diff options
Diffstat (limited to 'applications/luci-openvpn')
| -rw-r--r-- | applications/luci-openvpn/Makefile | 2 | ||||
| -rw-r--r-- | applications/luci-openvpn/luasrc/controller/openvpn.lua | 28 | ||||
| -rw-r--r-- | applications/luci-openvpn/luasrc/model/cbi/openvpn.lua | 287 | ||||
| -rw-r--r-- | applications/luci-openvpn/luasrc/view/openvpn/pageswitch.htm | 36 | ||||
| -rw-r--r-- | applications/luci-openvpn/root/etc/config/openvpn | 383 | ||||
| -rw-r--r-- | applications/luci-openvpn/root/etc/init.d/openvpn | 144 | ||||
| -rw-r--r-- | applications/luci-openvpn/root/lib/uci/schema/default/openvpn | 299 |
7 files changed, 1179 insertions, 0 deletions
diff --git a/applications/luci-openvpn/Makefile b/applications/luci-openvpn/Makefile new file mode 100644 index 0000000000..81a96f6a83 --- /dev/null +++ b/applications/luci-openvpn/Makefile @@ -0,0 +1,2 @@ +include ../../build/config.mk +include ../../build/module.mk
\ No newline at end of file diff --git a/applications/luci-openvpn/luasrc/controller/openvpn.lua b/applications/luci-openvpn/luasrc/controller/openvpn.lua new file mode 100644 index 0000000000..2b18c73c8e --- /dev/null +++ b/applications/luci-openvpn/luasrc/controller/openvpn.lua @@ -0,0 +1,28 @@ +--[[ +LuCI - Lua Configuration Interface + +Copyright 2008 Steven Barth <steven@midlink.org> +Copyright 2008 Jo-Philipp Wich <xm@leipzig.freifunk.net> + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +$Id: init.lua 3516 2008-10-04 18:42:06Z jow $ +]]-- +module("luci.controller.openvpn", package.seeall) + +function index() + require("luci.i18n") + luci.i18n.loadc("openvpn") + + local p = entry( + {"admin", "services", "openvpn"}, cbi("openvpn"), + luci.i18n.translate("openvpn", "OpenVPN") + ) + + p.i18n = "openvpn" + p.leaf = true +end diff --git a/applications/luci-openvpn/luasrc/model/cbi/openvpn.lua b/applications/luci-openvpn/luasrc/model/cbi/openvpn.lua new file mode 100644 index 0000000000..eeaaf7dd47 --- /dev/null +++ b/applications/luci-openvpn/luasrc/model/cbi/openvpn.lua @@ -0,0 +1,287 @@ +--[[ +LuCI - Lua Configuration Interface + +Copyright 2008 Steven Barth <steven@midlink.org> + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +$Id: olsrdplugins.lua 3288 2008-09-14 20:57:00Z jow $ +]]-- + +require("luci.fs") +require("luci.ip") + + +local knownParams = { + -- + -- Widget Name Optn. Default(s) + -- + + { "service", { + -- initialisation and daemon options + { "daemon", { + { ListValue, "verb", false, { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11 } }, + { Flag, "mlock", false, 0 }, + { Flag, "disable_occ", false, 0 }, + -- { Value, "user", true, "root" }, + -- { Value, "group", true, "root" }, + { Value, "cd", true, "/etc/openvpn" }, + { Value, "chroot", true, "/var/run" }, + -- { Value, "daemon", true, "Instance-Name" }, + -- { Value, "syslog", true, "Instance-Name" }, + { Flag, "passtos", false, 0 }, + -- { Value, "inetd", true, "nowait Instance-Name" }, + { Value, "log", true, "/var/log/openvpn.log" }, + { Value, "log_append", true, "/var/log/openvpn.log" }, + { Flag, "suppress_timestamps", false, 0 }, + -- { Value, "writepid", true, "/var/run/openvpn.pid" }, + { Value, "nice", true, 0 }, + { Flag, "fast_io", false, 0 }, + { Value, "echo", true, "some params echoed to log" }, + { ListValue, "remap_usr1", true, { "SIGHUP", "SIGTERM" } }, + { Value, "status", true, "/var/run/openvpn.status 5" }, + { Value, "status_version", true, { 1, 2 } }, -- status + { Value, "mute", true, 5 }, + } }, + + -- hook scripts + { "hookscripts", { + { Value, "up", true, "/usr/bin/ovpn-up" }, + { Value, "up_delay", true, 5 }, + { Value, "down", true, "/usr/bin/ovpn-down" }, + { Flag, "down_pre", false, 0 }, + { Flag, "up_restart", false, 0 }, + { Value, "route_up", true, "/usr/bin/ovpn-routeup" }, + { Value, "ipchange", true, "/usr/bin/ovpn-ipchange", { mode="p2p" } }, + { DynamicList, "setenv", true, { "VAR1 value1", "VAR2 value2" } }, + { Value, "tls_verify", true, "/usr/bin/ovpn-tlsverify" }, + { Value, "client_connect", true, "/usr/bin/ovpn-clientconnect" }, + { Flag, "client_disconnect", false, 0 }, + { Value, "learn_address", true, "/usr/bin/ovpn-learnaddress" }, + { Value, "auth_user_pass_verify", true, "/usr/bin/ovpn-userpass via-env" }, + } }, + } }, + + { "networking", { + -- socket config + { "networking", { + { ListValue, "mode", false, { "p2p", "server" } }, + { Value, "local", false, "0.0.0.0" }, + { Value, "port", false, 1194 }, + { Value, "lport", true, 1194 }, + { Value, "rport", true, 1194 }, + { Flag, "float", true, 0 }, + { Flag, "nobind", true, 0 }, + + { Value, "dev", true, "tun0" }, + { ListValue, "dev_type", false, { "tun", "tap" } }, + { Value, "dev_node", true, "/dev/net/tun" }, + { Flag, "tun_ipv6", false, 0 }, + + { Value, "ifconfig", true, "10.200.200.3 10.200.200.1" }, + { Flag, "ifconfig_noexec", false, 0 }, + { Flag, "ifconfig_nowarn", false, 0 }, + + { DynamicList, "route", true, "10.123.0.0 255.255.0.0" }, + { Value, "route_gateway", true, "10.234.1.1" }, + { Value, "route_delay", true, 0 }, + { Flag, "route_noexec", false, 