("Proxy timeout in seconds"),
 522                         { client="1" } },
 523                 { DynamicList,
 524                         "http_proxy_option",
 525                         { "VERSION 1.0", "AGENT OpenVPN/2.0.9" },
 526                         translate("Set extended HTTP proxy options"),
 527                         { client="1" } },
 528                 { Value,
 529                         "socks_proxy",
 530                         "192.168.1.200 1080",
 531                         translate("Connect through Socks5 proxy"),
 532                         { client="1" } },
 533         -- client && socks_proxy
 534                 { Value,
 535                         "socks_proxy_retry",
 536                         5,
 537                         translate("Retry indefinitely on Socks proxy errors"),
 538                         { client="1" } },
 539                 { Value,
 540                         "resolv_retry",
 541                         "infinite",
 542                         translate("If hostname resolve fails, retry"),
 543                         { client="1" } },
 544                 { ListValue,
 545                         "redirect_gateway",
 546                         { "", "local", "def1", "local def1" },
 547                         translate("Automatically redirect default route"),
 548                         { client="1" } },
 549                 { Value,
 550                         "verify_client_cert",
 551                         {  "none", "optional", "require" },
 552                         translate("Specify whether the client is required to supply a valid certificate") },
 553         } },
 554
 555         { "Cryptography", {
 556                 { FileUpload,
 557                         "secret",
 558                         "/etc/openvpn/secret.key",
 559                         translate("Enable Static Key encryption mode (non-TLS)") },
 560         -- parse
 561                 { Value,
 562                         "auth",
 563                         "SHA1",
 564                         translate("HMAC authentication for packets") },
 565         -- parse
 566                 { Value,
 567                         "cipher",
 568                         {
 569                                 "AES-128-CBC",
 570                                 "AES-128-CFB",
 571                                 "AES-128-CFB1",
 572                                 "AES-128-CFB8",
 573                                 "AES-128-GCM",
 574                                 "AES-128-OFB",
 575                                 "AES-192-CBC",
 576                                 "AES-192-CFB",
 577                                 "AES-192-CFB1",
 578                                 "AES-192-CFB8",
 579                                 "AES-192-GCM",
 580                                 "AES-192-OFB",
 581                                 "AES-256-CBC",
 582                                 "AES-256-CFB",
 583                                 "AES-256-CFB1",
 584                                 "AES-256-CFB8",
 585                                 "AES-256-GCM",
 586                                 "AES-256-OFB",
 587                                 "BF-CBC",
 588                                 "BF-CFB",
 589                                 "BF-OFB",
 590                                 "CAST5-CBC",
 591                                 "CAST5-CFB",
 592                                 "CAST5-OFB",
 593                                 "DES-CBC",
 594                                 "DES-CFB",
 595                                 "DES-CFB1",
 596                                 "DES-CFB8",
 597                                 "DES-EDE-CBC",
 598                                 "DES-EDE-CFB",
 599                                 "DES-EDE-OFB",
 600                                 "DES-EDE3-CBC",
 601                                 "DES-EDE3-CFB",
 602                                 "DES-EDE3-CFB1",
 603                                 "DES-EDE3-CFB8",
 604                                 "DES-EDE3-OFB",
 605                                 "DES-OFB",
 606                                 "DESX-CBC",
 607                                 "RC2-40-CBC",
 608                                 "RC2-64-CBC",
 609                                 "RC2-CBC",
 610                                 "RC2-CFB",
 611                                 "RC2-OFB"
 612                         },
 613                         translate("Encryption cipher for packets") },
 614         -- parse
 615                 { Value,
 616                         "keysize",
 617                         1024,
 618                         translate("Size of cipher key") },
 619         -- parse
 620                 { Value,
 621                         "engine",
 622                         "dynamic",
 623                         translate("Enable OpenSSL hardware crypto engines") },
 624                 { Value,
 625                         "replay_window",
 626                         "64 15",
 627                         translate("Replay protection sliding window size") },
 628                 { Flag,
