projects / project / luci.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
luci-app-openvpn: remove obsolete config options
[project/luci.git] / applications / luci-app-openvpn / luasrc / model / cbi / openvpn-advanced.lua
1 -- Copyright 2008 Steven Barth <steven@midlink.org>
2 -- Licensed to the public under the Apache License 2.0.
3
4 require("luci.ip")
5 require("luci.model.uci")
6
7
8 local knownParams = {
9 --
10 --Widget
11 -- Name
12 -- Default(s)
13 -- Description
14 -- Option(s)
15
16 { "Service", {
17 -- initialisation and daemon options
18 { ListValue,
19 "verb",
20 { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11 },
21 translate("Set output verbosity") },
22 { Flag,
23 "mlock",
24 0,
25 translate("Disable Paging") },
26 { Flag,
27 "disable_occ",
28 0,
29 translate("Disable options consistency check") },
30 -- { Value,
31 -- "user",
32 -- "root",
33 -- translate("Set UID to user") },
34 -- { Value,
35 -- "group",
36 -- "root",
37 -- translate("Set GID to group") },
38 { Value,
39 "cd",
40 "/etc/openvpn",
41 translate("Change to directory before initialization") },
42 { Value,
43 "chroot",
44 "/var/run",
45 translate("Chroot to directory after initialization") },
46 -- { Value,
47 -- "daemon",
48 -- "Instance-Name",
49 -- translate("Daemonize after initialization") },
50 -- { Value,
51 -- "syslog",
52 -- "Instance-Name",
53 -- translate("Output to syslog and do not daemonize") },
54 { Flag,
55 "passtos",
56 0,
57 translate("TOS passthrough (applies to IPv4 only)") },
58 -- { Value,
59 -- "inetd",
60 -- "nowait Instance-Name",
61 -- translate("Run as an inetd or xinetd server") },
62 { Value,
63 "log",
64 "/var/log/openvpn.log",
65 translate("Write log to file") },
66 { Value,
67 "log_append",
68 "/var/log/openvpn.log",
69 translate("Append log to file") },
70 { Flag,
71 "suppress_timestamps",
72 0,
73 translate("Don't log timestamps") },
74 -- { Value,
75 -- "writepid",
76 -- "/var/run/openvpn.pid",
77 -- translate("Write process ID to file") },
78 { Value,
79 "nice",
80 0,
81 translate("Change process priority") },
82 { Flag,
83 "fast_io",
84 0,
85 translate("Optimize TUN/TAP/UDP writes") },
86 { Value,
87 "echo",
88 "some params echoed to log",
89 translate("Echo parameters to log") },
90 { ListValue,
91 "remap_usr1",
92 { "SIGHUP", "SIGTERM" },
93 translate("Remap SIGUSR1 signals") },
94 { Value,
95 "status",
96 "/var/run/openvpn.status 5",
97 translate("Write status to file every n seconds") },
98 { Value,
99 "status_version",
100 { 1, 2 },
101 translate("Status file format version") }, -- status
102 { Value,
103 "mute",
104 5,
105 translate("Limit repeated log messages") },
106 { Value,
107 "up",
108 "/usr/bin/ovpn-up",
109 translate("Shell cmd to execute after tun device open") },
110 { Value,
111 "up_delay",
112 5,
113 translate("Delay tun/tap open and up script execution") },
114 { Value,
115 "down",
116 "/usr/bin/ovpn-down",
117 translate("Shell cmd to run after tun device close") },
118 { Flag,
119 "down_pre",
120 0,
121 translate("Call down cmd/script before TUN/TAP close") },
122 { Flag,
123 "up_restart",
124 0,
125 translate("Run up/down scripts for all restarts") },
126 { Value,
127 "route_up",
128 "/usr/bin/ovpn-routeup",
129 translate("Execute shell cmd after routes are added") },
130 { Value,
131 "ipchange",
132 "/usr/bin/ovpn-ipchange",
133 translate("Execute shell command on remote ip change"),
134 { mode="p2p" } },
135 { DynamicList,
136 "setenv",
137 { "VAR1 value1", "VAR2 value2" },
138 translate("Pass environment variables to script") },
139 { Value,
140 "tls_verify",
141 "/usr/bin/ovpn-tlsverify",
142 translate("Shell command to verify X509 name") },
143 { Value,
144 "client_connect",
145 "/usr/bin/ovpn-clientconnect",
146 translate("Run script cmd on client connection") },
147 { Flag,
148 "client_disconnect",
149 0,
150 translate("Run script cmd on client disconnection") },
151 { Value,
152 "learn_address",