0 }, + + { ListValue, "redirect_gateway", false, { "", "local", "def1", "local def1" } }, -- client + } }, + + -- connection tuning + { "conntune", { + { ListValue, "mtu_disc", false, { "yes", "maybe", "no" } }, + { Flag, "mtu_test", false, 0 }, + { Flag, "comp_lzo", false, 0 }, + { Flag, "comp_noadept", false, 0, { comp_lzo=1 } }, + { Value, "link_mtu", true, 1500 }, + { Value, "tun_mtu", true, 1500 }, + { Value, "tun_mtu_extra", true, 1500 }, + { Value, "fragment", true, 1500, { proto="udp" } }, + { Value, "mssfix", true, 1500, { proto="udp" } }, + { Value, "sndbuf", true, 65536 }, + { Value, "rcvbuf", true, 65536 }, + { Value, "txqueuelen", true, 100 }, + { Value, "shaper", true, 10240 }, + } }, + + -- idle timeouts & persistence + { "timeouts", { + { Value, "inactive", true, 240 }, + { Value, "keepalive", true, "10 60" }, + { Value, "ping", true, 30 }, + { Value, "ping_exit", true, 120 }, + { Value, "ping_restart", true, 60 }, + { Flag, "ping_timer_rem", false, 0 }, + + { Flag, "persist_tun", false, 0 }, + { Flag, "persist_key", false, 0 }, + { Flag, "persist_local_ip", false, 0 }, + { Flag, "persist_remote_ip", false, 0 }, + } }, + + -- management channel + { "management", { + { Value, "management", false, "127.0.0.1 31194 /etc/openvpn/mngmt-pwds" }, + { Flag, "management_query_passwords", + true, 0 }, -- management + { Flag, "management_hold", true, 0 }, -- management + { Flag, "management_log_cache", true, 100 }, -- management + } } + } }, + + { "role", { + { "server", { + { Value, "server", true, "10.200.200.0 255.255.255.0" }, + { Value, "server_bridge", true, "10.200.200.1 255.255.255.0 10.200.200.200 10.200.200.250" }, + { DynamicList, "push", true, { "redirect-gateway", "comp-lzo" } }, + { Flag, "push_reset", false, 0 }, + { Flag, "disable", false, 0 }, + { Value, "ifconfig_pool", true, "10.200.200.100 10.200.200.150 255.255.255.0" }, + { Value, "ifconfig_pool_persist", true, "/etc/openvpn/ipp.txt 600" }, + { Flag, "ifconfig_pool_linear", false, 0 }, + { Value, "ifconfig_push", true, "10.200.200.1 255.255.255.255" }, + { Value, "iroute", true, "10.200.200.0 255.255.255.0" }, + { Flag, "client_to_client", false, 0 }, + { Flag, "duplicate_cn", false, 0 }, + { Value, "client_config_dir", true, "/etc/openvpn/ccd" }, + { Flag, "ccd_exclusive", false, 0 }, + { Value, "tmp_dir", true, "/var/run/openvpn" }, + { Value, "hash_size", true, "256 256" }, + { Value, "bcast_buffers", true, 256 }, + { Value, "tcp_queue_limit", true, 64 }, + { Value, "max_clients", true, 10 }, + { Value, "max_routes_per_client", true, 256 }, + { Value, "connect_freq", true, "3 10" }, + { Flag, "client_cert_not_required", false, 0 }, + { Flag, "username_as_common_name", false, 0 }, + } }, + + { "client", { + { Flag, "client", false, 0 }, + { Flag, "pull", false, 0 }, + { Value, "auth_user_pass", true, "/etc/openvpn/userpass.txt" }, + { ListValue, "auth_retry", true, { "none", "nointeract", "interact" } }, + { Value, "explicit_exit_notify", true, 1 }, + { DynamicList, "remote", false, "1.2.3.4" }, -- client + { Flag, "remote_random", false, 1 }, -- client + { ListValue, "proto", false, { "udp", "tcp-client", "tcp-server" } }, + { Value, "connect_retry", true, 5, { proto="tcp-client" } }, -- client && proto=tcp-client + { Value, "http_proxy_server", true, "192.168.1.100 8080" }, -- client + { Flag, "http_proxy_retry", false, 0 }, -- client && http_proxy_server + { Value, "http_proxy_timeout", true, 5 }, -- client && http_proxy_server + { DynamicList, "http_proxy_option", true, { "VERSION 1.0", "AGENT OpenVPN/2.0.9" } }, -- client && http_proxy_server + { Value, "socks_proxy_server", true, "192.168.1.200 1080" }, -- client + { Value, "socks_proxy_retry", true, 5 }, -- client && socks_proxy_server + { Value, "resolv_retry", true, "infinite" }, -- client + } } + } }, + + { "cryptography", { + { "datachannel", { + { Value, "secret", true, "/etc/openvpn/secret.key 1" }, + { Value, "auth", true, "SHA1" }, -- parse + { Value, "cipher", true, "BF-CBC" }, -- parse + { Value, "keysize", true, 1024 }, -- parse + { Value, "engine", true, "dynamic" }, -- parse + { Flag, "no_replay", false, 0 }, + { Value, "replay_window", true, "64 15" }, + { Flag, "mute_replay_warnings", false, 0 }, + { Value, "replay_persist", true, "/var/run/openvpn-replay-state" }, + { Flag, "no_iv", false, 0 }, + } }, + + { "tlsmode", { + { Flag, "tls_server", false, 0 }, + { Flag, "tls_client", false, 0 }, + { Value, "ca", true, "/etc/easy-rsa/keys/ca.crt" }, + { Value, "dh", true, "/etc/easy-rsa/keys/dh1024.pem" }, + { Value, "cert", true, "/etc/easy-rsa/keys/some-client.crt" }, + { Value, "key", true, "/etc/easy-rsa/keys/some-client.key" }, + { Value, "pkcs12", true, "/etc/easy-rsa/keys/some-client.pk12" }, + { ListValue, "key_method", true, { 1, 2 } }, + { Value, "tls_cipher", true, "DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:RC4-SHA:RC4-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC4-MD5" }, + { Value, "tls_timeout", true, 2 }, + { Value, "reneg_bytes", true, 1024 }, + { Value, "reneg_pkts", true, 100 }, + { Value, "reneg_sec", true, 3600 }, + { Value, "hand_window", true, 60 }, + { Value, "tran_window", true, 3600 }, + { Flag, "single_session", false, 0 }, + { Flag, "tls_exit", false, 0 }, + { Value, "tls_auth", true, "/etc/openvpn/tlsauth.key 1" }, + --{ Value, "askpass", true, "[file]" }, + { Flag, "auth_nocache", false, 0 }, + { Value, "tls_remote", true, "remote_x509_name" }, + { ListValue, "ns_cert_type", true, { "client", "server" } }, + { Value, "crl_verify", true, "/etc/easy-rsa/keys/crl.pem" }, + } } + } } +} + + +local cts = { } +local params = { } + +local m = Map("openvpn") +local p = m:section( SimpleSection ) + +p.template = "openvpn/pageswitch" +p.category = arg[1] +p.csection = arg[2] +p.instance = arg[3] + +for _, c in ipairs(knownParams) do + cts[#cts+1] = { c[1], { } } + for _, o in ipairs(c[2]) do + cts[#cts][2][#cts[#cts][2]+1] = o[1] + if c[1] == p.category and o[1] == p.csection then + params = o[2] + end + end +end + +p.categories = cts + + +local s = m:section( + NamedSection, arg[3], "openvpn", + translate("openvpn_%s" % arg[2]), + translate("openvpn_%s_desc" % arg[2]) +) + +s.title = translate("openvpn_%s" % arg[2]) +s.addremove = false +s.anonymous = true + + +for _, option in ipairs(params) do + local o = s:option(option[1], option[2]) + + o.optional = option[3] + + if type(option[4]) == "table" then + if o.optional then o:value("", "-- remove --") end + for _, v in ipairs(option[4]) do + v = tostring(v) + o:value(v) + end + o.default = tostring(option[4][1]) + else + o.default = tostring(option[4]) + end + + for i=5,#option do + if type(option[i]) == "table" then + o:depends(option[i]) + end + end +end + +return m diff --git a/applications/luci-openvpn/luasrc/view/openvpn/pageswitch.htm b/applications/luci-openvpn/luasrc/view/openvpn/pageswitch.htm new file mode 100644 index 0000000000..13ef35c7b7 --- /dev/null +++ b/applications/luci-openvpn/luasrc/view/openvpn/pageswitch.htm @@ -0,0 +1,36 @@ +<%# +LuCI - Lua Configuration Interface +Copyright 2008 Steven Barth <steven@midlink.org> +Copyright 2008 Jo-Philipp Wich <xm@leipzig.freifunk.net> + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +$Id: value.htm 3333 2008-09-16 10:08:20Z Cyrus $ + +-%> + +<fieldset class="cbi-section"> + <legend> + <a href="<%=luci.dispatcher.build_url("admin", "services", "openvpn")%>"><%:openvpn_overview Overview%></a> » + <a href="<%=luci.dispatcher.build_url("admin", "services", "openvpn", self.instance)%>"><%=self.instance%></a> + </legend> + + <ul><% for _, c in ipairs(self.categories) do %> + <li><%=c[1]%><ul><li> + <% for i, s in ipairs(c[2]) do %> + <% if s == self.csection then %> + <strong><%=translate("openvpn_%s" % s, s)%></strong> + <% else %> + <a href="<%=luci.dispatcher.build_url( + "admin", "services", "openvpn", c[1], s, self.instance + )%>"><%=translate("openvpn_%s" % s, s)%></a> + <% end %> + <% if next(c[2], i) then %>|<% end %> + <% end %> + </li></ul></li> + <% end %></ul> +</fieldset> diff --git a/applications/luci-openvpn/root/etc/config/openvpn b/applications/luci-openvpn/root/etc/config/openvpn new file mode 100644 index 0000000000..9831ad15a1 --- /dev/null +++ b/applications/luci-openvpn/root/etc/config/openvpn @@ -0,0 +1,383 @@ +################################################# +# Sample OpenVPN 2.0 config file for # +# multi-client server. # +################################################# + +config openvpn sample_server + + # Set to 1 to enable this instance: + option enable 0 + + # Which local IP address should OpenVPN + # listen on? (optional) +# option local 0.0.0.0 + + # Which TCP/UDP port should OpenVPN listen on? + # If you want to run multiple OpenVPN instances + # on the same machine, use a different port + # number for each one. You will need to + # open up this port on your firewall. + option port 1194 + + # TCP or UDP server? +# option proto tcp + option proto udp + + # "dev tun" will create a routed IP tunnel, + # "dev tap" will create an ethernet tunnel. + # Use "dev tap0" if you are ethernet bridging + # and have precreated a tap0 virtual interface + # and bridged it with your ethernet interface. + # If you want to control access policies + # over the VPN, you must create firewall + # rules for the the TUN/TAP interface. + # On non-Windows systems, you can give + # an explicit unit number, such as tun0. + # On Windows, use "dev-node" for this. + # On most systems, the VPN will not function + # unless you partially or fully disable + # the firewall for the TUN/TAP interface. +# option dev tap + option dev tun + + # SSL/TLS root certificate (ca), certificate + # (cert), and private key (key). Each client + # and the server must have their own cert and + # key file. The server and all clients will + # use the same ca file. + # + # See the "easy-rsa" directory for a series + # of scripts for generating RSA certificates + # and private keys. Remember to use + # a unique Common Name for the server + # and each of the client certificates. + # + # Any X509 key management system can be used. + # OpenVPN can also use a