Skip to content

Commit 3fba322

Browse files
okraitsokraits
committed
Add further options to the OpenVPN backend
1 parent 93a2a57 commit 3fba322

3 files changed

Lines changed: 105 additions & 6 deletions

File tree

‎docs/source/backends/openvpn.rst‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,8 @@ Required properties:
112112
+--------------------------+---------+--------------+-------------------------------------------------------------+
113113
| ``key`` | string | | any non whitespace character |
114114
+--------------------------+---------+--------------+-------------------------------------------------------------+
115+
| ``pkcs12`` | string | | any non whitespace character |
116+
+--------------------------+---------+--------------+-------------------------------------------------------------+
115117
| ``ns_cert_type`` | string | | ``client``, ``server`` or empty string |
116118
+--------------------------+---------+--------------+-------------------------------------------------------------+
117119
| ``mtu_disc`` | string | ``no`` | ``no``, ``maybe`` or ``yes`` |
@@ -151,6 +153,16 @@ Required properties:
151153
+--------------------------+---------+--------------+-------------------------------------------------------------+
152154
| ``secret`` | string | | any non whitespace character |
153155
+--------------------------+---------+--------------+-------------------------------------------------------------+
156+
| ``reneg_sec`` | integer | ``3600`` | any positive integer |
157+
+--------------------------+---------+--------------+-------------------------------------------------------------+
158+
| ``tls_timeout`` | integer | ``2`` | any positive integer |
159+
+--------------------------+---------+--------------+-------------------------------------------------------------+
160+
| ``tls_cipher`` | string | | any string |
161+
+--------------------------+---------+--------------+-------------------------------------------------------------+
162+
| ``remote_cert_tls`` | string | | ``client``, ``server`` or empty string |
163+
+--------------------------+---------+--------------+-------------------------------------------------------------+
164+
| ``float`` | boolean | ``False`` | |
165+
+--------------------------+---------+--------------+-------------------------------------------------------------+
154166
| ``fast_io`` | boolean | ``False`` | |
155167
+--------------------------+---------+--------------+-------------------------------------------------------------+
156168
| ``log`` | string | | filesystem path |
@@ -179,8 +191,12 @@ Required properties:
179191
+--------------------------+---------+--------------+-------------------------------------------------------------+
180192
| ``pull`` | boolean | ``True`` | |
181193
+--------------------------+---------+--------------+-------------------------------------------------------------+
194+
| ``remote_random`` | boolean | ``False`` | |
195+
+--------------------------+---------+--------------+-------------------------------------------------------------+
182196
| ``auth_user_pass`` | string | | any non whitespace character |
183197
+--------------------------+---------+--------------+-------------------------------------------------------------+
198+
| ``auth_retry`` | string | ``none`` | ``none``, ``nointeract`` or ``interact`` |
199+
+--------------------------+---------+--------------+-------------------------------------------------------------+
184200