153 "/usr/bin/ovpn-learnaddress",
154 translate("Executed in server mode whenever an IPv4 address/route or MAC address is added to OpenVPN's internal routing table") },
155 { Value,
156 "auth_user_pass_verify",
157 "/usr/bin/ovpn-userpass via-env",
158 translate("Executed in server mode on new client connections, when the client is still untrusted") },
159 { ListValue,
160 "script_security",
161 { 0, 1, 2, 3 },
162 translate("Policy level over usage of external programs and scripts") },
163 } },
164
165 { "Networking", {
166 -- socket config
167 { ListValue,
168 "mode",
169 { "p2p", "server" },
170 translate("Major mode") },
171 { Value,
172 "local",
173 "0.0.0.0",
174 translate("Local host name or ip address") },
175 { Value,
176 "port",
177 1194,
178 translate("TCP/UDP port # for both local and remote") },
179 { Value,
180 "lport",
181 1194,
182 translate("TCP/UDP port # for local (default=1194)") },
183 { Value,
184 "rport",
185 1194,
186 translate("TCP/UDP port # for remote (default=1194)") },
187 { Flag,
188 "float",
189 0,
190 translate("Allow remote to change its IP or port") },
191 { Flag,
192 "nobind",
193 0,
194 translate("Do not bind to local address and port") },
195 { Value,
196 "dev",
197 "tun0",
198 translate("tun/tap device") },
199 { ListValue,
200 "dev_type",
201 { "tun", "tap" },
202 translate("Type of used device") },
203 { Value,
204 "dev_node",
205 "/dev/net/tun",
206 translate("Use tun/tap device node") },
207 { Value,
208 "ifconfig",
209 "10.200.200.3 10.200.200.1",
210 translate("Set tun/tap adapter parameters") },
211 { Flag,
212 "ifconfig_noexec",
213 0,
214 translate("Don't actually execute ifconfig") },
215 { Flag,
216 "ifconfig_nowarn",
217 0,
218 translate("Don't warn on ifconfig inconsistencies") },
219 { DynamicList,
220 "route",
221 "10.123.0.0 255.255.0.0",
222 translate("Add route after establishing connection") },
223 { Value,
224 "route_gateway",
225 "10.234.1.1",
226 translate("Specify a default gateway for routes") },
227 { Value,
228 "route_delay",
229 0,
230 translate("Delay n seconds after connection") },
231 { Flag,
232 "route_noexec",
233 0,
234 translate("Don't add routes automatically") },
235 { Flag,
236 "route_nopull",
237 0,
238 translate("Don't pull routes automatically") },
239 { ListValue,
240 "mtu_disc",
241 { "yes", "maybe", "no" },
242 translate("Enable Path MTU discovery") },
243 { Flag,
244 "mtu_test",
245 0,
246 translate("Empirically measure MTU") },
247 { Value,
248 "link_mtu",
249 1500,
250 translate("Set TCP/UDP MTU") },
251 { Value,
252 "tun_mtu",
253 1500,
254 translate("Set tun/tap device MTU") },
255 { Value,
256 "tun_mtu_extra",
257 1500,
258 translate("Set tun/tap device overhead") },
259 { Value,
260 "fragment",
261 1500,
262 translate("Enable internal datagram fragmentation"),
263 { proto="udp" } },
264 { Value,
265 "mssfix",
266 1500,
267 translate("Set upper bound on TCP MSS"),
268 { proto="udp" } },
269 { Value,
270 "sndbuf",
271 65536,
272 translate("Set the TCP/UDP send buffer size") },
273 { Value,
274 "rcvbuf",
275 65536,
276 translate("Set the TCP/UDP receive buffer size") },
277 { Value,
278 "txqueuelen",
279 100,
280 translate("Set tun/tap TX queue length") },
281 { Value,
282 "shaper",
283 10240,
284 translate("Shaping for peer bandwidth") },
285 { Value,
286 "inactive",
287 240,
288 translate("tun/tap inactivity timeout") },
289 { Value,
290 "keepalive",
291 "10 60",
292 translate("Helper directive to simplify the expression of --ping and --ping-restart in server mode configurations") },
293 { Value,
294 "ping",
295 30,
296 translate("Ping remote every n seconds over TCP/UDP port") },
297 { Value,
298 "ping_exit",
299 120,
300 translate("Remote ping timeout") },
301 { Value,
302 "ping_restart",
303 60,
304 translate("Restart after remote ping timeout") },
305 { Flag,
306 "ping_timer_rem",
307 0,
308 translate("Only process ping timeouts if routes exist") },
309 { Flag,
310 "persist_tun",
311 0,