PKCS #12 formatted key file + # (see "pkcs12" directive in man page). + option ca ca.crt + option cert server.crt + # This file should be kept secret: + option key server.key + + # Diffie hellman parameters. + # Generate your own with: + # openssl dhparam -out dh1024.pem 1024 + # Substitute 2048 for 1024 if you are using + # 2048 bit keys. + option dh dh1024.pem + + # Configure server mode and supply a VPN subnet + # for OpenVPN to draw client addresses from. + # The server will take 10.8.0.1 for itself, + # the rest will be made available to clients. + # Each client will be able to reach the server + # on 10.8.0.1. Comment this line out if you are + # ethernet bridging. See the man page for more info. + option server "10.8.0.0 255.255.255.0" + + # Maintain a record of client <-> virtual IP address + # associations in this file. If OpenVPN goes down or + # is restarted, reconnecting clients can be assigned + # the same virtual IP address from the pool that was + # previously assigned. + option ifconfig_pool_persist ipp.txt + + # Configure server mode for ethernet bridging. + # You must first use your OS's bridging capability + # to bridge the TAP interface with the ethernet + # NIC interface. Then you must manually set the + # IP/netmask on the bridge interface, here we + # assume 10.8.0.4/255.255.255.0. Finally we + # must set aside an IP range in this subnet + # (start=10.8.0.50 end=10.8.0.100) to allocate + # to connecting clients. Leave this line commented + # out unless you are ethernet bridging. +# option server_bridge "10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100" + + # Push routes to the client to allow it + # to reach other private subnets behind + # the server. Remember that these + # private subnets will also need + # to know to route the OpenVPN client + # address pool (10.8.0.0/255.255.255.0) + # back to the OpenVPN server. +# list push "route 192.168.10.0 255.255.255.0" +# list push "route 192.168.20.0 255.255.255.0" + + # To assign specific IP addresses to specific + # clients or if a connecting client has a private + # subnet behind it that should also have VPN access, + # use the subdirectory "ccd" for client-specific + # configuration files (see man page for more info). + + # EXAMPLE: Suppose the client + # having the certificate common name "Thelonious" + # also has a small subnet behind his connecting + # machine, such as 192.168.40.128/255.255.255.248. + # First, uncomment out these lines: +# option client_config_dir ccd +# list route "192.168.40.128 255.255.255.248" + # Then create a file ccd/Thelonious with this line: + # iroute 192.168.40.128 255.255.255.248 + # This will allow Thelonious' private subnet to + # access the VPN. This example will only work + # if you are routing, not bridging, i.e. you are + # using "dev tun" and "server" directives. + + # EXAMPLE: Suppose you want to give + # Thelonious a fixed VPN IP address of 10.9.0.1. + # First uncomment out these lines: +# option client_config_dir ccd +# list route "10.9.0.0 255.255.255.252" +# list route "192.168.100.0 255.255.255.0" + # Then add this line to ccd/Thelonious: + # ifconfig-push "10.9.0.1 10.9.0.2" + + # Suppose that you want to enable different + # firewall access policies for different groups + # of clients. There are two methods: + # (1) Run multiple OpenVPN daemons, one for each + # group, and firewall the TUN/TAP interface + # for each group/daemon appropriately. + # (2) (Advanced) Create a script to dynamically + # modify the firewall in response to access + # from different clients. See man + # page for more info on learn-address script. +# option learn_address ./script + + # If enabled, this directive will configure + # all clients to redirect their default + # network gateway through the VPN, causing + # all IP traffic such as web browsing and + # and DNS lookups to go through the VPN + # (The OpenVPN server machine may need to NAT + # the TUN/TAP interface to the internet in + # order for this to work properly). + # CAVEAT: May break client's network config if + # client's local DHCP server packets get routed + # through the tunnel. Solution: make sure + # client's local DHCP server is reachable via + # a more specific route than the default route + # of 0.0.0.0/0.0.0.0. +# list push "redirect-gateway" + + # Certain Windows-specific network settings + # can be pushed to clients, such as DNS + # or WINS server addresses. CAVEAT: + # http://openvpn.net/faq.html#dhcpcaveats +# list push "dhcp-option DNS 10.8.0.1" +# list push "dhcp-option WINS 10.8.0.1" + + # Uncomment this directive to allow different + # clients to be able to "see" each other. + # By default, clients will only see the server. + # To force clients to only see the server, you + # will also need to appropriately firewall the + # server's TUN/TAP interface. +# option client_to_client 1 + + # Uncomment this directive if multiple clients + # might connect with the same certificate/key + # files or common names. This is recommended + # only for testing purposes. For production use, + # each