7 files changed, 56 insertions, 37 deletions
diff --git a/data/templates/ocserv/ocserv_config.tmpl b/data/templates/ocserv/ocserv_config.j2
index 0be805235..8418a2185 100644
--- a/data/templates/ocserv/ocserv_config.tmpl
+++ b/data/templates/ocserv/ocserv_config.j2
@@ -8,19 +8,27 @@ run-as-group = daemon
 
 {% if "radius" in authentication.mode %}
 auth = "radius [config=/run/ocserv/radiusclient.conf]"
+{% elif "local" in authentication.mode %}
+{%     if authentication.mode.local == "password-otp" %}
+auth = "plain[passwd=/run/ocserv/ocpasswd,otp=/run/ocserv/users.oath]"
+{%     elif authentication.mode.local == "otp" %}
+auth = "plain[otp=/run/ocserv/users.oath]"
+{%     else %}
+auth = "plain[/run/ocserv/ocpasswd]"
+{%     endif %}
 {% else %}
 auth = "plain[/run/ocserv/ocpasswd]"
 {% endif %}
 
-{% if ssl.certificate is defined %}
+{% if ssl.certificate is vyos_defined %}
 server-cert = /run/ocserv/cert.pem
 server-key = /run/ocserv/cert.key
-{% if ssl.passphrase is defined %}
+{%     if ssl.passphrase is vyos_defined %}
 key-pin = {{ ssl.passphrase }}
-{% endif %}
+{%     endif %}
 {% endif %}
 
-{% if ssl.ca_certificate is defined %}
+{% if ssl.ca_certificate is vyos_defined %}
 ca-cert = /run/ocserv/ca.pem
 {% endif %}
 
@@ -42,7 +50,8 @@ rekey-method = ssl
 try-mtu-discovery = true
 cisco-client-compat = true
 dtls-legacy = true
-
+max-ban-score = 80
+ban-reset-time = 300
 
 # The name to use for the tun device
 device = sslvpn
@@ -50,33 +59,33 @@ device = sslvpn
 # An alternative way of specifying the network:
 {% if network_settings %}
 # DNS settings
-{%   if network_settings.name_server is string %}
+{%     if network_settings.name_server is string %}
 dns = {{ network_settings.name_server }}
-{%   else %}
-{%     for dns in network_settings.name_server %}
+{%     else %}
+{%         for dns in network_settings.name_server %}
 dns = {{ dns }}
-{%     endfor %}
-{%   endif %}
+{%         endfor %}
+{%     endif %}
 # IPv4 network pool
-{%   if network_settings.client_ip_settings %}
-{%     if network_settings.client_ip_settings.subnet %}
+{%     if network_settings.client_ip_settings %}
+{%         if network_settings.client_ip_settings.subnet %}
 ipv4-network = {{ network_settings.client_ip_settings.subnet }}
+{%         endif %}
 {%     endif %}
-{%   endif %}
 # IPv6 network pool
-{%   if network_settings.client_ipv6_pool %}
-{%     if network_settings.client_ipv6_pool.prefix %}
+{%     if network_settings.client_ipv6_pool %}
+{%         if network_settings.client_ipv6_pool.prefix %}
 ipv6-network = {{ network_settings.client_ipv6_pool.prefix }}
 ipv6-subnet-prefix = {{ network_settings.client_ipv6_pool.mask }}
+{%         endif %}
 {%     endif %}
-{%   endif %}
 {% endif %}
 
 {% if network_settings.push_route is string %}
 route = {{ network_settings.push_route }}
 {% else %}
-{%   for route in network_settings.push_route %}
+{%     for route in network_settings.push_route %}
 route = {{ route }}
-{%   endfor %}
+{%     endfor %}
 {% endif %}
 