312 translate("Keep tun/tap device open on restart") },
313 { Flag,
314 "persist_key",
315 0,
316 translate("Don't re-read key on restart") },
317 { Flag,
318 "persist_local_ip",
319 0,
320 translate("Keep local IP address on restart") },
321 { Flag,
322 "persist_remote_ip",
323 0,
324 translate("Keep remote IP address on restart") },
325 -- management channel
326 { Value,
327 "management",
328 "127.0.0.1 31194 /etc/openvpn/mngmt-pwds",
329 translate("Enable management interface on <em>IP</em> <em>port</em>") },
330 -- management
331 { Flag,
332 "management_query_passwords",
333 0,
334 translate("Query management channel for private key") },
335 -- management
336 { Flag,
337 "management_hold",
338 0,
339 translate("Start OpenVPN in a hibernating state") },
340 -- management
341 { Value,
342 "management_log_cache",
343 100,
344 translate("Number of lines for log file history") },
345 { ListValue,
346 "topology",
347 { "net30", "p2p", "subnet" },
348 translate("'net30', 'p2p', or 'subnet'"),
349 {dev_type="tun" } },
350 } },
351
352 { "VPN", {
353 { Value,
354 "server",
355 "10.200.200.0 255.255.255.0",
356 translate("Configure server mode"),
357 { client="0" }, { client="" } },
358 { Value,
359 "server_bridge",
360 "10.200.200.1 255.255.255.0 10.200.200.200 10.200.200.250",
361 translate("Configure server bridge"),
362 { client="0" }, { client="" } },
363 { DynamicList,
364 "push",
365 { "redirect-gateway" },
366 translate("Push options to peer"),
367 { client="0" }, { client="" } },
368 { Flag,
369 "push_reset",
370 0,
371 translate("Don't inherit global push options"),
372 { client="0" }, { client="" } },
373 { Flag,
374 "disable",
375 0,
376 translate("Client is disabled"),
377 { client="0" }, { client="" } },
378 { Value,
379 "ifconfig_pool",
380 "10.200.200.100 10.200.200.150 255.255.255.0",
381 translate("Set aside a pool of subnets"),
382 { client="0" }, { client="" } },
383 { Value,
384 "ifconfig_pool_persist",
385 "/etc/openvpn/ipp.txt 600",
386 translate("Persist/unpersist ifconfig-pool"),
387 { client="0" }, { client="" } },
388 { Value,
389 "ifconfig_push",
390 "10.200.200.1 255.255.255.255",
391 translate("Push an ifconfig option to remote"),
392 { client="0" }, { client="" } },
393 { Value,
394 "iroute",
395 "10.200.200.0 255.255.255.0",
396 translate("Route subnet to client"),
397 { client="0" }, { client="" } },
398 { Flag,
399 "client_to_client",
400 0,
401 translate("Allow client-to-client traffic"),
402 { client="0" }, { client="" } },
403 { Flag,
404 "duplicate_cn",
405 0,
406 translate("Allow multiple clients with same certificate"),
407 { client="0" }, { client="" } },
408 { Value,
409 "client_config_dir",
410 "/etc/openvpn/ccd",
411 translate("Directory for custom client config files"),
412 { client="0" }, { client="" } },
413 { Flag,
414 "ccd_exclusive",
415 0,
416 translate("Refuse connection if no custom client config"),
417 { client="0" }, { client="" } },
418 { Value,
419 "tmp_dir",
420 "/var/run/openvpn",
421 translate("Temporary directory for client-connect return file"),
422 { client="0" }, { client="" } },
423 { Value,
424 "hash_size",
425 "256 256",
426 translate("Set size of real and virtual address hash tables"),
427 { client="0" }, { client="" } },
428 { Value,
429 "bcast_buffers",
430 256,
431 translate("Number of allocated broadcast buffers"),
432 { client="0" }, { client="" } },
433 { Value,
434 "tcp_queue_limit",
435 64,
436 translate("Maximum number of queued TCP output packets"),
437 { client="0" }, { client="" } },
438 { Value,
439 "max_clients",
440 10,
441 translate("Allowed maximum of connected clients"),
442 { client="0" }, { client="" } },
443 { Value,
444 "max_routes_per_client",
445 256,
446 translate("Allowed maximum of internal"),
447 { client="0" }, { client="" } },
448 { Value,
449 "connect_freq",
450 "3 10",
451 translate("Allowed maximum of new connections"),
452 { client="0" }, { client="" } },
453 { Flag,