185201
Server specific settings
186202
~~~~~~~~~~~~~~~~~~~~~~~~

‎netjsonconfig/backends/openvpn/openvpn.py‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -83,15 +83,21 @@ def auto_client(cls, host, server, ca_path=None, ca_contents=None,
8383
if 'tls_server' not in server or not server['tls_server']:
8484
client['tls_client'] = False
8585
# ns_cert_type
86-
if not server.get('ns_cert_type'):
87-
client['ns_cert_type'] = ''
88-
elif server.get('ns_cert_type') == 'client':
89-
client['ns_cert_type'] = 'server'
86+
ns_cert_type = {None: '',
87+
'': '',
88+
'client': 'server'}
89+
client['ns_cert_type'] = ns_cert_type[server.get('ns_cert_type')]
90+
# remote_cert_tls
91+
remote_cert_tls = {None: '',
92+
'': '',
93+
'client': 'server'}
94+
client['remote_cert_tls'] = remote_cert_tls[server.get('remote_cert_tls')]
9095
copy_keys = ['name', 'dev_type', 'dev', 'comp_lzo', 'auth',
91-
'cipher', 'ca', 'cert', 'key', 'mtu_disc', 'mtu_test',
96+
'cipher', 'ca', 'cert', 'key', 'pkcs12', 'mtu_disc', 'mtu_test',
9297
'fragment', 'mssfix', 'keepalive', 'persist_tun', 'mute',
9398
'persist_key', 'script_security', 'user', 'group', 'log',
94-
'mute_replay_warnings', 'secret', 'fast_io', 'verb']
99+
'mute_replay_warnings', 'secret', 'reneg_sec', 'tls_timeout',
100+
'tls_cipher', 'float', 'fast_io', 'verb']
95101
for key in copy_keys:
96102
if key in server:
97103
client[key] = server[key]

‎netjsonconfig/backends/openvpn/schema.py‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,14 @@
143143
"pattern": "^(\\S*)$",
144144
"propertyOrder": 16,
145145
},
146+
"pkcs12": {
147+
"title": "PKCS #12",
148+
"description": "Path to a PKCS #12 file containing local private key, "
149+
"local certificate, and root CA certificate",
150+
"type": "string",
151+
"pattern": "^(\\S*)$",
152+
"propertyOrder": 17,
153+
},
146154
"ns_cert_type": {
147155
"title": "NS cert type",
148156
"type": "string",
@@ -319,6 +327,42 @@
319327
"pattern": "^(\\S*)$",
320328
"propertyOrder": 38,
321329
},
330+
"reneg_sec": {
331+
"title": "reneg_sec",
332+
"description": "Renegotiate data channel key after n seconds",
333+
"type": "integer",
334+
"default": 3600,
335+
"propertyOrder": 39,
336+
},
337+
"tls_timeout": {
338+
"title": "TLS timeout",
339+
"description": "Packet retransmit timeout on TLS control channel if no "
340+
"acknowledgment from remote within n seconds",
341+
"type": "integer",
342+
"default": 2,
343+
"propertyOrder": 40,
344+
},
345+
"tls_cipher": {
346+
"title": "TLS cipher",
347+
"description": "A list of allowable TLS ciphers delimited by a colon (':')",
348+
"type": "string",
349+
"propertyOrder": 41,
350+
},
351+
"remote_cert_tls": {
352+
"title": "Remote certificate TLS",
353+
"type": "string",
354+
"default": "",
355+
"propertyOrder": 42
356+
},
357+
"float": {
358+
"title": "float",
359+
"description": "Allow remote peer to change its IP address and/or port number, "
360+
"such as due to DHCP",
361+
"type": "boolean",
362+
"default": False,
363+
"format": "checkbox",
364+
"propertyOrder": 43,
365+
},
322366
"fast_io": {
323367
"title": "fast IO",
324368
"description": "(Experimental) Optimize TUN/TAP/UDP I/O writes by avoiding a "
@@ -441,6 +485,16 @@
441485
"format": "checkbox",
442486
"propertyOrder": 11,
443487
},
488+
"remote_random": {
489+
"title": "random remote",
490+
"description": "When multiple remote address/ports are specified, or if "
491+
"connection profiles are being used, initially randomize "
492+
"the order of the list as a basic load-balancing measure",
493+
"type": "boolean",
494+
"default": False,
495+
"format": "checkbox",
496+
"propertyOrder": 12,
497+
},
444498
"ns_cert_type": {
445499
"description": "Require that peer certificate was signed with an explicit "
446500
"nsCertType designation of \"server\"",
@@ -454,6 +508,23 @@
454508
"type": "string",
455509
"pattern": "^(\\S*)$",
456510
"propertyOrder": 40,
511+
},
512+
"auth_retry": {
513+
"title": "auth retry",
514+
"description": "Controls how OpenVPN responds to username/password "
515+
"verification errors such as the client-side response "
516+
"to an AUTH_FAILED message from the server or "
517+
"verification failure of the private key password",
518+
"type": "string",
519+
"enum": ["none", "nointeract", "interact"],
520+
"default": "none",
521+
"propertyOrder": 41,
522+
},
523+
"remote_cert_tls": {
524+
"description": "Require that peer certificate was signed with an explicit "
525+
"key usage and extended key usage based on RFC3280 TLS rules",
526+
"enum": ["", "server"],
527+
"options": {"enum_titles": ["disabled", "server"]}
457528
}
458529
}
459530
}
@@ -549,6 +620,12 @@
549620
"type": "string",
550621
"pattern": "^((\\S*) (\\S*)|)$",
551622
"propertyOrder": 45,
623+
},
624+
"remote_cert_tls": {
625+
"description": "Require that peer certificate was signed with an explicit "
626+
"key usage and extended key usage based on RFC3280 TLS rules",
627+
"enum": ["", "client"],
628+
"options": {"enum_titles": ["disabled", "client"]}
552629
}
553630
}
554631
},

0 commit comments

Comments
 (0)