 629                         "mute_replay_warnings",
 630                         0,
 631                         translate("Silence the output of replay warnings") },
 632                 { Value,
 633                         "replay_persist",
 634                         "/var/run/openvpn-replay-state",
 635                         translate("Persist replay-protection state") },
 636                 { Flag,
 637                         "tls_server",
 638                         0,
 639                         translate("Enable TLS and assume server role"),
 640                         { tls_client="" }, { tls_client="0" } },
 641                 { Flag,
 642                         "tls_client",
 643                         0,
 644                         translate("Enable TLS and assume client role"),
 645                         { tls_server="" }, { tls_server="0" } },
 646                 { FileUpload,
 647                         "ca",
 648                         "/etc/easy-rsa/keys/ca.crt",
 649                         translate("Certificate authority") },
 650                 { FileUpload,
 651                         "dh",
 652                         "/etc/easy-rsa/keys/dh1024.pem",
 653                         translate("Diffie Hellman parameters") },
 654                 { FileUpload,
 655                         "cert",
 656                         "/etc/easy-rsa/keys/some-client.crt",
 657                         translate("Local certificate") },
 658                 { FileUpload,
 659                         "key",
 660                         "/etc/easy-rsa/keys/some-client.key",
 661                         translate("Local private key") },
 662                 { FileUpload,
 663                         "pkcs12",
 664                         "/etc/easy-rsa/keys/some-client.pk12",
 665                         translate("PKCS#12 file containing keys") },
 666                 { ListValue,
 667                         "key_method",
 668                         { 1, 2 },
 669                         translate("Enable TLS and assume client role") },
 670                 { Value,
 671                         "tls_cipher",
 672                         "DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:RC4-SHA:RC4-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC4-MD5",
 673                         translate("TLS cipher") },
 674                 { Value,
 675                         "tls_timeout",
 676                         2,
 677                         translate("Retransmit timeout on TLS control channel") },
 678                 { Value,
 679                         "reneg_bytes",
 680                         1024,
 681                         translate("Renegotiate data chan. key after bytes") },
 682                 { Value,
 683                         "reneg_pkts",
 684                         100,
 685                         translate("Renegotiate data chan. key after packets") },
 686                 { Value,
 687                         "reneg_sec",
 688                         3600,
 689                         translate("Renegotiate data chan. key after seconds") },
 690                 { Value,
 691                         "hand_window",
 692                         60,
 693                         translate("Timeframe for key exchange") },
 694                 { Value,
 695                         "tran_window",
 696                         3600,
 697                         translate("Key transition window") },
 698                 { Flag,
 699                         "single_session",
 700                         0,
 701                         translate("Allow only one session") },
 702                 { Flag,
 703                         "tls_exit",
 704                         0,
 705                         translate("Exit on TLS negotiation failure") },
 706                 { Value,
 707                         "tls_auth",
 708                         "/etc/openvpn/tlsauth.key",
 709                         translate("Additional authentication over TLS") },
 710                 { Value,
 711                         "tls_crypt",
 712                         "/etc/openvpn/tlscrypt.key",
 713                         translate("Encrypt and authenticate all control channel packets with the key") },
 714         --      { Value,
 715         --              "askpass",
 716         --              "[file]",
 717         --              translate("Get PEM password from controlling tty before we daemonize") },
 718                 { Flag,
 719                         "auth_nocache",
 720                         0,
 721                         translate("Don't cache --askpass or --auth-user-pass passwords") },
 722                 { Value,
 723                         "tls_remote",
 724                         "remote_x509_name",
 725                         translate("Only accept connections from given X509 name") },
 726                 { ListValue,
 727                         "ns_cert_type",
 728                         { "client", "server" },
 729                         translate("Require explicit designation on certificate") },
 730                 { ListValue,
