summaryrefslogtreecommitdiff
path: root/src/conf_mode/interfaces-openvpn.py
AgeCommit message (Collapse)Author
2020-04-20openvpn: T2339: fix for IPv4 local-host addressesJernej Jakob
Commit bb9f998 introduced a bug where openvpn fails to start if 'local-host' is an IPv4 address due to 'proto' wanting a IPv6 socket. This adds a conditional check and uses normal proto if it's IPv4.
2020-04-19openvpn: T2336: delete auth-user-pass file when interface is unused #2Christian Poessinger
2020-04-19Revert "openvpn: T2336: delete auth-user-pass file when interface is unused"Christian Poessinger
This reverts commit 26adfd6d0d03af44a03f327478199f3009f2ad3c.
2020-04-19openvpn: T2336: delete auth-user-pass file when interface is unusedChristian Poessinger
Unused means disabled or even deleted - there should be no secrets left-over.
2020-04-19openvpn: T2336: fix auth-user-pass file generationChristian Poessinger
Bug introduced in commit b36e6e6 ("openvpn: T2273: migrate from SysVinit to systemd") as not all relevant configuration files have been re-rendered into /run/openvpn
2020-04-19bridge: T2232: move helper to vyos.validateChristian Poessinger
2020-04-16openvpn: T149: IPv6 supportJernej Jakob
- allow configuring IPv6 server addresses and push options - add IPv6 server client IP pool - add IPv6 push dhcp-option DNS6 - allow configuring IPv6 server client addresses - allow configuring IPv6 site-to-site addresses - validate all IPv6 options and addresses - use protos that explicitely open an IPv6 listening socket (tcp6-server, tcp6-client, udp6) as the default on Linux listens on IPv4 only (https://community.openvpn.net/openvpn/ticket/360) - add validator for any IPv6 address, host or network (used by pool)
2020-04-15openvpn: T2335: allow disabling client-ip-poolJernej Jakob
2020-04-15openvpn: T2293: fix UnboundLocalError if server subnet is unsetJernej Jakob
2nd part of this fix, first commit 9b6a369 didn't fix it.
2020-04-14openvpn: T2293: fix UnboundLocalError if server subnet is unsetJernej Jakob
Commit bb36bde introduced a bug when server subnet is unset, this fixes it.
2020-04-13Merge pull request #325 from jjakob/openvpn-poolChristian Poessinger
openvpn: T2235: add custom server pool handling
2020-04-13openvpn: T2235: add custom server pool handlingjjakob
- add config options and logic for server client-ip-pool - add function for determining default IPs for the server in different configurations - verify for pool IPs and maximum subnet prefix length - move remote netmask logic for client ifconfig-push to use new function - add topology 'net30' , set it as default (as it already was) - replace generic ip_* with IPv4* where necessary - print warning to console when server client IP is in server pool - fix server subnet help field
2020-04-13openvpn: T2235: use IPv4Network where input is already validatedjjakob
2020-04-13openvpn: T2283: move ccd to /run/openvpnjjakob
Commit a457c9d2 moved the config directory to /run/openvpn but didn't move the client-config-dir in the template.
2020-04-12template: T2230: use render to generate templatesThomas Mangin
convert all call to jinja to use template.render
2020-04-12openvpn: T2273: cleanup client config generationChristian Poessinger
2020-04-12openvpn: T2273: cleanup config dir generationChristian Poessinger
2020-04-12vyos.util: openvpn: migrate to chmod_600()Christian Poessinger
2020-04-12vyos.util: rename chmod_x() -> chmod_755()Christian Poessinger
2020-04-11openvpn: T2273: re-use vyos.util library functionsChristian Poessinger
2020-04-11openvpn: T2273: migrate from SysVinit to systemdChristian Poessinger
2020-04-10openvpn: T2266: fix verify for client-server bridged modejjakob
2020-04-08openvpn: T2234: clean up and rework openvpn templatejjakob
- rearranged options to put them in logical groups separated by blank lines - removed unnecessary blank lines (whitespace) - fixed encryption if-else comparison logic that caused 3des to be ignored - set tls if tls-version-min is set
2020-04-07bridge: T2232: prevent deletion of enslaved interfacesChristian Poessinger
Interfaces enslaved to a bridge are not allowed to be deleted. If an interface is deleted from the config but it is still enslaved to a bridge will cause a configuration error on the subsequent boot.