diff --git a/data/templates/ocserv/ocserv_otp_usr.j2 b/data/templates/ocserv/ocserv_otp_usr.j2
new file mode 100644
index 000000000..b2511ed94
--- /dev/null
+++ b/data/templates/ocserv/ocserv_otp_usr.j2
@@ -0,0 +1,8 @@
+#<token_type> <username> <pin> <secret_hex_key> <counter> <lastpass> <time>
+{% if username is vyos_defined %}
+{%     for user, user_config in username.items() %}
+{%         if user_config.disable is not vyos_defined and user_config.otp is vyos_defined %}
+{{ user_config.otp.token_tmpl }} {{ user }} {{ user_config.otp.pin | default("-", true) }} {{ user_config.otp.key }}
+{%         endif %}
+{%     endfor %}
+{% endif %}
diff --git a/data/templates/ocserv/ocserv_passwd.j2 b/data/templates/ocserv/ocserv_passwd.j2
new file mode 100644
index 000000000..30c79d66a
--- /dev/null
+++ b/data/templates/ocserv/ocserv_passwd.j2
@@ -0,0 +1,8 @@
+#<username>:<group>:<hash>
+{% if username is vyos_defined %}
+{%     for user, user_config in username.items() %}
+{%         if user_config.disable is not vyos_defined %}
+{{ user }}:*:{{ user_config.hash }}
+{%         endif %}
+{%     endfor %}
+{% endif %}
+\ No newline at end of file
diff --git a/data/templates/ocserv/ocserv_passwd.tmpl b/data/templates/ocserv/ocserv_passwd.tmpl
deleted file mode 100644
index ffadb4860..000000000
--- a/data/templates/ocserv/ocserv_passwd.tmpl
+++ /dev/null
@@ -1,6 +0,0 @@
-#<username>:<group>:<hash>
-{% for user in username if username is defined %}
-{%   if not "disable" in username[user] %}
-{{ user }}:*:{{ username[user].hash }}
-{%   endif %}
-{% endfor %}
-\ No newline at end of file
diff --git a/data/templates/ocserv/radius_conf.tmpl b/data/templates/ocserv/radius_conf.j2
index 1712d83ef..b6612fee5 100644
--- a/data/templates/ocserv/radius_conf.tmpl
+++ b/data/templates/ocserv/radius_conf.j2
@@ -1,13 +1,13 @@
 ### generated by vpn_openconnect.py ###
 nas-identifier VyOS
 {% for srv in server %}
-{%   if not "disable" in server[srv] %}
-{%     if "port" in server[srv] %}
-authserver {{ srv }}:{{server[srv]["port"]}}
-{%     else %}
+{%     if not "disable" in server[srv] %}
+{%         if "port" in server[srv] %}
+authserver {{ srv }}:{{ server[srv]["port"] }}
+{%         else %}
 authserver {{ srv }}
+{%         endif %}
 {%     endif %}
-{%   endif %}
 {% endfor %}
 radius_timeout {{ timeout }}
 {% if source_address %}
@@ -15,7 +15,7 @@ bindaddr {{ source_address }}
 {% else %}
 bindaddr *
 {% endif %}
-servers /run/ocserv/radius_servers  
+servers /run/ocserv/radius_servers
 dictionary /etc/radcli/dictionary
 default_realm
 radius_retries 3
diff --git a/data/templates/ocserv/radius_servers.j2 b/data/templates/ocserv/radius_servers.j2
new file mode 100644
index 000000000..302e91600
--- /dev/null
+++ b/data/templates/ocserv/radius_servers.j2
@@ -0,0 +1,7 @@
+### generated by vpn_openconnect.py ###
+# server   key
+{% for srv in server %}
+{%     if not "disable" in server[srv] %}
+{{ srv }}   {{ server[srv].key }}
+{%     endif %}
+{% endfor %}
diff --git a/data/templates/ocserv/radius_servers.tmpl b/data/templates/ocserv/radius_servers.tmpl
deleted file mode 100644
index 7bacac992..000000000
--- a/data/templates/ocserv/radius_servers.tmpl
+++ /dev/null
@@ -1,7 +0,0 @@
-### generated by vpn_openconnect.py ###
-# server	key
-{% for srv in server %}
-{%   if not "disable" in server[srv] %}
-{{ srv }}	{{ server[srv].key }}
-{%   endif %}
-{% endfor %}