454 "username_as_common_name",
455 0,
456 translate("Use username as common name"),
457 { client="0" }, { client="" } },
458 { Flag,
459 "client",
460 0,
461 translate("Configure client mode") },
462 { Flag,
463 "pull",
464 0,
465 translate("Accept options pushed from server"),
466 { client="1" } },
467 { Value,
468 "auth_user_pass",
469 "/etc/openvpn/userpass.txt",
470 translate("Authenticate using username/password"),
471 { client="1" } },
472 { ListValue,
473 "auth_retry",
474 { "none", "nointeract", "interact" },
475 translate("Handling of authentication failures"),
476 { client="1" } },
477 { Value,
478 "explicit_exit_notify",
479 1,
480 translate("Send notification to peer on disconnect"),
481 { client="1" } },
482 { DynamicList,
483 "remote",
484 "1.2.3.4",
485 translate("Remote host name or ip address"),
486 { client="1" } },
487 { Flag,
488 "remote_random",
489 0,
490 translate("Randomly choose remote server"),
491 { client="1" } },
492 { ListValue,
493 "proto",
494 { "udp", "tcp-client", "tcp-server" },
495 translate("Use protocol"),
496 { client="1" } },
497 { Value,
498 "connect_retry",
499 5,
500 translate("Connection retry interval"),
501 { proto="tcp-client" }, { client="1" } },
502 { Value,
503 "http_proxy",
504 "192.168.1.100 8080",
505 translate("Connect to remote host through an HTTP proxy"),
506 { client="1" } },
507 { Flag,
508 "http_proxy_retry",
509 0,
510 translate("Retry indefinitely on HTTP proxy errors"),
511 { client="1" } },
512 { Value,
513 "http_proxy_timeout",
514 5,
515 translate("Proxy timeout in seconds"),
516 { client="1" } },
517 { DynamicList,
518 "http_proxy_option",
519 { "VERSION 1.0", "AGENT OpenVPN/2.0.9" },
520 translate("Set extended HTTP proxy options"),
521 { client="1" } },
522 { Value,
523 "socks_proxy",
524 "192.168.1.200 1080",
525 translate("Connect through Socks5 proxy"),
526 { client="1" } },
527 -- client && socks_proxy
528 { Value,
529 "socks_proxy_retry",
530 5,
531 translate("Retry indefinitely on Socks proxy errors"),
532 { client="1" } },
533 { Value,
534 "resolv_retry",
535 "infinite",
536 translate("If hostname resolve fails, retry"),
537 { client="1" } },
538 { ListValue,
539 "redirect_gateway",
540 { "", "local", "def1", "local def1" },
541 translate("Automatically redirect default route"),
542 { client="1" } },
543 } },
544
545 { "Cryptography", {
546 { FileUpload,
547 "secret",
548 "/etc/openvpn/secret.key",
549 translate("Enable Static Key encryption mode (non-TLS)") },
550 -- parse
551 { Value,
552 "auth",
553 "SHA1",
554 translate("HMAC authentication for packets") },
555 -- parse
556 { Value,
557 "cipher",
558 "BF-CBC",
559 translate("Encryption cipher for packets") },
560 -- parse
561 { Value,
562 "keysize",
563 1024,
564 translate("Size of cipher key") },
565 -- parse
566 { Value,
567 "engine",
568 "dynamic",
569 translate("Enable OpenSSL hardware crypto engines") },
570 { Value,
571 "replay_window",
572 "64 15",
573 translate("Replay protection sliding window size") },
574 { Flag,
575 "mute_replay_warnings",
576 0,
577 translate("Silence the output of replay warnings") },
578 { Value,
579 "replay_persist",
580 "/var/run/openvpn-replay-state",
581 translate("Persist replay-protection state") },
582 { Flag,
583 "tls_server",
584 0,
585 translate("Enable TLS and assume server role"),
586 { tls_client="" }, { tls_client="0" } },
587 { Flag,
588 "tls_client",
589 0,
590 translate("Enable TLS and assume client role"),
591 { tls_server="" }, { tls_server="0" } },
592 { FileUpload,
593 "ca",
594 "/etc/easy-rsa/keys/ca.crt",
595 translate("Certificate authority") },
596 { FileUpload,
597 "dh",
598 "/etc/easy-rsa/keys/dh1024.pem",
599 translate("Diffie Hellman parameters") },
600 { FileUpload,
601 "cert",
602 "/etc/easy-rsa/keys/some-client.crt",
603 translate("Local certificate") },
604 { FileUpload,
605 "key",
606 "/etc/easy-rsa/keys/some-client.key",
607 translate("Local private key") },
608 { FileUpload,
609 "pkcs12",
