Skip to content

Commit 86dfbc7

Browse files
pushkar-grpandafynemesifier
authored
[change] OpenVPN: updated compression options #198
Closes #198 --------- Co-authored-by: Gagan Deep <pandafy.dev@gmail.com> Co-authored-by: Federico Capoano <f.capoano@openwisp.io>
1 parent 9a91092 commit 86dfbc7

6 files changed

Lines changed: 612 additions & 84 deletions

File tree

‎docs/source/backends/openvpn.rst‎

Lines changed: 81 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -86,85 +86,92 @@ Required properties:
8686
- proto
8787
- dev
8888

89-
========================= ======= ============ ===========================
90-
key name type default allowed values
91-
========================= ======= ============ ===========================
92-
``name`` string 2 to 24 alphanumeric
93-
characters, dashes and
94-
underscores
95-
``mode`` string ``p2p`` or ``server``
96-
``proto`` string ``udp``, ``tcp-client``,
97-
``tcp-server``
98-
``port`` integer ``1194`` integers
99-
``data_ciphers`` list list of dicts, each dict
100-
need to have ``cipher`` and
101-
``optional``, see `cipher
102-
property source code`_ for
103-
the allowed ciphers
104-
``data_ciphers_fallback`` string see `cipher property source
105-
code`_
106-
``dev_type`` string ``tun``, ``tap``
107-
``dev`` string any non-whitespace
108-
character (max length: 15)
109-
``local`` string any string
110-
``comp_lzo`` string ``adaptive`` ``yes``, ``no`` or
111-
``adaptive``
112-
``auth`` string ``SHA1`` see `auth property source
113-
code`_
114-
``cipher`` string ``BF-CBC`` see `cipher property source
115-
code`_
116-
``engine`` string ``bsd``, ``rsax``,
117-
``dynamic`` or empty string
118-
``ca`` string any non whitespace
119-
character
120-
``cert`` string any non whitespace
121-
character
122-
``key`` string any non whitespace
123-
character
124-
``pkcs12`` string any non whitespace
125-
character
126-
``tls_auth`` string string containing TLS Auth
127-
key
128-
``ns_cert_type`` string ``client``, ``server`` or
129-
empty string
130-
``mtu_disc`` string ``no`` ``no``, ``maybe`` or
131-
``yes``
89+
========================= ======= ========== =============================
90+
key name type default allowed values
91+
========================= ======= ========== =============================
92+
``name`` string 2 to 24 alphanumeric
93+
characters, dashes and
94+
underscores
95+
``mode`` string ``p2p`` or ``server``
96+
``proto`` string ``udp``, ``tcp-client``,
97+
``tcp-server``
98+
``port`` integer ``1194`` integers
99+
``data_ciphers`` list list of dicts, each dict need
100+
to have ``cipher`` and
101+
``optional``, see `cipher
102+
property source code`_ for
103+
the allowed ciphers
104+
``data_ciphers_fallback`` string see `cipher property source
105+
code`_
106+
``dev_type`` string ``tun``, ``tap``
107+
``dev`` string any non-whitespace character
108+
(max length: 15)
109+
``local`` string any string
110+
``auth`` string ``SHA1`` see `auth property source
111+
code`_
112+
``cipher`` string ``BF-CBC`` see `cipher property source
113+
code`_
114+
``engine`` string ``bsd``, ``rsax``,
115+
``dynamic`` or empty string
116+
``ca`` string any non whitespace character
117+
``cert`` string any non whitespace character
118+
``key`` string any non whitespace character
119+
``pkcs12`` string any non whitespace character
120+
``tls_auth`` string string containing TLS Auth
121+
key
122+
``ns_cert_type`` string ``client``, ``server`` or
123+
empty string
124+
``mtu_disc`` string ``no`` ``no``, ``maybe`` or ``yes``
132125
``mtu_test`` boolean ``False``
133-
``fragment`` integer ``0`` any positive integer
134-
``mssfix`` integer ``1450`` any positive integer
135-
``keepalive`` string two numbers separated by
136-
one space
126+
``fragment`` integer ``0`` any positive integer
127+
``mssfix`` integer ``1450`` any positive integer
128+
``keepalive`` string two numbers separated by one
129+
space
137130
``persist_tun`` boolean ``False``
138131
``persist_key`` boolean ``False``
139-
``up`` string any non whitespace
140-
character
141-
``up_delay`` integer ``0`` any positive integer
142-
``down`` string any non whitespace
143-
character
144-
``script_security`` integer ``1`` ``0``, ``1``, ``2``, ``3``
145-
``user`` string any string
146-
``group`` string any string
147-
``mute`` integer ``0`` any positive integer
148-
``status`` string string and number separated
149-
by space, eg:
150-
``/var/log/openvpn.status
151-
10``
152-
``status_version`` integer ``1`` ``1``, ``2``, ``3``
132+
``up`` string any non whitespace character
133+
``up_delay`` integer ``0`` any positive integer
134+
``down`` string any non whitespace character
135+
``script_security`` integer ``1`` ``0``, ``1``, ``2``, ``3``
136+
``user`` string any string
137+
``group`` string any string
138+
``mute`` integer ``0`` any positive integer
139+
``status`` string string and number separated
140+
by space, eg:
141+
``/var/log/openvpn.status
142+
10``
143+
``status_version`` integer ``1`` ``1``, ``2``, ``3``
153144
``mute_replay_warnings`` boolean ``False``
154-
``secret`` string any non whitespace
155-
character
156-
``reneg_sec`` integer ``3600`` any positive integer
157-
``tls_timeout`` integer ``2`` any positive integer
158-
``tls_cipher`` string any string
159-
``remote_cert_tls`` string ``client``, ``server`` or
160-
empty string
145+
``secret`` string any non whitespace character
146+
``reneg_sec`` integer ``3600`` any positive integer
147+
``tls_timeout`` integer ``2`` any positive integer
148+
``tls_cipher`` string any string
149+
``remote_cert_tls`` string ``client``, ``server`` or
150+
empty string
161151
``float`` boolean ``False``
162152
``auth_nocache`` boolean ``False``
163153
``fast_io`` boolean ``False``
164-
``log`` string filesystem path
165-
``verb`` integer ``1`` from ``0`` (disabled) to
166-
``11`` (very verbose)
167-
========================= ======= ============ ===========================
154+
``log`` string filesystem path
155+
``verb`` integer ``1`` from ``0`` (disabled) to
156+
``11`` (very verbose)
157+
``allow_compression`` string ``""`` ``""`` (empty string to
158+
remove the directive),
159+
``asym`` (compression allowed
160+
in one direction), ``no``
161+
(disabled, default in OpenVPN
162+
2.6), ``yes`` (allowed both
163+
directions)
164+
``compress`` string ``""`` ``""`` (empty string to
165+
remove the directive),
166+
``lzo``, ``lz4``, ``lz4-v2``,
167+
``stub``, ``stub-v2``,
168+
``migrate``.
169+
``comp_lzo`` string **DEPRECATED**: ``yes``,
170+
``no`` or ``adaptive``.
171+
Default is empty string
172+
(``""``). Use ``compress``
173+
instead.
174+
========================= ======= ========== =============================
168175