2020-04-06util: T2226: rewrite openvpn to use cmdThomas Mangin
2020-04-05openvpn: improve value help on ipfixChristian Poessinger
2020-04-04openvpn: T2222: set 'multihome' option when local-host is unsetjjakob
If configured with protocol udp and no local-host, openvpn needs the 'multihome' option to correctly work on all addresses.
2020-03-29vyos.util: increase usage of process_running() and remove duplicated codeChristian Poessinger
OpenVPN, WIFI, SSTP all had the same boiler plate copied about checking if a process associated with a pidfile is running or not. This has been migrated to the common library function vyos.util.process_running().
2020-03-28ipv6: T1831: migrate eui64 addressing to XML and pythonChristian Poessinger
2020-03-28ipv6: T1831: migrate autoconf nodeChristian Poessinger
Autoconfigure addresses using Prefix Information in Router Advertisements.
2020-03-28ipv6: T1831: use integers over bool in interface configurationChristian Poessinger
2020-03-28ipv6: T1831: migrate forwarding and dup-addr-detect-transmits nodesChristian Poessinger
... to new XML and Python based frontend/backend.
2020-03-28ifconfig: T2057: explicity name state functionsThomas Mangin
The Interface get_state/set_state were not clear about if they edited the admin or operational state. functions are now using admin_state and oper_state for clarity.
2020-03-25openvpn: T2148: fix setting "server client" without "ip"Jernej Jakob
2020-03-25Merge pull request #265 from thomas-mangin/2057-dhcp-vlanChristian Poessinger
ifconfig: T2057: break down DHCP, add register, STP and VLAN as adapters
2020-03-24openvpn: T2146: remove user/pass auth file when not neededJernej Jakob
2020-03-24openvpn: T2146: delete old client configsJernej Jakob
Previously old client configs for clients that were deleted from the server stayed in the ccd directory, causing them to still be used. As we can't know which clients were deleted, this deletes all the client configs as they are recreated shortly later.
2020-03-24ifconfig: T2057: add VTunIf classThomas Mangin
2020-03-23ifconfig: T2154: fixing failure to start-stop-daemonThomas Mangin
2020-03-20Merge pull request #248 from jjakob/openvpn-dh-noneChristian Poessinger
T2139: openvpn: allow unset dh-file when using EC keys
2020-03-20T2139: openvpn: allow unset dh-file when using EC keysJernej Jakob
2020-03-19T2140: openvpn: fix checkCertHeader function return valueJernej Jakob
This function returned True even if no match in the certificate file was found, causing all checks using it to erroneously pass.
2020-03-03interfaces: T1579: fix c/p error when evaluating ↵Christian Poessinger
os.environ['VYOS_TAGNODE_VALUE'] This has been only a theoretical problem but then the error condition was triggered - only an error has been printed instead of raising an Exception.
2020-02-27openvpn: T2075: add support for OpenVPN tls-crypt file optionChristian Poessinger
Encrypt and authenticate all control channel packets with the key from keyfile. Encrypting (and authenticating) control channel packets: * provides more privacy by hiding the certificate used for the TLS connection * makes it harder to identify OpenVPN traffic as such * provides "poor-man's" post-quantum security, against attackers who will never know the pre-shared key (i.e. no forward secrecy)
2020-02-23openvpn: T2065: move daemon parameter to start-stop-daemon command-lineChristian Poessinger
2020-01-23openvpn: T1975: ta devices need to be explicitly brought upChristian Poessinger
2019-11-11[OpenVPN]: T1704: Added uppercase entries of ncp-ciphers, since there seems ↵vindenesen
to be a bug in OpenVPN client when comparing pushed cipher with local ncp cipher list
2019-11-11[OpenVPN]: T1704: Moved ncp-ciphers out of encryption block in config templatevindenesen
2019-11-11[OpenVPN]: T1704: Added function for ncp-ciphers, and ability to disable it.vindenesen
[OpenVPN]: T1704: Changed config structure for OpenVPN encryption to support ncp-ciphers. [OpenVPN]: T1704: Added migration scripts for interface 2-to-3
2019-10-13openvpn: T1548: clean out import statementsChristian Poessinger
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-18 12:19:21 +0000