client should have its own certificate/key + # pair. + # + # IF YOU HAVE NOT GENERATED INDIVIDUAL + # CERTIFICATE/KEY PAIRS FOR EACH CLIENT, + # EACH HAVING ITS OWN UNIQUE "COMMON NAME", + # UNCOMMENT THIS LINE OUT. +# option duplicate_cn 1 + + # The keepalive directive causes ping-like + # messages to be sent back and forth over + # the link so that each side knows when + # the other side has gone down. + # Ping every 10 seconds, assume that remote + # peer is down if no ping received during + # a 120 second time period. + option keepalive "10 120" + + # For extra security beyond that provided + # by SSL/TLS, create an "HMAC firewall" + # to help block DoS attacks and UDP port flooding. + # + # Generate with: + # openvpn --genkey --secret ta.key + # + # The server and each client must have + # a copy of this key. + # The second parameter should be '0' + # on the server and '1' on the clients. + # This file is secret: +# option tls_auth "ta.key 0" + + # Select a cryptographic cipher. + # This config item must be copied to + # the client config file as well. + # Blowfish (default): +# option cipher BF-CBC + # AES: +# option cipher AES-128-CBC + # Triple-DES: +# option cipher DES-EDE3-CBC + + # Enable compression on the VPN link. + # If you enable it here, you must also + # enable it in the client config file. + option comp_lzo 1 + + # The maximum number of concurrently connected + # clients we want to allow. +# option max_clients 100 + + # The persist options will try to avoid + # accessing certain resources on restart + # that may no longer be accessible because + # of the privilege downgrade. + option persist_key 1 + option persist_tun 1 + + # Output a short status file showing + # current connections, truncated + # and rewritten every minute. + option status openvpn-status.log + + # By default, log messages will go to the syslog (or + # on Windows, if running as a service, they will go to + # the "\Program Files\OpenVPN\log" directory). + # Use log or log-append to override this default. + # "log" will truncate the log file on OpenVPN startup, + # while "log-append" will append to it. Use one + # or the other (but not both). +# option log openvpn.log +# option log_append openvpn.log + + # Set the appropriate level of log + # file verbosity. + # + # 0 is silent, except for fatal errors + # 4 is reasonable for general usage + # 5 and 6 can help to debug connection problems + # 9 is extremely verbose + option verb 3 + + # Silence repeating messages. At most 20 + # sequential messages of the same message + # category will be output to the log. +# option mute 20 + + +############################################## +# Sample client-side OpenVPN 2.0 config file # +# for connecting to multi-client server. # +############################################## + +config openvpn sample_client + + # Set to 1 to enable this instance: + option enable 0 + + # Specify that we are a client and that we + # will be pulling certain config file directives + # from the server. + option client 1 + + # Use the same setting as you are using on + # the server. + # On most systems, the VPN will not function + # unless you partially or fully disable + # the firewall for the TUN/TAP interface. +# option dev tap + option dev tun + + # Are we connecting to a TCP or + # UDP server? Use the same setting as + # on the server. +# option proto tcp + option proto udp + + # The hostname/IP and port of the server. + # You can have multiple remote entries + # to load balance between the servers. + list remote "my_server_1 1194" +# list remote "my_server_2 1194" + + # Choose a random host from the remote + # list for load_balancing. Otherwise + # try hosts in the order specified. +# option remote_random 1 + + # Keep trying indefinitely to resolve the + # host name of the OpenVPN server. Very useful + # on machines which are not permanently connected + # to the internet such as laptops. + option resolv_retry infinite + + # Most clients don't need to bind to + # a specific local port number. + option nobind 1 + + # Try to preserve some state across restarts. + option persist_key 1 + option persist_tun 1 + + # If you are connecting through an + # HTTP proxy to reach the actual OpenVPN + # server, put the proxy server/IP and + # port number here. See the man page + # if your proxy server requires + # authentication. + # retry on connection failures: +# option http_proxy_retry 1 + # specify http proxy address and port: +# option http_proxy "192.168.1.100 8080" + + # Wireless networks often produce a lot + # of duplicate packets. Set this flag + # to silence duplicate packet warnings. +# option mute_replay_warnings 1 + + # SSL/TLS parms. + # See the server config file for more + # description. It's best to use + # a separate .crt/.key file pair + # for each client. A single ca + # file can be used for all clients. + option ca ca.crt + option cert client.crt + option key client.key + + # Verify server certificate by checking + # that the certicate has the nsCertType + # field set to "server". This is an + # important