610 "/etc/easy-rsa/keys/some-client.pk12",
611 translate("PKCS#12 file containing keys") },
612 { ListValue,
613 "key_method",
614 { 1, 2 },
615 translate("Enable TLS and assume client role") },
616 { Value,
617 "tls_cipher",
618 "DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:RC4-SHA:RC4-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC4-MD5",
619 translate("TLS cipher") },
620 { Value,
621 "tls_timeout",
622 2,
623 translate("Retransmit timeout on TLS control channel") },
624 { Value,
625 "reneg_bytes",
626 1024,
627 translate("Renegotiate data chan. key after bytes") },
628 { Value,
629 "reneg_pkts",
630 100,
631 translate("Renegotiate data chan. key after packets") },
632 { Value,
633 "reneg_sec",
634 3600,
635 translate("Renegotiate data chan. key after seconds") },
636 { Value,
637 "hand_window",
638 60,
639 translate("Timeframe for key exchange") },
640 { Value,
641 "tran_window",
642 3600,
643 translate("Key transition window") },
644 { Flag,
645 "single_session",
646 0,
647 translate("Allow only one session") },
648 { Flag,
649 "tls_exit",
650 0,
651 translate("Exit on TLS negotiation failure") },
652 { Value,
653 "tls_auth",
654 "/etc/openvpn/tlsauth.key",
655 translate("Additional authentication over TLS") },
656 { Value,
657 "tls_crypt",
658 "/etc/openvpn/tlscrypt.key",
659 translate("Encrypt and authenticate all control channel packets with the key") },
660 -- { Value,
661 -- "askpass",
662 -- "[file]",
663 -- translate("Get PEM password from controlling tty before we daemonize") },
664 { Flag,
665 "auth_nocache",
666 0,
667 translate("Don't cache --askpass or --auth-user-pass passwords") },
668 { Value,
669 "tls_remote",
670 "remote_x509_name",
671 translate("Only accept connections from given X509 name") },
672 { ListValue,
673 "ns_cert_type",
674 { "client", "server" },
675 translate("Require explicit designation on certificate") },
676 { ListValue,
677 "remote_cert_tls",
678 { "client", "server" },
679 translate("Require explicit key usage on certificate") },
680 { Value,
681 "crl_verify",
682 "/etc/easy-rsa/keys/crl.pem",
683 translate("Check peer certificate against a CRL") },
684 { Value,
685 "tls_version_min",
686 "1.0",
687 translate("The lowest supported TLS version") },
688 { Value,
689 "tls_version_max",
690 "1.2",
691 translate("The highest supported TLS version") },
692 { Value,
693 "key_direction",
694 "1",
695 translate("The key direction for 'tls-auth' and 'secret' options") },
696 } }
697 }
698
699
700 local cts = { }
701 local params = { }
702
703 local m = Map("openvpn")
704 local p = m:section( SimpleSection )
705
706 p.template = "openvpn/pageswitch"
707 p.mode = "advanced"
708 p.instance = arg[1]
709 p.category = arg[2] or "Service"
710
711 for _, c in ipairs(knownParams) do
712 cts[#cts+1] = c[1]
713 if c[1] == p.category then params = c[2] end
714 end
715
716 p.categories = cts
717
718
719 local s = m:section(
720 NamedSection, arg[1], "openvpn",
721 translate("%s" % arg[2])
722 )
723
724 s.title = translate("%s" % arg[2])
725 s.addremove = false
726 s.anonymous = true
727
728
729 for _, option in ipairs(params) do
730 local o = s:option(
731 option[1], option[2],
732 option[2], option[4]
733 )
734
735 if option[1] == DummyValue then
736 o.value = option[3]
737 else
738 if option[1] == DynamicList then
739 function o.cfgvalue(...)
740 local val = AbstractValue.cfgvalue(...)
741 return ( val and type(val) ~= "table" ) and { val } or val
742 end
743 end
744
745 o.optional = true
746
747 if type(option[3]) == "table" then
748 if o.optional then o:value("", "-- remove --") end
749 for _, v in ipairs(option[3]) do
750 v = tostring(v)
751 o:value(v)
752 end
753 o.default = tostring(option[3][1])
754 else
755 o.default = tostring(option[3])
756 end
757 end
758
759 for i=5,#option do
760 if type(option[i]) == "table" then
761 o:depends(option[i])
762 end
763 end
764 end
765
766 return m
Lua Configuration Interface (mirror)