 731                         "remote_cert_tls",
 732                         { "client", "server" },
 733                         translate("Require explicit key usage on certificate") },
 734                 { Value,
 735                         "crl_verify",
 736                         "/etc/easy-rsa/keys/crl.pem",
 737                         translate("Check peer certificate against a CRL") },
 738                 { Value,
 739                         "tls_version_min",
 740                         "1.0",
 741                         translate("The lowest supported TLS version") },
 742                 { Value,
 743                         "tls_version_max",
 744                         "1.2",
 745                         translate("The highest supported TLS version") },
 746                 { ListValue,
 747                         "key_direction",
 748                         { 0, 1 },
 749                         translate("The key direction for 'tls-auth' and 'secret' options") },
 750                 { Flag,
 751                         "ncp_disable",
 752                         0,
 753                         translate("This completely disables cipher negotiation") },
 754                 { Value,
 755                         "ncp_ciphers",
 756                         "AES-256-GCM:AES-128-GCM",
 757                         translate("Restrict the allowed ciphers to be negotiated") },
 758         } }
 759 }
 760
 761
 762 local cts = { }
 763 local params = { }
 764
 765 local m = Map("openvpn")
 766 m.redirect = luci.dispatcher.build_url("admin", "services", "openvpn")
 767 m.apply_on_parse = true
 768
 769 local p = m:section( SimpleSection )
 770 p.template = "openvpn/pageswitch"
 771 p.mode     = "advanced"
 772 p.instance = arg[1]
 773 p.category = arg[2] or "Service"
 774
 775 for _, c in ipairs(knownParams) do
 776         cts[#cts+1] = c[1]
 777         if c[1] == p.category then params = c[2] end
 778 end
 779
 780 p.categories = cts
 781
 782
 783 local s = m:section(
 784         NamedSection, arg[1], "openvpn",
 785         translate("%s" % arg[2])
 786 )
 787
 788 s.title     = translate("%s" % arg[2])
 789 s.addremove = false
 790 s.anonymous = true
 791
 792
 793 for _, option in ipairs(params) do
 794         local o = s:option(
 795                 option[1], option[2],
 796                 option[2], option[4]
 797         )
 798
 799         o.optional = true
 800
 801         if option[1] == DummyValue then
 802                 o.value = option[3]
 803         elseif option[1] == FileUpload then
 804
 805                 function o.cfgvalue(self, section)
 806                         local cfg_val = AbstractValue.cfgvalue(self, section)
 807
 808                         if cfg_val then
 809                                 return cfg_val
 810                         end
 811                 end
 812
 813                 function o.formvalue(self, section)
 814                         local sel_val = AbstractValue.formvalue(self, section)
 815                         local txt_val = luci.http.formvalue("cbid."..self.map.config.."."..section.."."..self.option..".textbox")
 816
 817                         if sel_val and sel_val ~= "" then
 818                                 return sel_val
 819                         end
 820
 821                         if txt_val and txt_val ~= "" then
 822                                 return txt_val
 823                         end
 824                 end
 825
 826                 function o.remove(self, section)
 827                         local cfg_val = AbstractValue.cfgvalue(self, section)
 828                         local txt_val = luci.http.formvalue("cbid."..self.map.config.."."..section.."."..self.option..".textbox")
 829
 830                         if cfg_val and fs.access(cfg_val) and txt_val == "" then
 831                                 fs.unlink(cfg_val)
 832                         end
 833                         return AbstractValue.remove(self, section)
 834                 end
 835         elseif option[1] == Flag then
 836                 o.default = nil
 837         else
 838                 if option[1] == DynamicList then
 839                         function o.cfgvalue(...)
 840                                 local val = AbstractValue.cfgvalue(...)
 841                                 return ( val and type(val) ~= "table" ) and { val } or val
 842                         end
 843                 end
 844
 845                 if type(option[3]) == "table" then
 846                         if o.optional then o:value("", "-- remove --") end
 847                         for _, v in ipairs(option[3]) do
 848                                 v = tostring(v)
 849                                 o:value(v)
 850                         end
 851                         o.default = tostring(option[3][1])
 852                 else
 853                         o.default = tostring(option[3])
 854                 end
 855         end
 856
 857         for i=5,#option do
 858                 if type(option[i]) == "table" then
 859                         o:depends(option[i])
 860                 end
 861         end
 862 end
 863
 864 return m