precaution to protect against + # a potential attack discussed here: + # http://openvpn.net/howto.html#mitm + # + # To use this feature, you will need to generate + # your server certificates with the nsCertType + # field set to "server". The build_key_server + # script in the easy_rsa folder will do this. +# option ns_cert_type server + + # If a tls_auth key is used on the server + # then every client must also have the key. +# option tls_auth "ta.key 1" + + # Select a cryptographic cipher. + # If the cipher option is used on the server + # then you must also specify it here. +# option cipher x + + # Enable compression on the VPN link. + # Don't enable this unless it is also + # enabled in the server config file. + option comp_lzo 1 + + # Set log file verbosity. + option verb 3 + + # Silence repeating messages +# option mute 20 diff --git a/applications/luci-openvpn/root/etc/init.d/openvpn b/applications/luci-openvpn/root/etc/init.d/openvpn new file mode 100644 index 0000000000..baa683ff49 --- /dev/null +++ b/applications/luci-openvpn/root/etc/init.d/openvpn @@ -0,0 +1,144 @@ +#!/bin/sh /etc/rc.common +# OpenVPN init script +# Copyright (C) 2008 Jo-Philipp Wich +# This is free software, licensed under the GNU General Public License v2. +# See /LICENSE for more information. +# $Id$ + +START=95 +BIN=/usr/sbin/openvpn +SSD=start-stop-daemon + +LIST_SEP=" +" + +append_param() { + local v="$1" + case "$v" in + *_*_*_*) v=${v%%_*}-${v#*_}; v=${v%%_*}-${v#*_}; v=${v%%_*}-${v#*_} ;; + *_*_*) v=${v%%_*}-${v#*_}; v=${v%%_*}-${v#*_} ;; + *_*) v=${v%%_*}-${v#*_} ;; + esac + ARGS="$ARGS --$v" + return 0 +} + +append_bools() { + local p; local v; local s="$1"; shift + for p in $*; do + config_get_bool v "$s" "$p" + [ "$v" == 1 ] && append_param "$p" + done +} + +append_params() { + local p; local v; local s="$1"; shift + for p in $*; do + config_get v "$s" "$p" + IFS="$LIST_SEP" + for v in $v; do + [ -n "$v" ] && append_param "$p" && ARGS="$ARGS $v" + done + unset IFS + done +} + +append_params_quoted() { + local p; local v; local s="$1"; shift + for p in $*; do + config_get v "$s" "$p" + IFS="$LIST_SEP" + for v in $v; do + [ -n "$v" ] && append_param "$p" && ARGS="$ARGS '$v'" + done + unset IFS + done +} + +start_service() { + local s="$1" + local enable=0 + + # disabled? + config_get_bool enable "$s" enable 0 + [ "$enable" == 0 ] && return 0 + + PID="/var/run/openvpn-$s.pid" + ARGS="" + + # append flags + append_bools "$s" \ + auth_nocache ccd_exclusive client client_cert_not_required \ + client_disconnect client_to_client comp_lzo comp_noadapt disable \ + disable_occ down_pre duplicate_cn fast_io float http_proxy_retry \ + ifconfig_noexec ifconfig_nowarn ifconfig_pool_linear management_hold \ + management_query_passwords mktun mlock mtu_test mute_replay_warnings \ + nobind no_iv no_replay passtos persist_key persist_local_ip \ + persist_remote_ip persist_tun ping_timer_rem pull push_reset \ + remote_random rmtun route_noexec single_session socks_proxy_retry \ + suppress_timestamps test_crypto tls_client tls_exit tls_server \ + tun_ipv6 up_delay up_restart username_as_common_name + + # append params + append_params "$s" \ + auth auth_user_pass auth_user_pass_verify bcast_buffers ca cd cert \ + chroot cipher client_config_dir client_connect config connect_freq \ + connect_retry crl_verify cryptoapicert dev dev_node dev_type dh down \ + echo engine explicit_exit_notify fragment group hand_window hash_size \ + http_proxy http_proxy_option http_proxy_timeout ifconfig ifconfig_pool \ + ifconfig_pool_persist ifconfig_push inactive ipchange iroute keepalive \ + key key_method keysize learn_address link_mtu local log log_append \ + lport management management_log_cache max_clients \ + max_routes_per_client mode mssfix mtu_disc mute nice ns_cert_type ping \ + ping_exit ping_restart pkcs12 plugin port proto rcvbuf \ + redirect_gateway remap_usr1 remote reneg_bytes reneg_pkts reneg_sec \ + replay_persist replay_window resolv_retry route route_delay \ + route_gateway route_up rport server server_bridge setenv shaper sndbuf \ + socks_proxy status status_version syslog tcp_queue_limit tls_auth \ + tls_cipher tls_remote tls_timeout tls_verify tmp_dir tran_window \ + tun_mtu tun_mtu_extra txqueuelen up user verb + + # append multi-value params + append_params_quoted "$s" \ + push + + + [ -n "$ARGS" ] && \ + eval "$SSD -q -b -m -p $PID -x $BIN -S -- --syslog 'openvpn($s)' $ARGS" +} + +kill_service() { + local s="$1" + local S="${2:-TERM}" + local enable=0 + + # disabled? + config_get_bool enable "$s" enable 0 + [ "$enable" == 0 ] && return 0 + + PID="/var/run/openvpn-$s.pid" + + $SSD -q -p $PID -x $BIN -K -s $S +} + +hup_service() { kill_service "$1" HUP; } +stop_service() { kill_service "$1" TERM; } + +start() { + config_load openvpn + config_foreach start_service openvpn +} + +stop() { + config_load openvpn + config_foreach stop_service openvpn +} + +reload() { + config_load openvpn + config_foreach hup_service openvpn +} + +restart() { + stop; sleep 5; start +} diff --git