169176
Client specific settings
170177
~~~~~~~~~~~~~~~~~~~~~~~~
@@ -221,8 +228,8 @@ type is one the following:
221228
- lists
222229

223230
For a list of all the OpenVPN configuration settings, refer to the
224-
`OpenVPN 2.3 manual
225-
<https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage>`_.
231+
`OpenVPN 2.6 manual
232+
<https://openvpn.net/community-docs/community-articles/openvpn-2-6-manual.html>`_.
226233

227234
.. _auth property source code: https://github.com/openwisp/netjsonconfig/blob/master/netjsonconfig/backends/openvpn/schema.py#L157-L186
228235

‎netjsonconfig/backends/openvpn/openvpn.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,8 @@ def auto_client(
9292
"dev_type",
9393
"dev",
9494
"comp_lzo",
95+
"compress",
96+
"allow_compression",
9597
"auth",
9698
"cipher",
9799
"ca",

‎netjsonconfig/backends/openvpn/schema.py‎

Lines changed: 66 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
"""
2-
OpenVpn 2.3 specific JSON-Schema definition
2+
OpenVpn 2.6 specific JSON-Schema definition
33
"""
44

55
from copy import deepcopy
@@ -89,6 +89,16 @@
8989
"RC2-OFB",
9090
"none",
9191
]
92+
93+
compression_algorithms = [
94+
"lzo",
95+
"lz4",
96+
"lz4-v2",
97+
"stub",
98+
"stub-v2",
99+
"migrate",
100+
]
101+
92102
default_cipher = "AES-256-GCM"
93103

94104
base_openvpn_schema = {
@@ -143,15 +153,6 @@
143153
"If unspecified, OpenVPN will bind to all interfaces.",
144154
"propertyOrder": 8,
145155
},
146-
"comp_lzo": {
147-
"title": "LZO compression",
148-
"description": "Use fast LZO compression; may add up to 1 "
149-
"byte per packet for incompressible data",
150-
"type": "string",
151-
"enum": ["yes", "no", "adaptive"],
152-
"default": "adaptive",
153-
"propertyOrder": 9,
154-
},
155156
"auth": {
156157
"title": "auth digest algorithm",
157158
"type": "string",
@@ -568,6 +569,61 @@
568569
"description": "Set output verbosity for logging and debugging",
569570
"propertyOrder": 52,
570571
},
572+
"allow_compression": {
573+
"title": "allow compression",
574+
"description": (
575+
"Controls whether the peer is allowed to negotiate compression for the"
576+
" VPN data channel. OpenVPN discourages the use of compression due to security"
577+
" risks such as the VORACLE attack."
578+
),
579+
"type": "string",
580+
"enum": ["", "asym", "no", "yes"],
581+
"default": "",
582+
"propertyOrder": 53,
583+
},
584+
"compress": {
585+
"title": "compression algorithm",
586+
"description": (
587+
"Specifies the compression algorithm for the VPN data channel."
588+
" OpenVPN discourages the use of compression due to security risks such as the"
589+
" VORACLE attack. Leaving the value empty removes the compress directive from the"
590+
" generated configuration."
591+
),
592+
"type": "string",
593+
"enum": [""] + compression_algorithms,
594+
"options": {
595+
"enum_titles": [
596+
"Disabled",
597+
"LZO",
598+
"LZ4",
599+
"LZ4 v2",
600+
"Stub (framing only)",
601+
"Stub v2 (framing only)",
602+
"Migrate (transition from comp-lzo)",
603+
]
604+
},
605+
"default": "",
606+
"propertyOrder": 54,
607+
},
608+
"comp_lzo": {
609+
"title": "LZO compression",
610+
"description": (
611+
'DEPRECATED: Legacy LZO compression option. Use the "compression algorithm" option'
612+
" instead. Leave empty unless compatibility with legacy OpenVPN clients is required."
613+
),
614+
"type": "string",
615+
"enum": ["", "yes", "no", "adaptive"],
616+
"options": {
617+
"enum_titles": [
618+
"disabled",
619+
"yes",
620+
"no",
621+
"adaptive",
622+
]
623+
},
624+
"default": "",
625+
"propertyOrder": 55,
626+
},
571627
},
572628
},
573629
"client": {

0 commit comments

Comments
 (0)