a/applications/luci-openvpn/root/lib/uci/schema/default/openvpn b/applications/luci-openvpn/root/lib/uci/schema/default/openvpn new file mode 100644 index 0000000000..2a31ff4992 --- /dev/null +++ b/applications/luci-openvpn/root/lib/uci/schema/default/openvpn @@ -0,0 +1,299 @@ +mode m +Set OpenVPN major mode + +local host +Local host name or IP address for bind + +remote host [port] +Remote host name or IP address + +remote-random +When multiple --remote address/ports are specified, initially randomize the order of the list as a kind of basic load-balancing measure + +proto p +Use protocol p for communicating with remote host + +connect-retry n +For --proto tcp-client, take n as the number of seconds to wait between connection retries (default=5) + +connect-retry-max n +For --proto tcp-client, take n as the number of retries of connection attempt (default=infinite) + +auto-proxy +Try to sense HTTP or SOCKS proxy settings automatically + +http-proxy server port [authfile|'auto'] [auth-method] +Connect to remote host through an HTTP proxy at address server and port port + +http-proxy-retry +Retry indefinitely on HTTP proxy errors + +http-proxy-timeout n +Set proxy timeout to n seconds, default=5 + +http-proxy-option type [parm] +Set extended HTTP proxy options + +socks-proxy server [port] +Connect to remote host through a Socks5 proxy at address server and port port (default=1080) + +socks-proxy-retry +Retry indefinitely on Socks proxy errors + +resolv-retry n +If hostname resolve fails for --remote, retry resolve for n seconds before failing + +float +Allow remote peer to change its IP address and/or port number, such as due to DHCP (this is the default if --remote is not used) + +ipchange cmd +Execute shell command cmd when our remote ip-address is initially authenticated or changes + +port port +TCP/UDP port number for both local and remote + +lport port +TCP/UDP port number for bind + +rport port +TCP/UDP port number for remote + +bind +Bind to local address and port + +nobind +Do not bind to local address and port + +dev tunX | tapX | null +TUN/TAP virtual network device ( X can be omitted for a dynamic device + +dev-type device-type +Which device type are we using? device-type should be tun or tap + +topology mode +Configure virtual addressing topology when running in --dev tun mode + +tun-ipv6 +Build a tun link capable of forwarding IPv6 traffic + +dev-node node +Explicitly set the device node rather than using /dev/net/tun, /dev/tun, /dev/tap, etc + +lladdr address +Specify the link layer address, more commonly known as the MAC address + +iproute cmd +Set alternate command to execute instead of default iproute2 command + +ifconfig l rn +Set TUN/TAP adapter parameters + +ifconfig-noexec +Don't actually execute ifconfig/netsh commands, instead pass --ifconfig parameters to scripts using environmental variables + +ifconfig-nowarn +Don't output an options consistency check warning if the --ifconfig option on this side of the connection doesn't match the remote side + +route network/IP [netmask] [gateway] [metric] +Add route to routing table after connection is established + +route-gateway gw +Specify a default gateway gw for use with --route + +route-metric m +Specify a default metric m for use with --route + +route-delay [n] [w] +Delay n seconds (default=0) after connection establishment, before adding routes + +route-up cmd +Execute shell command cmd after routes are added, subject to --route-delay + +route-noexec +Don't add or remove routes automatically + +route-nopull +When used with --client or --pull, accept options pushed by server EXCEPT for routes + +redirect-gateway flags... +(Experimental) Automatically execute routing commands to cause all outgoing IP traffic to be redirected over the VPN + +link-mtu n +Sets an upper bound on the size of UDP packets which are sent between OpenVPN peers + +tun-mtu n +Take the TUN device MTU to be n and derive the link MTU from it (default=1500) + +tun-mtu-extra n +Assume that the TUN/TAP device might return as many as n bytes more than the --tun-mtu size on read + +mtu-disc type +Should we do Path MTU discovery on TCP/UDP channel? Only supported on OSes such as Linux that supports the necessary system call to set + +mtu-test +To empirically measure MTU on connection startup, add the --mtu-test option to your configuration + +fragment max +Enable internal datagram fragmentation so that no UDP datagrams are sent which are larger than max bytes + +mssfix max +Announce to TCP sessions running over the tunnel that they should limit their send packet sizes such that after OpenVPN has encapsulated them, the resulting UDP packet size that OpenVPN sends to its peer will not exceed max bytes + +sndbuf size +Set the TCP/UDP socket send buffer size + +rcvbuf size +Set the TCP/UDP socket receive buffer size + +socket-flags flags... +Apply the given flags to the OpenVPN transport socket + +txqueuelen n +(Linux only) Set the TX queue length on the TUN/TAP interface + +shaper n +Limit bandwidth of outgoing tunnel data to n bytes per second on the TCP/UDP port + +inactive n [bytes] +Causes OpenVPN to exit after n seconds of inactivity on the TUN/TAP device + +ping n +Ping remote over the TCP/UDP control channel if no packets have been sent for at least n seconds (specify --ping on both peers to cause ping packets to be sent in both directions since OpenVPN ping packets are not echoed like IP ping packets) + +ping-exit n +Causes OpenVPN to exit after n seconds pass without reception of a ping or other packet from remote + +ping-restart n +Similar to --ping-exit, but trigger a SIGUSR1 restart after n seconds pass without reception of a ping or other packet from remote + +keepalive n m +A helper directive designed to simplify the expression of --ping and --ping-restart in server mode configurations + +ping-timer-rem +Run the --ping-exit / --ping-restart timer only if we have a remote address + +persist-tun +Don't close and reopen TUN/TAP device or run up/down scripts across SIGUSR1 or --ping-restart restarts + +persist-key +Don't re-read key files across SIGUSR1 or --ping-restart + +persist-local-ip +Preserve initially resolved local IP address and port number across SIGUSR1 or --ping-restart restarts + +persist-remote-ip +Preserve most recently authenticated remote IP address and port number across SIGUSR1 or --ping-restart restarts + +mlock +Disable paging by calling the POSIX mlockall function + +up cmd +Shell command to run after successful TUN/TAP device open (pre --user UID change) + +up-delay +Delay TUN/TAP open and possible --up script execution until after TCP/UDP connection establishment with peer + +down cmd +Shell command to run after TUN/TAP device close (post --user UID change and/or --chroot ) + +down-pre +Call --down cmd/script before, rather than after, TUN/TAP close + +up-restart +Enable the --up and --down scripts to be called for restarts as well as initial program start + +setenv name value +Set a custom environmental variable name=value to pass to script + +setenv-safe name value +Set a custom environmental variable OPENVPN_name=value to pass to script + +disable-occ +Don't output a warning message if option inconsistencies are detected between peers + +user user +Change the user ID of the OpenVPN process to user after initialization, dropping privileges in the process + +group group +Similar to the --user option, this option changes the group ID of the OpenVPN process to group after initialization + +cd dir +Change directory to dir prior to reading any files such as configuration files, key files, scripts, etc + +chroot dir +Chroot to dir after initialization + +#daemon [progname] +#Become a daemon after all initialization functions are completed + +#syslog [progname] +#Direct log output to system logger, but do not become a daemon + +passtos +Set the TOS field of the tunnel packet to what the payload's TOS is + +inetd [wait|nowait] [progname] +Use this option when OpenVPN is being run from the inetd or xinetd(8) server + +log file +Output logging messages to file, including output to stdout/stderr which is generated by called scripts + +log-append file +Append logging messages to file + +suppress-timestamps +Avoid writing timestamps to log messages, even when they otherwise would be prepended + +writepid file +Write OpenVPN's main process ID to file + +nice n +Change process priority after initialization ( n greater than 0 is lower priority, n less than zero is higher priority) + +fast-io +(Experimental) Optimize TUN/TAP/UDP I/O writes by avoiding a call to poll/epoll/select prior to the write operation + +echo [parms...] +Echo parms to log output + +remap-usr1 signal +Control whether internally or externally generated SIGUSR1 signals are remapped to SIGHUP (restart without persisting state) or SIGTERM (exit) + +verb n +Set output verbosity to n (default=1) + +status file [n] +Write operational status to file every n seconds + +status-version [n] +Choose the status file format version number + +mute n +Log at most n consecutive messages in the same category + +comp-lzo [mode] +Use fast LZO compression -- may add up to 1 byte per packet for incompressible data + +comp-noadapt +When used in conjunction with --comp-lzo, this option will disable OpenVPN's adaptive compression algorithm + +management IP port [pw-file] +Enable a TCP server on IP:port to handle daemon management functions + +management-query-passwords +Query management channel for private key password and --auth-user-pass username/password + +management-forget-disconnect +Make OpenVPN forget passwords when management session disconnects + +management-hold +Start OpenVPN in a hibernating state, until a client of the management interface explicitly starts it with the hold release command + +management-signal +Send SIGUSR1 signal to OpenVPN if management session disconnects + +management-log-cache n +Cache the most recent n lines of log file history for usage by the management channel + +plugin module-pathname [init-string] +Load plug-in module from the file module-pathname, passing init-string as an argument to the module initialization function |